Last updated: 2026-08-17
1. Who we are
DermoShelf (“we”, “us”) is an anti-impulse skincare decision assistant. We help you evaluate cosmetic products against your skin profile before you buy. Contact: support@dermoshelf.com.
2. Data we collect
- Skin profile — skin type, conditions, allergies, concerns. This is special-category health data under GDPR Art 9.
- Product shelf — products you own, wishlist, scan history.
- Adviser messages — your chat history with the AI adviser.
- Account data — email address (for sign-in only).
- Usage analytics — account-linked usage events sent to PostHog and Amplitude only when you opt in; events use your internal account ID and exclude email and free-text content.
- Subscription data — whether you have an active Pro subscription, its store/platform and expiry date, and the purchase events the store sends us. We never receive or store card numbers.
- Device identifier — a random identifier generated on your device, stored only as a salted one-way hash. Its ONLY purpose is to stop the daily free allowance from being reset by deleting and reinstalling the app. It cannot be reversed into a device or person, and it is never used for advertising or tracking across apps.
3. Legal basis
- Skin profile / health data (Art 9) — your explicit consent, given during onboarding. You can withdraw at any time via Profile → Privacy.
- Account + product data (Art 6(1)(b)) — necessary to perform the service you requested.
- Analytics (Art 6(1)(a)) — your consent via the web cookie banner or the optional, default-off mobile onboarding/privacy control.
4. How we use your data
Your skin profile and shelf are used exclusively to generate verdicts and routines. We do not sell your data. We do not use your data to train AI models (OpenAI's API is used in “no training” mode via a Data Processing Agreement).
5. Data retention
- Scan history — 2 years
- Adviser chat messages — 1 year
- Deleted accounts — 30-day soft-delete grace period, then hard deletion
- Backups — 90 days
- Subscription records — kept while the subscription is active and 13 months after it ends (accounting and dispute obligations)
- Store purchase events — 90 days (duplicate-delivery protection)
You can request the full data-retention schedule at support@dermoshelf.com.
6. Sub-processors
We share data with the following third-party processors:
- Supabase — EU Frankfurt — database + auth
- Vercel — Global Edge — hosting
- OpenAI — US — AI verdicts, routines and adviser chat. Receives the ingredient list plus your skin profile (skin type, age range, concerns, medical conditions, allergies — including any free-text notes you write — and pregnancy/lactation and other sensitive mode flags), and your adviser chat messages. No direct identifiers (no name, email or account ID) are sent.
- ScraperAPI — US — fallback retrieval of the product page URL you submit; no account or profile identifier is sent
- Apple — US/EU — Sign in with Apple, App Store purchases and APNS push delivery
- Google — US — Google Sign-In and Android FCM delivery; Sign-In may receive the OAuth user identifier and request IP for fraud prevention
- Expo — US — build/submission infrastructure and push-token/payload relay to APNS or FCM
- Sentry — EU — crash, performance and other technical diagnostics; identifiers and user-entered content are scrubbed before send
- Upstash — EU — rate limiting (IP/user ID keys)
- PostHog — EU — account-linked product analytics (consent-gated and off by default)
- Amplitude — EU — the same account-linked, scrubbed product analytics as PostHog (same consent gate)
- RevenueCat — US — subscription receipt validation and entitlement state for in-app purchases. Receives your Supabase user ID (as the subscription's `app_user_id`), the store receipt and the device platform. It does NOT receive your skin profile, ingredients or adviser messages.
- Stripe — US/EU — payment processing for web subscriptions and donations. Receives your email and payment details; card numbers go straight to Stripe and never reach our servers.
7. Your rights
Under GDPR you have the right to:
- Access — download all your data via Profile → Download my data.
- Erasure — delete your account via Profile → Delete account.
- Portability — data export is available in JSON format.
- Withdraw consent — toggle off skin profile consent in Profile → Privacy at any time.
- Object to automated decisions — request human review of any verdict via the “Request human review” link on the result page.
To exercise any right, email support@dermoshelf.com.
8. Cookies
We use localStorage (not cookies) for session state and preferences. Analytics cookies are only set after you click “Accept analytics” in the consent banner.
9. Contact & complaints
Data controller: DermoShelf — support@dermoshelf.com
You have the right to lodge a complaint with your national data protection authority. For EU users this is the supervisory authority in your country of residence.
Mobile app — additional disclosures (v1)
Mobile addendum last updated: 2026-08-17
This section applies when you use the DermoShelf mobile app (iOS and Android). It restates and adds to the policy above; nothing here removes or weakens any right you have under the rest of this page.
- Push notification token — Issued by Apple APNS or Google FCM via the Expo Push Service. We store the token in push_subscriptions to deliver routine reminders and expiry warnings. The token is an Identifiers → Device ID category data point. You can revoke it any time from Profile → Notifications.
- Device locale — Read by expo-localization to pick your interface language. We do not store the device locale beyond mirroring your preferred_language on your profile row.
- Camera and photo library — Runtime permission requested only when you open the scan tab. Captures stay on the device until you submit the scan, are uploaded to a private user-scoped bucket, and are auto-deleted within 24 hours.
- No advertising-identifier tracking — We do not request IDFA on iOS and do not read the Android Advertising ID. The ATT prompt is never shown. We use the platform-issued IDFV only to scope app-side caches; the IDFV is never sent to our servers.
- Crash and analytics SDKs — PostHog and Amplitude analytics are off by default and consent-gated — you opt in during onboarding and can withdraw any time from Profile → Privacy. Both receive the same events linked to your internal account ID; email and free-text content are excluded, and the shared sanitizer removes email, phone, password, token, secret and address properties. Sentry crash, performance and other diagnostics run under App Functionality (legitimate interest); its beforeSend hook redacts UUID, email, phone and IPv4 patterns and drops password, token, secret, authorization, cookie and session keys.
- No HealthKit, no Health Connect — The app does not read from or write to Apple HealthKit or Android Health Connect. Skin profile, allergies, and persona toggles remain self-reported text and toggles.
Core mobile data is processed in the EU: Supabase in eu-central-1 (Frankfurt), Sentry on the EU cluster, and PostHog and Amplitude in their EU data centers. Cross-border processing is not limited to OpenAI: OpenAI (US) receives ingredient data, your profile flags and adviser messages without direct account identifiers; RevenueCat (US) receives your internal account ID and store subscription/receipt data; Google Sign-In may receive your OAuth user identifier and request IP, which may estimate coarse location for fraud prevention. The applicable processor contracts and transfer safeguards are listed in our sub-processor record.
Mobile-specific retention: scan-upload images are auto-purged within 24 hours. Anonymous accounts are deleted after 30 days of inactivity. All other retention windows match the table above.