This Privacy Policy explains what personal data Acne Fix collects, why, who we share it with, and the rights you have. Please read it alongside our Terms of Service.
1. Who we are / Data Controller
Acne Fix is provided by Ralfs Jansons, an individual sole developer based in Latvia (European Union). You can contact us at support@acnefix.app or by post at Latvia, Riga.
For users in the EU/EEA and the UK, this policy describes how we process your personal data as a data controller under the General Data Protection Regulation (GDPR).
2. Scope
This policy applies to the Acne Fix mobile app and the acnefix.app website (together, the “Service”).
3. Data we collect and why
The table below summarizes the categories of personal data we process:
| Category | Examples | Purpose | Shared with | GDPR legal basis |
|---|---|---|---|---|
| Photos & images (special care) | Face selfies, progress photos, product/food scan photos. | AI skin analysis, routine personalization, and generating an AI “goal” preview image. | Google (Gemini AI). | Your explicit consent. |
| Health & skin data (special category — GDPR Art. 9) | Skin type, acne severity and areas, self-reported skincare habits, and medications you tell us about (e.g. topical/oral antibiotics, retinoids, the contraceptive pill, isotretinoin/Accutane), plus AI-generated Skin Scores and observations about your skin. | Personalize your routine and track progress. | Google (Gemini), Supabase (cloud backup). | Your EXPLICIT consent (Art. 9(2)(a)). |
| Account data | Email address and name. Source: Sign in with Apple / Google. | Create and secure your account. | Supabase (auth), Apple, Google. | Performance of a contract. |
| Profile / demographic data | Age, gender, and the goals/motivations you select during onboarding. | Tailor recommendations. | Google (Gemini), Supabase. | Consent. |
| Approximate location | Your city and approximate coordinates. | Show the local UV index so we can advise on sun protection. Used on-demand and not stored on our servers. | Open-Meteo (weather API). | Consent. |
| Purchase & subscription data | Subscription status and transaction identifiers (NOT full card numbers; payment is handled by Apple/Google). | Manage your Pro subscription. | RevenueCat, Apple, Google. | Contract. |
| Usage & analytics data | In-app events (e.g. onboarding steps, routine generated, scans, paywall views), screens viewed, and a randomly generated device identifier. | Understand and improve the app. | PostHog. | Legitimate interests (and consent where required). |
| Device identifier | A random UUID we generate on your device to key your data. | Associate your data with your device/account. We do NOT use advertising identifiers (no IDFA/GAID) and do not track you across other apps or websites. | RevenueCat, PostHog (as an app-scoped id). | Legitimate interests. |
4. How the app stores data (local-first)
Acne Fix is local-first: most of your data lives on your device. We keep a best-effort, encrypted-in-transit backup with Supabase so your data isn't lost if you change devices. This cloud backup can include your profile answers, routine, daily logs, Skin Score results, scans, and references to your photos. Your photos themselves are processed by Google's Gemini AI to produce your results.
5. AI processing disclosure
To generate your routine and Skin Scores, your photos and questionnaire answers are sent to Google (Gemini API) for automated analysis. This is automated processing and not a medical diagnosis; results are informational only (see the medical disclaimer). Google's handling of this data is governed by its Privacy Policy.
6. Third parties / processors
We share data with the following service providers, each for the purpose noted:
- Google (Gemini AI) — Automated AI analysis of your photos and questionnaire answers to generate routines and Skin Scores. Privacy policy.
- Supabase — Authentication and best-effort encrypted-in-transit cloud backup of your profile, routine, logs, Skin Scores, and scans. Privacy policy.
- Apple — Sign in with Apple and App Store subscription billing. Privacy policy.
- Google Play — Google Sign-In and Google Play subscription billing. Privacy policy.
- RevenueCat — Manages your Pro subscription status (keyed to a random device identifier). Privacy policy.
- PostHog — Product analytics to understand and improve the app (us.i.posthog.com). Privacy policy.
- Open-Meteo — Provides the local UV index from your approximate coordinates so we can advise on sun protection. Privacy policy.
- Amazon Associates — Affiliate product links; we may earn a commission on qualifying purchases. Privacy policy.
- Open Beauty Facts — Open product database used to look up skincare product information. Privacy policy.
We do not sell your personal information, and for the purposes of the CCPA/CPRA we do not “sell” or “share” it for cross-context behavioral advertising.
7. International data transfers
Some processors (for example Google, PostHog, and RevenueCat) may process data in the United States and other countries. Your data may be processed within the EU and/or the United States. Where we transfer EU/EEA/UK personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
8. Data retention
We keep your account and app data until you request deletion or delete your account, after which we delete it from our systems within 30 days— except where we must retain limited records to comply with legal, tax, or accounting obligations. Data stored locally remains on your device until you delete the app or use “Delete all my data.” Analytics data is retained according to PostHog's retention settings.
9. Your rights
Under the GDPR you have the right to access, rectify, erase (“right to be forgotten”), restrict, and port your data, to object to processing, and to withdraw consent at any time (without affecting processing already carried out).
Under the CCPA/CPRA you have the right to know, delete, and correct your personal information, to opt out of its sale/sharing, and to non-discrimination for exercising your rights.
To exercise any of these rights, email support@acnefix.app or use our account & data deletion page. EU/EEA users also have the right to lodge a complaint with their supervisory authority — in Latvia, the Data State Inspectorate (Datu valsts inspekcija).
10. Account & data deletion
There are two paths. In the app, Profile → “Delete all my data” removes the data stored on your device and signs you out. To also remove your cloud backup and account, submit a request on our Delete your account & data page or email us. To be clear: the in-app control clears on-device data only; a request to us is needed to erase the cloud backup and your account.
11. Children's privacy
Acne Fix is intended for users aged 16 and older. We do not knowingly collect personal data from children below that age. If you believe a child has provided us with data, contact us at support@acnefix.app and we will remove it.
12. Security
We use reasonable technical and organizational measures to protect your data, including encryption in transit and access controls. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
13. Changes to this policy
We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and we will surface material changes in the app.
14. Contact
Questions about this policy or your data? Email support@acnefix.app or write to us at Latvia, Riga.