SKIN COACH PRIVACY POLICY

Effective Date: October 20, 2026
Last Updated: October 20, 2026
Service Operator: Liyang Ge
Contact Email: miaoyangcomp@gmail.com
Website: https://myskincoach.app

1. Introduction

Skin Coach ("Skin Coach," "we," "us," or "our") respects your privacy and is committed to handling your personal information responsibly.

This Privacy Policy explains how we collect, use, disclose, store, protect, and delete personal information when you access or use our website, application, AI-powered skincare coaching features, product and ingredient analysis tools, progress tracking features, subscription services, and related services (collectively, the "Service").

The Service is operated by Liyang Ge.

This Privacy Policy applies to information collected through the Service and through communications you have with us in connection with the Service. It does not automatically apply to independent third-party websites, products, or services that we do not control.

Please read this Policy carefully before using features that involve personal information, particularly facial photographs, skincare concerns, and AI-generated analysis.

By using the Service, you acknowledge that you have had the opportunity to review this Policy. Where applicable law requires consent to a particular collection, use, or disclosure, we will obtain that consent through an appropriate process. Merely using the Service does not constitute consent to every possible use of your information.

2. Information We Collect

The information we collect depends on which features you choose to use, how you interact with the Service, and the settings available to you.

2.1 Account and Profile Information

When you register or manage an account, we may collect:

• Name or display name, if provided.
• Email address.
• Authentication and account identifiers.
• Account creation date and account status.
• Age eligibility or other information needed to administer the account.
• Communication preferences and account settings.
• Subscription tier and entitlement information.

If you sign in through a third-party authentication provider, we may receive the account information that provider makes available to us, subject to your authorization and that provider's policies.

We do not need your legal name for every feature. Where possible, you may use a display name.

2.2 Skincare Profile and Preferences

To provide personalized skincare coaching, you may choose to provide:

• Skin type or self-described skin characteristics.
• Skincare goals and concerns.
• Routine preferences and product preferences.
• Existing skincare routines.
• Product names and ingredient lists.
• Reported sensitivities, allergies, or reactions.
• Product usage frequency and personal observations.
• Habit tracking information and check-in responses.
• Relevant contextual information that you choose to share with the AI Coach.

Some of this information may reveal details about your health or other sensitive aspects of your life. Please provide only the information necessary for the features you wish to use.

The Service is not intended to replace a medical record system. You should avoid submitting unnecessary medical details or information about other individuals.

2.3 Photographs and Visual Progress Records

If you use photo-based features, we may collect and process:

• Photographs of your face or skin.
• Dates and times associated with photographs.
• Optional captions.
• Side-by-side comparisons between photographs taken at different times.
• Information needed to organize, display, and track your visual progress.

Photographs may reveal personal information beyond the immediate purpose of skincare tracking. For example, an image may contain identifiable facial features, background details, or information about your surroundings.

Please upload photographs only when you understand why the feature needs them. You should avoid including other people, identifying documents, or unnecessary background information.

We use photographs for the purposes described in this Policy, including the photo-related features you choose to use. We do not use photographs to identify you through facial recognition unless we separately disclose such a feature and obtain any required authorization.

The current photo feature stores the original uploaded image in private Lovable Cloud storage for your timeline and comparisons; it does not send photo files to the AI Coach. Original files may contain embedded metadata. Display links expire after one hour but can be used by anyone who obtains the link during that period. You may choose to include photos in a locally generated PDF report. Future AI image processing would require updated disclosures and any required separate consent before activation.

2.4 AI Coach Conversations and Generated Content

When you interact with the AI Coach, we may collect and process:

• Questions, prompts, and messages you submit.
• Relevant skincare profile information used to personalize responses.
• Product and routine details included in your conversations.
• Text descriptions or links that you choose to include in your messages; the current Coach has no photo-attachment processing feature.
• AI-generated responses, summaries, and recommendations.
• Conversation history and records needed to provide continuity across sessions.

The AI Coach may use saved context, such as your stated goals, current routine, product inventory, and previous check-ins, to generate more relevant responses.

AI-generated descriptions or inferences about your skin may themselves constitute personal information when associated with your account.

2.5 Product, Routine, and Progress Information

We may collect information you enter or generate through the Service, including:

• Products in your inventory.
• Ingredient information associated with products.
• Routine steps, schedules, and changes.
• Progress check-ins and observations.
• Routine completion and skipped-step records.
• Historical charts and summaries.
• Reports generated for your personal use.
• Your interactions with recommendations and features.

We use this information to operate the features you request, maintain your history, and provide longitudinal coaching.

2.6 Subscription and Transaction Information

If you purchase a paid subscription, we may collect:

• Subscription plan and status.
• Billing interval and renewal dates.
• Transaction identifiers and payment status.
• Records of purchases, cancellations, refunds, and billing disputes.
• Information needed to administer subscription entitlements.
• Customer support records relating to payments.

Payments may be processed by a third-party payment provider, such as Stripe. Depending on the payment integration, the payment provider may collect and process payment card information directly.

We generally receive payment-related information necessary to manage your subscription, rather than needing to store your complete payment card number or security code ourselves.

The payment provider's own privacy policy may also apply to information it collects directly.

2.7 Technical and Usage Information

When you access the Service, we or our service providers may collect technical information such as:

• IP address.
• Browser type and version.
• Device type and operating system.
• Approximate location inferred from an IP address, where available.
• Login and authentication events.
• Pages, screens, and features accessed.
• Error reports, performance logs, and diagnostic information.
• Security events and suspected abuse.
• Cookie identifiers or similar technologies, where used.

We use this information to operate the Service, troubleshoot problems, protect accounts, prevent abuse, and understand basic service performance.

We do not intentionally collect precise GPS location unless a feature requires it, we disclose that collection, and we obtain any required permission.

2.8 Communications and Support Requests

If you contact us, we may collect your email address, message content, attachments you choose to provide, and information needed to respond to your request.

We may retain support communications to resolve issues, maintain records, investigate complaints, and meet applicable legal obligations.

3. How We Use Personal Information

We collect and use personal information for specified purposes that are reasonably necessary for operating the Service and providing the features you request.

Depending on your use of the Service, these purposes may include:

3.1 Providing and Personalizing the Service

We use information to:

• Create and manage your account.
• Save your skincare profile and preferences.
• Build and maintain your product inventory and routine.
• Provide AI-generated coaching and explanations.
• Analyze product and ingredient information.
• Display progress charts and historical records.
• Generate summaries and downloadable reports.
• Maintain continuity between AI Coach sessions.
• Apply subscription-based feature limits.
• Provide the functions you specifically request.

3.2 Operating and Improving Reliability

We may use technical information and service records to troubleshoot errors, improve performance, monitor availability, investigate suspicious activity, and maintain the reliability of the Service.

Where practical, we will use aggregated or de-identified information for analytics rather than identifiable personal information when identifiable information is not needed.

3.3 Security and Fraud Prevention

We may use relevant information to detect unauthorized access, investigate suspected fraud, enforce account restrictions, protect our systems, and respond to security incidents.

3.4 Subscription Administration

We use account and transaction information to process subscriptions, manage paid access, confirm payment status, handle cancellations, issue refunds where applicable, and respond to billing inquiries.

3.5 Communications

We may send service-related communications concerning account security, subscription status, billing, important changes, support requests, and other operational matters.

We will obtain consent for marketing communications where required by applicable law. You can unsubscribe from marketing emails using the instructions provided in those messages. Unsubscribing from marketing communications will not necessarily stop essential service or transaction notices.

3.6 Legal Compliance and Protection of Rights

We may use or disclose information when reasonably necessary to comply with applicable law, respond to valid legal requests, establish or defend legal claims, investigate suspected violations, or protect the rights, safety, and security of users and other persons, subject to applicable legal requirements.

We do not use personal information for unrelated purposes simply because the information is technically available to us.

4. How AI Processing Works

The AI Coach uses artificial intelligence systems to generate responses based on information provided by you and relevant context available within the Service.

The current Coach, ingredient reviews and AI progress summaries send text through Lovable AI to the OpenAI model identified as openai/gpt-6-astra. Recent gateway records confirm this model on the Responses endpoint. The request includes your question; full saved profile, goals and product records; active routines and steps; up to 30 check-ins and 30 product-history entries; and, for chat, up to 16 previous messages. Whole records can include your display name, account-linked identifiers, timestamps, sensitivities and free-text notes. Saved context is capped at 70,000 characters, which is a size limit rather than removal of identifying information. Uploaded photo files are not included in this pipeline. If you put personal details or links in your message, they are included as text.

Published research abstracts are included with requests. Supplemental Europe PMC searches send recognized ingredient aliases and generic research filters, not your raw question, profile or account identifiers.

We aim to limit the information sent to AI providers to what is reasonably necessary for the requested feature.

AI-generated responses may be inaccurate, incomplete, inconsistent, or misleading. They may also contain inferences about your skin or skincare needs that are not correct.

We do not treat AI-generated conclusions as verified medical findings.

AI Model Training and Secondary Use

Review required before final acceptance: On October 20, 2026, the authenticated model catalog classified this model's Responses endpoint as zero retention and the app explicitly requested store: false. These facts do not establish that Lovable gateway diagnostics or other operational logs retain no information. Recent gateway records expose redacted or truncated payload availability. Their exact retention period, access controls and deletion handling remain unverified.

Our intended approach is not to use identifiable user photographs, skincare records, or private AI conversations to train our own general-purpose AI models.

We will not use your identifiable photographs or private skincare records for unrelated model training or other secondary purposes unless we have a valid legal basis and obtain any consent required by law.

Lovable's published data-opt-out guidance states that app end-user data is not used to train its models. OpenAI's published API guidance states that API inputs and outputs are not used for training by default unless a customer opts in. The exact applicable Lovable/OpenAI contractual coverage, upstream settings, processing locations and gateway retention/deletion practices still require confirmation. These published statements are not a guarantee of zero retention across every system. No app-controlled model-training pipeline was found in the reviewed implementation.

We will not claim that a provider never retains or trains on submitted information unless we have verified the applicable terms and settings.

If our AI training practices materially change, we will update this Policy and obtain additional consent where required by law.

5. How We Share Personal Information

We do not disclose personal information indiscriminately. We share information only for purposes described in this Policy, with appropriate authorization, or as otherwise permitted or required by law.

5.1 Service Providers and Processors

We may share relevant information with service providers that help us operate the Service. Depending on our actual implementation, these may include:

• Cloud hosting and database providers.
• Authentication and account management providers.
• AI model and image-processing providers.
• Payment and subscription management providers.
• Email delivery and customer support providers.
• Security, monitoring, and diagnostic providers.
• Infrastructure providers needed to store photographs and generated reports.

The reviewed implementation uses Lovable Cloud for authentication, account-linked application records and private photograph storage; Lovable AI with an OpenAI model for text inference; Stripe for payments; and Europe PMC for ingredient research. PDF reports and JSON exports are prepared in your browser rather than saved as report documents in the application database. Optional error-reporting hooks may transmit route, error and stack details to Lovable diagnostics; payload redaction and log retention require review. Support emails go to the stated contact address; mailbox retention has not been verified.

These providers may process information on our behalf to perform contracted services. Where appropriate, we use contractual, technical, and organizational measures intended to restrict their use of personal information to authorized purposes.

Some providers may process information in countries other than Canada. Additional information about international processing is provided below.

5.2 Legal Requests and Protection

We may disclose information where reasonably necessary to comply with applicable law, a valid court order, or another legally binding request, or to investigate fraud, security incidents, or unlawful activity.

Where legally permitted and reasonably appropriate, we will limit disclosures to the information relevant to the request.

5.3 Business Transactions

If we are involved in a merger, acquisition, financing, restructuring, bankruptcy, or sale of all or part of our business or assets, personal information may be disclosed to relevant parties as reasonably necessary for the transaction.

Any such disclosure or transfer will be subject to applicable law and appropriate safeguards. We will provide notice or obtain consent where required.

5.4 With Your Direction or Consent

We may disclose information when you direct us to do so or give the required consent, such as when you choose to export a report or share information through a feature that expressly supports sharing.

5.5 No Public Sharing by Default

Your skincare photographs, private AI conversations, product inventory, progress records, and personal reports are not intended to be publicly accessible.

We do not provide public profiles, public photo galleries, or public skincare rankings as part of the core Service.

We will not make your private records publicly available without your direction or another lawful basis.

5.6 Sale of Personal Information and Advertising

We do not sell personal information to third parties for money.

We do not use your private photographs, skincare concerns, or AI conversations to create advertising profiles for unrelated third parties.

If we introduce advertising, analytics, affiliate, or other monetization features that involve additional collection or disclosure of personal information, we will assess the applicable legal requirements and update this Policy before implementing those practices.

We will not represent that we have no advertising-related data sharing unless our actual technical configuration and practices support that statement.

6. Cookies and Similar Technologies

The Service may use cookies, local storage, session identifiers, or similar technologies to support login sessions, preserve preferences, protect accounts, and maintain functionality.

Where used, these technologies may help us:

• Keep you signed in.
• Remember preferences.
• Maintain session security.
• Understand basic service performance.
• Diagnose technical problems.

Some technologies may be provided by third-party services integrated into the application.

We will seek consent for non-essential cookies or similar technologies where required by law. Where appropriate, you may control cookies through your browser settings or through controls provided by the Service.

Disabling essential cookies or storage mechanisms may prevent some features from working correctly.

This section should be updated if the application introduces analytics, advertising pixels, session replay, or other tracking tools.

7. International Processing and Storage

We and our service providers may store or process personal information in Canada or other countries, depending on the infrastructure and providers used by the Service.

When information is processed outside your province or country, it may be subject to the laws of the jurisdiction in which it is processed and may be accessible to authorities under those laws.

We take reasonable steps to select providers and safeguards appropriate to the sensitivity of the information being processed.

Review required: Exact database, file storage, inference, diagnostics and support-email processing locations and the applicable subprocessor list have not been verified. Ontario governing law does not imply that data stays in Ontario or Canada.

8. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Policy, subject to legal, security, accounting, and operational requirements.

Retention periods vary depending on the type of information and the purpose for which it is held.

These are general principles, not a promise that every record will be deleted on an identical schedule.

We will establish actual retention periods for the systems used by the live Service. We will not retain information indefinitely merely because storage is inexpensive.

Backups — documented platform behavior, not a verified project inventory: Lovable Cloud documentation describes daily database backups retained for up to roughly 14 days; these cover database schema/data, not stored image files. Deleting active records does not erase earlier snapshots immediately. Actual backup timestamps, log expiry and a process to reapply deletions after a restore remain under review. No project-specific file-backup behavior has been verified.

When information is no longer needed, we will take reasonable steps to delete it, securely dispose of it, or de-identify it, subject to applicable law.

9. Security Measures

We use reasonable technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, and misuse.

Depending on the system and feature, safeguards may include:

• Authentication and access controls.
• Restricted access to databases and storage.
• Private file storage and controlled access to photographs.
• Encryption in transit where supported.
• Secure handling of application secrets and AI credentials.
• Server-side authorization checks.
• Database access policies and row-level security where supported.
• Monitoring for suspicious activity and technical errors.
• Appropriate access restrictions for personnel and service providers.

No online service, database, device, or transmission method can be guaranteed completely secure. We therefore cannot promise that unauthorized access, data loss, or other security incidents will never occur.

This limitation does not relieve us of our legal obligations to implement reasonable safeguards, respond appropriately to incidents, or notify affected individuals or authorities when required.

If a security incident occurs, we will assess and respond to it in accordance with applicable law.

10. Your Privacy Rights and Choices

Depending on the laws applicable to you, you may have rights concerning your personal information, including the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of information where legally available.
• Withdraw consent to certain processing activities.
• Ask questions about how your information is collected, used, or disclosed.
• Challenge our handling of personal information.
• Make a complaint to the appropriate privacy regulator.

These rights may be subject to lawful exceptions, verification requirements, and circumstances in which we must retain particular records.

10.1 Access and Correction Requests

To request access to or correction of personal information, contact us using the details in the Contact Us section.

We may need to verify your identity before responding. We will handle requests within the time limits required by applicable law.

10.2 Withdrawing Consent

Where processing is based on consent, you may withdraw that consent subject to legal or contractual restrictions and reasonable notice.

Withdrawal may affect our ability to provide a feature that depends on the relevant information. For example, deleting photographs may prevent photo-based progress comparisons from continuing.

Withdrawal does not automatically make prior processing unlawful where that processing was authorized at the time.

10.3 Deleting Your Account

You may request account deletion through available account controls or by contacting us at miaoyangcomp@gmail.com.

When we receive a valid deletion request, we will take reasonable steps to delete or de-identify personal information associated with your account, subject to applicable law and legitimate retention requirements.

Deletion may not immediately remove information from every backup, security log, transaction record, or third-party system. Where continued retention is necessary or legally required, the information will be retained only as appropriate for that purpose.

You should export any reports or records you wish to retain before deleting your account.

The app's account-deletion action first checks and cancels linked Stripe subscriptions, then removes owner-folder files and application records, and finally deletes the authentication identity. It stops if a step fails; earlier cancellations and removals are not rolled back, and you may need to retry. It does not request deletion of Stripe customer/invoice records, AI-provider/gateway logs, backups or support emails. It cannot erase files already downloaded to your device.

Review required before final acceptance: The audit identified a product-history cleanup ordering defect, concurrent-write and nested-folder cleanup risks, and no end-to-end deletion verification with a disposable account. These prevent a claim that all app data is reliably removed in every case. Until final verification, contact us if cleanup fails or you need confirmation of removal.

10.4 Complaints

If you have concerns about our privacy practices, you may contact us using the details below.

We will review complaints and make reasonable efforts to resolve them. You may also have the right to contact the relevant privacy regulator.

11. Children's Privacy

The Service is intended for individuals aged 18 or older unless we expressly provide a different arrangement that complies with applicable law.

We do not knowingly seek to collect personal information from children through an account that is not permitted under our eligibility rules.

If we become aware that we have collected personal information from a child in circumstances where collection is not permitted, we will take reasonable steps to address the situation, including deleting the information where appropriate and legally required.

A parent or guardian who believes a child has submitted personal information may contact us using the details below.

12. Third-Party Websites and Services

The Service may contain links to third-party websites, product pages, or other external services.

We do not control the privacy practices of independent third parties. Once you leave the Service or interact directly with an external provider, that provider's privacy policy and terms may apply.

We encourage you to review the privacy practices of any external service before submitting personal information.

The inclusion of a link does not necessarily mean that we endorse the third party or guarantee its privacy or security practices.

13. Changes to This Privacy Policy

We may update this Policy when our practices, technology, service providers, or legal obligations change.

The updated version will be posted with a revised "Last Updated" date.

If we make a material change to how we collect, use, or disclose personal information, we will provide notice through the Service, by email, or through another appropriate method where required by law.

Where a new use or disclosure requires additional consent, we will seek that consent before proceeding.

We encourage you to review this Policy periodically. The date at the top indicates when it was most recently updated.

14. Contact Us

If you have questions, concerns, access requests, correction requests, deletion requests, or complaints relating to privacy, contact:

Organization: Liyang Ge
Privacy Contact: Liyang Ge
Email: miaoyangcomp@gmail.com
Website: https://myskincoach.app

Please do not send payment card details, passwords, or unnecessary sensitive information in an email.

We will review privacy inquiries and respond in accordance with applicable law.

End of Privacy Policy