Legal

Privacy Policy

Last updated: October 1, 2026

This Privacy Policy explains how ilysia ("we", "us", "our") handles personal information when you use our app and related services.

1. Data We Collect

Account details such as email and authentication identifiers.
App usage and diagnostics data (for reliability, analytics, and fraud prevention), such as app launches, screen views, time spent on screens, feature taps, performance timing, and crash data. We do not include skin photos, free-form analysis input, receipts, API keys, or authentication tokens in analytics events. If you opt in to usage analytics, admin funnel telemetry may include a privacy-safe identity bucket derived server-side from your Firebase authentication identifier so we can estimate unique conversion counts; we do not store the raw Firebase UID, email address, or RevenueCat identifier in that telemetry.
Basic campaign attribution from links you open, such as UTM source, medium, campaign, content, keyword, and the type of advertising click identifier present. We do not store raw advertising click IDs in app analytics.
If you allow optional usage analytics, confirm that you are 18 or older, and grant Apple's App Tracking Transparency permission, ilysia may send Meta generic app activity such as a completed scan, a paywall view, or the start of checkout together with device and advertising identifiers for ad attribution and campaign measurement. These Meta events do not contain skin photos, skin scores, visible concerns, product details, or free-form inputs.
Subscription lifecycle and revenue information, such as trial starts, initial subscriptions, conversions, and renewals, may be sent from RevenueCat to Meta's Conversions API for ad measurement after the permissions above. ilysia does not send duplicate purchase or revenue events from the app.
Device data, including app version, OS version, technical metadata, and a random app-specific device usage token stored in secure storage for account security, fraud prevention, and scan-limit enforcement. This token is not derived from hardware identifiers and is not used for advertising tracking.
Images and inputs you provide for skin and product analysis features, including face photos that you choose to capture or upload for a skin scan.
Your third-party AI analysis permission choice and the consent acknowledgement sent with AI requests after you allow that sharing.
Your approximate location, if you choose to share it for weather-based routine tuning. This is optional, requested only when you opt in during routine creation, and used once to fetch today's temperature, humidity, and UV from Open-Meteo. The coordinates are not stored by ilysia, not shared with any AI provider, and not used for advertising.

2. Face Data and AI Skin Analysis

For skin scans, ilysia collects the front-facing face photo you capture or upload. If you use the guided face scan, ilysia may also collect supporting side-view face photos to improve scan quality and consistency. The app may temporarily process face position, head angle, face mesh, and landmark signals on your device to guide capture and show the scanning animation. These on-device signals are not sent to our cloud AI providers as separate biometric templates.

ilysia uses face data only to provide the requested skin analysis, estimate visible skin attributes, build your skin scores, identify visible concerns, create sensitivity map regions, personalize skincare routines and product guidance, save your local history, and support progress insights. ilysia is a beauty and skincare app, not a medical diagnostic service.

Before raw face photos, product photos, product details, ingredient lists, or structured skin results are shared for AI analysis, the app explains what will be sent and asks for your permission. When you allow AI analysis, your front-facing face photo, any guided-scan side-view face photos, product photos, product details, ingredient lists you choose to analyze, structured skin results such as scores, skin type, visible concerns, facial observations, sensitivity map regions, summaries, app language, analysis prompts, and relevant feature inputs are sent through Firebase Cloud Functions to our AI analysis providers, OpenRouter-powered Xiaomi MiMo and Google Gemini, to generate the requested skin analysis, routines, product guidance, and insights. OpenRouter routes selected requests to Xiaomi MiMo. Xiaomi MiMo's platform policy states that API content is not used for model training or other purposes, and Google Gemini is not permitted to use this data to train AI models. Your raw face photos are processed in memory for that scan and are not stored on ilysia servers. ilysia does not sell face data and does not use raw face photos for advertising or ilysia AI model training.

Third-party AI permission: The app shows an "Allow third-party AI analysis?" prompt before sharing personal data with OpenRouter-powered Xiaomi MiMo or Google Gemini. The prompt names the data categories above, identifies the AI recipients, and asks you to choose whether to allow sharing for AI-powered analysis and recommendations. If you choose "Not now" or do not allow this prompt, ilysia does not send the AI request and the requested AI analysis or recommendation does not continue. When you allow the prompt, ilysia stores your permission choice on your device and sends a third-party AI data-sharing consent acknowledgement with AI Cloud Function requests. Requests missing the current consent acknowledgement are rejected before third-party AI processing starts.

Structured skin results, such as scores, skin type, visible concerns, face-shape observations, sensitivity map regions, summaries, language, and timestamps, may be stored locally on your device and synced to ilysia's Supabase database behind Firebase Callable Functions for history, progress, routines, product guidance, and insights. Cloud scan sessions are pruned to the 100 most recent sessions per user and are deleted when older than 18 months. Local scan history photos are compressed and retained on your device for up to 100 days unless you delete them sooner or delete your account data.

Product catalog contributions are optional and require separate permission for each submission. If you opt in, we store the product photos you took, the product details extracted by AI, and a record of your permission linked to your account. We remove embedded photo metadata before storage. Your personal skin profile and personalized analysis are not included in the catalog contribution. Contributions remain private for review; only verified product details and product-only photos may be shown to other users. You can use product analysis without contributing. Contact support to request removal; deleting your account also removes your contributions and photos.

3. How We Use Data

Provide core app features and personalized recommendations.
Record and honor your privacy choices, including third-party AI analysis permission.
Maintain account security and prevent abuse.
Improve product quality, stability, and performance.
Support subscriptions, purchases, and restore workflows through app store providers.
Measure whether Meta advertising leads to generic app activity and subscriptions when an eligible adult grants both optional analytics and App Tracking Transparency permission.

4. Data Sharing

We may share data with infrastructure and service providers (for example hosting, analytics, authentication, in-app purchase services, and AI analysis providers) only as needed to operate the product. We do not sell your personal information. For users who are confirmed as 18 or older and grant both optional analytics and Apple's App Tracking Transparency permission, Meta may receive generic app activity and device or advertising identifiers for cross-app ad attribution. RevenueCat may send trial, subscription, renewal, and related revenue events to Meta's Conversions API for the same measurement purpose. ilysia does not send Meta skin photos, skin scores, visible concerns, product details, or free-form inputs. We do not currently use a separate mobile measurement partner SDK such as AppsFlyer or Singular.

When you allow third-party AI analysis, ilysia routes the requested AI data through Firebase Cloud Functions to OpenRouter-powered Xiaomi MiMo and Google Gemini. Firebase Cloud Functions authenticate the request, check the current consent acknowledgement, and forward only the data needed for the requested AI feature. OpenRouter routes selected requests to Xiaomi MiMo. Xiaomi MiMo and Google Gemini process this data to return the requested skin analysis, routine, product guidance, or insight. OpenRouter, Xiaomi MiMo, and Google Gemini do not receive permission to sell the data, use it for advertising, or train AI models with it.

Third-party service providers that process personal data for ilysia, including AI analysis providers, are required to protect that data with confidentiality, security, and limited-use protections that are the same as or equivalent to the protections described in this policy.

When you opt in to weather-based routine tuning during routine creation, your approximate location coordinates are sent to Open-Meteo (api.open-meteo.com) to retrieve today's temperature, humidity, and ultraviolet index. The coordinates are used once in memory and are not stored by ilysia, not sent to ilysia servers, not shared with AI providers, and not used for advertising. Open-Meteo's public terms state that API request logs — which include geographic coordinates from the query string — may be retained for up to 90 days. You can skip the location step and still create a routine.

5. Retention

We retain data for as long as necessary to provide services, fulfill legal obligations, resolve disputes, and enforce agreements. Raw analysis images are processed for the requested analysis and are not sold; local scan history is stored on your device unless you choose to save or sync related app data. Account deletion removes user-owned app data and local app subscription snapshots from our database; App Store, Google Play, RevenueCat, and other provider records remain governed by those providers' retention and restore policies.

6. Security

We apply technical and organizational safeguards to protect data. However, no transmission or storage system is 100% secure.

7. Your Choices

You can request account deletion and related data removal.
You can turn optional usage analytics on or off in the app's Profile / Privacy & About settings. Turning it off disables optional Firebase Analytics and PostHog collection and optional behavior telemetry for future events from that device. We may still keep minimal operational diagnostics and business outcome counts needed for reliability, fraud prevention, purchases, and service delivery, without raw photos, free-form inputs, receipts, or authentication tokens. Turning optional usage analytics off also disables future Meta app events and removes the Meta anonymous identifier and IDFA attributes that ilysia previously supplied to RevenueCat. Provider records already created remain subject to the providers' retention policies. If usage analytics is on, we may use a privacy-safe identity bucket to count unique funnel steps; turning usage analytics off stops future identity bucket generation for usage analytics from that device. PostHog processes opted-in product events in its EU region, using pseudonymous identifiers and app/device context. We do not send photos, skin answers, email addresses, or authentication tokens to PostHog. Session replay and automatic screen recording are disabled. With your usage analytics permission, subscription purchase, renewal, and refund events may be linked to the same pseudonymous PostHog identifier. Turning usage analytics off removes that identifier from RevenueCat and marks optional analytics disabled. Device capture stops immediately; provider-side updates require network delivery and may be delayed while your device is offline.
On iOS, Apple's App Tracking Transparency permission is separate. You can deny the prompt or later change the permission in iOS Settings. ilysia does not enable Meta tracking without permission and does not enable it for users who identify as ages 13-17.
You can reset the third-party AI analysis permission in the app's Profile / Privacy & About settings. When reset, ilysia will ask for your permission again before sharing personal data with AI analysis providers. Resetting this permission stops future AI sharing until you allow it again; to remove stored account data, use the account deletion option.
You can manage subscription settings directly in your app store account.
You can stop using the app at any time.

8. Children's and Teen Privacy

ilysia may not be used by children under 13. Teens ages 13-17 may use ilysia only with consent from a parent or legal guardian. ilysia is not positioned in the App Store Kids Category. ilysia does not enable Meta advertising tracking for users who identify as ages 13-17. If you believe a child under 13 has provided personal data, contact us so we can take action.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Updated versions will be posted on this page with a new "Last updated" date.

10. Contact

For privacy questions, contact us at [email protected].