Last Updated: April 6, 2026
Welcome to Aureya (“we,” “our,” or “us”). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.
By using Aureya, you agree to the collection and use of information in accordance with this policy.
Account Information: Email address, name (optional), date of birth (for age verification), password (encrypted).
Profile Information: Skin type, skin concerns, age group, gender (optional), ethnicity/skin tone (optional), chronic skin conditions, allergies, budget preferences, current skincare products.
Photos: Selfies for facial skin analysis; body area photos (neck, hands, arms, legs, feet); photos uploaded from your device; progress tracking photos.
Food Logs: Meal descriptions, food photos (optional), dietary information.
Health & Wellness Data (with your permission): Sleep duration and quality, heart rate variability (HRV) as a stress indicator, step count, water/hydration intake, and dietary caffeine intake — via Apple HealthKit (iOS) or Google Health Connect (Android). This data is collected only if you grant the relevant permissions. You can revoke access at any time in your device settings.
User Content: Notes and comments, product reviews, feedback you submit.
Device information (model, OS version, unique identifiers), usage data (features used, time in app, crash reports), and camera permission status.
Firebase Services (authentication, analytics, cloud storage metadata) and payment processor transaction records.
All photos are encrypted in transit (HTTPS/TLS) and stored in Firebase Cloud Storage with encryption at rest. Each photo is linked only to your user ID.
When you submit a selfie, Google Cloud Vision API detects facial landmarks (up to 33 anatomical points) solely to identify skin zones for analysis (T-zone, cheeks, forehead). We do NOT collect biometric identifiers, do NOT build a facial recognition profile, and do NOT use this data to identify you.
Face landmark data is processed in real-time and is not stored as a separate facial profile. Raw selfie photos are stored in Firebase Cloud Storage (encrypted at rest). You can delete any selfie at any time from within the app.
Body area photos (neck, hands, arms, legs, feet) are analyzed by Google Gemini AI only. No facial detection, facial landmarks, or biometric processing is performed. These photos do not involve biometric identifiers of any kind.
If you choose to connect your health data, this section applies.
What we collect (opt-in only): Sleep duration and stages, heart rate variability (HRV), step count, water intake, and dietary caffeine — from the last 24 hours only.
How it’s used: Exclusively to correlate lifestyle factors with your skin condition trends and provide personalized insights (e.g., “poor sleep may be contributing to breakouts”). Health data is NOT used for advertising, marketing, or any unrelated purpose.
Storage & sharing: Health data is cached locally on your device for up to 30 minutes. It is NOT sent to Google Gemini AI or any external AI service. It is NOT shared with any third parties or sold. Aggregated, anonymized wellness trends may be stored in your profile to power insights.
Retention: Locally cached data clears after 30 minutes. Aggregated insights are retained until account deletion. Raw metrics are re-fetched each session and not stored long-term.
Your rights: You can revoke health data access at any time in your device Settings. Revoking access immediately stops all health data collection. All core Aureya features work without granting health data access.
Compliance: iOS — We comply with Apple HealthKit guidelines. Health data is not stored in iCloud and is not used for advertising. Android — We comply with Google Health Connect policies using the principle of least privilege.
We do NOT sell your personal information. We share only with:
Google processes data under their Privacy Policy: policies.google.com/privacy
We implement end-to-end encryption for photos, secure HTTPS connections, Firebase security rules, and regular security audits. In the unlikely event of a data breach, we will notify you within 72 hours and inform relevant authorities as required.
What gets deleted: Account credentials, profile information, all face and body area photos, all skin analyses, food logs, journal entries, wishlist items, routine data, and health wellness insights. Your subscription is cancelled (refunds subject to Apple/Google policy). Health data permissions are revoked.
Timeline: All personal data permanently deleted within 30 days. Some anonymized, aggregated analytics may be retained as it cannot be linked back to you.
To exercise any rights: Email privacy@aureyaskin.io with subject “Privacy Rights Request.”
Aureya is NOT intended for children under 13 (or 16 in the EU). We do not knowingly collect data from children. Parents can contact privacy@aureyaskin.io to request deletion.
Your data may be processed outside your country via Firebase (Google servers worldwide). EU users: Data transfers comply with GDPR (Standard Contractual Clauses).
California residents may request details about data collected, correction or deletion of data, and opt-out of data sharing. We do NOT sell personal information. Email contact@aureyaskin.io with subject “CCPA Request.” We respond within 45 days.
EU/EEA users have rights of access, rectification, erasure, restriction, portability, and the right to object. Legal basis for processing: consent, contract performance, legitimate interests, and legal obligations. Data Protection Officer: privacy@aureyaskin.io. You can file a complaint with your local data protection authority.
Aureya is a wellness and skincare information application. It is NOT a medical device, does NOT provide medical advice, diagnosis, or treatment, and is NOT a substitute for professional medical care. Always consult a licensed dermatologist or healthcare provider for any skin concerns.
Changes will be posted with an updated “Last Updated” date. Significant changes will trigger an in-app notification. Continued use after changes means you accept the new policy.
v1.0 – Nov 13, 2025 · v2.0 – Feb 13, 2026 · v3.0 – Feb 28, 2026 · v4.0 – Apr 6, 2026 (Added Health Data section 3C, RevenueCat & FCM disclosures, expanded retention table, account deletion instructions)
We aim to respond within 48 hours.
Copyright 2024–2026 MoLabs LLC. All rights reserved.