1. Who we are
SkinMatch ("we", "us") is an AI-powered skincare ingredient scanner that helps users find comparable products with similar formulations. This Privacy Policy explains what data we collect, why, and your rights.
2. Data we collect
- Account data (only if you sign in): email address, display name, and authentication provider (Google / email). Managed via Supabase.
- Scan content: photos you upload and the extracted ingredient text. Photos are processed by Google Cloud Vision for OCR and are not stored long-term on our servers.
- Scan history: if you're signed in, we save the scanned product name and its ingredient list so you can revisit it. You can delete individual entries or your entire history at any time.
- Skin profile (optional): self-reported skin type and concerns you enter into the profile page, used to personalise recommendations.
- Technical data: IP address, browser / device type, approximate region (inferred from IP), and request timestamps. Used for rate limiting, fraud prevention, and abuse investigation.
3. How we use your data
- To perform the core service: OCR, ingredient analysis, dupe recommendations.
- To personalise results based on your skin profile.
- To show you your own scan history and favorites.
- To prevent abuse (rate limits, blocking obvious attacks).
- To improve the service (aggregate, non-identifying usage patterns).
We do not sell your data, show ads, or share your scan history with other users or brands.
4. Third-party processors
We rely on a small number of trusted vendors to operate the service:
- Supabase — account auth and database hosting.
- Google Cloud Vision API — OCR of uploaded photos.
- Google Gemini API — AI analysis of ingredient lists.
- Vercel — web hosting and edge delivery.
- Upstash Redis — rate limit counters (no content stored, only hashed identifiers).
Each vendor processes data on our behalf under their own security and privacy terms. We do not share data with advertisers, data brokers, or insurance companies.
5. AI processing
Ingredient text you submit is sent to Google Gemini for analysis. Per Google's generative AI terms, these API requests are not used to train their general models. We do not share personally identifying information (name, email) with the AI — only the ingredient list and your skin type if you've set one.
6. Data retention
- Uploaded photos are discarded after OCR (typically within seconds).
- Scan history is kept until you delete it or close your account.
- Rate-limit counters expire automatically (1–24 hours).
- Account data is kept until you request deletion.
7. Your rights
Depending on your jurisdiction (TH PDPA, TW PIPA, EU GDPR, etc.) you may have the right to:
- Access a copy of the data we hold about you.
- Correct inaccurate data.
- Delete your account and associated data.
- Withdraw consent for optional data processing.
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, email us at skinmatch.app@gmail.com.
8. Children
SkinMatch is not directed at children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.
9. Changes to this policy
We may update this policy as the product evolves. Material changes will be announced on this page with an updated effective date. Continued use of the service after changes constitutes acceptance.