Glowdays Privacy Policy
Effective date: 15 October 2026 · Version: en-1
This policy explains how your personal data is handled when you use the Glowdays mobile app and the glowdays.app website. If anything is unclear, write to support@glowdays.app.
Summary
- Glowdays works without an account. Your skin quiz answers, skin profile, routines, shelf, lists, journal and history stay on your device; they are not sent to our servers.
- Our servers only receive what is needed to read product and ingredient information (search text, barcode, filters, product IDs). These requests are not linked to an account or to anything that identifies you.
- If you create an account, submit a product, write a review or post in the community, that content is stored on our servers with your account; reviews and posts are public under your nickname.
- Your skin condition, pregnancy and medication information is health data; it leaves your device only with your explicit consent.
- We do not sell your data, use it for advertising or share it with ad networks.
- Glowdays is for people aged 18 and over.
- You can delete the data on your device (Settings > "Delete my data on this device") and your account with all server-side data (Settings > "Delete account") at any time.
1. Who is responsible (controller)
Controller: Halil İbrahim Kes (natural person, Türkiye). Contact: support@glowdays.app. We have not appointed an EU or UK representative (GDPR Art. 27) because the app is not yet offered in the EU / EEA or the UK; if that changes, this section will be updated before launch there. We have not appointed a Data Protection Officer because we are not required to; privacy questions go to the address above.
2. What data we process
2.1 Data that stays on your device (never sent to us)
We do not see or process this data; it is kept in the app's storage on your device:
- Skin quiz answers and skin profile (skin type, sensitivity, skin concerns, goals, ingredients you avoid, lifestyle preferences), pregnancy / breastfeeding status and any skin medication prescribed by your doctor.
- Your optional age range and gender (only to rank Learn articles for you; they never leave the device, even with an account).
- Routines, daily check-offs and streak; shelf items (opening / expiry date, your notes); product lists; history of scanned and viewed products; badges; articles you have read.
- Your journal: mood, sleep, period days, skin symptoms, notes. This is health data and is never sent to a server.
- Reminder settings (notifications are scheduled on your device), theme, language and layout preferences, product drafts you are preparing, and the list of content you chose to hide.
"Matches my profile" results, the compatibility score and the pregnancy filter are calculated on your device; your skin profile is not sent for them.
Your phone's own backup: on Android, Glowdays data is not included in the phone's Google backup. On iPhone, if iCloud Backup is on, this data is included in your phone's backup; that backup lives in your Apple account and Glowdays cannot access it.
2.2 Data sent to us when you use the app without an account
- Text you type into product and ingredient searches, filters you pick in Explore, barcodes you scan or type.
- The ID of the product, ingredient or article you open (ID only).
- Ingredient lists you paste or that are read from a photo: analysed and not stored. The ingredient-list photo is read on your device and is not uploaded.
- Your "Was this helpful?" answer: only the article ID and yes / no; not linked to you or your device.
- App language.
- As with any internet request, your IP address and basic technical request data (app / operating system type).
These requests are not linked to an account. Server logs keep the request address and IP address for at most 30 days. To limit abuse, request counts are kept per IP address and email; the address and email are stored in the counter only as a one-way hash, and each counter is deleted when its window (at most one day) ends.
2.3 If you create an account
- Your email address, or the identifier shared by Apple / Google when you sign in with them (including Apple's private relay address), and session data (the session token is kept in secure storage on your device).
- Your nickname (shown in the community and on reviews; your real name is not shown).
- With your explicit consent: your skin profile and safety answers are saved to your account, and your routines, shelf and lists are synced with it. Without consent they stay on your device.
- Consent records: which text, which version, which language, and when you accepted or withdrew it.
2.4 If you contribute (account required)
- Product submissions: barcode, product name, brand, category, packaging type, size and ingredient text. No photos are requested or uploaded; if you scan the ingredient list with your camera, the photo is read on your device and only the text is sent.
- Product reviews: your rating, text, optionally your skin type, age range and usage duration, product photos and nickname. Published publicly.
- Community: your posts, comments, likes, poll votes, routine snapshots and products you attach, photos, optionally your skin type and age range, and your nickname. Posts and comments are public; who liked or voted is not shown.
- Reports: the ID of the content you report and the reason you choose.
Uploaded photos are re-encoded on our server and metadata such as location (GPS) and device details is removed. Face or skin photos are not allowed in reviews or community posts (product, packaging and shelf photos only).
2.5 Planned features
- If face scanning is added, face photos will be protected as health data and processed only with separate explicit consent; this policy will be updated and you will be asked again.
- Premium subscription: payment is handled by the App Store / Google Play; we never receive your card details. Your subscription status (the store receipt and a random in-app identifier) is processed by RevenueCat; your name, email and card details do not go to RevenueCat either.
- Error monitoring (Sentry): when the app or server crashes, a technical error report is sent (device model, OS, app version, error log). No user content, identity, email or device identifier is sent; IP addresses are not stored.
3. Why we process it and our legal basis
| Purpose | Data | GDPR legal basis |
|---|---|---|
| Showing and searching product and ingredient information, analysing ingredient lists | search text, barcode, filters, IDs, ingredient text, IP | performance of a contract (Art. 6(1)(b)) |
| Creating and running your account, signing you in | email / provider ID, nickname, session | performance of a contract (Art. 6(1)(b)) |
| Saving your skin profile to your account and syncing your data | skin profile, safety answers (health data) | explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
| Publishing and reviewing reviews, posts and product submissions | your content, photos, nickname, tags | performance of a contract (Art. 6(1)(b)) |
| Security: preventing abuse, spam and illegal content; moderation | IP, request logs, reports, rate-limit counters | legitimate interests (Art. 6(1)(f)) — keeping the service safe and usable |
| Proving consent and deletion requests, legal obligations | consent records, request correspondence | legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Finding and fixing errors (Sentry) | technical error reports | legitimate interests (Art. 6(1)(f)) |
If you choose to share your skin type, age range or a skin experience publicly in a review or post, you make that information public yourself (Art. 9(2)(e)). Think twice before sharing; you can delete it at any time.
We do not use your data for advertising, marketing profiling or data sales. Health data is used only to give you recommendations and to store it in your account. The compatibility score and "Matches my profile" are suggestions, not automated decisions with legal or similarly significant effects on you (Art. 22 does not apply).
Providing data is voluntary. Without an account you can use the core features; to write reviews, post or submit products you need an account; without consent your skin profile simply stays on your device.
4. Who we share it with and international transfers
We share data only with service providers (processors) needed to run the service, under contract and only as far as necessary:
| Provider | Purpose | Location |
|---|---|---|
| Render Services, Inc. | server and database hosting | Germany (Frankfurt); US-based company |
| Cloudflare, Inc. | domain, firewall, photo storage (R2) | global network; US-based company |
| Google LLC (Gmail) | sign-in / verification emails | US |
| Apple / Google | "Sign in with Apple" / "Sign in with Google" (if you choose) | US; their own privacy policies apply |
| Functional Software, Inc. (Sentry) | error reports (no personal data, IP not stored) | Germany (EU data region); US-based company |
| RevenueCat, Inc. | subscription status (receipt, random identifier) | US |
Our data is hosted in the EU (Germany). Where a provider may access it from outside the EU / EEA or the UK (for example the United States), the transfer is protected by the EU Standard Contractual Clauses (and the UK Addendum) and, where the provider is certified, the EU-U.S. Data Privacy Framework. Because we are based in Türkiye, data may also be accessed from Türkiye. Türkiye has no EU adequacy decision; this access is covered by Standard Contractual Clauses and, where applicable, is necessary for the contract with you (Art. 49(1)(b)). You can ask us for a copy of the safeguards.
We may also disclose data where we are legally required to (court order, request from a competent authority).
Public content: your reviews and community posts can be seen by anyone using the app, with your nickname and, if you chose them, your skin type and age range.
Open Beauty Facts: part of our product database comes from Open Beauty Facts (ODbL licence). The app does not contact Open Beauty Facts on your behalf; if you tap "Open source", your browser opens their website.
5. How long we keep it
| Data | Retention |
|---|---|
| Data on your device | until you delete it or uninstall the app |
| Account, skin profile, routine / shelf sync | while your account is open; deleted immediately when you delete the account |
| Reviews and community content | until you delete them or your account; may be removed if they break the rules |
| Product submissions | if approved, the product stays in the catalogue (the link to you is removed when you delete your account) |
| Consent records | while your account is open; deleted with your account |
| Security records (sign-in, password, session) | 90 days; records linked to your account are deleted immediately when you delete it, the record of the deletion itself (email hash, part of the IP) stays 90 days |
| Server logs (requests, IP) | at most 30 days |
| Database backups | at most 14 days; deleted data disappears from backups after this period |
| Correspondence about your requests | 3 years after the request is closed (to prove we handled it) |
If you withdraw consent, your skin profile and health data are deleted from our servers; whether to delete the copy on your device is up to you.
6. Your rights
Under the GDPR you have the right to:
- access your data and get a copy;
- rectification of inaccurate data;
- erasure ("right to be forgotten");
- restriction of processing;
- data portability (receive the data you gave us in a machine-readable format) for data processed on the basis of consent or contract;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting processing before the withdrawal — in the app under Settings > Privacy > "Manage consent";
- lodge a complaint with a supervisory authority, in particular in the EU country where you live or work (list: https://edpb.europa.eu/about-edpb/about-edpb/members_en), or in the UK with the ICO.
You can do much of this yourself in the app: delete on-device data (Settings > "Delete my data on this device"), delete your reviews and posts, and delete your account with all server-side data (Settings > "Delete account"; if you cannot access the app, use https://glowdays.app/en/delete-account).
To exercise a right, email support@glowdays.app from the address linked to your account (so we can verify it is you). We reply within one month, free of charge; for complex requests we may extend by up to two further months and will tell you why.
Users in Türkiye also have the rights in Article 11 of the KVKK; see the Turkish version of this policy.
7. Security
All communication with our servers is encrypted (HTTPS). Your session token is kept in secure storage on your device. Photo metadata is removed. Access to the admin panel is protected by additional authentication. No system is perfect; if a personal data breach occurs, we will notify the competent authority and affected users as required by law.
8. Age limit
Glowdays is for people aged 18 and over. If you are under 18, do not use the app. If we learn that someone under 18 has given us personal data, we will delete it.
9. Health notice
Glowdays is a cosmetic skincare guide; it does not diagnose, does not recommend treatment and is not a medical device. If a skin problem persists, see a dermatologist.
10. Changes
We may update this policy. For significant changes (a new type of data, a new purpose, a new transfer) we will notify you in the app, and where consent is required we will ask for it again. Each version is archived with its date and version number.