Privacy Policy

Effective 31 October 2026 · Version 1.1

Skinory is an app for tracking your skin: breakouts, products, routine, treatments, cycle and daily habits, with an AI assistant called Nory and a report you can take to a doctor. Almost everything you put into Skinory is about your body and your health. This policy explains what we collect, why, where it lives, who else sees it, and how you delete it. We wrote it to be read, not skimmed.

1. Who is responsible

Skinory is operated by Carolina Ordonez Hoyos, based in Envigado, Colombia ("Skinory", "we"). We are the data controller for the personal data described here. For anything about your data, write to hello@skinory.app.

2. What we collect

We collect only what the app needs to work. Everything in this list is entered by you or produced from what you enter.

Account

• Email address and a password, or your Google account email and name if you sign in with Google.
• Your first name and an optional profile photo.
• Language, time zone and reminder preferences.

Skin and health information (sensitive data)

• Skin profile: skin type, type of acne, conditions you tell us about (for example PCOS or rosacea), and whether pregnancy-safe mode is on.
• Breakouts you place on the face map: location, type, when they appeared and cleared, and whether you picked at them.
• Daily log: sleep, stress, water, meals and what was in them, workouts and what touched your skin, hygiene items like pillowcases and towels.
• Products you use or have tried, with their ingredient lists, and how you rate them.
• Routine steps and whether you completed them, including medications and supplements you add as steps.
• Treatments and medications, past and current, with doses, dates and how they went.
• Menstrual cycle data if you turn the cycle module on: period dates, cycle length and predicted phases.
• Photos: close-ups of individual spots, weekly progress photos of your face, and photos of product labels (see section 4 for how labels are handled).
• Your messages to Nory and her replies.

Technical information

• Device type, operating system version and app version, which travel with every request so the app can be supported.
• Server logs with request times and error messages. Logs do not contain the content of your log, photos or chats.

Waitlist (website)

If you join the waitlist on skinory.app, we keep your email address, the language of the page and the date you joined. Nothing else, and no health information.

We do not collect your precise location, your contacts, or advertising identifiers. Skinory contains no advertising and no third-party analytics or tracking SDKs.

3. Why we use it, and on what basis

Answering any question about your health is optional. You can skip it or choose "I'd rather not say", and Skinory keeps working; only the features that need that answer, such as cycle predictions, will be missing.

Consent can be withdrawn at any time by deleting your account (section 8). The optional research consent can also be turned off on its own, in Settings, and Skinory keeps working exactly the same. We do not use your data for advertising, we do not build profiles for anyone else, and we never sell your personal data.

We never give your data to outside companies to train their AI models, and your photos are never used to train any model, ours included. Skinory's own models learn only from de-identified data, and only from people who turned the research consent on.

How we de-identify data

Whenever this policy says data is de-identified, it means all of the following:

• Everything that identifies you directly is removed: your name, email, photos, and anything you typed in your own words, such as notes and messages to Nory.
• Your account id is replaced with a random code that is never stored next to your account.
• Anything we publish or share with someone outside Skinory is a statistic about a group of at least 50 people, never a record about one person.
• We commit publicly, here, never to try to re-identify anyone from de-identified data, and we keep it apart from your account.
• Anyone we share de-identified statistics with, such as a research partner or a skincare company, must sign a contract that forbids them from trying to re-identify anyone and from passing the data on.

If you turn the research consent off, your data is left out of anything we build from then on. Statistics already made from it cannot be taken apart again, because they no longer contain anything that points to you.

4. Who else processes your data

We use a small number of service providers. Each one acts on our instructions under a data processing agreement, and none of them may use your data for their own purposes.

We may also disclose data if the law requires it, or to protect someone's safety, and we will tell you unless we are legally prevented from doing so.

If Skinory is ever merged with or acquired by another company, or its assets are sold, including in a bankruptcy, your data may pass to the new owner. That owner has to keep the promises in this policy, including that your data is never sold and never used for ads. We will tell you inside the app and by email before your data moves, so that you can delete your account first if you want to.

5. Where your data lives, and international transfers

Skinory's servers are in the United States. If you use Skinory from Colombia, the European Economic Area, the United Kingdom or anywhere else, your data is transferred to and stored in the United States.

• Colombia. Under Ley 1581 de 2012 and Decreto 1377 de 2013 this is an international transfer of sensitive data. It happens with your prior, express and informed authorization, which you give on the consent screen in the app, and which you may revoke by deleting your account.
• EEA and UK. We rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our agreements with each provider, and on the EU-US Data Privacy Framework where the provider is certified.

6. How long we keep it

• Everything you log stays until you delete it or delete your account.
• Label photos are deleted immediately after the ingredient text is read.
• When you delete your account, your photos are removed from storage and your account and every row of data are deleted at that moment. Copies may persist in encrypted database backups for up to 30 days and are then gone.
• Server logs are kept for 30 days.
• Waitlist emails are kept until Skinory opens and we have told you, and then for up to 6 months so the founding offer can reach you. Write to hello@skinory.app to be removed at any time, and every email we send has a way to leave the list.
• If you stop using Skinory and do not delete your account, we will email you after 24 months of inactivity and delete the account 30 days later if you do not sign in.

7. How we protect it

Data is encrypted in transit (TLS) and at rest. Every table is protected by row-level security so a signed-in user can read only their own rows, and our server functions run as the signed-in user rather than with a master key. Photos are never public: each one is reached through a signed link that expires in minutes. Access to production systems is limited to the people who operate Skinory, with two-factor authentication. No system is perfectly secure; if a breach ever affects your data we will tell you and the relevant authority without undue delay, and within 72 hours where the law requires it.

8. Your rights and how to use them

Wherever you live, you can:

• See and correct your data: everything is editable inside the app.
• Export it: Settings → Your data → Export gives you a file with your full log. (Until that button ships, email us and we will send it within 30 days.)
• Delete it: Settings → Delete account removes everything, as described in section 6. No email, no waiting.
• Withdraw consent for health-data processing: the same deletion does that, because Skinory cannot work without it.
• Complain to a supervisory authority: in Colombia the Superintendencia de Industria y Comercio (SIC); in the EEA your national data protection authority; in the UK the ICO.

Colombian users additionally have the rights to know, update, rectify and delete their data and to revoke authorization under Ley 1581, exercised by writing to hello@skinory.app; we answer requests within 10 business days and complaints within 15, as the law sets out. EEA and UK users have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR. We answer all requests within one month.

We will never treat you differently for exercising any of these rights.

9. For users in the United States

Skinory is not a healthcare provider or health plan and is not covered by HIPAA. Instead, the information you give us is "consumer health data" under laws such as Washington's My Health My Data Act, Nevada's SB 370 and the Connecticut Data Privacy Act, and this section is our consumer health data privacy policy.

• We collect the categories listed in section 2 for the purposes in section 3, from you directly.
• We share consumer health data only with the processors in section 4, so that they can run the service for us. De-identified data, made as described in section 3, is not consumer health data, and we keep it that way.
• We do not sell consumer health data and we do not use it for targeted advertising. We will never ask you to authorize a sale.
• You can access, delete and withdraw consent as described in section 8, and appeal a decision by replying to our response; we will answer the appeal within 45 days.

California residents have the rights to know, delete, correct and to non-discrimination under the CCPA/CPRA, exercised the same way. We do not "sell" or "share" personal information as those words are defined there.

10. Children

Skinory is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child under 16 has an account, email us and we will delete it. In Colombia, users under 18 may use Skinory only with the authorization of a parent or guardian.

11. Nory and automated decisions

Nory is a language model with your data as context. She can suggest patterns and questions for your dermatologist; she cannot diagnose, prescribe or change your treatment, and nothing in Skinory makes decisions about you with legal or similar effect. Treat her answers as information, not medical advice. If something in your skin worries you, see a professional.

12. Changes

If we change this policy in a way that matters, we will tell you inside the app before it takes effect and, where the change expands how we use health data, ask for your consent again. The version number and date at the top always tell you which edition you are reading. Earlier versions are available on request.

13. Contact

Carolina Ordonez Hoyos
Domicile: Envigado, Antioquia, Colombia
Correspondence address: Calle 55A Sur # 38-09, Interior 1302, María Auxiliadora, Sabaneta, Antioquia, Colombia
+57 300 216 4085
hello@skinory.app