Privacy policy

The short version

Who we are

Mytikas (“we”, “us”) makes Glowbie and decides how the data described here is used. You can reach us at info@mytikas.org. This policy covers the Glowbie app (“the app”) and the website at glowbie.mytikas.org.

Glowbie is a cosmetic skincare tool. It does not diagnose, treat or rule out any medical condition, and we do not treat what you tell it as medical records.

What stays on your phone

These are saved in the app’s private storage on your device and never reach us:

• your name, profile picture, age range, skin type, goals, the ingredients you avoid, your allergy terms, and the reasons you gave for avoiding things (such as pregnancy, a prescription or a skin condition)
• the products on your shelf, your routine, your edits to it and your reminder times
• your daily skin ratings
• your scan history: the photos, the results and their maps (the newest 12)
• your chats with Naia (the newest 30)
• products you added from a label photo, and the ingredient list read from it

Your phone’s own backup (iCloud) may include this data, under your device settings. Removing the app erases it from the phone.

What leaves your phone

We do not collect your email address, phone number, contacts, precise location or advertising ID. Reminders are scheduled on your phone, carry generic text with no skin or allergy details, and use no push service.

Skin reads and your face photo

A skin read is the part of Glowbie that handles the most sensitive data, so here is exactly what happens.

• Before you join, Analyze checks and maps your photo on your phone. Nothing is uploaded. The photo is held on your phone so it can be read once you become a member.
• Asking first. The first time a read would start, the app asks whether to share your photo. If you say no, nothing is sent. You can change your answer in Settings › Data & privacy.
• The read. The app removes the photo’s metadata (such as location and camera details) and sends it over an encrypted connection to our server, which forwards it to our skin analysis partner, AILabTools, and returns the answer to your phone. Our server keeps no copy of the photo or the answer. Under AILabTools’ policy the uploaded photo is deleted right after processing and result images are kept for at most 24 hours.
• Captions. To describe each finding in plain words, our server sends OpenAI the finding’s name, level, face area and numbers. It never sends the photo or the maps.
• Not used to identify you. We use your photo only to describe visible features of your skin. We do not use it to recognise who you are, and we do not build a face template for recognition.
• On your phone. Your newest 12 reads, with their photos and maps, are saved on your phone. Settings › Face scans deletes them.

Naia

Naia, Glowbie’s guide, answers with an AI model from OpenAI. We use OpenAI’s API, not the ChatGPT consumer product.

• When you ask a question, the app sends it with up to eight recent messages from the same chat (each cut to 600 characters) and the context Naia needs: your goals, the ingredients you avoid, your allergy terms, your routine and your skin results. It never sends your name, your photo or the reasons behind your avoids. Other chats are never sent.
• Our server turns off OpenAI’s option to store requests and identifies each installation to OpenAI only by a one-way hash. OpenAI may still keep API data for a limited time under its own policies, for example to detect abuse. See OpenAI’s privacy policy and its API data controls.
• Copies of AI exchanges. We keep a copy of each AI request and reply in PostHog: the instructions, your question, the context above and Naia’s answer, or for captions the finding facts and the caption, with the model used, how long it took and what it cost. Copies carry your random installation ID, not your name, and never include images. We review them to find wrong, unsafe or unhelpful answers. We do not use them for advertising and we do not sell them.

AI answers can be wrong. They are cosmetic guidance, not medical advice. The terms say more.

Analytics and recordings

We use PostHog, hosted in the EU, to count events such as “app opened”, “setup finished”, which screen you view, whether a product was found and whether a purchase went through. Events carry your random installation ID so we can follow one installation across sessions. They contain ids, counts and yes-or-no values only: never your name, your skin findings, anything you typed or any photo. Crash reports include the technical details of the error.

The first time you open Glowbie, PostHog also records the setup screens as a session replay, up to and including the membership offer. Every image, the camera, the face map, text fields and your name are hidden in the recording. Recording stops when you enter the main app.

Tests of prices and offers

We sometimes show different versions of the app to different installations to learn which works better. This includes membership offers: two people may see a different price, discount or offer length. PostHog places your installation in a group at random. We do not set prices based on your personal details or behaviour. The price the App Store shows before you confirm is the price you pay.

The app does not yet have a switch for usage analytics. If you object to it, email us and we will delete what we hold for your installation (see Your choices and rights).

Purchases

Apple takes the payment. We never see your card number or billing details. We use Adapty to manage subscriptions, scan packs and restores, and our server checks with Adapty before it unlocks anything. Your skin read allowance is tied to your App Store subscription (its original transaction ID), not to your phone, so it follows you across reinstalls. Restoring a purchase restores your access only; it doesn’t bring back data that lived on another phone.

Permissions

• Camera. For face photos, barcodes and ingredient labels, only when you open the camera.
• Photos. Only to let you pick a face or label photo.
• Location. Approximate and only while the app is open, asked for only when you turn on the local UV card. The coordinates go to Open-Meteo for the forecast and are not stored.
• Notifications. For routine reminders. You can decline, and switch them off at any time.

Who we share data with

These companies process data for us or provide the services the app relies on.

We do not sell personal data or share it for advertising. We may disclose data if the law requires it, to protect people’s safety or our rights, or as part of a sale or merger of our business, in which case this policy keeps applying unless we tell you otherwise.

Some of these providers are outside your country, including in the United States. Where the law requires it, we rely on safeguards such as the European Commission’s standard contractual clauses.

How long we keep data

Your choices and rights

• In the app. Settings › Data & privacy turns skin reads and Naia on or off and deletes all saved scans or all chats. You can swipe away a single chat, edit your profile and avoids, and switch off reminders and the UV card.
• On your phone. Removing the app erases everything it stored on the phone.
• Ask us. Email info@mytikas.org to ask for a copy of the data we hold about you, to correct it, to delete it, to object to analytics or to withdraw consent. We answer within 30 days. The delete your data page explains the steps.

Because Glowbie has no accounts, we hold no name or email that points to you. If you have bought anything, the Apple order ID from your receipt lets us find your record. We never ask for more than we need to find it, and if we cannot connect a request to any record, we will say so.

You can also complain to your local data protection authority. We would like the chance to fix the problem first, so please write to us.

Rights by region

European Economic Area, United Kingdom and Switzerland

Under the GDPR and similar laws you can ask us to access, correct, erase, restrict or move your data, and you can object to processing based on legitimate interests. Our legal bases are:

• Explicit consent for skin reads and Naia, which handle your face photo and information about your skin. You give it when you tap Allow, and you can withdraw it at any time in Settings › Data & privacy.
• Contract, to provide what you bought and the features you use.
• Legitimate interests, to keep the service secure, apply fair usage limits, understand how the app is used, test offers and check the quality of Naia’s answers.
• Consent for device permissions such as the camera, location and notifications, which you can withdraw in your device settings.

United States

Depending on your state, you have the right to know what we collect, to get a copy, to delete it, to correct it and to be free from discrimination for using these rights. In the last 12 months we collected identifiers (installation ID), commercial information (membership status), internet and app activity (analytics events), the questions you sent Naia, and face photos and skin information you chose to share. We do not sell personal information or share it for cross-context behavioural advertising.

Face photos and skin information may count as consumer health data or sensitive data under some state laws, including Washington’s My Health My Data Act. We collect them only with the consent you give in the app, use them only to provide the feature you asked for and to review the quality of AI answers as described above, and never sell them. You can withdraw consent in Settings › Data & privacy and ask us to delete what we hold. You can make a request by email, and an authorised agent may make one for you.

Everywhere else

If your country gives you privacy rights, we will honour them. Write to us.

Children

Glowbie is not directed at children under 13, or under 16 where the local age of digital consent is higher, and we do not knowingly collect their data. If you think a child has used Glowbie, email us and we will delete what we can find.

Security

Traffic between the app and our server uses TLS. Your installation’s access token is kept in your phone’s secure storage, and our server stores only a hash of it. Provider keys never ship inside the app. No system is perfectly secure, and we cannot promise nothing will go wrong. If a breach affects you, we will tell you as the law requires.

This website

This site sets no cookies and runs no analytics or advertising scripts. Our host, Cloudflare, keeps ordinary request logs (such as IP address and pages requested) for security and operations. If you email us, we use your address only to reply.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters, such as a new kind of data or a new provider, we will also say so in the app or in the release notes before it takes effect.

Contact

Mytikas
Email: info@mytikas.org