Skin Journal Privacy Policy
Version: 1.0.0
Last updated: July 16, 2026
1. Scope
This Privacy Policy applies to:
- the Skin Journal mobile app (iOS and Android);
- the skinjournal.net website and its pre-registration forms.
2. What Skin Journal Is
Skin Journal is a skin journaling app that lets you log daily face photos, skincare products, habits, and receive AI-generated analyses and insights. It is not a medical device and does not replace professional healthcare advice.
3. Data We Process
3.1. Account and authentication data
- Firebase user identifier (including initial anonymous access).
- If you link your account with Google: name, email address, and profile photo associated with your Google account.
3.2. Profile data
- Gender identity (and custom description if provided).
- Date of birth (to verify minimum age and personalize the service).
- Preferred language.
3.3. Health and appearance data (special category)
- Face photographs you upload for daily analysis.
- Derived metrics from analysis (e.g. clarity, hydration, calmness) and AI-generated comments.
- Important: photographs are sent to AI providers for analysis but are not persistently stored on our servers. We only keep the resulting metrics and comments.
3.4. Service usage data
- Skincare products you log (name, ingredients, usage dates).
- Daily habits (sleep, stress, etc., as you record them).
- Insights and hypotheses generated from your history.
- Dates and frequency of use (scan streaks, completed logs).
3.5. Technical data
- Device and session identifiers required for operation.
- Technical and security logs (IP address, device type, app version) when needed to keep the service secure.
3.6. Website data
- Email address if you pre-register on skinjournal.net.
- Cookies and similar technologies (see section 10).
3.7. Analytics and measurement (only with your consent)
If you enable the optional setting in the app or on the website, we may process:
- Usage analytics to improve Skin Journal (e.g. Google Analytics on the web or equivalent tools in the app).
- Campaign and install measurement (e.g. Singular, Meta) to understand where users come from and how advertising performs.
You can use the service without enabling this option.
4. Purposes and Legal Bases
- Create and manage your account (Firebase ID, Google data): contract performance (Art. 6(1)(b) GDPR).
- Provide journaling and analysis (profile, processed photos, metrics, products, habits): contract performance; explicit consent for health/appearance data (Art. 9(2)(a) GDPR).
- Generate AI insights (metrics history, products, habits): contract performance; consent (Art. 9(2)(a)).
- Operational communications (email, if applicable): contract / legitimate interest.
- Web pre-registration (email): consent (Art. 6(1)(a)).
- Product analytics and campaign measurement (aggregated or pseudonymized usage, install attribution): consent (Art. 6(1)(a)), via the optional setting in the app or website.
- Security and fraud prevention (technical logs): legitimate interest (Art. 6(1)(f)).
- Legal compliance (necessary data): legal obligation (Art. 6(1)(c)).
5. Processors and Third Parties
We share data with the following types of providers, only as necessary:
- Google (Firebase Authentication): user authentication (US / EU).
- Google (Google Sign-In): Google sign-in (US / EU).
- AI providers (Groq, Google Gemini, OpenAI, or others as configured): face photo analysis and text generation (primarily US).
- MongoDB (hosting infrastructure): app data storage (per hosting provider).
- Google Analytics: web analytics, consent only (US).
- Meta (Facebook Pixel): web campaign measurement, consent only (US).
- Singular (when integrated): app install attribution, consent only (US).
All providers are subject to data processing agreements or standard contractual clauses where applicable.
6. International Transfers
Some providers are located outside the European Economic Area (primarily the United States). Transfers are made with GDPR safeguards (EU Standard Contractual Clauses, adequacy decisions, or other applicable mechanisms).
7. Data Controller
Óscar Ares Bascón
Tax ID (NIF): 54131325C
Address: Simón Bolívar 15, 1ºA, Spain
Privacy email: [email protected]
Skin Journal is a service operated by an individual (self-employed) based in Spain.
8. Data Retention
- Active account: we keep your data while you maintain your account.
- Photographs: not persistently stored; only derived metrics and comments are kept.
- After account deletion: we delete all associated personal data (analyses, products, habits, insights, profile) within a reasonable timeframe. You can delete your account from the app (Profile → Delete account).
- Web pre-registration: until you request removal or data is no longer needed.
- Security logs: minimum necessary period (typically up to 12 months).
9. Minors
Skin Journal is intended for people aged 16 or older. We do not knowingly collect data from anyone under 16. If we discover an account created by someone under 16, we will delete it.
10. Cookies and Similar Technologies (Website)
On skinjournal.net we use:
- Strictly necessary cookies: for basic site operation (e.g. language preference).
- Analytics cookies (Google Analytics): only if you accept in the cookie banner.
- Marketing/measurement cookies (Meta Pixel): only if you accept in the cookie banner.
You can manage your preferences at any time via the cookie banner or your browser settings.
11. Your Rights
You have the right to:
- Access your personal data.
- Rectify inaccurate data.
- Erasure ("right to be forgotten").
- Restrict processing.
- Data portability.
- Object to processing based on legitimate interest.
- Withdraw consent at any time (without affecting prior lawful processing).
To exercise your rights, email [email protected] with your request and identity verification if needed.
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.
12. Security
We apply appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), secure authentication via Firebase, and access controls on servers.
13. Changes to This Policy
We may update this Privacy Policy. We will notify you of significant changes in the app or on the website. The current version is always available at skinjournal.net/en/privacy and via the app API.
14. Contact
Óscar Ares Bascón
Simón Bolívar 15, 1ºA, Spain