Privacy Policy

1. Introduction

At TintKin, we take your privacy seriously. This Privacy Policy explains how we collect, use, and protect your personal information when you use our skincare wellness journal, including your personal 30-day skin plan, daily routine and check-in scans.

2. Information We Collect

• Account Information: We collect your email address, name, and profile picture provided during sign-up (or from Google, if you sign in with Google). Passwords are stored only as salted bcrypt hashes.
• Profile Data: We collect information you provide during onboarding, including birth date, gender, skin type, and skincare goals.
• Facial Images: When you take a scan (your starting selfie during sign-up, a plan check-in, or any extra scan), you upload a photo of your face.
• Analysis Data: We store the numerical scores (e.g., wrinkles, firmness) and AI-generated advice derived from your scans.
• Plan and Routine Data: We store your 30-day skin plan (your focus areas, targets and steps, and any changes made to it after check-ins), which routine steps you tick off each day, your check-in results and the reports generated from them, and your care streak and milestones.
• Notification Data: If you turn on reminders, we store a push subscription for each browser or device you enable them on, and your reminder preferences and time zone, so we can send gentle morning and evening nudges. You can turn reminders off in Settings at any time.
• Payment Data: If you purchase credits, our payment processor (Polar, see below) handles your payment details directly — we never see or store your card number. We retain only the order/credit records needed to apply your purchase and handle refunds.

3. How We Process and Retain Images

Your privacy and the security of your biometric data are a top priority. Here is exactly how your photos are handled:

• When you upload a photo, it is securely transmitted to Cloudinary (using private, authenticated delivery, not a public link) for staging and formatting.
• The formatted image is sent to our analysis partner (PerfectCorp/YouCam) to generate your skin scores. Your plan is built from those scores, not from the photo itself.
• Your choice — store or delete: In Settings, you can choose what happens to your photo after each scan. If you choose “delete,” it is permanently removed immediately after analysis. If you choose “store” (the default), your most recent photo is kept — to let you run What-If simulations and see your own photo in your journal — until you take your next scan, at which point the previous photo is automatically and permanently deleted. Depending on how often you scan, this could be anywhere from the same day to several weeks.
• We do not sell, share, or use your images to train AI models.

4. Third-Party Services

We rely on trusted third-party services to operate TintKin. These services comply with strict data protection standards:

• MongoDB Atlas: For storing your account, profile and analysis data.
• Google (optional): For sign-in if you choose “Sign in with Google”.
• Cloudinary: For secure image staging and processing.
• PerfectCorp (YouCam): For analyzing skin metrics.
• Alibaba Cloud (Qwen): For writing your personalised plan, routine and check-in adjustments. It receives your numerical scores, your plan progress and routine consistency, and basic profile details (age, sex, skin type and goals) (no images, name or email are sent to this service). This service is based outside your country.
• Resend: For sending account emails (password reset, email verification, and data export emails if you request one).
• Sentry: For error monitoring, so we can detect and fix bugs. Sentry data is automatically filtered to remove emails, images, and other personal details before it is sent.
• Polar: For processing credit purchases and refunds, if you buy credits in the shop.
• Vercel: For hosting the application.

5. Cookies and Sessions

We use a single, essential session cookie to keep you signed in; it contains no data beyond your account ID and session status. If you sign in with Google, Google may also set its own cookies during that sign-in step. We do not use advertising or tracking cookies.

6. Data Deletion and User Rights

You own your data. From your account Settings, you can, at any time and without contacting anyone: download a copy of your data, have a copy emailed to you, or permanently delete your account and all associated data (journal history, photos, and profile data). You’re also welcome to reach out to us directly with any request — see Contact Us below.

7. Contact Us

If you have any questions or concerns about this Privacy Policy or how your data is handled, please contact us at muhammad0alire@gmail.com.