GlowAI Privacy Policy

1. Introduction

Welcome to GlowAI ("GlowAI," "we," "our," or "us"). We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the GlowAI mobile application and related services. We comply with applicable data protection laws, including the GDPR, CCPA/CPRA and COPPA.

By using GlowAI, you acknowledge that you have read and understood this Privacy Policy.

2. Who is responsible for your data

The data controller is Munetic, based in Armenia. You can reach us at munetic.studio@gmail.com.

3. Information we collect

Personal information

Your email address and display name; account credentials (hashed passwords for email sign-in, or identifiers from Sign in with Apple or Google); and your preferences and settings. Legal basis: contract performance (GDPR Art. 6(1)(b)).

Profile and health-related data

Age, gender, height and weight; skin type and any allergies you enter; and the goals and answers you give the AI Coach (skincare, hair, grooming, fitness, nutrition, sleep). We ask your age to enforce our 13+ minimum and to tailor analysis. Some of this is health-related; we use it only to personalize your results and coaching, never for advertising. Legal basis: your consent (GDPR Art. 6(1)(a)); for health-related data, Art. 9(2)(a).

Facial image data (sensitive)

Photos you upload or capture in-app; facial landmarks and geometric measurements derived from your photos; analysis results computed from those geometric measurements, including harmony and attractiveness-style scores and tier and archetype labels; and AI-generated skin feature observations with personalized recommendations. Legal basis: your explicit consent (GDPR Art. 6(1)(a)).

What actually happens to a photo: we process facial photos only to measure facial geometry, observe skin features, compute your scores from those measurements, generate your recommendations, and store your scans in your account history so you can view them and use the results in the Coach. GlowAI performs no facial recognition, and neither your photos nor your measurements are used to identify you. Images travel over encrypted channels, are processed transiently by our AI provider, and are stored only in your own account history.

We send face images only to Google Gemini AI for analysis. Google does not retain your face images; processing is transient and images are not stored on their systems. We store your face images and analysis results in your account until you delete the scan or your account, so you can view your history and use results in the Coach.

Usage and technical data

App activity and interaction patterns, error logs and crash reports, device type, operating system and identifiers, and your device timezone (not GPS location).

Analytics and diagnostics: we use Mixpanel and Google Firebase (Analytics, Crashlytics and Performance Monitoring) to understand which features are used, fix crashes, and improve performance. These tools receive only bucketed, non-identifying usage events and crash and performance diagnostics, tied to a one-way salted hash, never your email or account ID. We never send your face images, facial measurements, analysis scores, or age to any analytics tool. Usage analytics is collected only after you opt in. Crash and performance diagnostics are on by default to keep the app stable; you can turn them off any time in Settings → Privacy. None of this is collected from users under 13. Legal basis: legitimate interests (GDPR Art. 6(1)(f)); for analytics, your consent (Art. 6(1)(a)).

AI Coach, routines and products

Your AI Coach chat messages and any images you attach; routines you build and your device timezone (to schedule reminders); and products you save, including any product photos you add. Legal basis: contract performance and your consent (GDPR Art. 6(1)(b), 6(1)(a)).

Device, notifications and identifiers

Your push notification token, device name and model, OS and app version (for reminders and updates); a salted-hash analytics identifier (never your email or account ID); and your notification preferences, which you can change anytime in Settings. Legal basis: legitimate interests and your consent (GDPR Art. 6(1)(f), 6(1)(a)).

4. How we use your information

Core services: facial geometry measurement, skin analysis and skincare recommendations; account authentication and management; and your analysis history and progress tracking. Service operation: performance monitoring and debugging, security and fraud prevention, and customer support.

We do not use your data for advertising, cross-app ad tracking, selling, or automated decisions with legal effects. We do use privacy-preserving usage analytics (bucketed and non-identifying) solely to improve GlowAI, as described in section 3.

5. Data sharing and disclosure

Google Firebase (Google LLC, USA)

Purpose: authentication, database, cloud storage, and, via Firebase Analytics, Crashlytics and Performance Monitoring, bucketed usage analytics, crash reporting and performance diagnostics. Analytics data shared: non-identifying usage, crash and performance events tied to a one-way salted hash; no face images, measurements, scores, age or email. Usage analytics is collected only with consent; crash and performance diagnostics are on by default with an opt-out in Settings, and none of this is collected from users under 13. Face data handling: your facial images and scan results are stored in Firebase Cloud Storage and Firestore for the duration of your account; Firebase hosts them on our behalf and uses them for nothing else. Data is encrypted in transit and at rest. Safeguards: Data Processing Addendum, and the EU–US Data Privacy Framework or Standard Contractual Clauses for international transfers.

Google Gemini AI (Google LLC)

What we share: face images for facial and skin analysis and for generating recommendations, and Coach chat messages with any attached images for generating responses. Google does not store your face data: processing is transient, and images are sent only for the analysis request, not retained on Gemini's systems, per its API terms. Safeguards: secured API channels and encryption in transit. We do not share face data with any other third party.

Mixpanel, Inc. (USA)

What we share: bucketed, non-identifying product-usage events (for example "scan completed" or a screen view) tied to a one-way salted hash; no face images, measurements, scores, age, name or email. Purpose: product analytics, to understand feature usage. Collected only with your consent, and never from users under 13. Safeguards: Data Processing Addendum, and the EU–US Data Privacy Framework or Standard Contractual Clauses for international transfers.

International transfers

Our analytics and AI processors (Google and Mixpanel) are based in the United States, so your information may be processed there. These transfers are protected by the EU–US Data Privacy Framework and/or Standard Contractual Clauses, together with the safeguards above.

Affiliate and outbound links

Some product suggestions are affiliate links (including the Amazon Associates program); if you buy through them we may earn a commission at no extra cost to you. Tapping a product link takes you to a third-party site with its own privacy practices, which we do not control.

GlowAI does not sell your personal information, and does not share it for cross-context behavioral advertising, for monetary or other valuable consideration.

6. Your privacy rights

Wherever you live, you can access your data, correct inaccuracies, delete your data, take a copy of it with you, and withdraw consent. In the EU and UK, you can also restrict or object to processing and lodge a complaint with your supervisory authority. In California, you additionally have the right to know the categories of data we hold, to opt out of sale or sharing (we do neither), and to be free from retaliation for exercising any of these rights.

7. How to exercise your rights

Delete your account: in the app, open Profile, then Privacy & Security, then Delete Account. Deletion is immediate on confirmation: all personal data, facial images and analysis results are permanently erased, and the action cannot be undone. The step-by-step detail lives on the account deletion page.

Export your data: in the app, open Profile, then Privacy & Security, then Export data, for a complete machine-readable (JSON) copy of your profile, scans, Coach chats, routines and saved products.

Delete a single scan: open History, select the scan, and choose Delete.

Everything else (access, correction, portability questions): email munetic.studio@gmail.com from your registered address. Replies usually come within 48 hours, and formal data-rights requests are completed within 30 days as the GDPR provides. We may need to verify your identity first.

8. Data security

Data is protected with HTTPS encryption in transit, AES-256 encryption at rest, strict access controls with multi-factor authentication, and regular security review of the systems that store it.

9. Data retention

Account data is retained for the lifetime of your account. Scan history, including facial images, is kept until you delete the individual scan or the account, so your history and Coach stay useful. Coach chat history is kept until the account is deleted. Aggregated usage analytics and diagnostics, which cannot identify you, are kept for up to 14 months and then aggregated further or deleted.

When you delete your account, deletion is immediate: your personal data, facial images and analysis results are permanently erased on confirmation, you lose access at once, and the action cannot be undone.

10. Children's privacy

You must be at least 13 years old to use GlowAI. GlowAI is not directed to children under 13. During sign-up we ask for the user's age and block accounts under 13, and we do not knowingly collect personal information, or any behavioral analytics, from anyone under 13. If we become aware that we have collected personal information from a child under 13, we will delete it promptly. Parents or guardians can contact us at munetic.studio@gmail.com.

11. Governing law and jurisdiction

This Privacy Policy is governed by the laws of Armenia, without regard to conflict-of-law principles. All disputes arising from or relating to this Policy shall be resolved exclusively in the competent courts of Armenia.

12. Contact

Email munetic.studio@gmail.com. Every message is read by the founder, and replies usually come within 48 hours.