GlossGuardian Privacy Policy

1. Introduction

GlossGuardian ("GlossGuardian," "we," "our," or "us") is developed and operated by an independent developer. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the GlossGuardian mobile application ("App").

By creating an account or using the App, you agree to the practices described in this Privacy Policy.

2. Information We Collect

We collect only the minimum information necessary to operate the App.

2.1 Personal Information You Provide

• Email address – used for account creation, login, verification, password reset, and account-related notifications
• Age and sex (optional) – used solely to improve ingredient and allergen relevance for you or a family member you are tracking products for
• Allergen preferences – used to check scanned or manually added products against ingredients you identify as concerns
• Product data you enter or scan – including product names, brands, categories, expiry dates, PAO (period after opening) values, opened dates, ingredients, ratings, notes, and product photos you choose to attach
• Push notification token – a device-specific identifier issued by Google Firebase Cloud Messaging (FCM), used solely to deliver expiry reminder notifications to your device

2.2 Community Donation Data

If you choose to share or donate a product to the community using the Share/Donate feature:

• We record a declaration confirming you verified the product is unopened, sealed, and within its expiry date at the time of sharing
• This declaration includes the product name, expiry date snapshot, and timestamp. It is retained for safety and accountability purposes
• No personal information (name, email, or location) is included in or attached to the generated share card image

2.3 Automatically Collected Information

• Device information – device model, operating system platform and version, and app version, collected only when an error or crash occurs, and used strictly for diagnostics and troubleshooting
• No advertising identifiers are collected

2.4 Information We Do NOT Collect

We do not collect or access:

• Precise or approximate location
• Contacts or address book
• Photos, media, or files beyond product photos you choose to attach
• Health or biometric data
• Financial or payment information
• Browsing history
• Advertising IDs
• Analytics tracking beyond error logs

3. How We Use Your Information

We use your information to:

• Create, authenticate, and secure your account
• Provide expiry tracking, PAO monitoring, and allergen-checking features
• Look up product details when you scan a barcode (via third-party product databases)
• Validate product categories and estimate missing ingredient information using AI (no personal data is sent to AI services)
• Send account-related emails (verification codes, password resets, deletion confirmations)
• Send push notifications reminding you of products approaching their expiry date
• Record your product ratings and repurchase preferences for your own reference (Product Memory)
• Generate anonymised product knowledge for improving barcode lookup accuracy upon account deletion
• Diagnose and resolve technical issues

We do not sell, rent, or share your personal data for advertising or marketing purposes.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area, we process your data under the following legal bases:

• Contract – to provide the App and its core functionality
• Consent – for optional fields such as age, sex, and allergen preferences
• Legitimate interest – for error logs, security measures, and community safety declarations

5. Third-Party Service Providers

GlossGuardian relies on the following service providers:

• Supabase – secure database hosting, authentication, and file storage (data stored in US West – Oregon)
• OpenAI – used only to validate product categories, estimate missing ingredients, and check product similarity. No personal data (email, profile, allergens, or location) is ever sent to OpenAI. Only product names and brand names are used
• Open Beauty Facts, Open Products Facts, Open Food Facts, UPCitemdb, go-UPC – used to retrieve product details from barcodes. Only the barcode number is sent; no personal data is transmitted
• Resend – email delivery service for verification codes and account notifications
• Firebase Cloud Messaging (Google) – used to deliver push notifications (e.g. product expiry reminders) to your Android device
• Amazon – if you tap "Buy on Amazon," you are redirected to Amazon's website or app. We do not share your personal data with Amazon. Prices and availability are subject to change and are the sole responsibility of Amazon
• Cloudflare – used to host our legal pages (privacy policy and terms of service)

6. Amazon Affiliate Disclosure

GlossGuardian may participate in the Amazon Associates Program, an affiliate advertising program designed to provide a means for apps to earn advertising fees by linking to Amazon. When this feature is active, tapping "Buy on Amazon" may include an affiliate tracking parameter. This does not affect the price you pay on Amazon. When affiliate tracking is active, the disclosure "As an Amazon Associate I earn from qualifying purchases" will be displayed within the App.

7. Data Accuracy and Medical Disclaimer

Product ingredient and category data retrieved from third-party databases or estimated by AI may be incomplete or inaccurate. All allergen-checking features are informational only and are not a substitute for professional medical advice. Always read the physical product label and consult a healthcare professional before making decisions based on ingredient information.

8. Data Retention

We retain your data for as long as your account remains active. If you delete your account:

• All personal data (products, profile, allergens, notification history, and related records) is permanently deleted immediately
• Community donation declarations are retained in anonymised form for safety and accountability
• We retain a minimal deletion log (email + deletion date) for up to 90 days to verify authorised requests
• Anonymous product data (barcode, product name, category) may be retained in an anonymised product knowledge base to improve barcode lookup for all users

9. Data Security

We implement industry-standard security measures, including:

• Encryption in transit (HTTPS/TLS)
• Supabase-managed encryption at rest
• Secure password hashing (bcrypt)
• Row-level security (RLS) ensuring users can only access their own data
• Access controls and rate limiting
• API keys and secrets stored server-side only, never in the app binary

No method of transmission is 100% secure, but we take reasonable steps to protect your information.

10. International Data Transfers

Your data is stored in Supabase's US West (Oregon) region. By using the App, you consent to the transfer of your information to the United States.

11. Your Rights

Depending on your location, you may have the right to:

• Access your data
• Correct inaccurate data
• Delete your account and all associated data
• Withdraw consent for optional fields (age, sex, allergens)
• Export your data (via the PDF export feature within the App)

All rights can be exercised directly within the App or by contacting us at support@myglossguardian.com.

12. California Privacy Rights (CCPA)

If you are a California resident:

• We do not sell or share personal information
• You may request access or deletion of your data
• You may not be discriminated against for exercising your rights

13. Children's Privacy

GlossGuardian accounts must be created by individuals aged 13 or older. We do not knowingly collect personal information directly from children under 13.

Parents and guardians may use GlossGuardian to track beauty and personal care products for family members of any age, including children. In such cases, the account holder (parent or guardian) is responsible for the account and any profile information entered, including age fields used for allergen personalisation purposes.

If you believe a child under 13 has created an account independently, please contact us at support@myglossguardian.com and we will promptly delete the account.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated within the App. Continued use of the App after changes constitutes acceptance of the updated policy.

15. Contact Us

For privacy inquiries, data requests, or to exercise your rights, contact: support@myglossguardian.com