Privacy Policy

---

For any questions about this privacy policy or the personal data we collect, please contact: support@incismart.co.uk

InciSmart is operated by Ieva Jonaityte, an individual developer based in the United Kingdom, who is the data controller for the personal data described here.

1. Information we collect

Account information — your email address, name, and authentication identifiers provided by Google or Apple when you sign in. Signing in is required to use the app; there is no separate username/password sign-up. Sign in with Google is available on Android and iOS; Sign in with Apple is available on iOS. If you use Sign in with Apple, you may choose to hide your email address, in which case Apple provides us with a private relay address instead of your real one, and we will only ever see that relay address.

Skin profile — the skin concerns, ingredients to avoid, and brands to avoid that you choose during onboarding or in your profile. This information is stored on your device. Your skin concerns and ingredients to avoid are shared with our AI provider only when you use AI analysis (see "AI analysis" below). Your brands to avoid never leave your device.

Activity in the app — your scan and search history, the products on your shelf, your morning and evening routines, and the dupes you view. This data is stored only on your device.

Purchase information — subscription status and purchase history provided by the app store you purchased through: Apple's App Store on iOS, or Google Play Billing on Android. We never receive your card or payment details; all payments are processed entirely by Apple or Google. To confirm your subscription, the app sends the store's purchase receipt to our server, which checks it with Apple or Google and records your subscription status against your account ID. We keep only a one-way fingerprint of the receipt, not the receipt itself.

Usage statistics — which screens you open, when a session starts, and the outcome of each scan (for example, whether it succeeded, how it matched, how many ingredients were read and how confident the text recognition was), together with the app version, platform (Android or iOS) and whether you use the free or premium tier. These statistics are linked to a random identifier created on your device — not to your account, name or email — and never include photos, the text read from a label, or product names. On Android, the app also records the names of ingredients it could not recognise, with no identifier attached, so we can improve ingredient recognition. We use these statistics only to understand, in aggregate, how the app is used.

Crash reports — on Android, if the app crashes or hits an error, a crash report (device model, operating system version, app version and technical details of the error) is sent to Firebase Crashlytics. We may also receive aggregated, anonymised statistics from the Apple App Store and Google Play about downloads, crashes, and app performance. These reports do not identify individual users.

Feedback — if you send feedback or ask us to add a missing product, we receive your message and its category, together with the app version, platform, operating system version, your tier and whether you are signed in. Feedback is not linked to your account. Before your message is stored, email addresses and phone numbers in it are automatically removed. Please don't include your name or other personal details.

Photos — if you use the camera to scan a product or ingredient label, the image is processed on your device only to read its text and barcode. We do not upload or store photos on our servers.

Product lookups — to identify a product you scan, the app may look up its barcode, or a fingerprint of its ingredient list, in our product database. These lookups contain no personal information and are not stored.

AI analysis — when you choose Analyse + AI, the following is sent to Anthropic, PBC to generate the analysis:

• for an ingredient: the ingredient's name, function and safety information;
• for a product: the product's name and ingredient list;
• for your shelf or routine: the name, brand, category and ingredient list of each product, and the order of your morning and evening routines;
  

in each case together with your skin concerns and the ingredients you avoid. It is sent through our server without your name, email or account ID. Anthropic does not use it to train its models and deletes it within 30 days, unless it must be kept longer to enforce Anthropic's usage policies or comply with the law.

We do not collect your location, contacts, advertising identifier, or browsing history.

2. How we use your information

We use your personal data to create and manage your account, analyse ingredient lists to show you product matches and dupes, personalise results based on your skin profile, remember your shelf and routines, manage your subscription and apply free-tier limits, diagnose crashes, improve the app's stability and features, respond to your feedback and support requests, and protect the app against abuse.

We do not use your personal data for third-party advertising, nor do we sell your personal data to anyone. We do not track you across other companies' apps or websites.

3. Legal bases for processing (UK and EU users)

If you are in the UK or the EU, we process your personal data on the following lawful bases under the UK GDPR and EU GDPR:

Performance of a contract — to create and operate your account, provide the app's core features (including AI analysis when you ask for it), and manage your subscription. Without this data we cannot provide the service you have asked for.

Legitimate interests — to diagnose crashes, maintain and improve the app's stability and features, understand in aggregate how the app is used, handle your feedback, and protect the app and our users against abuse and security threats. We have considered your rights and interests and believe this processing is limited in scope and low-risk, as it relies on minimal data that is not linked to your account. You can object to it at any time (see section 9).

Consent — where you choose to give it, for example when you grant camera access to scan a label. You may withdraw consent at any time in your device settings, without affecting processing carried out before withdrawal.

Legal obligation — where we must retain or disclose information to comply with the law, such as responding to a valid legal request or meeting tax and accounting requirements in relation to purchases.

4. Third-party services

The app is built on Google Firebase (Google LLC), which provides authentication, data storage, server functions, crash reporting (Firebase Crashlytics, on Android) and app integrity checks (Firebase App Check). Data handled by Firebase is processed in accordance with Google's Privacy Policy. To confirm that requests come from the genuine app, App Check uses Google Play Integrity on Android and Apple DeviceCheck on iOS; Google and Apple process that check under their own privacy policies.

AI analysis is provided by Anthropic, PBC, which processes the request on our behalf under its commercial terms.

Text and barcode recognition run on your device using Google ML Kit on Android and Apple's Vision framework on iOS.

If you sign in with Apple, Apple's privacy policy applies to that sign-in, including the Private Relay email service where you choose to hide your address. If you sign in with Google, Google's privacy policy applies to that sign-in.

Payments and subscriptions are facilitated by Apple (App Store and StoreKit) on iOS and by Google Play Billing on Android. Apple and Google act as the merchant of record for those purchases and process your payment details under their own privacy policies. We receive only your subscription status and purchase history, never your payment details. On Android, Google Play may also tell the app when an update is available.

Some product pages link to Amazon. These are affiliate links: if you buy through one, we may earn a commission at no extra cost to you. The link opens outside the app, and Amazon's privacy policy applies from then on. We do not send Amazon any information about you.

5. Where your data is stored

InciSmart is designed to keep your personal data on your device. Your skin profile, scan and search history, shelf and routines are stored locally and are not uploaded to our servers. On Android, the app's database and settings are encrypted on your device; on iOS, they are protected by the operating system's data protection, which encrypts them with your device passcode.

The following data leaves your device:

• authentication data (your Google or Apple sign-in, handled by Firebase Authentication);
• your subscription status, and weekly usage counters used to apply free-tier limits and prevent abuse, both linked to your account ID (Firebase);
• usage statistics linked to a random identifier, and the names of unrecognised ingredients (Firebase);
• crash reports on Android (Firebase Crashlytics);
• feedback you choose to send (Firebase);
• when you use AI analysis, the request described in section 1 (Anthropic).
  

Apart from AI analysis requests, this data is stored on Firebase (Google Cloud) infrastructure, which may be located outside the UK and the European Economic Area, including in the United States. When data is transferred internationally, it is protected by appropriate safeguards such as the UK International Data Transfer Addendum and EU Standard Contractual Clauses provided by Google for Firebase services, and the equivalent safeguards in Anthropic's commercial terms.

Purchase and subscription data is processed by Apple or Google on their own infrastructure under their respective privacy policies and transfer safeguards.

6. Sharing your information

We share personal data only with the service providers described above (Google/Firebase, Apple, Google Play, Anthropic) and where legally required — for example, in response to a valid legal request. We never sell personal data or share it with advertisers or data brokers.

7. How long we keep your data

• On your device — your skin profile, history, shelf and routines remain until you delete them in the app, delete your account, or uninstall the app.
• Account and subscription data — your authentication data, subscription status and usage counters are kept for as long as your account exists, and are deleted when you delete your account.
• Usage statistics — kept for as long as they are useful for understanding how the app is used. They are not linked to your account; see section 8 if you would like yours deleted.
• Feedback — automatically deleted 180 days after it is sent.
• Crash reports — held by Firebase Crashlytics for limited periods defined by Google before being deleted.
• AI analysis requests — not stored by us; deleted by Anthropic as described in section 1.
• Purchase records — held by Apple or Google under their own policies and applicable tax law.
• Earlier product contributions — earlier versions of the app could add scanned products to our shared product database. The app no longer does this. Products added that way may be kept as part of the database; they were linked only to a random identifier and contain no name, email or account ID.
  

8. Exporting and deleting your data

Export — You can export a copy of your data at any time using Export my data (Profile → About the App). The export includes your skin profile, settings, scan history, shelf and routines, saved analyses, and the random identifier your usage statistics are linked to.

Deletion — Delete account and all data (Profile → About the App) permanently deletes your account, all of your data on the device, and the subscription status and usage counters linked to your account on our servers, in one step. You can also request deletion by emailing support@incismart.co.uk from the email address linked to your account. Deletion is permanent and cannot be undone.

Usage statistics and feedback are not linked to your account, so deleting your account does not remove them; feedback is deleted automatically after 180 days. If you would like your usage statistics deleted, export your data first and email us the identifier it contains at support@incismart.co.uk.

Deleting your account does not automatically cancel an active subscription. To stop future charges you must also cancel the subscription in your Apple ID or Google account settings.

9. Your rights

Depending on your location, you may have the right to access a copy of the personal data we hold about you, correct inaccurate data, delete your data, restrict or object to certain processing, receive your data in a portable format, and withdraw consent where processing is based on consent. You can exercise the most common rights directly in the app, using Export my data and Delete account and all data (Profile → About the App), and you can edit your skin profile at any time in your profile. For other requests, please email support@incismart.co.uk. We will respond within one month. If you are in the UK or EU, you also have the right to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).

10. Children

We comply with legal requirements regarding children's privacy and do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, please contact us at support@incismart.co.uk, and we will delete the account and its data promptly.

11. Security

We implement reasonable technical and organisational measures to protect your data, including encryption in transit, encryption of the app's data on your device, Firebase's encryption at rest, app integrity checks on requests to our servers, and access controls. No method of transmission or storage is completely secure, but we strive to enhance our data security practices to guard against unauthorised access, loss, or misuse.

12. A note on the app's content

InciSmart provides ingredient information and product comparisons for general informational purposes. This app does not provide medical advice, so always consult a qualified professional regarding skin conditions, allergies, or reactions.

13. Changes to this policy

We may update this policy periodically. If we make material changes, we will notify you in the app or by email before changes take effect. The effective date at the top of this page indicates when this policy was last revised.

14. Contact

For any questions about this privacy policy or your personal data, please contact: support@incismart.co.uk