InciSmart ("the app", "we", "us") is a skincare ingredient analysis app operated by Ieva Jonaityte, an individual developer based in the United Kingdom. This policy explains what personal data we collect when you use InciSmart, how we use it, and the choices and rights you have. If you have any questions, contact us at support@incismart.co.uk.
1. Information we collect
We collect the following categories of information:
Account information — your email address, name, and authentication identifiers, provided by Google or Apple when you sign in. There is no separate username/password sign-up, and this is the only identifiable information processed outside your device (see section 5).
Skin profile — skin type, skin concerns, and ingredient preferences you enter during onboarding or in your profile. Provided by you and stored only on your device.
Activity in the app — product searches, saved products, favourites, and dupes you view. Generated by your use of the app and stored only on your device.
Product database contributions — products or ingredient lists you submit to the shared product database. Linked only to a random anonymised ID, never to your name or email.
Purchase information — subscription status and purchase history, provided by Google Play Billing. We never receive your card or payment details; payments are processed entirely by Google Play.
Device and usage data — device model, operating system version, app version, crash logs, and anonymised usage statistics, collected automatically via Firebase.
Photos. If you use the camera to scan a product or ingredient label, the image is processed on your device only. Photos are never uploaded to our servers or stored by us.
2. How we use your information
We use your data to: create and manage your account; analyse ingredient lists and show you product matches and dupes; personalise results based on your skin profile; remember your saved products; manage your subscription; diagnose crashes and improve the app's stability and features; respond to your support requests; and keep the service secure and prevent abuse.
We do not use your personal data for third-party advertising, and we do not sell your personal data to anyone.
3. Legal bases (UK and EU users)
Where the UK GDPR or EU GDPR applies, we process your data on the following bases: performance of a contract — providing the app's core features, your account, and your subscription; legitimate interests — crash reporting, aggregate analytics, and securing the service; and consent — where required, for example camera access, which you may withdraw at any time in your device settings.
4. Third-party services
The app is built on Google Firebase (Google LLC), which provides authentication, data storage, analytics, and crash reporting. Data handled by Firebase is processed in accordance with Google's Privacy Policy. If you sign in with Apple, Apple's privacy policy applies to that sign-in. Payments and subscriptions are handled by Google Play.
5. Where your data is stored
InciSmart is designed to keep your personal data on your device. Your skin profile, searches, saved products, and favourites are stored locally and are not uploaded to our servers.
Only the following leaves your device: authentication data (your Google or Apple sign-in, handled by Firebase Authentication); anonymised product database contributions, which carry a random ID that cannot be linked back to you; and crash logs and anonymised usage statistics (Firebase). This data is stored on Firebase (Google Cloud) infrastructure, which may be located outside the UK and the European Economic Area, including in the United States. Where data is transferred internationally, it is protected by appropriate safeguards such as the UK International Data Transfer Addendum and EU Standard Contractual Clauses, which Google provides for Firebase services.
6. Sharing your information
We share personal data only with the service providers described above (Google/Firebase, Google Play), and where we are legally required to do so — for example in response to a valid legal request. We never sell personal data or share it with advertisers or data brokers.
7. How long we keep your data
Your skin profile and activity data live on your device and remain there until you delete them in the app or uninstall the app. Your authentication data is kept for as long as your account exists. Anonymised product database contributions may be retained indefinitely as part of the shared database — they contain no information that identifies you. Crash logs and analytics data are retained by Firebase for limited periods defined by Google and are then deleted or anonymised.
8. Exporting and deleting your data
Export. You can export a copy of your data at any time using the export option in the app's settings.
Deletion. The app's settings include a "sign out and delete all data" option, which permanently removes your data from the device and your authentication data from our systems in one step. You can also request deletion by emailing support@incismart.co.uk from the email address linked to your account. Deletion is permanent and cannot be undone.
9. Your rights
Depending on where you live, you may have the right to: access a copy of the personal data we hold about you; correct inaccurate data; delete your data; restrict or object to certain processing; receive your data in a portable format; and withdraw consent where processing is based on consent. You can exercise the most common rights directly in the app: the settings include options to export your data and to sign out and delete all data. For anything else, email support@incismart.co.uk. If you are in the UK or EU, you also have the right to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).
10. Children
InciSmart is not intended for children under 13, and we do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, please contact us and we will delete the account and its data promptly.
11. Security
We take reasonable technical and organisational measures to protect your data, including encryption in transit, Firebase's encryption at rest, and access controls. No method of transmission or storage is completely secure, but we work to protect your information against unauthorised access, loss, or misuse.
12. A note on the app's content
InciSmart provides ingredient information and product comparisons for general informational purposes. It does not provide medical advice. Always consult a qualified professional about skin conditions, allergies, or reactions.
13. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you in the app or by email before the changes take effect. The effective date at the top of this page shows when the policy was last revised.
14. Contact
For any questions about this policy or your personal data, contact: support@incismart.co.uk
Copyright © 2026 InciSmart - All Rights Reserved.