Privacy Policy
Effective October 31, 2026
The short version
Steeped Skin is an iPhone app that analyzes a photo of your face and helps you follow a skincare routine. Here is what that means for your data:
- Your face photo goes to one company: Perfect Corp, which runs the skin analysis. It keeps the photo for up to 30 days. Claude, the AI that writes your report, never sees your photo.
- Your scores, skin type, report, routine and answers are saved to your Steeped account so you can track changes over time and use the app on a new phone.
- Your scan photo and its highlight images stay on your phone unless you turn on “Keep my scan photos.”
- We never sell your data, never show ads, and never share your results with advertisers.
- No one under 13 can use Steeped, and no one under 18 can take or upload a photo in the app.
- You can delete your account and its data at any time in the app: My Skin → Delete account.
Who we are
Steeped Skin (“Steeped,” “we,” “us”) makes the Steeped Skin iPhone app and the website steepedskin.com. We are based in the United States. This policy covers both.
For any question or request about your data, email [email protected].
The website collects one thing: the email address you give us to join the waitlist. We store it with our database host and use it only to tell you when Steeped is available. Email us and we will delete it. The website uses no cookies and no analytics. It is hosted by Cloudflare, and its fonts load from Google Fonts, so both receive your IP address when you visit. Emails you send us pass through Cloudflare’s email routing to our Google inbox.
What we collect
Most of this you enter yourself. Your scan results come from the skin analysis. Usage analytics, error reports and update checks are collected automatically by the app. Each item is listed below with where it is kept.
| What | Details | Where it is kept |
|---|---|---|
| Account | An account ID created when you first open the app. If you save your progress: your email address, or with Sign in with Apple, your Apple email (or Apple’s private relay address) and your first name. For Sign in with Apple we also keep a token from Apple, used only to end that sign-in when you delete your account. We never use passwords. | Our servers |
| About you | Your first name, gender, the skin concerns and skin type you choose, and your age range. We ask your age but keep only a range, such as 18–24, never your birthday or exact age. | Our servers |
| Your routine | Product names and brands, morning or evening, how often you use each, the ingredient lists you confirm, reminder times, the days you check off steps, and whether a product was prescribed. | Our servers. Reminders are scheduled on your phone. |
| Product labels | If you photograph a label or choose a label photo, your phone reads the text itself using Apple’s on-device text recognition. The photo is deleted right away and never uploaded. If you turned on “Let Claude review your routine,” only the ingredient part of the text is sent to Claude to be tidied. | Your phone |
| Your skin, in your own words (18+, optional) | What you write about your skin, and the concerns you confirm from it. | Our servers |
| Plan answers | How long you have used a product, whether it is working, any reaction, whether it was prescribed, anything you type under “Other,” and your answers when you update your plan. If you tell us you are pregnant, breastfeeding or trying, the app sends that answer to our server only while it builds your plan. It is not saved there and is never sent to Claude. | Our servers, except “Other” answers and the pregnancy answer, which are saved only on your phone |
| Your plan | The personalized plan the app writes for you. | Our servers and your phone |
| Skin scans (18+) | See Face photos and skin scans below. | See below |
| Consent choices | Each privacy switch you turn on or off, with the date and the version of the wording you saw. | Our servers |
| Usage analytics | Which features you use, such as “routine saved” or “scan completed,” with your account ID, app version, device model, iOS version, language and time zone. Never your photos, skin results, product names, name or email. Analytics start only after the age question. | PostHog |
| Error and crash reports | When something breaks: the type of error, where in the app it happened, your device model, iOS and app version, language, time zone and account ID. Error messages from the app are stripped of emails, links and IDs before they leave your phone. Crash reports from the iPhone’s own system code are sent as they are, and can contain file locations or internal IDs. | PostHog |
| App updates | When the app checks for updates, it sends its version and platform, a random ID for your install, and your IP address. | Expo |
We do not collect your precise location, your contacts, your advertising ID, or anything that tracks you across other apps and websites. We have set our analytics provider not to store your IP address or a location derived from it. Reminders are local notifications on your phone, so we do not collect a push notification token.
Face photos and skin scans
Only adults (18+) can scan, and only after turning on “Analyze my scan.” The scan camera never opens without it.
What happens to your photo
- You take the photo in the app. Your phone crops it to your face. If the crop would be too small, it sends the whole photo instead.
- Your phone sends the photo directly to Perfect Corp’s YouCam skin-analysis service.
- Perfect Corp returns scores for 11 skin concerns, your skin type, an estimated skin age, an overall score, and highlight images showing where each concern appears.
- Claude, an AI model made by Anthropic, turns your scores into a written report. Claude receives only the scores and their labels, never your photo or your account ID.
Where each piece is kept
- Perfect Corp keeps your photo and results for up to 30 days, on servers in the United States, and then deletes them. Its terms say it will not use them to develop or improve its services unless we agree, and we have not. When you delete your account, we ask Perfect Corp to delete your finished scans right away. Anything else is deleted on its 30-day schedule.
- Our servers keep Perfect Corp’s full analysis result (scores, skin types, estimated skin age and overall score, without any image links) and your written report. We also keep details of how each photo was taken: the exact time, time zone, device model, iOS and app version, photo size and framing, camera settings, and whether the ring light was on. We store the estimated skin age and overall score but do not show them to you.
- Your phone keeps a resized copy of your photo and its highlight images.
- Our private storage keeps a copy of your photo and highlight images only if you turn on “Keep my scan photos.” Only your account can view them.
Biometric information
Some laws treat face photos, or measurements taken from them, as biometric information. Steeped does not use your photo to recognize or identify you. We never sell, lease or trade your photo or anything measured from it, and never use them for advertising or marketing.
We share your photo only with Perfect Corp. The scores measured from it go to Anthropic to write your report and plan, and are stored by Supabase, our database host. We share them with no one else unless the law requires it.
Our retention schedule: Perfect Corp deletes your photo and results within 30 days. We keep your scan results until you delete your account, and then delete them.
How we use your information
We use your information to run Steeped for you, and for nothing you have not agreed to.
- To provide the app: analyze your scans, write your report and plan, check your products’ ingredients, send your reminders, and track your skin and routine over time.
- To keep your account: save your progress so you can sign in on a new phone.
- To keep the app working: find and fix errors and crashes.
- To improve the app: see which features people use, from usage analytics that never include your photos or skin results.
- To answer you: reply when you contact us.
- To stay safe and legal: prevent abuse and meet legal obligations.
- Optional uses you can switch on: improving our skin analysis with your scans, counting your results in overall statistics, and featuring your before-and-after results. We record these choices but do not use them for anything yet. We will update this policy before we do, and will use only data from people who turned that switch on.
We do not use your information for advertising, sell it, or build marketing profiles from it.
Who we share it with
We share your information only with the companies that run parts of Steeped for us. Each may use it only to provide its service to us, and must protect it at least as well as this policy does.
| Company | What it receives | Why |
|---|---|---|
| Supabase | Everything saved to your account, and waitlist emails | Hosts our database, sign-in and private file storage. It also keeps system logs and backups. |
| Perfect Corp (YouCam) | Your face photo | Runs the skin analysis. Keeps the photo and results up to 30 days. |
| Anthropic (Claude) | Your scan scores and labels. If you turn on “Let Claude review your routine”: your products, ingredient lists, plan answers including “Other” text, check-in answers, how consistently you checked off steps, your chosen concerns and skin type, and what you write about your skin. Product names, which Claude may look up on a set list of trusted websites to find ingredient lists. | Writes your report and plan, tidies ingredient lists, and finds product information. Never receives your photo, name, email, account ID or pregnancy answer. Anthropic does not train its models on this data and generally deletes it within 30 days, unless it must keep it longer for safety or legal reasons. |
| PostHog | Usage analytics and error and crash reports, with your account ID | Shows us which features are used and alerts us when something breaks |
| Slack | Technical error descriptions and app build status | Sends alerts to our team. Never your name, email, photos or skin results. |
| Apple | Your Sign in with Apple details. For beta testers, the feedback and crash reports you choose to send through TestFlight. | Sign-in and beta testing |
| Expo | App update checks | Delivers app updates |
| Our email provider | Your email address | Sends your sign-in codes and links |
| Cloudflare | Your IP address, when you visit steepedskin.com, and emails you send us | Hosts the website and forwards our email |
| Your IP address, when you visit steepedskin.com, and emails you send us | Loads the website’s fonts and hosts our inbox |
We may also share information if the law requires it, or to protect someone’s safety. If Steeped is ever merged or sold, your information may move to the new owner, who must keep following this policy. We will tell you before that happens.
We do not sell your information, and we do not share it for advertising.
Your choices
You control each use of your data with a separate switch in My Skin → Data & consent. Optional switches stay off unless you turn them on.
| Switch | What it allows |
|---|---|
| Analyze my scan | Needed to scan. Sending your face photo to Perfect Corp and saving your results, as described above. |
| Keep my scan photos | Saving a copy of your scan photo and highlight images to our private storage |
| Let Claude review your routine | Needed for your plan, ingredient checks and product lookups. Sending your routine and answers to Claude, as listed above. |
| Help improve the analysis | Using your scans to make our skin analysis more accurate |
| Count me in overall stats | Combining your results with other people’s, with your identity removed, for statistics like “most common concerns” |
| Feature my results | Using your before-and-after results in Steeped content, such as our website or social posts |
We record the last three choices but do not use them for anything yet. We will update this policy before we do.
Turning a switch off stops future use. It does not erase what is already stored. To erase it, delete your account, or email us and we will delete it.
Usage analytics and error reports cannot be turned off in the app. Email us and we will delete yours. You can turn off reminders in the app or in iOS Settings.
Teens and children
Steeped is not for children under 13. The app asks your age before setting anything up. If you are under 13, it stops. We delete the temporary account created when the app opened, and record once that the age check stopped a device, under a random analytics ID, never an account. If we learn we hold information from a child under 13, we delete it. Parents can contact us at [email protected].
Teens aged 13 to 17 never take or upload photos. That means no face scans, no label photos, and no camera at all. Teens also never see the field for describing their skin in their own words or the pregnancy question. Teens can track a routine, get reminders, and choose two optional switches: “Count me in overall stats” and “Let Claude review your routine.”
How long we keep it, and deleting your account
We keep your information until you delete your account.
To delete your account: in the app, go to My Skin → Delete account. Deleting your account:
- Removes your account, survey answers, routine, check-offs, scan results, reports, plans, the words you wrote about your skin, your consent records and any stored scan photos from our servers
- Ends Sign in with Apple for Steeped
- Asks Perfect Corp to delete your finished scans right away. Anything else is deleted on its 30-day schedule.
- Deletes your usage analytics and error reports from PostHog. PostHog may take some time to finish.
- Clears your data from the phone
What stays after deletion:
- Ingredient lists and official product names you confirmed, and product names you typed, may stay in our shared product catalog so other people do not have to scan the same product. They are never linked to you.
- Copies held by Anthropic and Perfect Corp follow their own deletion windows, of up to 30 days.
- Our database host’s system logs and backups expire on their own schedule.
Deleting the app is not deleting your account. If you saved your progress with email or Apple, sign in again to get it back. If you never saved your progress, delete your account in the app before you remove it. Without an email or Apple sign-in, we cannot find your data to delete it later.
If you email us a request, we will act on it within 30 days.
Security
Your data is encrypted when it travels between your phone and our servers. Each account can read only its own data, and stored scan photos sit in private storage that only your account can open. Your sign-in is kept in your iPhone’s secure Keychain, and Steeped has no passwords to steal. No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.
Your rights
Wherever you live, you can ask us to:
- Give you a copy of your information
- Correct it
- Delete it
- Stop any optional use of it
Email [email protected] from the address on your account, or tell us how you signed in, so we can confirm the data is yours. We will respond within 30 days and will never treat you differently for asking. Some US states give you more rights than this; we honor them too.
Where your data is processed, and changes to this policy
Steeped is made for people in the United States. Your information is processed in the United States and wherever our providers operate.
If we change this policy, we will update the date at the top. If a change affects how we use information you already gave us, we will tell you in the app before it takes effect.
Questions: [email protected].