Privacy Policy

The short version

Your face photo is analyzed in memory and permanently deleted the moment scoring finishes. We never write it to disk, object storage, backups, or logs. We do not build, train, or contribute to any face-recognition database, and we cannot identify you from the data we keep.

Photo handling, retention, and destruction schedule

When you upload a selfie for analysis: (1) the image is received into server memory only; (2) it is resized and stripped of all metadata (including GPS/EXIF); (3) it is sent to an AI vision provider for scoring with your explicit consent; (4) it is destroyed from memory when the request completes - within seconds, and in all cases within minutes of upload. This is our complete biometric data retention and destruction schedule: retention period zero beyond the live analysis request, destruction automatic and unconditional.

What we keep: numeric scores (e.g. "skin: 62.5"), short improvement notes, and which AI model produced them. None of this can recreate your photo or identify your face.

We also keep a one-way cryptographic checksum (SHA-256) of the processed image file alongside its scores. The checksum is not the image, cannot reconstruct the image, and is not derived from facial geometry or any biometric feature - it is a fingerprint of the file's bytes, used solely so that re-uploading the exact same photo returns the exact same scores without re-running AI analysis. It is deleted with your scores when you delete your account or data.

Photo analysis is not available in Illinois at this time.

What we collect

Quiz answers (lifestyle habits you self-report), derived appearance scores, account email if you create an account, payment status via our payment processors (we never see card numbers), and standard analytics events. We collect coarse region (country/state) at upload time solely to enforce regional availability.

AI providers

Photos are scored by a third-party AI vision API (currently Anthropic's Claude, with Google's Gemini as an automatic fallback; the configured providers may change). Your image is transmitted only for the analysis you requested, under the provider's enterprise API terms, and is not used to train their models per their API data policies.

Other processors

Besides the AI providers above we rely on: Supabase, which hosts the database your account, scores and plan live in; Stripe for payments on the web (Stripe receives your billing details directly - we never see card numbers, only whether a payment succeeded); RevenueCat to process purchases made in our iOS app; Resend to deliver account and drip emails, which means it processes your email address; Upstash for rate limiting and caching; Vercel for hosting, which processes requests to the site; Google Analytics and DataFast for traffic analytics; PostHog for product analytics on the site and in our iOS app, which processes which pages and features are used and, once you sign in, your account id - never your photos, email or name (on the site it follows your cookie choice; in the app you can turn it off in Settings, and it starts off in the EU/EEA, the UK and Switzerland); Intercom for the in-app support chat, which processes your account id, email, name and anything you write in a conversation (please don't send photos there); and Sentry for error monitoring, which processes technical details of errors (we configure it not to capture request contents or photos). Each operates under its own privacy policy.

Cookies

The website uses a few cookies it needs to work: keeping you signed in, saving your quiz progress, remembering your language, holding a referral code if you arrived through one, running the support chat on signed-in pages, and remembering your cookie choice. These can't be switched off.

Analytics cookies from Google Analytics, DataFast and PostHog help us understand how visitors find and use the site. If you're in the EU/EEA, the UK or Switzerland, they stay off until you accept them in the cookie banner. Everywhere else they're on by default. Anyone can change their choice at any time with "Cookie settings" in the site footer or on your account's Settings page, and declining removes the analytics cookies already set.

Consent and withdrawal

Photo analysis only happens after you explicitly consent on the photo screen - it is never bundled into account creation or general terms. Age confirmation (18+) and consent to the analysis are two separate, unbundled checkboxes, neither pre-ticked, and both are re-confirmed on every scan.

You can withdraw your consent at any time from Settings ("Withdraw biometric consent"), without deleting your account. Withdrawal clears your consent on record and blocks any future scan until you grant it again; your existing scores, plan and account are left untouched. Because the photo itself was already destroyed at the end of the analysis request, there is no stored biometric identifier left for withdrawal to erase - it governs future processing.

Separately, you can delete your scores and account entirely, at any time, from Settings or by emailing hello@glowster.app. Deletion is permanent and also removes the file checksum described above.

Your rights

You may request access to, correction of, or deletion of your data at any time (GDPR/CCPA). Email hello@glowster.app. Account deletion removes all assessments, scores, plans, and progress data within 30 days.

Not medical advice

Glowster provides self-improvement and grooming guidance only. It is not medical, dermatological, or psychological advice, and scores are subjective aesthetic assessments by an AI model, not clinical measurements.