SkinFormula

Privacy policy

Effective 27 September 2026

What stays on your phone

• Your answers: name, age, gender, skin type, sun type, climate, face and body concerns, goals, sensitivity, pregnancy and breastfeeding, products in use, budget, and the safety answers you add (medicines, conditions, allergies, cycle dates, weight entries).
• Your scans, scan photos, self-assessment answers and weekly check-in answers.
• Your routine ticks, appointments and clinic notes, shelf products with their expiry dates, supplements you take, blood test values, saved articles and chat history.
• Reminder settings. Reminders are scheduled locally on the phone.
• Period dates read from Apple Health, if you connect it (see below).

All of this lives in the app's own storage on your device. Deleting the app deletes it; Profile → Settings → Erase everything does the same.

Backups you make yourself. Save a backup puts everything listed above into one file: your answers, health information (including your period dates, also those read from Apple Health), photos, chat history and blood test values. The app does not upload it anywhere; the file is saved where you choose in the share sheet, for example iCloud Drive, the Files app or AirDrop to a new phone, and from then on it is kept under that place's own terms. The app deletes its temporary copy once the share sheet closes. Anyone with the file can read what is in it, so keep it somewhere private.

What the app sends, and to whom

Always (free and Pro)

• Weather. If you allow location, your position is rounded to about one kilometre and only those coordinates are sent to Open-Meteo (open-meteo.com) for the UV index, temperature and humidity. The app does not store your position.
• Ingredient lookup. A product photo is read on your phone. To find the ingredient list, the app sends only the product name it read to Open Beauty Facts (openbeautyfacts.org), a public database. The photo is not sent.
• Calendar and Reminders. Appointments you choose to add are written into Apple's Calendar or Reminders on your phone.
• Report for a doctor. The PDF is built on your phone and goes only where you send it from the share sheet.

Pro AI features, only with your permission

These features are optional. They run through a small server operated for SkinFormula on Cloudflare Workers, which passes the request to Anthropic (Anthropic PBC, the maker of the Claude AI models) and returns the answer. Anthropic is the AI provider that processes the request; nothing is sent to any other AI company.

Your permission, per feature. Each AI feature asks before its first use, on a screen that names our server and Anthropic and says what will be sent. Nothing is sent until you tap yes; the default is off. You give or refuse permission separately for skin analysis (a photo of your face), the assistant (your chat messages and profile summary) and product recognition (a photo of a pack).

Switching it off. Profile → AI features shows each feature's permission with a switch. Turning a switch off withdraws your permission at once: the app then refuses to send anything for that feature until you turn it on again. Switch all AI off withdraws all three.

• Personal skin assistant. Your question, the last few messages of that conversation, and a short summary of your profile so the answer fits you: age, sun type, face and body concerns, pregnancy or breastfeeding, medicines, conditions, and whether your skin is sensitive. Never your name or email. The app shows this summary before you agree to use the assistant.
• Skin analysis. One front photo from your scan, resized, together with your sun type and language. Only after you agree on the consent screen, and only when you tap Analyse my photo.
• Product recognition. A photo of the product pack, or the product name you type when the app searches the web for its ingredient list. When the ingredient list is found, the product's name and its ingredient list are kept on the server for 90 days so the next person who scans the same product gets it at once. This cache contains products, never people.
• Usage limit. Each request carries a random code created on your phone, not linked to you, so the server can count daily use and stop abuse. The server also counts requests per network, under a one-way code made from your IP address that changes every day; the address itself is not stored. Both counts are deleted after about two days.

Reading a blood test from a photo, the skin scan itself and the Sunday check-in work on your phone and use no AI server.

Our server stores nothing else: no photos, no messages, no profile summaries. Anthropic processes these requests as our service provider under its commercial terms: it does not use them to train its AI models, and it deletes them within 30 days, unless a request is flagged for a usage-policy violation (then it may be kept up to two years) or the law requires keeping it longer (see anthropic.com/legal/privacy). Cloudflare hosts the server (cloudflare.com/privacypolicy). Both may process data outside your country, including in the United States, under the safeguards in their data processing terms.

You choose whether to use these features. Erase everything also resets your AI permissions and the random code.

Subscriptions

SkinFormula Pro is bought through Apple. Apple handles payment and your Apple ID; the app only learns from Apple whether a Pro subscription is active on this device. We never see your name, email or card.

The app uses no analytics, advertising identifiers, crash-reporting services or tracking.

Camera and photos

The camera is used for skin scans and to read product labels and blood test results. Images are analysed on the device. The app keeps scan photos in its own folder for your progress timeline. A photo leaves the phone only for the Pro features above, or in a report you share yourself.

Apple Health

If you choose Read from Apple Health under Cycle awareness, the app asks Apple for read-only access to one data type: menstrual flow (your period dates). It uses them only to show which phase of your cycle you are in and how that affects your skin. The app never writes to Apple Health and reads nothing else.

Data from Apple Health stays on your phone. It is never sent to our server, to Anthropic or to anyone else, never included in the AI assistant's profile summary, and never used for advertising, marketing or data mining. The only exception is a backup file you make yourself (see above), which includes your period dates and is saved only where you choose. You can turn access off at any time in the Health app under Sharing → Apps → SkinFormula.

Health information

Skin observations, pregnancy status, medicines, conditions, cycle dates, weight, supplements and blood test values are health information. They are stored on your phone and used to build your plan and safety notes. They leave the phone only as part of the Pro assistant's profile summary (and any test results you shared in that chat), when you use the assistant and have agreed. Apple Health data is never part of it. SkinFormula is not a medical device and does not diagnose.

Legal basis and your rights

Data sent for the Pro features is processed to provide the feature you asked for, and health information only with your explicit consent (GDPR Art. 6(1)(b) and 9(2)(a); Swiss Federal Act on Data Protection). You can withdraw consent at any time in Profile → AI features, and erase your data in the app. Because we hold no data that identifies you, there is usually nothing for us to access or delete; if you have a question or request, write to us and we will help. You may also complain to your data protection authority.

Children

SkinFormula is intended for people aged 16 and over.

Who is responsible

The controller for any data processed by SkinFormula is:
Loaded AG
Klostergutstrasse 4
8252 Schlatt TG
Switzerland
UID CHE-413.943.367

Contact

hello@skinformula.app

Changes

If a future version sends any further data anywhere, this page and the app will say so before that version is released.