Privacy Policy
Effective date: July 27, 2026
1. Purpose
This Privacy Policy is incorporated by reference into the LunaGlow Terms of Use. "LunaGlow," "we," "us," and "our" refer to the makers of the LunaGlow app. This Privacy Policy explains our online information practices, the types of information we may collect, how we use, store, protect, disclose, and share that information, and how you can opt out of a use or correct or change it.
2. Scope
This Privacy Policy applies to Personal Information processed by LunaGlow in the course of operating the LunaGlow app and any related websites, support channels, or future offerings (together, the "Services"). By installing, using, or otherwise accessing the Services, you agree to this Privacy Policy and the LunaGlow Terms of Use, and you give explicit and informed consent to the processing of your Personal Information as described here. Please do not install or use the Services if you do not agree. LunaGlow reserves the right to update this Privacy Policy, and continued use of the Services means you accept the changes.
3. Information We Collect
We collect information you provide directly (e.g. your name, skin type, skin concerns, product preferences, and other onboarding answers), information generated by using the app (e.g. scan history, glow-score progress, chat messages with "Ask Luna"), and automated data such as device identifiers, app usage, and crash/analytics logs collected through Firebase and similar service providers.
3.1 Advertising Identifiers (IDFA)
On iOS, we may request access to the Identifier for Advertisers (IDFA) via Apple's App Tracking Transparency framework. You can allow or deny this at any time in Settings > Privacy & Security > Tracking. Declining does not limit access to any app feature.
3.1.1 Advertising Measurement (Meta)
To measure how well our ads perform, the app includes the Meta (Facebook) SDK and we share limited app-activity data with Meta Platforms, Inc. This data consists of: app installs and app opens; in-app milestones such as completing onboarding, viewing our subscription screen, or starting a purchase; subscription purchase events (forwarded server-side by our subscription infrastructure provider, RevenueCat); and device identifiers — the IDFA only if you allow tracking via the App Tracking Transparency prompt, and otherwise an anonymous SDK-generated identifier. Meta uses this data solely for advertising attribution and measurement (for example, telling us which ad campaign led to an install or subscription). Your selfies, product photos, skin profile, AI results, and "Ask Luna" chat messages are never shared with Meta or any other advertiser.
3.2 Selfie and Skin/Product Photos (Face Data)
LunaGlow lets you upload selfies and photos of skincare products so our AI can assess skin concerns, verify that a product photo actually shows a cream/product, track your skincare progress over time, and generate personalized recommendations. Sections 3.2.1 through 3.2.5 explain whether face data is retained, exactly what we collect, which third parties receive it and why, whether those third parties store it and for how long and why, and how long we keep your photos.
3.2.1 Face Data Is Not Retained
LunaGlow does not collect, store, or retain face data. We do not perform facial recognition, and we do not extract, generate, or store biometric identifiers, facial geometry, facial-landmark maps, or face templates — not on your device and not on our servers. Your photos are never used to identify or authenticate you or anyone else. The only face-related content we handle is the ordinary selfie photograph you choose to upload, which is processed as a photo and is never converted into face data.
3.2.2 What We Collect and How We Use It
We collect photos of your face ("selfies") and photos of skincare products you scan, in each case only when you choose to take or upload them. Your selfie is used solely to analyze visible skin characteristics (such as texture, redness, and hydration cues) and to generate your skin score, insights, and product recommendations. Product photos are used solely to identify and evaluate the skincare product shown.
3.2.3 Third Parties We Share Photos With, and Why
We share your selfies and product photos only with the following third parties, and only for the following reasons: (1) xAI (Grok multimodal models) — to perform the AI analysis of your photo; (2) OpenAI (GPT multimodal models) — to perform the AI analysis of your photo; (3) Anthropic (Claude multimodal models) — to perform the AI analysis of your photo; and (4) Google Firebase (Google Cloud) — our cloud hosting provider, to store your photos under your account so the app can show your scan history and skincare progress. We do not sell your photos, and we do not share them with advertisers, data brokers, or any other third party. If we change AI providers, we will update this Policy before doing so.
3.2.4 Whether These Third Parties Store Your Photos, for How Long, and Why
Yes — each third party stores your photo for a defined period and a single, stated reason: xAI stores each API request and response (including your photo) on its servers for 30 days, solely so it can audit for potential abuse or misuse of its API; after 30 days that copy is automatically and permanently deleted. OpenAI stores API inputs and outputs (including your photo) for up to 30 days, solely to monitor for abuse or misuse of its API; after that period the data is automatically and permanently deleted. Anthropic stores API inputs and outputs (including your photo) for up to 30 days, solely for trust-and-safety monitoring of its API; after that period the data is automatically and permanently deleted. Each provider stores the data for this length of time because it is the window the provider requires to detect and investigate potential abuse of its API; the photos are stored for no other purpose and no longer than that, and none of these providers uses your photos to train its models. Google Firebase stores your photos for as long as your account exists, because it is the cloud storage layer where your account content lives; those photos are permanently deleted when you delete your account.
3.2.5 How Long We Keep Your Photos
Your selfies and product photos are kept in our Firebase Storage for as long as your account remains active. We keep them for this length of time because the app's progress-tracking feature compares your earlier and current photos (before/after comparisons). All photos are permanently deleted when you delete your account (Profile > Settings), or sooner if you request deletion by contacting us.
3.3 AI-Generated Recommendations
Skin assessments, product scores, and chat responses from "Ask Luna" are generated by AI models and are provided for general skincare informational purposes only. They are not medical advice, and LunaGlow is not a substitute for consultation with a dermatologist or other qualified healthcare provider. If you have a skin condition, allergy, or medical concern, please consult a professional.
3.4 Other Personal Data Sent to Our AI Processors
In addition to photos (Section 3.2), the following personal data is sent to our third-party AI processors — xAI, OpenAI, and Anthropic — when you use AI features, solely to generate your personalized results: your first name, age, ethnic background, skin type, skin concerns, and product preferences (collected directly from you during onboarding and in your profile settings; used so that skin insights, product scores, and recommendations match your individual skin profile), and your "Ask Luna" chat messages together with relevant account content such as your scan history and routine data (collected from your chat input and app activity; used so Luna can answer your questions in context). This data is sent only after you give explicit consent on the consent screen shown at first launch, and never before. The same third-party storage terms described in Section 3.2.4 apply to this data: each AI processor stores it for a maximum of 30 days solely for abuse monitoring, then permanently deletes it, and never uses it to train models. Each of these processors is contractually bound to protect your data to a standard equal to this Policy.
4. How We Disclose Information
We do not sell your Personal Information. We may share it with trusted service providers who help us operate the Services, including cloud hosting and database providers (such as Firebase/Google Cloud), our AI processors used to generate skin assessments, product scores, and chat responses — currently xAI (Grok models), OpenAI (GPT models), and Anthropic (Claude models) — our subscription infrastructure provider RevenueCat (which processes purchase receipts and subscription status), and Meta Platforms (which receives only the advertising-measurement events described in Section 3.1.1). We may add or change providers in the future and will update this Policy accordingly. These providers are only permitted to use your data to perform services for us and are contractually required to protect it to a standard consistent with this Policy.
5. International Transfer
Personal Information collected by LunaGlow may be stored and processed anywhere in the world, including in Turkey, the United States, the European Union, and on the servers of our cloud infrastructure and service providers.
6. Your Choices and Opt-Out Rights
You may withdraw previously given consent at any time by contacting us or using the relevant setting in the app. To opt out of advertising identifiers: on iOS, go to Settings > Privacy & Security > Tracking; on Android, go to Settings > Privacy > Ads and opt out of ads personalization or delete your advertising ID.
7. Rights of Access, Rectification, Erasure, and Restriction
You have the right to request access to, correction of, or deletion of your Personal Information, and to object to or restrict certain processing. You can delete your account and all associated data at any time from the app's Profile > Settings, or by contacting us directly.
8. Data Retention
We retain Personal Information for as long as you use the Services or as necessary to provide them, unless a longer retention period is required by law or you request earlier deletion. This includes your uploaded selfies and product photos, which we keep for as long as your account is active so we can show your skincare progress over time. All your Personal Information, including photos, is permanently deleted when you delete your account.
9. Security
Personal Information you provide to LunaGlow is stored on servers protected by industry-standard security protocols and access controls.
10. Children's Privacy
The Services are not directed to children under the age of 13, and we do not knowingly collect Personal Information from children under 13. Users between 13 and 18 should have parental or guardian consent to use the Services. If you believe a child has provided us with Personal Information, please contact us so we can delete it.
11. California and Other Regional Privacy Rights
Depending on where you live, you may have additional rights under laws such as the CCPA (California) or GDPR (EEA/UK), including the right to request a list of categories of Personal Information disclosed for direct marketing purposes in the prior year. Contact us to exercise these rights.
12. Changes to This Policy
If we make material changes to this Privacy Policy, we will notify you in the app or by other reasonable means. Continued use of the Services after changes take effect means you accept the updated policy.
13. Contact Us
If you have questions about this Privacy Policy or our privacy practices, or want to request deletion of your data, contact us at kumbasarabidinalp@gmail.com.
Questions? Contact us at kumbasarabidinalp@gmail.com