Privacy Policy
LookFlex keeps your photos and face landmarks on your device. This policy explains exactly what reaches our servers, what is kept there, who receives it, why, and the choices you have.
Last updated:
On this page
Summary
Who we are
LookFlex (the website at lookflex.app and the iPhone app) is provided by [Company legal name], [Registered address], [Country of incorporation] (“we”, “us”). For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the controller of the personal data described in this policy that reaches our systems or our service providers.
For anything about privacy, email [email protected]. This policy works together with our Biometric Data Policy, Consumer Health Data Privacy Policy and Cookies and Local Storage page.
What we process and where
LookFlex processes data in three places. Knowing which is which explains most of this policy.
On your device
The following is created on your iPhone and stored in the app's own private storage. It is not stored on our servers unless you turn on backup, which covers only the parts listed there. If you back up your iPhone, your own backup may include it, and we have no access to that.
- Profile answers: an optional first name, sex, age bracket, goals, skin type and concerns, habits (skincare, sunscreen, exercise, sleep, water and diet), facial hair, hair type and reminder times.
- Photos: each scan photo (resized to at most 1280 pixels on the longest side), a small thumbnail, and any Lab images you generate.
- Face geometry: for each scan, 478 three-dimensional landmark points computed by an on-device face model, and the measurements derived from them (16 facial proportions, symmetry and face shape), a measurement margin for each reading, and how the photo was taken (head angle, light level, balance and colour, focus, face size in the frame, expression strength and the hour) so scans can be compared fairly. See the Biometric Data Policy.
- Skin readings: estimates across six skin zones (such as clarity, texture, evenness, redness, under-eye and oil balance) read from the photo's pixels.
- Activity: your results, daily plan, completed steps, streaks and points, coach conversation (the most recent 200 messages), Lab credit balance, settings and a record of the consents you gave.
- A sign-in token: kept in the iPhone's Keychain. It connects the app to your LookFlex account on our servers, whether or not you have signed in.
When you use the camera, live frames are processed in memory to guide your capture. Nothing is recorded except the photo you take, which is then stored as above.
On our servers
Our servers handle the content of an AI request only for the seconds the request takes. What they keep is listed under What our servers keep. An AI request carries:
- AI analysis (when enabled): a copy of your photo resized to at most 1024 pixels, the derived measurements and skin readings (not the landmark points) and your profile answers. Our server forwards what is needed to Anthropic and returns the result to your device.
- AI coach: your recent messages (up to the last 30), your profile answers, a short summary of your latest scores, and your streak and level.
- Lab: a resized copy of your photo, the edit you chose, your sex and age bracket, face shape and top improvement areas. Our server forwards this to Google.
Your device may include your first name and reminder times in these requests because they are part of your profile. Our server discards them before anything is forwarded. Our servers do not save the photos, measurements, messages or results sent in these requests, and we do not log their content. They record only that the request happened: a usage counter for a scan read or a coach message, and a change to your Lab credit balance for a Lab image.
What our servers keep
Our servers keep the records below in a database. The app does not send photos, thumbnails or face landmark points to be kept, and our server checks every backup and refuses image data and landmark points.
- An anonymous account: the first time you open the app, it creates an account id on our servers for that installation, with the times it was created and last used. It holds no name, email address or other personal details. It is there so that scan and message limits, purchases and Lab credits work without a sign-in.
- Sign-in details, if you sign in: signing in is your choice. With Sign in with Apple, we keep the identifier Apple gives us for you, the email address Apple passes on (a private relay address if you chose to hide your email), and an encrypted Sign in with Apple token that we use only to revoke the sign-in when you delete your account. We do not ask Apple for your name and do not keep one. With an email code, we keep your email address. The code itself is kept only in hashed form and expires after 10 minutes. An account has one sign-in method: signing in a different way gives you a separate account.
- Sign-in sessions: for each installation connected to your account, anonymous or signed in: a hash of its sign-in token (not the token itself), the platform, the app version, and when the session was created and last used. Each sign-in starts a new session and ends the one that installation had before.
- Purchases: Apple's transaction identifiers, the product, the purchase, expiry and refund dates, the status of your subscription, and your Lab credit balance with each change to it. For each subscription we also keep, under Apple's identifier for it and not under your account, when its monthly credits were last added and how often it has changed LookFlex account.
- Usage counters: one record each time you run an AI scan read or send a coach message. It holds the time and which of the two it was, linked to your account id, and nothing from the request itself. This is how the free and Pro limits are applied. A Lab image is recorded instead as a change to your Lab credit balance, kept with your credits until you delete your account.
- Rate limiting: counters that stop abuse of our API, stored under a keyed hash of your IP address, of your account id or, for sign-in codes, of the email address. Our application does not store the IP address itself. The contact form on our website is limited in the same way.
- Backup, if you keep it on: described under Backup.
We also process:
- Hosting logs: our host, Vercel, records standard request data (IP address, time, URL, the type of app or browser, and response status), and our own event log: event names with account ids and Apple transaction ids, never content.
- Emails: if you email us, use a contact form on our website or leave your email to be told when the app is on the App Store, we receive your email address, your name if you give it, and your message.
Backup
Backup is optional and works only while you are signed in. It is offered when you sign in: the sign-in screen tells you that signing in turns backup on, and we record the date and the version of that notice. You can turn backup off at any time in Profile. Turning it off deletes the backup from our servers and leaves the data on your iPhone. A backup is also deleted when its account has not been used for 35 months.
While backup is on, our servers keep a copy of:
- your profile answers, including your first name if you gave one;
- your daily plan, your journey and your progress: completed steps, daily logs, streaks, points and badges;
- your settings and the record of the consents you gave;
- your scan results: the scores, measurements, symmetry, skin readings, face shape, findings and summary of each scan, with its measurement margins and how the photo was taken.
Backup never includes photos, thumbnails or face landmark points. The app leaves them out, and our server checks every backup and refuses image data and landmark points. Coach conversations and Lab images are not backed up either. When a backup is restored on another iPhone, each scan shows its numbers without the photo.
With our service providers
Apple handles every purchase made in the app. It collects your payment details and keeps the purchase records under your Apple Account and its own privacy policy (opens in a new tab). We never see your card number or other payment details. When you buy or restore a purchase, the app sends Apple's signed transaction to our server. Our server checks Apple's signature and records the purchase against your LookFlex account, which is what unlocks Pro and adds Lab credits. Apple also sends our server a notice when a subscription renews, expires or is refunded. Apple keeps sending us notices while a subscription is active; after you delete your account we record them without any link to you. We delete each notice after 90 days.
If you sign in with Apple, Apple confirms who you are under its own privacy policy and gives us the identifier and email address described above. If you sign in with an email code, the code is sent to you by our email provider, Resend.
The full list of providers that process data for us is in Service providers.
Purposes and legal bases
We use personal data only for the purposes below. If you are in the EU, EEA or UK, the GDPR legal basis for each is shown.
| Purpose | Data | Legal basis |
|---|---|---|
| Analysing your face and skin, and AI analysis when it is on | Photos, face geometry, measurements, skin readings, profile answers | Your explicit consent, given before your first scan (Article 6(1)(a) and Article 9(2)(a)). You can withdraw it at any time by deleting your account in the app, which erases your scans, and not scanning again. |
| Your plan, progress, AI coach and Lab | Profile answers, results, coach messages, Lab requests | Performing our contract with you (Article 6(1)(b)). Where this includes health-related information, your explicit consent (Article 9(2)(a)). |
| Giving the app an account, signing you in if you choose to, and keeping you signed in | Account id, email address or Apple identifier, sign-in sessions | Performing our contract with you (Article 6(1)(b)) |
| Backing up your results and progress, when you keep backup on | Profile answers, plan, journey and progress, settings, scan results (scores and measurements) | Your consent, given when you sign in (Article 6(1)(a) and, for face measurements and health-related information, Article 9(2)(a)). You can withdraw it at any time by turning backup off, which deletes the backup. |
| Unlocking Pro and the Lab credits you bought through Apple, and applying the limits of your plan | Apple transaction records, subscription status, Lab credit balance, usage counters | Performing our contract with you (Article 6(1)(b)) |
| Keeping tax and accounting records | Sales and payout reports from Apple | Legal obligation (Article 6(1)(c)) |
| Security, rate limiting and preventing abuse or fraud | Rate-limit counters, IP address, request data, hosting logs | Our legitimate interest in keeping the service safe and available (Article 6(1)(f)) |
| Answering your messages and requests | Email address, name, message | Our legitimate interest in helping you, or performing our contract (Article 6(1)(b) and (f)) |
| Telling you when the app is on the App Store | The email address you leave on our website | Your consent (Article 6(1)(a)), which you can withdraw at any time by emailing us |
| Establishing, exercising or defending legal claims | Only the records relevant to the claim | Our legitimate interests (Article 6(1)(f)) |
We do not use your data for advertising, we do not build profiles of you for marketing, and we do not make decisions with legal or similarly significant effects on you based solely on automated processing. Your scores are automated estimates for your own information.
How long we keep data
| Data | How long |
|---|---|
| Everything stored on your device | Until you delete it. Lab images can be deleted one at a time in the Lab; Profile, then Delete account erases everything on the device, including every scan. Signing out does not erase it. Deleting the app from your iPhone also deletes it from the phone, and an iPhone backup you made stays under your control. |
| Your account id and sign-in details | Until you delete your account. One kind of account is deleted sooner: an anonymous account with no purchases is deleted after 12 months without use. |
| Sign-in sessions | A session ends 180 days after it was last used, when you sign out, or when you sign in again on that installation. Its record is deleted about 30 days after it ends. |
| Email sign-in codes | Valid for 10 minutes, kept in hashed form, and deleted by a regular clean-up once expired |
| Backup | Until you turn backup off or delete your account. A backup is also deleted when its account has not been used for 35 months, which keeps it inside the three-year limit in our Biometric Data Policy. |
| Purchase records, subscription status and Lab credits | Until you delete your account. After that we keep Apple's transaction records with the link to your account removed, so that the same purchase cannot be counted twice, and the per-subscription record described above, which was never linked to your account. Apple keeps its own purchase records. |
| Apple's notices about a subscription | 90 days |
| A Sign in with Apple token waiting to be revoked after you delete your account | Kept encrypted, with no link to you, until Apple confirms the revocation, and 30 days at most |
| Usage counters | 90 days |
| Rate-limit counters (hashed IP address, account id or email address) | Up to 2 days |
| Backups of our database made by our database host | [owner to confirm: how long the database host keeps its backups of the database, after which deleted data is gone from them too] |
| AI request content on our servers | Held in memory only for the seconds the request takes. Never written to storage. |
| AI request content at Anthropic and Google | Not kept by us. The providers may keep it for a limited period under their terms, for example for abuse monitoring. |
| Hosting logs, including our event log | Short periods set by our hosting plan, no more than 30 days |
| Sales and payout reports from Apple | As long as tax and accounting laws require (in many countries, up to 10 years) |
| Emails with us, including launch-notice sign-ups | Up to 24 months after our last exchange, unless we need them longer for a legal claim |
Service providers
These providers process personal data on our behalf, under contracts that limit them to providing their service to us. We do not allow them to use your data for their own advertising.
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Anthropic, PBCPrivacy policy (opens in a new tab), Commercial terms (opens in a new tab) | AI analysis of your scan and AI coach replies (Claude models, via the Anthropic API) | A downscaled copy of your photo, derived face measurements and skin readings, your profile answers (not your name), coach messages and a short summary of your latest scores | United States |
| Google LLCGemini API terms (opens in a new tab), Privacy policy (opens in a new tab) | Lab image generation (Gemini API) | A downscaled copy of your photo, the style you chose, your sex and age bracket, face shape and improvement areas | United States |
| Vercel Inc.Privacy policy (opens in a new tab) | Website and API hosting | Request data such as IP address, time, URL and the type of app or browser, and our event log (event names with account ids and Apple transaction ids); the content of requests to our API, including AI requests and backup, passes through in memory only | United States and global edge network |
| Our database host | Hosting the database that holds accounts, sign-in sessions, purchase records, usage counters and, if you keep backup on, your backup | Account ids, the email address or Apple identifier you sign in with, sign-in sessions, Apple purchase records, Lab credits, usage and rate-limit counters and, with backup on, your profile answers, plan, progress, settings and scan results (scores and measurements). Never photos or face landmark points | [owner to confirm: the database hosting provider and the region where the database is kept] |
| Resend (Plus Five Five, Inc.)Privacy policy (opens in a new tab) | Sending the sign-in code when you sign in with an email address, and delivering messages from our website forms to our mailbox | Your email address and the one-time code; for a website form, your email address, your name if you give it, and your message | United States |
| Our email service provider | Receiving and answering your emails, contact messages and launch notice sign-ups | Your email address, name if you give it, and what you write to us | Named on request |
We may also disclose data if the law requires it (for example, a valid court order), to protect someone's safety, or as part of a merger or acquisition, in which case this policy would continue to apply to your data. When you download the app, buy Pro or sign in with Apple, Apple processes data about that under its own privacy policy.
International transfers
Our service providers process data in the United States and other countries that may not have the same data protection laws as yours. When personal data from the EU, EEA, UK or Switzerland is transferred, we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or on the Standard Contractual Clauses approved by the European Commission, with the UK Addendum where needed, together with additional safeguards such as encryption in transit. You can ask us for a copy of the relevant safeguards at [email protected].
AI processing
We want you to know exactly what the AI does and does not do:
- What it is: AI analysis and the coach use Claude models from Anthropic. The Lab uses Gemini image models from Google. When AI analysis is on, the scan shows an AI step while it runs.
- What it receives: only the data listed in On our servers, for one request at a time.
- No training by us: we do not train or fine-tune any AI model on your photos, measurements, messages or results.
- No training by our providers: we use the providers' paid business services, under which they state they do not use customer content to train their models. Read Anthropic's commercial terms and Google's Gemini API terms.
- No identification: we never use your face to identify you, and we never infer race or ethnicity.
- Estimates: AI output can be wrong. Treat it as a second opinion on your measurements, not a fact. See the Medical Disclaimer.
Your rights
Depending on where you live, you have some or all of these rights over your personal data:
- to know what we process and get a copy (access and portability);
- to correct inaccurate data;
- to have your data deleted;
- to restrict or object to our processing, including processing based on legitimate interests;
- to withdraw consent at any time, without affecting processing that happened before;
- not to be treated differently for using these rights.
In the EU, EEA and UK you can also complain to your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to help first.
How to exercise your rights
You can exercise most rights yourself, immediately, in the app:
- Access and portability: open Profile, then Export my data. You get a JSON file with your profile, results, plan, progress, chat and consents, and with what our servers hold about your account. Photos are not included in the export and stay on your device. If you cannot use the app, email [email protected] and we will send you what our servers hold.
- Correction: Profile, then Edit my answers.
- Stopping backup: turn backup off in Profile. This deletes the backup from our servers and leaves the data on your iPhone.
- Deletion: delete Lab images one at a time in the Lab. Profile, then Delete account deletes your account on our servers with everything linked to it (sign-in details, sessions, subscription status, Lab credits, usage counters and any backup), has the Sign in with Apple token revoked by Apple, and erases the app's data on your iPhone, including every scan and photo. If Apple does not confirm the revocation at once, we retry for up to 30 days.
- Signing out is not deletion: it keeps the data on your iPhone and leaves your account and any backup on our servers.
Deleting your account does not cancel an Apple subscription. Cancel it in your iPhone's Settings, as described in Subscriptions and Refunds. Apple keeps its own purchase and payment records, so ask Apple for those.
For anything else held by us or our providers (such as emails), email [email protected]. We may ask for details that let us find your records, such as the email address you signed in with or wrote to us from. We will not ask for more than we need. We answer within one month (GDPR) or 45 days (US state laws), and will tell you if we need more time as the law allows. Someone you authorise can make a request for you if they can show they are authorised.
If we decline your request, we will explain why. In US states that give you a right to appeal, reply to our decision with the word “Appeal”. We will answer within the time the law sets, and if you are not satisfied you can contact your state attorney general.
US state privacy rights
California
This section is our notice at collection and privacy policy under the California Consumer Privacy Act as amended by the CPRA. In the past 12 months we have processed these categories of personal information, from you, your device and Apple, for the purposes described above:
- identifiers (account id, email address, the identifier Apple gives us when you sign in with Apple, and IP address);
- commercial information (the subscription or credits you bought through Apple, and Apple's transaction records for them);
- internet activity (request and hosting logs, and usage counters);
- audio and visual information (photos you send to AI features);
- biometric information (measurements derived from face geometry, sent with AI analysis and stored with backup on);
- characteristics of protected classifications (sex and age bracket);
- inferences (scores, face shape and plan, created on your device or by AI analysis, and stored with backup on);
- sensitive personal information (biometric information and health-related skin readings).
We disclose these only to the service providers listed above, for the business purposes described. We do not sell or share (for cross-context behavioural advertising) personal information, including that of consumers under 16, and we have not done so in the past 12 months. We use sensitive personal information only to provide the service you asked for, as allowed by the CPRA regulations, so there is no need to limit its use. We do not disclose personal information to third parties for their direct marketing. Retention periods are in How long we keep data.
You have the right to know, delete and correct your personal information, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We treat a Global Privacy Control signal as a valid opt-out request, although there is no sale or sharing to stop.
Other US states
If you live in a state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon or Montana), you have rights to access, correct, delete and obtain a copy of your personal data, and to opt out of targeted advertising, sale and profiling with legal or similarly significant effects. We do not do any of those three. We process sensitive data only with your consent, which you give before your first scan, and you can appeal any decision as described above. Washington and Nevada residents should also read our Consumer Health Data Privacy Policy, and residents of Illinois, Texas, Washington and Colorado our Biometric Data Policy.
Children
LookFlex is for people aged 16 and over. Onboarding asks for your age, and if you are under 16 it stops and saves none of your answers. The anonymous account id created when the app first opened holds no personal details. Users aged 16 and 17 get stricter content rules (for example, no cosmetic procedure or weight-loss advice). If you believe someone under 16 has sent us personal data, email [email protected] and we will delete anything we hold.
Security
We protect data with encryption in transit (HTTPS with HSTS), strict security headers, size limits and rate limits on our API, and server-only storage of our API keys. We do not store images on our servers or log request content. Sign-in tokens and email codes are kept only as hashes, the Sign in with Apple token is encrypted, and every request for account or backup data is checked against the session that made it. Data on your iPhone is protected by the phone's own security, so use a passcode and keep your software up to date. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires. Read more in Security and Responsible Disclosure.
Changes to this policy
We will update this policy when our practices change and change the date at the top. If a change is material, we will tell you in the app or on our website before it takes effect, and where the law requires it (for example, for a new use of biometric data) we will ask for your consent again before your next scan.
Contact us
Email [email protected], or write to [Company legal name], [Registered address], [Country of incorporation].