Privacy Policy
Shyn analyses photos of your face and asks about your skin. That is sensitive information, so this policy explains plainly what we collect, why, who else touches it, and how you delete it.
1. Who we are
Shyn is operated by Appstract Studio ("Shyn", "we", "us"), the data controller for the personal data described here. Products bought through the app are sold by Greymark Studio Limited, a company registered in Hong Kong, which is the controller for your order and payment details — delivery address, what you ordered and what it cost. Both companies are reachable at hello@appstract.studio.
2. What we collect
Account
- Your name and email address, and an identifier from Sign in with Apple or Google Sign-In. If you use Apple's "Hide My Email", we only receive the relay address.
Skin profile
- Answers to the onboarding quiz: age, gender, city, skin sensitivity, skin type, goals and any skin conditions you tell us about.
- If you tap "Use my current location", the app reads your location once to fill in your city, and only the city is sent to us; we use it to account for your local climate. You can decline and type your city instead.
Face scans
- Photos of your face that you take in the app, and the scores and condition detections derived from them (for example hydration, texture, redness, signs of acne).
- Scan history so you can see change over time.
Routine and products
- Products you add to your shelf or routine, barcodes you scan, and the ingredient checks we run on them.
- Daily check-ins and notes you log (for example sleep, SPF use, a new product).
Sage chat
- Messages you send to Sage, our in-app skincare assistant, and the replies. Face photos are never sent to the chat provider; Sage only receives your profile and scan scores.
Purchases and orders
- Subscription status and purchase history for Shyn Premium. Payment is processed by Apple or Google; we never see your card number.
- If you buy a physical product through the app, the items ordered, your shipping name and address, and order status. Payment for physical products is processed by Stripe; card details do not touch our servers.
Device and diagnostics
- Device model, OS version, app version, a push notification token if you enable notifications, and crash or error reports.
How you use the app
- Actions you take in the app, such as signing in, finishing onboarding, completing a scan, adding a product to your cart or shelf, placing an order, subscribing and messaging Sage, along with when you open and close the app. These are linked to your account, including your name and email address, so we can see how people move through Shyn.
3. How we use it
- To analyse your skin, build and update your routine, and show progress across scans.
- To check ingredient compatibility across the products on your shelf.
- To provide Sage chat with the context it needs to answer you.
- To process subscriptions and physical product orders and tell you their status.
- To send routine reminders and scan nudges, if you turn notifications on.
- To keep the service secure, fix bugs, and understand how the app is used so we can improve it.
We do not sell your personal data, and we do not use your face photos for advertising or to train our own models. Where consent is the legal basis (face photos and health-related quiz answers), you can withdraw it at any time by deleting your scans or your account.
4. Who else processes your data
We use a small number of service providers. Each only receives what it needs for its job.
| Provider | Purpose | Data involved |
|---|---|---|
| Apple, Google | Sign-in and in-app purchases | Sign-in identifier, purchase receipts |
| RevenueCat | Subscription management | App user id, purchase and renewal events |
| IvyAI (aihealthpred.com) | Face analysis | Your face photo, sent from our server for each full scan and used to return scores and condition detections |
| OpenRouter and its model providers | Sage chat | Your chat messages plus profile and scan scores. Never photos |
| Stripe | Card payments for physical product orders | Your card details, entered directly into Stripe's payment sheet (we never see the number), the amount, and a payment reference |
| Zinc | Placing physical product orders with retailers | Items ordered and shipping name and address |
| Railway | Hosting, database and photo storage (EU West) | All data above, encrypted in transit and at rest |
| Expo | Push notifications | Push token and notification content |
| PostHog (United States) | Product analytics and error tracking | Your account id, name and email, the in-app actions above, device and app details, and crash reports. Never photos, scan results or chat messages |
We may also disclose data if the law requires it, or to a successor if Shyn is acquired, in which case this policy continues to apply.
5. How photos are stored
Face photos are stored in a private bucket that is not publicly accessible. The app loads them only through short-lived signed links. Photos are transmitted to our analysis provider over an encrypted connection and are not published anywhere. You can delete any individual scan, and its photo, from the app at any time.
6. Retention
- Account, profile, scans and routine data are kept while your account is active.
- When you delete your account, we delete your profile, photos, scans, routine data and chat history within 30 days. Backups roll off within a further 30 days.
- Order and subscription records are kept for as long as tax and accounting law requires, then deleted.
7. Your choices and rights
- Download your data from Profile → Privacy & data in the app, or email us.
- Delete individual scans from your scan history.
- Delete your account from Profile → Privacy & data. This removes everything listed above.
- Notifications, camera and location can be turned off in iOS Settings at any time.
Depending on where you live, you may also have the right to access, correct, restrict or object to our processing, to data portability, and to complain to a supervisory authority. Email hello@appstract.studio and we will respond within 30 days.
8. Children
Shyn is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
9. Security
Data is encrypted in transit and at rest. Access to production systems is limited to the people who operate the service. No system is perfectly secure, so if we learn of a breach affecting you we will tell you and the relevant authorities as the law requires.
10. International transfers
Our servers are in the EU. Some providers listed above operate in the United States, and order and payment data is handled by Greymark Studio Limited in Hong Kong. Where data leaves the UK or EU we rely on standard contractual clauses or an equivalent lawful mechanism.
11. Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect. The date at the top always shows the current version.
12. Contact
Email hello@appstract.studio — it reaches both companies.
Appstract Studio (United Kingdom) — the Shyn app and Premium subscriptions.
Greymark Studio Limited (Hong Kong) — product orders and payments.