Privacy Policy
Shyn analyses photos of your face and asks about your skin. That is sensitive information, so this policy explains plainly what we collect, why, who else touches it, and how you delete it.
1. Who we are
Shyn is operated by Appstract Studio ("Shyn", "we", "us"). We are the data controller for the personal data described here. You can reach us at hello@appstract.studio.
2. What we collect
Account
- Your name and email address, and an identifier from Sign in with Apple or Google Sign-In. If you use Apple's "Hide My Email", we only receive the relay address.
Skin profile
- Answers to the onboarding quiz: age, gender, location or climate, skin sensitivity, skin type, goals and any skin conditions you tell us about.
- If you allow location access, we use your approximate location only to infer climate. You can decline and pick a climate manually.
Face scans
- Photos of your face that you take in the app, and the scores and condition detections derived from them (for example hydration, texture, redness, signs of acne).
- Scan history so you can see change over time.
Routine and products
- Products you add to your shelf or routine, barcodes you scan, and the ingredient checks we run on them.
- Daily check-ins and notes you log (for example sleep, SPF use, a new product).
Sage chat
- Messages you send to Sage, our in-app skincare assistant, and the replies. Face photos are never sent to the chat provider; Sage only receives your profile and scan scores.
Purchases and orders
- Subscription status and purchase history for Shyn Premium. Payment is processed by Apple or Google; we never see your card number.
- If you buy a physical product through the app, the items ordered, your shipping name and address, and order status. Payment for physical products is processed by our checkout partner; card details do not touch our servers.
Device and diagnostics
- Device model, OS version, app version, a push notification token if you enable notifications, and crash or error reports.
3. How we use it
- To analyse your skin, build and update your routine, and show progress across scans.
- To check ingredient compatibility across the products on your shelf.
- To provide Sage chat with the context it needs to answer you.
- To process subscriptions and physical product orders and tell you their status.
- To send routine reminders and scan nudges, if you turn notifications on.
- To keep the service secure, fix bugs and understand aggregate usage.
We do not sell your personal data, and we do not use your face photos for advertising or to train our own models. Where consent is the legal basis (face photos and health-related quiz answers), you can withdraw it at any time by deleting your scans or your account.
4. Who else processes your data
We use a small number of service providers. Each only receives what it needs for its job.
| Provider | Purpose | Data involved |
|---|---|---|
| Apple, Google | Sign-in and in-app purchases | Sign-in identifier, purchase receipts |
| RevenueCat | Subscription management | App user id, purchase and renewal events |
| IvyAI (aihealthpred.com) | Face analysis | Your face photo, sent from our server for each full scan and used to return scores and condition detections |
| OpenRouter and its model providers | Sage chat | Your chat messages plus profile and scan scores. Never photos |
| Zinc | Physical product checkout | Items ordered and shipping name and address |
| Railway | Hosting, database and photo storage (EU West) | All data above, encrypted in transit and at rest |
| Expo | Push notifications | Push token and notification content |
We may also disclose data if the law requires it, or to a successor if Shyn is acquired, in which case this policy continues to apply.
5. How photos are stored
Face photos are stored in a private bucket that is not publicly accessible. The app loads them only through short-lived signed links. Photos are transmitted to our analysis provider over an encrypted connection and are not published anywhere. You can delete any individual scan, and its photo, from the app at any time.
6. Retention
- Account, profile, scans and routine data are kept while your account is active.
- When you delete your account, we delete your profile, photos, scans, routine data and chat history within 30 days. Backups roll off within a further 30 days.
- Order and subscription records are kept for as long as tax and accounting law requires, then deleted.
7. Your choices and rights
- Download your data from Profile → Privacy & data in the app, or email us.
- Delete individual scans from your scan history.
- Delete your account from Profile → Privacy & data. This removes everything listed above.
- Notifications, camera and location can be turned off in iOS Settings at any time.
Depending on where you live, you may also have the right to access, correct, restrict or object to our processing, to data portability, and to complain to a supervisory authority. Email hello@appstract.studio and we will respond within 30 days.
8. Children
Shyn is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
9. Security
Data is encrypted in transit and at rest. Access to production systems is limited to the people who operate the service. No system is perfectly secure, so if we learn of a breach affecting you we will tell you and the relevant authorities as the law requires.
10. International transfers
Our servers are in the EU. Some providers listed above operate in the United States. Where data leaves the UK or EU we rely on standard contractual clauses or an equivalent lawful mechanism.
11. Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect. The date at the top always shows the current version.
12. Contact
Appstract Studio · hello@appstract.studio