Draft for review by a qualified lawyer before publication. This is not legal advice, and it is not the final policy of Routimate. The operator must insert the legal entity name, address, and governing law.

Draft · 31 October 2026

Privacy policy

Routimate is a cosmetic skincare app. This draft explains what the app and the website at routimate.app collect, why, and how to delete it. The publisher (“Routimate”, “we”) will be the legal entity named here before launch. Contact privacy@routimate.app.

What this is not

Face photos and scores are used to describe cosmetic traits: hydration, oiliness, visible blemishes, redness, texture, pores, dark spots, and a skin-type label. They are not a medical record, a diagnosis, or a way to identify you. Routimate does not build a face template for signing in, and it does not try to recognize who is in a photo.

Some privacy laws still treat a face photo, or measurements derived from a face, as biometric or biometric-adjacent information. We treat face photos and the analysis JSON derived from them as sensitive. We process them only after you accept a separate in-app consent, and only to produce the reading you asked for.

Information we collect

• Account. Email address, display name, locale, and country code. Sign in with Apple or Google, when enabled, sends us the identifier and email those providers share.
• Face photos. The image you submit for a reading, stored in a private Supabase Storage bucket at a path only your account can access.
• Analysis. The structured JSON returned by the vision model or by preview mode, including scores and the short summary.
• Shelf and routine. Products you add, including barcode and label text, plus the morning and evening steps we save.
• Consent records. Which policy version you accepted, and when, for the cosmetic disclaimer and for face-photo processing.
• Subscription status. Whether Plus is free, in trial, active, in a grace period, expired, or cancelled. Receipts are processed by Apple or Google and by RevenueCat. Routimate does not collect your card number.
• Affiliate clicks. When you open a product link, go.routimate.app stores the offer id, time, country header, referrer, and user agent. That log is not tied to your account id.
• Deletion requests. The email address and time of a deletion request from the app, this website, or support.
• Support mail. Whatever you send to support@routimate.app or privacy@routimate.app.

AI processing

When a vision API key is configured, the face photo or label photo is sent to the configured provider — Google Gemini or OpenAI — solely to return JSON. The provider is a processor. Before launch, the operator must sign that provider’s data-processing terms, turn off training on customer content where the contract allows it, and record which provider and model are in use. Preview mode, used when no key is set, does not send the photo to a model and labels the result as a sample.

Label photos are sent the same way when you ask Routimate to read a product label. Barcode lookup may also query the public Open Beauty Facts API with the barcode. That request does not include your account id or face photo.

Recommendations and sponsored placements

Gap analysis runs on your scores and your shelf. A sponsored product can be inserted into that list. The placement is labeled. The brand does not receive your face photo, scores, or account. Affiliate links go out through go.routimate.app. The retailer you land on has its own cookies and privacy policy. We do not sell personal information. We do not share face photos or scores for cross-context behavioral advertising.

Legal bases and regional rights

GDPR / UK GDPR. Account, shelf, and routine data are processed to perform the contract. Face photos and analysis are processed on explicit consent, which you can withdraw by deleting the scan or the account. Security logs and de-identified affiliate counts rely on legitimate interests. You can request access, correction, erasure, restriction, portability, and objection, and you can lodge a complaint with your supervisory authority. Transfers to a vision provider outside your country require the provider’s standard contractual clauses or an equivalent mechanism, which the operator must put in place before launch.

PIPEDA (Canada). We collect personal information for the purposes described here, with meaningful consent. Face photos are sensitive, so the in-app face-data consent is separate from creating an account. You can ask for access or correction, and you can challenge our compliance with the Office of the Privacy Commissioner of Canada.

CCPA / CPRA (California). Categories collected: identifiers (email), commercial information (subscription status, shelf), internet activity (affiliate click logs without an account id), sensory / biometric-adjacent information (face photos), and inferences (cosmetic scores). We do not sell personal information and we do not share it for cross-context behavioral advertising. You can request to know, delete, and correct. We will not discriminate against you for exercising those rights. An authorized agent may write to privacy@routimate.app.

Retention

• Face photos, scores, shelf, routine, and profile: kept until you delete the scan or the account.
• Account deletion removes the auth user, profile, scans, shelf, routine, recommendations, consent records, and subscription row, and deletes the face-photo objects.
• Deletion-request rows (email and timestamps) are kept for up to 12 months as a record that the request was made, then deleted.
• Affiliate click logs are kept for up to 24 months and are not linked to an account.
• Database backups may retain deleted data for up to 30 days.

Deletion and export

In the app: Settings → Export data, and Settings → Delete account. On the web: routimate.app/delete-account. Export returns your JSON. It does not include the raw image bytes; those are deleted with the account or when you delete a scan.

Children

Routimate is not for anyone under 16. We do not knowingly collect their information. If we learn we have, we will delete it.

Security

Traffic uses HTTPS. Face photos sit in a private bucket. Database access is limited by row-level security so one account cannot read another account’s scans, shelf, or routine. The service-role key used by edge functions and the affiliate worker is not shipped in the app.

Changes

If this policy changes in a material way, the app will ask for the new consent version before another face photo is processed. The version string in the app is the date of the draft you accepted.