Privacy Policy

Last updated: August 20, 2026

This Privacy Policy explains how Poreo ("Poreo," "we," "us," or "our") collects, uses, and protects your information when you use the Poreo iOS app (the "App"). We built Poreo to be private by design. We want you to understand exactly what happens to your data — especially your skin photos.

1. Information we collect

Poreo does not require you to create an account with a name or email to use the App. We collect the following:

• Anonymous account identifier. We use Firebase Anonymous Authentication to give your device a private, anonymous ID, without us knowing who you are.
• Subscription and purchase data. Managed through RevenueCat and Apple — for example, your subscription status, plan, transaction identifiers, and renewal/expiration dates. We do not receive or store your full payment card details; those are handled by Apple.

That is the complete list. We run no analytics and no crash-reporting SDK, and we do not collect your name, email, phone number, contacts, location or advertising identifier.

What stays on your device. Your skin scores and Skin Age, your quiz answers (skin type, sensitivity, concerns, habits), anything you type in the notes field, your routine, your scan history, your product scans, your chat history and your progress photos are all stored only on your device. They are not uploaded to our servers, so we cannot see them. If you delete the App, that data is deleted with it.

2. How we handle your skin photos

This is the most important part of how Poreo works, so we want to be explicit:

• Selfie analysis is transient. When you take a selfie for analysis, the image is sent securely (encrypted in transit) to our cloud analysis provider — Google's Gemini model, accessed through Firebase AI Logic — to be processed in real time. It is used only to compute your skin scores and is not retained afterward: the photo is processed in memory to produce the result and is not saved by Poreo or written to any Poreo database or storage.
• We never store your selfie. Your analysis selfie is not saved to our servers, and we do not keep a copy of it after analysis completes.
• We never sell your photos. We do not sell, rent, or trade your skin photos or any biometric-style imagery to anyone.
• Only the numbers are kept, and only on your device. After analysis, the resulting scores are written to your device's own storage so you can see your trends over time. They are not sent to our servers.
• Progress photos stay on-device. Any before-and-after progress photos you choose to keep are stored locally on your device. They are not uploaded to our servers.
• The projected image is transient too. The illustrative "8 weeks later" picture is generated from your selfie during that session, shown to you in the app, and is not stored on our servers.

Faces and biometric data

Your photo contains your face, so we want to be precise about what we do and do not do with it. Poreo estimates skin characteristics — hydration, barrier, pores, texture, tone and fine lines — from the image. That is the only purpose the photo serves.

We do not perform facial recognition. We do not create, derive, or store facial geometry, a faceprint, or any other biometric identifier, and we do not use your face to identify, verify, or track you. We do not attempt to determine your identity, and we do not match your photo against any database or against other users. We do not sell, rent, or trade your photos or any imagery derived from them.

Poreo has no account, no email and no password — it works from a randomly generated anonymous identifier — and your scores never leave your device, so nothing we hold is linked to your name or contact details.

3. How we use information

• To provide the core features: skin analysis, scores, personalized phased routines, and the product/ingredient scanner.
• To track your skin trends over time and show your progress.
• To manage and verify your subscription and access to premium features.
• To improve the App, fix crashes, and understand aggregate usage.
• To protect against abuse, fraud, and security threats.
• To comply with our legal obligations.

We do not use your skin photos or scores to serve you third-party advertising, and we do not sell your personal information.

4. Service providers we use

We rely on a small set of trusted third-party processors who handle data on our behalf under their own privacy and security commitments:

• Google Firebase — Anonymous Authentication (anonymous account ID), Cloud Firestore (storing only that anonymous ID and your subscription status), and App Check (verifying requests come from the genuine app to prevent abuse). We do not use Firebase Analytics or Crashlytics.
• Google (Gemini via Firebase AI Logic) — real-time processing of your analysis selfie and product photos to compute skin scores and generate the illustrative projection image, and powering the AI chat. Google acts as our data processor for these requests: images are processed transiently to return the result, are not stored by Poreo, and are not used by Google to train its models under the applicable data-processing terms.
• RevenueCat — managing and validating your subscription and purchase data.
• Apple — processing payments and managing subscriptions through the App Store.

These providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

5. Legal bases (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:

• Performance of a contract — to provide the App and the features you request.
• Legitimate interests — to secure, maintain, and improve the App (balanced against your rights).
• Consent — where required, for example for certain analytics; you can withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

6. Your rights (EU / UK – GDPR)

If you are in the EEA or UK, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability — receive your data in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at poreo.app@gmail.com.

7. Your rights (California – CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect and how we use it.
• Request access to the specific personal information we have collected about you.
• Request deletion of your personal information.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information.
• Not be discriminated against for exercising your privacy rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. To make a request, contact poreo.app@gmail.com.

8. Account & data deletion

You can delete your account and associated data at any time, directly within the App (in Settings) or by emailing us at poreo.app@gmail.com. When you delete your account, we remove your anonymous identifier and subscription record from our systems, and the App erases your scores, routine, profile, chat and photos from your device. Progress photos stored on your device are removed when you delete them or uninstall the App. Some limited records may be retained where required by law (for example, transaction records).

9. Data retention

Your scores and app content live on your device for as long as you keep the App, so you can track your progress. Analysis selfies are not retained after processing — there is nothing to delete on our side, because they are never stored. Progress photos remain on your device until you delete them or uninstall the App. When you delete your account, we delete your associated data as described above.

10. Security

We use industry-standard measures to protect your data, including encryption in transit, restricted access, and Firebase App Check to help ensure requests come from the genuine app. No method of transmission or storage is 100% secure, but we work to protect your information and limit what we collect in the first place.

11. Children's privacy

Poreo is not directed at children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, please contact us at poreo.app@gmail.com and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the App. Your continued use of Poreo after changes take effect means you accept the updated policy.

13. Contact us

If you have any questions, requests, or concerns about this Privacy Policy or your data, contact us at:

Email: poreo.app@gmail.com

---

Poreo is not a medical device. Skin scores and routine suggestions are estimates for cosmetic and informational use only and are not a substitute for professional medical advice. Please consult a qualified dermatologist for any skin concern.