Privacy Policy

Last updated: November 7, 2026 · Français

1. Data controller

Guillaume Velé

Email: contact@acuence.app

2. Data collected

2.1 Account data (optional)

• Sign in with Apple identifier
• First name (if provided through Sign in with Apple)
• Email (if provided through Sign in with Apple)

Legal basis: Consent (GDPR Article 6.1.a)

2.2 Product scan data

• Photos of cosmetic products (barcodes, labels), read on your device
• History of scanned products
• Personal notes and verdicts

Legal basis: Performance of the contract (GDPR Article 6.1.b)

Retention: your history and what you note are sent to no one. The photo of a product is read on your device and is never sent. Only text is sent, for ingredient analysis and catalog search: the ingredient list read from the label, and the name or barcode you search. If you turn on the contribution, the product's identity and that list join the shared catalog. Details in section 2.6. Your face photos are never sent.

2.3 Health / skin analysis data (special category)

• Face photos for skin analysis
• Skin readings computed on your device from the photo (for example redness, texture and pores, dark circles, shine) and the indicators derived from them
• Skin profile: skin type, concerns, sensitivities, age range and, if you enter it, exact age
• Habits, only if you indicate them in your profile (tobacco, regular sport, frequent sun, daily skincare, short sleep, regular makeup)
• Pregnancy or breastfeeding, only if you indicate it in your profile
• Contraception, with or without hormones, only if you indicate it in your profile
• Life stage, only if you indicate it in your profile
• Cycle dates, only if you turn on cycle tracking: the start of your last period, the length of your cycle and of your periods
• Phototype set by hand, only if you change yourself the one the app shows: the value you chose
• Factors you declare yourself, day by day (short night, sun, rich meal, alcohol, dairy, spicy food, stress, sport, travel, new product, makeup worn) and, if you turn it on, the phase of your cycle
• Your conversations with Acu (the 50 most recent messages), kept in a file of the application on your device
• The readings shown by Acu (“Today”, the reading of a scan, your skin's evolution), as text only: the 120 most recent are sent to no one, and are excluded from backups. They can be found again in Acu's history. They are included in your data export and are erased with your data
• Acu's reading of each scan (the 80 most recent) and its readings comparing two scans (the 60 most recent), as text only, with a fingerprint of the measurements that tells whether a read is still up to date: they are sent to no one, and are excluded from backups. They are shown again without being redone. They are included in your data export, leave with the scan you delete and are erased with your data
• History of analyses
• Dated technical measures of the quality of each of your captures (sharpness of the photo and of the camera image at the shutter, device movement, exposure time and ISO of the photo, wait before the shot, front or back camera, automatic or manual shot, photo judged before or after the analysis, retakes before the analysis, framing, glare, photo retaken or kept and why, exact app version, device model), with no image. Unless you turn on “Send my measurements”, none of these measurements is sent to Acuence. Only the app version is also sent with a catalog contribution. The 500 most recent are excluded from backups, are included in your data export and are erased with your data or when you withdraw this consent. What leaves if you turn it on is described in section 2.6.
• The dated course of each of your reading attempts (outcome: reading saved, photo refused, interrupted or too long, and why, duration of each step, first reading since the app opened or not, thermal state of the device, sharpness and framing of the photo, what each channel could read or why it stayed silent, exact app version, device model), with no image and no identifier. Unless you turn on “Send my measurements”, nothing from this course is sent to Acuence. The 500 most recent are excluded from backups, are included in your data export and are erased with your data or when you withdraw this consent. What leaves if you turn it on is described in section 2.6.

Legal basis: Explicit consent (GDPR Article 9.2.a)

Health information you choose to enter (pregnancy or breastfeeding, contraception, cycle dates, the pregnancy or breastfeeding setting, the daily journal): Acuence keeps and uses it only if you tick a separate box, which is not ticked by default and appears on the screens where you enter this information, never when you open the app. The box reads: “I agree that Acuence keeps and uses this information on this device to adapt the advice it gives me, and that Acu tells me, when I ask, what I noted.” Without your agreement nothing of it is kept, and the rest of the app works the same. You can withdraw your agreement at any time in “Your data”: this information (profile answers, journal, pregnancy or breastfeeding setting) is then erased. Cycle tracking also turns off, and what you noted there is erased. If you had entered some of it before this box existed, Acuence keeps it on your device without reading it until you agree, and erases it if you decline. While it waits, the pregnancy or breastfeeding watch is paused, and the app says so on a product sheet, in the routine and on the screens where you enter this information. Under 15, this consent is given together with a parent. None of this information is sent to an Acuence server.

Retention: your readings are kept in your journal, and your face photos only if you choose to keep them. Unless you turn on “Send my measurements”, they are sent to no one. Photos stay out of backups, and no photo is sent to Acuence.

Processing: the analysis of the face photo runs entirely on your device. No face photo is sent to a server. The numbers read from these photos, including the score and the skin measurements, leave the device only if you turn on “Send my measurements” in “Your data” (section 2.6).

Device backup: if you back up your device (iCloud or a computer), the backup made by Apple carries what the app keeps on the device, including your skin profile, your routine, your favorites, your recent products, the phototype you set by hand, and the dates and scores of your readings. It is kept by Apple, according to your own backup settings: it is never sent to Acuence, and Acuence cannot read it. It leaves out the health information you choose to enter (pregnancy or breastfeeding, life stage, contraception, cycle dates), your exact age, the pregnancy or breastfeeding setting, your face photos, what you note, and your conversations with Acu. If you restore a backup on a new device, what it contains comes back with it. What it leaves out does not come back.

Kiosk

A professional can open the app as a kiosk on their device. The person whose skin is read there first answers an age question: the kiosk is for people aged 18 and over. Their photo is analyzed on the professional's device and is sent to no one. The photo, the reading and the answer to the age question are added neither to the readings nor to the journal of that device, and are wiped when the reading ends, whether the person ends it or it ends for lack of interaction. Before the reading, the kiosk names on screen the professional providing it, and states who the data controller is for that reading.

2.4 Usage data

• Language and appearance preferences
• Beauty routine (morning/evening products)
• Your products
• Your brands, if you enter them: the ones you love and the ones you set aside

Legal basis: Performance of the contract (GDPR Article 6.1.b)

Your beauty routine, and the products you use in “Your products”: read by Siri and Shortcuts only with your consent (section 4).

2.5 Subscription data

Acuence Pro subscription status.

Managed exclusively by Apple through StoreKit. We have no access to your payment data.

2.6 Data sent to our servers

For transparency, here is the only data that may pass through our secure servers (HTTPS, hosted in the EU):

• Product catalog: your searches (name, brand, barcode) are sent to query our product database
• Photos of cosmetic products: none is sent, they are read on your device (and never your face)
• INCI analysis: the ingredient list of a product is sent to generate a verdict
• Shared catalog, an optional contribution that is off by default (consent, GDPR Article 6.1.a): only if you turn it on, the app sends the name, brand, barcode, category, size, ingredient list and ingredient count of the scanned product, with the app version, technical reading indicators and a token that changes every day to the shared catalog. No photo goes with it. You can withdraw this consent at any time in Profile > “Manage your data”.
• Usage statistics, only if you turn them on: see section 11
• Send my measurements, only if you turn it on in “Your data”: the numbers read from your photos, the capture conditions, including those of rejected captures, your device model and the iOS and app versions, and what is needed to group the captures of one session. No photo, no landmark of your face, no account or device identifier, nothing from your skin profile, nor what you declared there about your health. The details, the retention period and the deletion are described below.

Send my measurements (off by default). If you turn it on in “Your data”, Acuence sends to its server, for the readings taken on this device, the numbers read from your photos and the capture conditions: the measured indicators behind each channel, their states and the list of channels computed, the link between the redness and the lightness of the image, the score, its breakdown and the values it is built from, sharpness, brightness of each half of the face, evenness of lightness across the skin (before and after correction), color temperature of the light, clipping, share of the image taken by the face, thermal state of the device, device model, iOS, app and analysis versions, the version of the rule that judges photo quality, the day of the session, the number of seconds since it started, the type of the line (reading or rejected capture) and the version of its format. A capture rejected by the capture check also sends its quality values (sharpness, clipping, share of the image taken by the face), with the model and versions, without channels or score. No photo, no landmark of your face, no account or device identifier, nothing from your skin profile, nor what you declared there about your health. Nothing from a guest reading either. Each session carries a randomly drawn number, kept on your device, used to group its captures and to delete them. These measurements are used only to measure whether the app reads the same thing from one capture to the next, and to correct its reading thresholds. Legal basis: your consent, which you can withdraw at any time in “Your data”. They are kept for 24 months after the day of the session. You can ask for them to be deleted from “Your data”, or by writing to us with your session numbers, which your data export contains. Our host sees the IP address of each upload and the time it arrives, as for any connection. An upload leaves about twenty seconds after the capture, so this time, together with the recorded offset, places the time of the session. Our host, Supabase, keeps these two pieces of information in its technical logs for one day.

• Weather (optional, only when you turn it on): your approximate location is read on the device and sent to Apple Weather (WeatherKit) for the weather markers, never to any other third party
• Nearby centers (only when you open the center locator and allow location): your position, read on the device with an accuracy of about 100 meters, is used by Apple Maps (MapKit) for the search, never sent to any other third party

For the weather as for the centers, your location is sent to Apple, which provides the service. It is never read in the background, and Acuence does not keep it.

Erasing your data with Sign in with Apple has its own outbound call, described in section 6.

No face photo is sent to Acuence. Your skin measurements go there only if you turn on “Send my measurements” in “Your data”. The app reads an appearance, it identifies no one. The Acu assistant answers on your device: first its built-in question set, then Apple's built-in language model (Apple Foundation Models) when the system provides it. Your messages with Acu reach no server.

Legal basis: Performance of the contract (GDPR Article 6.1.b)

2.7 Technical performance data (local only)

To analyze slowdowns in the application, Acuence keeps locally on your device, for 14 days at most, the performance reports provided by iOS through the MetricKit framework:

• Application launch time
• Peak memory use
• Scrolling smoothness (scrollHitchTimeRatio)
• Hang reports and crash reports

These MetricKit reports are stored in the system cache (/Caches, excluded from iCloud backups) and contain no photos, no INCI lists and no scan payloads. Acuence sends no crash report to any server: incident reports go through Apple's own mechanisms.

Collection only starts after your explicit consent to skin data, and stops as soon as you withdraw it. You can delete this data at any time by uninstalling the application.

Legal basis: Consent (GDPR Article 6.1.a), collection is only enabled with your consent to skin data, and stops when you withdraw it

2.8 Write to us

When you write to us at contact@acuence.app, we receive your email address, with the name your mail app attaches to it, and what your email contains.

When you report something you received (an invitation or an item in a Cercle, a shared catalog listing, a ritual shared by link), the app hides it on this device and prepares an email to us. That email carries the type of content, its identifiers, the reported text as you received it from another person (a Cercle name, a note, product names), the fingerprint of the device that sent it when it is signed, the date, the app version and anything you choose to add, with no measurement and no photo. You send it yourself, from your mail app, or from the app you choose if the device has none: sent by email, it leaves with your email address, and no Acuence server receives it any other way. If someone reports content you sent them, that content reaches us in the same way.

3. Purposes of processing

• Analysis of cosmetic ingredients (INCI)
• Skin analysis and wellness recommendations
• Personalization of product recommendations
• Acu's answers, the app's guide
• Beauty routine tracking
• Capture quality check and tuning of its thresholds (section 2.3)
• Letting Siri and Shortcuts read your routine and the products you use, with your consent (section 4).

4. Data sharing

We neither sell nor rent any personal data to third parties for commercial purposes.

Processors (GDPR Article 28)

• Apple Inc., StoreKit (Acuence Pro payments), Sign in with Apple (authentication). Framework: Apple App Store Connect contractual clauses.
• Acuence API (verdictbeauty.app): product catalog, INCI analyses, product listings contributed with your consent. The reading of labels (INCI OCR) runs on your device. The Acu assistant goes through none of these servers: it runs on your device. Hosted in France by OVH SAS (2 rue Kellermann, 59100 Roubaix), HTTPS only, deletion on request at contact@acuence.app.
• OVH SAS (2 rue Kellermann, 59100 Roubaix) also hosts the contact@acuence.app mailbox, which receives the emails of section 2.8.
• Apple Weather (WeatherKit, Apple Inc.), weather requests from an approximate location, only if skin weather is enabled. Framework: Apple Developer terms.
• Apple Maps (MapKit, Apple Inc.), search for centers around your position, only when you use the center locator. Framework: Apple Developer terms.
• Supabase, which hosts the function that asks Apple to remove the authorization given to Acuence, only when you erase your data, if you sign in with Apple (section 6).
• Supabase, which hosts the measurements sent if you turn on “Send my measurements” (section 2.6), on servers located in the European Union.

No transfer to advertising third parties, data brokers or social networks.

What you share yourself

A few buttons open your phone's share sheet: nothing goes out through them without your gesture, and you choose the destination. This is everything that can leave that way. Every card image is re-encoded and every film exported without location, device model, software or capture date before it goes. The data export is a copy of your own data, created on your device.

• My reading card: An image of your face with the layers of your reading, from “Share my card”. Shows your face.
• My film: A short film of your face across your readings, from “Share my film”. Shows your face.
• My two readings side by side: An image placing two of your photos side by side, from “Share these two readings side by side”. Shows your face.
• My data export: A ZIP archive created on your device. It contains your face photos only if you allowed them to be kept, and always the profile photo or Cercle cover you chose. May contain your face photos.
• Export from the manifesto: The same ZIP archive, and the privacy commitment card (an image with no face). May contain your face photos.
• The two readings side by side as a PDF: A PDF created on your device: dates, no photo.
• The series sheet as a PDF: A PDF created on your device: your readings, their conditions and the reading by zone, no photo.
• The clinic report as a PDF: A PDF created on your device, to hand to a professional if you wish.
• My card for the clinic: A text image: your reading summary and the topics you ticked.
• My regularity: A text image: the number of readings you have kept.
• My label challenge: A text image: your result in this week's challenge.
• A receipt: A text image: a receipt of your actions in the app.
• The share card: A text image in the format you choose, no photo.
• A product card: A text image: the product name and its reading, no photo.
• My routine: A text image, a sentence and a link carrying your routine's products.
• A send to a Cercle: A link, with the brand card and, if you write one, your note.
• Invitation to a Cercle: An invitation link.
• Report: an email to us, prepared by the app, carrying the reported content and your email address (section 2.8).

Siri and Shortcuts

The shortcut for today's read has Siri say your overall read, when you ask, once your device is unlocked. Acuence returns it only as a spoken sentence. It returns no value another shortcut could pick up.

Siri and Shortcuts, only with your consent, given in “Your data” (off by default): once your device is unlocked, they can read your routine (for each step, the time of day, the step itself and the product name) and the products you use (name and brand). Once read, Shortcuts can send them elsewhere, for example to a third-party model such as ChatGPT, and Acuence no longer controls what is done with them.

This consent never opens your overall read, your readings, your photos, your journal or your health data to them. Legal basis: your consent (GDPR Article 6.1.a). You can withdraw it at any time in “Your data”. Erasing your data withdraws it too. No paid feature depends on it.

5. Transfers outside the EU

The Acuence backend (product catalog, INCI analysis, product listings contributed with your consent, opt-in statistics) is hosted in France, in the European Union, by OVH SAS. The reading of labels (INCI OCR) runs on your device: the server receives no photo, no face image and no skin data.

Apple services (StoreKit, Sign in with Apple, Apple Weather, Apple Maps) may involve processing outside the EU by Apple Inc. (United States). These transfers are covered by the safeguards of Apple's contractual frameworks for developers, including standard contractual clauses (GDPR Article 46).

To identify certain products, the application may query a public reference service: the Open Beauty Facts product database (a French non-profit). These requests contain only the name, brand, barcode or ingredients of the product being looked up, never your identity, your account or your skin data. Like any internet connection, they expose the device's IP address to the service being queried. These occasional transfers are necessary to perform the service you request (GDPR Article 49.1.b).

No advertising or data broker transfer takes place.

6. Retention periods

In line with the minimization principle (GDPR Article 5.1.e), each category of data has its own retention period:

• Skin data: kept on your device only (and in your device backup, see section 2.3). Readings (metrics) are kept for as long as the application is installed, up to the 365 most recent in your timeline: beyond that, the oldest one is deleted, with its photo. Reading photos are kept only with your agreement, and those of your timeline for the period you choose (3 months, 12 months suggested, or no time limit). That period deletes photos only, never a reading. Deleted from Profile > “Manage your data”, or by uninstalling the application.
• Product / routine history: local, until uninstallation or manual deletion.
• Acu's reads: local, the 120 most recent, until uninstallation or erasure of your data.
• Acu's reading of each scan and its comparative reads: local, the 80 and the 60 most recent, until uninstallation, deletion of the scan or erasure of your data.
• MetricKit reports: local, 14 days at most, then automatic rotation.
• Sign in with Apple account: kept for as long as you do not delete your account from Profile > “Manage your data”.
• Server logs (catalog, INCI analyses): 30 days for quality analysis, then automatic purge. The Acu assistant generates no server log (processing runs on the device).
• Shared catalog contributions (only if you turn them on): the product listing sent may be kept in the shared catalog. It carries neither your name nor your account, and the token that comes with it changes every day. A shared listing stays in the catalog. Write to us to ask for it to be removed. When the server confirms it received a listing from a label reading you shared, the app notes it on your device, to remind you if you delete its reading. The app never sends this note. It goes with “Delete your data” and is included in your data export.

You can exercise your right to erasure (GDPR Article 17) at any time from Profile > “Manage your data”: it erases your data on this device, along with the consents and sign-in sessions kept in the device keychain. If the deletion of your account on our servers fails, your sign-in session is kept so that you can run it again, and the app tells you so. Uninstalling the application deletes its files, but those keychain items may survive it. The date described below stays after your data is erased, by design, and it may survive the application being deleted.

To keep the device clock from being turned back, the app keeps in the iOS keychain the latest date it has seen. Normally that is roughly the last time it ran here. It holds no reading, no skin measurement and no identifier. It is not synced and can only be read on this device. It stays after your data is erased, by design. It may also survive the application being deleted, a behavior we observe in iOS without Apple guaranteeing it.

Sign in with Apple: if you sign in with Apple, erasing your data first asks you for a new Apple authorization. The app then sends only that single-use authorization code to a function hosted by Supabase, which asks Apple to remove the authorization given to Acuence. That function runs in Paris, in the European Union. The app sends no name, no email and no skin data, and the function keeps nothing, neither what it sends nor what Apple sends back.

7. Your rights (GDPR articles 15 to 22 and 77)

You have the following rights:

• Right of access to your data (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / right to be forgotten (Art. 17), from Profile > “Manage your data”, after a typed confirmation
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20): export of your data as JSON from Profile > “Manage your data”, in a ZIP archive (with your retained photos, if any)
• Right to object (Art. 21)
• Right to withdraw your consent at any time (Art. 7.3)

To exercise these rights: contact@acuence.app. We reply within 30 days (GDPR Art. 12.3).

Right to lodge a complaint (Art. 77): Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, 75334 Paris Cedex 07, www.cnil.fr.

8. Security

Local data is stored on your device and protected by Apple's hardware encryption mechanisms.

The skin analysis runs entirely on your device: no image of your face is transmitted over the internet.

9. Cookies and trackers

The application uses no cookie, no advertising tracker and no attribution SDK: nothing follows you from one application to another.

No analytics, attribution or crash-reporting SDK receives data: crash reports go through Apple's own mechanisms, with no external SDK. The public reference services the application queries to identify a product are listed in section 5.

10. Minors

Acuence is intended for people aged 15 and over. Under 15, use of the application requires the agreement of a parent or holder of parental authority, who consents with you to the processing of your health data (article 45 of the French Data Protection Act).

When you give your consent to the skin reading on your device, the application asks for your age range and, under 15, for your confirmation that a parent or the holder of parental authority is with you and gives their agreement. These answers are never sent to Acuence: they are kept on your device with the date of your consent, and are erased if you withdraw it.

The profile asks for your age range and, if you wish, your exact age, to adapt what the app reads. These answers are never sent to Acuence. Your device backup can contain your age range, never your exact age (see section 2.3). For the “Under 18” range, routine suggestions leave out retinoids and exfoliating acids.

11. Continuous improvement (opt-in)

With your explicit agreement (off by default), Acuence may send once a week, over Wi-Fi only, an aggregated, pseudonymous statistic about your usage, to improve product analysis, the coverage of Acu's questions and INCI list recognition.

• Each send carries an identifier drawn at random for that send, the version of its format, a hashed install identifier that changes every week, the week, the app version and the device language, then, for each counter, what is counted (an action in the app, such as a completed reading or a message sent to Acu), its day (UTC) and its count. The install identifier itself is never sent, and it is renewed every month. Like any internet connection, the sending exposes the device's IP address to the server. The sending carries no photo and no plain-text query.
• Each send is capped at 5 KB, aggregated over several days, and a counter is sent only if it reaches at least 5.
• No product identifier, brand or barcode is transmitted.
• Retention: raw server data 30 days, aggregates 2 years.

You can give or withdraw this consent at any time in Profile > Settings > “Help improve Acuence”. Withdrawing immediately erases the data not yet sent.

Legal basis: GDPR Article 6.1.a, explicit consent.

12. Changes

We reserve the right to change this policy. You will be informed in the application in case of a substantial change.