Privacy Policy

GLOW — AI Skincare Analysis

Last Updated: April 24, 2026

This Privacy Policy explains how Peyton (“we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use the GLOW mobile application and related services (collectively, the “App”). Please read this Privacy Policy carefully before using the App.

By creating an account or using the App, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use the App.

1. Information We Collect

When you use the App, we may collect the following categories of information:

1.1 Information You Provide

1.2 Face Data (Photos)

GLOW allows you to take selfies using your device camera for AI-powered skin analysis.

1.3 Information Collected Automatically

1.4 Subscription and Transaction Data

2. Biometric Data Notice

IMPORTANT — PLEASE READ CAREFULLY

Certain jurisdictions, including the State of Illinois under the Biometric Information Privacy Act (740 ILCS 14/1, et seq.) (“BIPA”), regulate the collection and use of biometric data, which may include scans of face geometry.

During the skin scanning process, the App uses on-device face mesh technology to detect facial landmarks for the sole purpose of guiding the scan (face positioning, stability, and quality validation). This facial geometry data:

Your face photo (a standard photograph, not a geometric scan) is transmitted to our AI service provider solely for cosmetic skin condition analysis. This photo is processed and deleted from our systems promptly after analysis is complete. Our AI provider may retain API data for up to 55 days for abuse monitoring and safety purposes (see Section 4.1).

Biometric Data Retention and Destruction Policy:

Publicly Available Retention Schedule (as required by applicable biometric privacy laws): This Section 2 constitutes our publicly available biometric data retention policy and guidelines. We will permanently destroy all biometric identifiers and biometric information when the initial purpose for collecting such data has been satisfied, or within 3 years of the individual's last interaction with the App, whichever comes first. Face geometry data is destroyed within seconds (upon scanning session completion). Face photos sent for AI analysis are destroyed within 24 hours. Stored scan result photos are destroyed upon account deletion or manual deletion by the user.

Consent: By using the skin scanning feature for the first time, you provide your informed, written consent to the processing described in this section, including: (a) the specific purpose for which your face photo and face geometry data will be collected (cosmetic skin condition analysis and scan guidance, respectively); and (b) the length of time for which such data will be collected, stored, and used (as specified in the retention schedule above). If we materially change the disclosures in this section (for example, by changing our AI analysis service provider), we will present the updated disclosure and request your consent again before any further scanning. Consent is also re-requested when you use the App on a new device or after reinstallation. You may withdraw your consent at any time by discontinuing use of the scanning feature, and you may request deletion of all stored face photos by deleting your account or contacting us.

Compliance With Other Biometric Privacy Laws: In addition to Illinois BIPA, we comply with all applicable state and federal biometric privacy laws, including the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), the Washington Biometric Identifier statute (RCW 19.375), and any similar laws enacted after the date of this Privacy Policy. Our biometric data practices described in this section are designed to meet or exceed the requirements of all such laws.

If you have questions about our biometric data practices, please contact us at the email address listed in Section 13.

3. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your personal information for third-party advertising or marketing purposes. We do not sell your personal information. We do not use your face photos, skin analysis data, or any personal information to train, fine-tune, or improve any artificial intelligence or machine learning models. Your data is used solely to provide you with the App's services.

4. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following limited circumstances:

4.1 Service Providers

We use trusted third-party service providers who process data on our behalf to deliver the App's functionality. These providers are contractually obligated to use your information only as necessary to provide services to us and to protect your information. Our current service providers include:

4.2 Affiliate Relationships

The App contains affiliate links to third-party retailers, including Amazon. When you tap a product link and make a purchase, we may earn a commission from the retailer. This affiliate relationship does not influence which products are recommended, how products are scored, or any AI-generated analysis. Our product recommendations and fit scores are based solely on ingredient science and your skin profile. When you tap an affiliate link, the retailer (such as Amazon) may collect information about your visit, including the referring link, in accordance with their own privacy policy. We do not share your personal information, skin profile, or analysis data with affiliate partners. For more details, see Section 7 of our Terms of Service.

4.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a law enforcement request.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice within the App of any change in ownership or use of your personal information.

5. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

6. Data Security

We implement industry-standard technical and organizational measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/SSL) and at rest, secure authentication protocols, and access controls limiting data access to authorized systems.

However, no method of electronic storage or transmission over the internet is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach affecting your personal information, we will notify affected users without unreasonable delay and in accordance with applicable state and federal laws, including providing notification within 72 hours where required by law.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

7.1 All Users

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

To exercise your California privacy rights, please contact us at the email address listed in Section 13.

7.3 European Economic Area, UK, and Swiss Residents (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation:

To exercise your rights, please contact us at the email address listed in Section 13. We will respond to your request within 30 days.

7.4 Washington Residents (My Health My Data Act)

If you are a Washington resident, the Washington My Health My Data Act (“MHMDA”) provides additional protections for consumer health data, which may include skin analysis scores and concern assessments generated by the App.

To exercise your rights under the MHMDA, please contact us at the email address listed in Section 13.

7.5 Maryland Residents (Maryland Online Data Privacy Act)

If you are a Maryland resident, the Maryland Online Data Privacy Act (“MODPA”) provides additional protections for sensitive data, which may include biometric data and health-related data such as skin analysis scores.

We collect and process sensitive data only as strictly necessary to provide the App's core analysis and recommendation features described in Section 3. We do not sell sensitive data. You may exercise your rights under MODPA, including the right to access, correct, and delete your data, by contacting us at the email address listed in Section 13.

8. Do Not Track and Global Privacy Control

Some web browsers and devices transmit “Do Not Track” (DNT) or Global Privacy Control (GPC) signals. The App does not track users across third-party websites or services, does not serve targeted advertising, and does not sell or share personal information for cross-context behavioral advertising. As such, there is no tracking activity for DNT or GPC signals to opt out of within the App. We honor GPC signals as valid opt-out-of-sale requests to the extent required by the CCPA, although we do not engage in any sale or sharing of personal information.

9. Children's Privacy

The App is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under the age of 16. If we become aware that we have collected personal information from a child under the age of 16, we will take steps to delete that information promptly. If you are between the ages of 16 and 18, you must have the consent of a parent or legal guardian to use the App. If you believe a child under 16 has provided us with personal information, please contact us at the email address listed in Section 13.

10. Third-Party Links and Services

The App may contain links to third-party websites, products, or services (such as product recommendations linking to retailer websites). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information. This Privacy Policy applies solely to information collected through the App.

11. International Data Transfers

Your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction. By using the App, you consent to the transfer of your information to the United States and other countries.

We are based in the United States. If you access GLOW from the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data may be transferred to and processed in the United States and other countries that may not provide the same level of data protection as your home country.

Where we transfer personal data from the EEA, UK, or Switzerland to a country not deemed adequate by the European Commission or the UK Information Commissioner's Office, we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses (SCCs) and the UK Addendum to the SCCs. We have entered into Data Processing Addenda incorporating SCCs with our service providers (including Convex, Cloudflare, Anthropic, OpenRouter, Google, Resend, Sentry, PostHog, RevenueCat, and Clerk) to ensure adequate protection of personal data in connection with cross-border transfers.

You may request a copy of the safeguards we use by contacting support@glowskincare.app.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of any material changes by posting the updated Privacy Policy within the App and updating the “Last Updated” date at the top of this page. For significant changes, we may also provide additional notice through email or an in-app notification. Your continued use of the App after such changes constitutes your acceptance of the updated Privacy Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: support@glowskincare.app
Chapel Hill, NC, United States

We will respond to your inquiry within 30 days.

This Privacy Policy is effective as of the date listed at the top of this page.

Consumer Health Data Privacy Policy →