Privacy Policy

Information We Collect

The app stores your name, quiz answers, scan records, product shelf items, daily logs, product tests, verdicts, saved scan photos, and saved product photos locally on your device. Optional product-label text and barcodes are read on-device with Apple Vision and are not sent to Works On Me, Vercel, or OpenAI. If you subscribe, scan history remains on your device so you can compare progress over time.

For an OpenAI analysis, the app sends a compressed selfie and quiz answers. Version 1.0.2 and later send skin type, selected skin concerns, sensitivity, and fragrance preference. Version 1.0.1 and earlier also send age, skincare spending range, sleep range, routine-safety preference, and shopping preference. Your name, location, random app-install identifier, scan operation identifier, RevenueCat anonymous app-user identifier, analytics cohort identifier, and the Apple Vision face rectangle are not sent to OpenAI.

The app sends a random app-install identifier, per-capture scan operation identifier, and RevenueCat anonymous app-user identifier only to the Works On Me analysis endpoint, hosted by Vercel, for server-side access checks, bounded lost-response recovery, and abuse limits. The endpoint uses the RevenueCat identifier to verify membership with RevenueCat or authorize one teaser analysis. For an active membership, it uses RevenueCat's canonical original app-user identifier so restored aliases for the same subscriber share one membership-week limit. It immediately converts access, operation, and ordinary network identifiers into one-way HMAC-derived keys. Upstash receives those keys, counters, and opaque retry state. It does not receive the raw identifiers or network address. Works On Me does not send them to OpenAI or advertising systems.

Vercel hosts the Works On Me website and API endpoints. It processes request contents and ordinary network metadata, such as IP address, device or browser information, and request timestamps, to operate and secure those endpoints.

If you allow location access, the app uses your approximate location at scan time to request local humidity, UV index, and weather context. Coordinates are used for that weather request and are not saved in your scan history.

Apple and RevenueCat process an anonymous app-user identifier, subscription product, purchase history, and entitlement status to complete purchases, unlock membership, restore access, and provide subscription-performance analytics. The Works On Me endpoint also sends that anonymous identifier to RevenueCat to verify the active membership before analysis.

The app automatically sends privacy-filtered product-interaction events, such as scan completion, report views, routine actions, paywall actions, and purchase conversion, to the Works On Me analytics endpoint. These events may include a separate random first-party analytics cohort identifier so Works On Me can understand whether a purchase cohort later reaches product value. They exclude names, contact information, the RevenueCat identifier, photos, location, quiz answers, advertising identifiers, and cross-app tracking data.

When an install qualifies for Apple's privacy-preserving ad attribution, the app registers a constant first-launch value with Apple. Apple may send a privacy-preserving install postback to the ad network. Works On Me does not receive an advertising identifier or user-level attribution record from this process. The app does not use IDFA or ask for permission to track you across other companies' apps or websites.

The website stores one first-party A/B variant cookie, containing only “a” or “b” for up to one year, so repeat visits receive the same landing-page treatment. The website also sends privacy-filtered first-party interaction events with the page path, assigned variant, and bounded campaign tags supplied in the URL. The cookie and website events exclude names, contact information, account or device identifiers, photos, location, and advertising identifiers, and are not used for cross-site tracking.

Before launch, the website email form collected email addresses only for waitlist and launch updates. That form is no longer active.

Works On Me is for adults 18 and older at launch.

How We Use Information

• To send a scan to OpenAI only after you grant analysis permission, then generate cosmetic estimates of visible skin marker bands and personalized routine guidance.
• To show your report, timeline, and scan comparisons inside the app.
• To verify membership server-side, authorize one teaser analysis, enforce access limits, and protect the Works On Me analysis endpoint from abuse.
• To provide optional scan-time weather context.
• To understand product performance using privacy-filtered interaction events.
• To send launch updates to people who joined the prelaunch website email list.
• To process subscriptions, restore purchases, and understand subscription performance through RevenueCat and Apple.

Data Monetization

We may use aggregate, anonymized insights to understand product performance. We never sell individual user data or share it for advertising. Brand payments never influence Works On Me recommendations.

Face and Scan Data

Face data means the selfie you choose to submit for cosmetic analysis and the temporary face rectangle used to guide capture. Apple Vision calculates the face rectangle on your device only. The rectangle is not transmitted or stored, and Works On Me does not perform face recognition, identify people, or create faceprints or biometric identity templates.

After you take a selfie and answer the quiz, the app shows an Allow OpenAI analysis? screen before the selfie and quiz answers are first sent for analysis. Those items are not sent until you tap Allow & analyze. If you tap Not now, the app sends no selfie or quiz answers for that scan. A Don’t ask me again option is off by default; if you select it before allowing analysis, the app remembers that permission on this device for later scans under the same disclosure. A camera acknowledgement is not permission to transfer data to OpenAI.

After you grant analysis permission, the compressed selfie and the quiz fields listed above pass through the Works On Me analysis endpoint, hosted by Vercel, to OpenAI only to generate the requested cosmetic report and protect service integrity. The same occurs on a later scan while your optional remembered permission remains active. Works On Me does not persist the selfie or quiz answers on its servers after completing the request. OpenAI may keep API inputs and outputs, including the submitted selfie, quiz answers, and report, in abuse-monitoring logs for up to 30 days, unless longer retention is required by law or reasonably necessary to protect its services or third parties from harm. OpenAI does not use API data to train its models by default.

Paying users can save scan photos locally on their device for timeline and comparison features. Local photos remain until you use Delete all data in the app, delete them through an available app control, or remove the app. Scan photos are not sold, used for advertising, or used to train Works On Me models.

Third-Party Services

Works On Me uses Vercel to host its website and API endpoints, OpenAI as its third-party AI provider for report generation, Open-Meteo for optional weather context, RevenueCat for subscription entitlement management, Upstash Redis for access and abuse-limit state, and Apple for App Store purchases. Vercel processes analysis requests, access identifiers, privacy-filtered product-interaction events, and ordinary network metadata only to operate and secure the Works On Me endpoints. RevenueCat receives its own anonymous app-user identifier for entitlement verification. Upstash receives only one-way HMAC-derived access and network keys, reservations, and counters, not the raw identifier, raw network address, selfie, or quiz answers. Access and analytics identifiers are not forwarded to OpenAI.

Works On Me requires every service provider that receives personal data from the app to use it only for the purposes described in this policy and to provide the same or equal protection of user data as this policy and Apple's App Review Guidelines require.

Consent and Your Choices

OpenAI analysis is opt-in. By default, Allow & analyze authorizes only that scan and future scans require a new choice. If you select Don’t ask me again, the app stores a versioned permission only on this device so later scans can begin analysis without showing the permission screen again. You can revoke that choice from the next scan’s preflight or Profile by selecting Ask me before every scan, and Delete All Data also clears it. A changed disclosure requires permission again. A transfer that has already completed cannot be reversed; the retention terms below still apply to data already processed.

You can turn off location access in iOS Settings. You can use Delete all data in the app to remove locally stored quiz answers, including their device-local Keychain copy, scan records and photos, shelf items and photos, daily logs, product tests, verdicts, the random app-install identifier, and analytics cohort identifier. The next analytics event uses a new cohort identifier. Server-side anti-abuse records are not reset. Use Delete all data before removing the app if you want to ensure the Keychain copy is deleted.

To request deletion of a prelaunch website email address or ask about data already processed by a service provider, email help@worksonme.com.

Retention and Deletion

• Works On Me does not retain submitted selfies or quiz answers on its servers after completing an analysis request.
• OpenAI may keep the submitted selfie, quiz answers, and generated report in abuse-monitoring logs for up to 30 days, unless longer retention is required by law or reasonably necessary to protect its services or third parties from harm.
• Vercel retains service-generated network and security data only as described in its service terms and privacy notice. Works On Me does not intentionally log submitted selfies or quiz answers.
• Local app data, the random app-install identifier, and analytics cohort identifier remain on your device until you delete them with an available app control or use Delete all data. The device-local Keychain copy of quiz answers may persist after the app is removed unless Delete all data is used first.
• Privacy-filtered product-interaction events and their random analytics cohort identifier are retained only as long as needed to understand product performance, then deleted or kept only in aggregate form.
• The first-party website A/B variant cookie expires after one year unless you clear it sooner. Website interaction events are retained only as long as needed to measure product and campaign performance, then deleted or kept only in aggregate form.
• Upstash retains one-way HMAC-derived keys needed to remember teaser, membership-week, included quality-retake, and bounded same-operation recovery state. Membership and operation keys expire no later than seven days after the official scan; HMAC-derived network and global daily counter keys expire within 48 hours. Upstash does not receive the selfie, quiz answers, report, raw RevenueCat identifier, raw operation UUID, or raw network address. Delete all data removes local identifiers and product data but does not reset these server-side anti-abuse records.
• Apple and RevenueCat retain purchase and entitlement records as needed to provide subscriptions, restore purchases, measure subscription performance, meet legal obligations, and resolve transactions.
• A prelaunch website email address remains on the launch list until you unsubscribe or request deletion.

Medical Disclaimer

Works On Me results are cosmetic estimates, not medical diagnoses. Consult a dermatologist for medical skin concerns.

Contact

Questions? Email help@worksonme.com.