Privacy Policy

Blimae · Last updated 21 October 2026

Blimae analyses your skin from a selfie and builds a skincare routine around your answers. This policy explains exactly what happens to that data — including the part most apps leave vague: your photo.

1. Who we are

Blimae ("we", "us") is operated by Steeven Noncent, 47 rue Littré, 44100 Nantes, France, who is the data controller for the processing described here.

For any privacy question or request, contact contact@blimae.com.

2. Your account, and the identifier we use without one

When the app asks for an account

Earlier versions of the app have no sign-up and no login. Versions with accounts ask you to create one right after you subscribe and see your full results, with Apple, with Google, or with an email address and a password. If you already have one, you can sign in from the app's first screen instead, and your backup comes back. If you subscribed in a version without accounts and update the app on the same iPhone, you are never required to create one, even if you had not finished the questionnaire; Profile offers it. If you delete and reinstall the app, or erase your data, the questionnaire starts over and asks for an account like it does for anyone.

What your account holds

• The email address it uses. With Apple you can choose Hide My Email: we then receive a private relay address from Apple, never your own.
• The identifier Apple or Google gives us for you, so that the same sign-in always finds the same account. With Apple, we ask for no name. With Google, the sign-in also passes on the name and the profile picture address of your Google account; our sign-in service stores them with the account as Google sends them, and Blimae neither uses nor shows them.
• With an email address, your password, stored by our sign-in service only as a one-way hash: nobody at Blimae can read it.
• A random account identifier, created with the account. It is not your email address and says nothing about you.
• Sign-in records: when the account was created and last used and, for each phone signed in, the time, IP address and type of device of the session, which our sign-in service keeps to protect the account.
• Your account backup, described in section 3.

We never ask for your surname, phone number or postal address. The first name you can optionally enter stays on your device to greet you — the single exception is the skin coach, whose opening greeting is part of the conversation sent with your question (see section 3).

The emails about your account — the link to confirm your address, or to choose a new password — are the only emails the account sends. We send no newsletter and no marketing.

The device identifier

To count how many scans a device has used — our analysis provider charges per scan, so it is metered — the app generates an identifier the first time it opens, made of the moment of that first launch and a random string, for example dev-mfk3z1a0-q7x2m9b4kt. It is created by the app, it is not your device's advertising ID or any hardware serial number, and without an account it is not linked to you. Deleting the app deletes it; reinstalling produces a new, unrelated one. Restoring a purchase asks Apple what your Apple ID already owns, so your subscription follows you to the new identifier — without an account, nothing else does. When you sign in, the app asks RevenueCat to move your subscription from this identifier to your account identifier, and RevenueCat's records then show that move (see Your subscription in section 3).

3. What we process, and why

Your selfie

When you run a skin analysis, the photo is sent over an encrypted connection to our backend, which immediately forwards it to the analysis provider that scores it. Our backend keeps no copy: as soon as the scores come back, the photo is gone from it. The provider necessarily receives and holds the photo for the time it takes to run the analysis, and applies its own retention period to it — see its policy, linked in section 4.

The copy of your photo saved with your report lives on your phone, in the app's private storage, so you can compare scans over time. It is removed when you delete the scan or the app.

Because that copy disappears with the app, Profile → Help & data offers Save my photos to Photos, which writes them into your own photo library. It runs only when you tap it, it asks iOS for permission to add photos and nothing more — Blimae never gains the right to read your library — and the copies then belong to you alone: they are outside the app, and deleting Blimae no longer touches them. Nothing is sent to us at any point.

Once per device, the same photo is also used for the skin simulation: the provider returns a version of your own face with your main concerns corrected, so you can see what your skin could look like. That image is generated from your selfie, sent straight back to your phone and stored there — we keep neither the source photo nor the result.

No face recognition. Blimae does not identify faces. We ask the analysis provider for skin-condition scores and the overlay images shown in your report, and that is all we receive: no faceprint, no face template, no identifier that could be used to recognise you in another photo. Your phototype is worked out on your phone from the answers you gave, and is never sent anywhere.

Your questionnaire answers, routine and history

Skin type, concerns, goal, sensitivity, sun responses, product preferences, age range, the skin conditions and the ingredient reactions you tell us about, what you told us about pregnancy, breastfeeding or a prescription treatment, your daily check-ins, the reactions you log and your saved products are stored on your device. Without an account, they stay there: we do not receive a copy or hold them on our servers. With an account, part of them is also kept in your account backup, described just below; the rest never leaves your phone.

The one other exception is the skin coach. When you ask it a question, your recent messages in that conversation are sent along with it. Only if you agree on the coach screen, a summary of your plan travels with them too, so the answer fits your plan: your goal, skin type and sensitivity, your age group when it changes your plan, your routine and products, products set aside and why, the reactions you logged, the ingredients you told us you react to, your weekly readings and, if you told us, pregnancy, breastfeeding or a prescription treatment. The coach screen shows you exactly these lines before you agree, and lets you stop sharing at any time. Without your agreement, nothing about you goes with your question. Either way, it is used to produce the reply and is not stored on our servers afterwards. (Version 1.0.1 of the app sends a shorter summary — skin type, goal, sensitivity and product preferences — with each question; updating the app replaces it with this choice.)

Your account backup

While you are signed in, the app keeps a backup of part of what is on your phone in our database, under your account, so that it comes back when you sign in on another iPhone or after reinstalling the app. The app writes it a few seconds after something in it changes and when it goes to the background; only your own signed-in session can read or change it.

What the backup contains:

• your questionnaire answers, except the three listed below — for example your goal and its detail, your concerns, your skin type and how reactive it is, your routine and the products you use, your sun answers and your age group;
• your readings: for each full analysis or weekly scan, its date, its kind, the scores it returned, the skin type it read and which provider produced it — never the photo, never the overlay images;
• what your plan reads: the products on your shelf, except the ones you marked as prescribed by a doctor (name, brand, ingredient list and where it came from, when you started it, whether you use it), the changes to your plan you accepted or declined (for example stopping or pausing a product), the steps you added or removed, when you set your current goal and your earlier goals, and for each day the steps you ticked and how your skin felt (calm, oily, dry, breakout, sensitive or irritated). The app keeps the backup under a size limit; if it ever grew past it, your oldest daily ticks would be left out of it (they stay on your phone);
• the product records your shelf and your added steps point to;
• where you are in the app: whether you finished the questionnaire and your first analysis, the badges already celebrated, the guides you read and the weekly cards you opened.

What never goes into it:

• your photos — your scans, the skin simulation, a photo waiting for its analysis, your profile picture — and the overlay images;
• your answers about skin conditions (such as rosacea or eczema), the ingredients you told us you react to, and what you told us about pregnancy, breastfeeding or a prescription treatment. On a new iPhone, the app asks these again;
• the products you marked as prescribed by a doctor, and the days you ticked them. On a new iPhone, you add them again;
• the reactions you log in your evening check-in;
• your first name, your coach conversation, your favourites and saved articles, and your choices about coach sharing, sending your weekly scan photos for analysis, the usage journal and notifications;
• anything about your subscription, which RevenueCat and Apple decide.

Signing out keeps everything on your phone and stops the backup until you sign in again. If a different account then signs in on that iPhone, the app saves nothing to it before asking: erase the phone's data first, or keep it with the new account. Erase my data in Profile, while you are signed in, erases the backup too (your account stays); deleting your account erases both (section 6). Nothing is saved to the backup before you have answered the age question, and nothing at all if you answer that you are under 16 (section 7).

Products you look up

When you search for a product, photograph its packaging, or scan its barcode, what you typed or photographed is sent to our backend and on to the provider that identifies it. A barcode is looked up in the open Open Beauty Facts database, and the ingredient list printed on the pack is then read by OpenAI so the app can say who the formula suits; a search term or a packaging photo is read by OpenAI directly. Product photos are handled exactly like your selfie: passed through, never written to a database, a storage bucket or a log of ours. We keep no record of what you searched for — the products you save live on your phone and, if you have an account, in its backup.

Usage counters

We store, against your anonymous identifier, counters only: how many full analyses and weekly scans that device has run, how many analysis attempts it has made today, whether it has used its one skin simulation, how many coach messages and product searches it has sent today, and the time of the last of these. When you are signed in, the same counters are also kept against your account identifier, so that one account signed in on several iPhones shares one weekly scan and one daily allowance of coach messages and product searches, and has at most two skin simulations. Some counters reset daily or weekly; the full-analysis and simulation counts are kept for the life of the identifier. This is what enforces the weekly scan limit and prevents abuse of a paid API. No content is stored — not your photo, not your question, not what you searched for.

Your subscription

Your subscription is billed by Apple through the App Store, and it stays tied to your Apple ID: only you can cancel it, in your iPhone Settings → your name → Subscriptions. Deleting your account does not cancel it. We never see your payment details. Through RevenueCat we learn whether a subscription is active, which plan it is and until when, so the app can unlock it. Without an account, RevenueCat knows you by your anonymous device identifier. When you sign in, the app asks RevenueCat to file your subscription under your account identifier instead, so that it is attached to your account; signing out, or deleting the account, asks RevenueCat to move it back to the device identifier. Our server keeps RevenueCat's answer against the identifier it asked about — the device identifier and, when you are signed in, the account identifier — so that scans and the coach are provided to subscribers only. When a device without an active subscription asks for one of them, our server keeps that device identifier for 30 days, so we can check that no paying subscriber is ever refused by mistake. To count sales, we also keep a record of each purchase, renewal, cancellation or refund — product, price, currency, country and date — with no device identifier, account or anything else that could tell who made it.

Usage journal

To see where the app helps and where people give up, it records which screens are opened and which buttons are used — including whether an account was created, signed in to, signed out of or deleted, and whether with Apple, Google or email — never what you answered, never a score, a photo, a message, a product name or an email address. These events carry a random identifier created on your phone for this purpose only. It is different from the device identifier used for scan limits and your subscription, and from your account identifier, and they are never joined. You can turn the journal off in Profile › Help & data; the events are kept for 13 months.

In the European Union, the EEA, the United Kingdom and Switzerland, the journal is off until you turn it on. The app asks you once, with “Allow” and “No thanks” side by side, and the same switch stays in Profile › Help & data. Until you say yes, nothing is recorded, nothing is stored on your phone for it and nothing is sent; turning it off later deletes the journal identifier and anything not yet sent. Your region comes from your phone's region setting or time zone; when the phone gives neither, the app treats it as European. What is needed to give you the service and keep it safe — the device identifier for scan limits, your account, your subscription status, purchase records and the consents you give on screen — does not depend on this switch.

4. Who else sees your data

We use the processors listed below, and only for the purposes above. We do not sell your data, we do not share it with advertisers, and none of it is used to train our own models.

• Perfect Corp. — performs the skin analysis and the skin simulation on your photo. See their privacy policy.
• OpenAI — powers the skin coach, identifies the products you search for or photograph, and scores your selfie when the primary provider is unavailable. API data is not used to train their models. See their privacy policy.
• RevenueCat — checks your App Store receipt on our behalf and tells the app whether a subscription is active. It receives your anonymous device identifier or, once you are signed in, your account identifier (never your email address), and the subscription information Apple returns; it never receives your photo, your answers or your coach messages. See their privacy policy.

All three are established outside the European Economic Area. Transfers rely on the European Commission's Standard Contractual Clauses. Each provider applies its own retention period to the data it receives, which we do not control beyond our contract with them; their policies above describe it.

One lookup does not go through us at all. When you scan a product barcode, your phone queries Open Beauty Facts — the open, non-profit cosmetics database — directly, so that service sees the barcode and your device's IP address. We send it nothing about you, and we receive back only the product record. See their site for how they handle it.

Our backend and database — including the sign-in service, your account and its backup — are hosted by Supabase in the European Union (Paris region).

The emails about your account (confirming your address, resetting your password) are sent through Google Workspace, our email provider, which receives your address and the message for that purpose only. Google may process them outside the European Economic Area; that transfer relies on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

If you sign in with Apple or Google, that company confirms your identity to us and learns that you use Blimae; what it does with that sign-in is governed by its own policy (Apple, Google). We do not receive your Apple or Google password.

Your subscription is billed by Apple through the App Store. We never see your payment details: see Your subscription in section 3 for what RevenueCat tells us and what we keep.

5. How long we keep things

• Your selfie: not retained by us at all.
• Your account and its backup: as long as the account exists. Deleting it in the app removes the account — its email address, its sign-in identifiers, its sessions — and its backup from our database at once. Copies in our hosting provider's routine database backups, where they exist, disappear as those backups expire.
• Sign-in records: a session's record ends when the session does (when you sign out, or delete the account). Our sign-in service also logs each sign-in, with the account's email address and the IP address it came from; those logs are kept by our hosting provider under its own log retention.
• Devices found without a subscription when asking for a scan or the coach: 30 days, then deleted automatically.
• Usage counters: kept for as long as that device identifier is in use, so a scan limit cannot be reset by closing the app. You can have them deleted at any time — see section 6. The counters kept against an account stay after the account is deleted, as numbers only, under an identifier that no longer points to an account.
• Your subscription record at RevenueCat: the record of your purchases stays with RevenueCat as a financial record, under the identifier it was filed under, after your account is deleted.
• Error logs: our backend records technical failures — status codes, error messages, and a truncated excerpt of what the provider answered — to diagnose problems. Your photo is never written to them; an excerpt can occasionally carry part of one of the short-lived links to an overlay image from your scan, and those links stop working within hours. Logs are kept by our hosting provider under its own retention.
• Everything on your device: as long as you keep the app. Deleting the app deletes all of it, except your account's sign-in: iOS keeps it in the Keychain, so that reinstalling Blimae finds you signed in and brings your backup back. Sign out first if you do not want that.

6. Your rights

Under the GDPR you can request access to your data, correction, erasure, restriction, portability, and object to processing based on legitimate interest. Write to contact@blimae.com.

If you have an account, you can also write to us — for a copy of your backup, a correction, or its deletion. The mails the app prepares (Profile → Help & data) carry your account identifier, which lets us find your account even if you signed in with Apple and hid your email address; otherwise we look for the email address you write from.

You also have the right to lodge a complaint with your national data protection authority.

7. Children

Blimae is not directed at children under 16 and we do not knowingly process their data. The questionnaire asks your age group: an answer under 16 ends it, and nothing else is asked. Without an account, nothing is sent either. If you had signed in to an account before that question, nothing is saved to its backup before the question is answered, and an answer under 16 deletes any backup that account held, at once (or as soon as the phone is online). If you are 16 or 17, your plan follows what dermatologists advise for young skin: it does not add retinoids, vitamin C or exfoliating acids, and suggests a dermatologist for a retinoid. Acne care is the same as for adults. Your age group stays on your phone, and in your account backup if you have an account; if you are under 18, or have not said, and you agreed to share your profile with the coach, the coach is told so with your questions, so that it gives the same advice.

8. Security

All traffic between the app, our backend and our providers is encrypted in transit (TLS). Provider credentials are held server-side as secrets and are never shipped in the app. Access to our database is restricted to the backend service, with one exception: your account backup, which the app reads and writes with your own signed-in session, and which row-level security limits to your account alone. On your iPhone, your session is kept in the iOS Keychain.

9. Changes

If we change how we handle your data, we will update this page and its date. Material changes will be surfaced in the app.