Privacy Policy

MySkync Privacy Policy
Effective date: 8 October 2026. Last updated: 8 October 2026

MySkync is built so the only people processing your data are you, us, and the small set of vendors we need to operate the service. This Privacy Policy explains what data we collect, how we use it, and the rights you have.

1. Who we are
MySkync is operated by Skync Labs, registered at Thamerhorn 28, Uithoorn, 1421 CE, The Netherlands. KvK 42058858, BTW 281314755B01. We are the data controller for your personal data.
General contact: support@myskync.com

Privacy questions, data requests and exercising your rights: support@myskync.com

Data Protection Officer. Skync Labs has assessed whether it must appoint a Data Protection Officer under Article 37 GDPR and has concluded that it is not required to do so at this stage, as its processing does not currently meet the “large scale” threshold in Article 37(1)(c).

Skync Labs keeps this assessment under review and will appoint a Data Protection Officer if the scale of processing grows.

For any privacy or data protection question, contact support@myskync.com.

2. What we collect
• Account data: your email address and an authentication identifier managed by Firebase Authentication (email and password sign-in only; MySkync does not currently offer Sign in with Google or Sign in with Apple).

• Onboarding data: age range, gender, skin type, smoking status, exercise frequency, country, and skin concerns (optional).

We treat this whole category as special category data alongside your daily entries (see Section 3), because it directly feeds the SkinBalance score and insights together with your health data, not because every individual field (for example gender or country) is inherently special category on its own.

• Daily entry data, which is special category (health) data under Article 9 GDPR:
• Skin state, selected from a fixed list (dry, normal, breakout, glowing, sensitive)
• Lifestyle factors, recorded from fixed options only, with no free-text field: sleep (hours), water intake (ml), stress level, and routine completion
• Skincare products you log: you enter the product name and brand yourself as free text the first time; it is then saved to your own list for quick selection on later entries. You can add new products at any time. There is no preloaded product catalogue. Please enter only the product name and brand in this field, and no personal or health information.
• One photo per entry (optional), stored in Firebase Storage
• Notes: an optional free-text note you can add to an entry. Please enter only what is necessary, and no sensitive personal information or information about other people.
• Derived data: your SkinBalance score and any insights or Before/After comparisons generated from the data above. These are calculated by fixed rules on our backend (see Section 6).
• Parental authorisation record: if you are aged 16 or 17, a timestamped record that the permission of your parent or guardian was confirmed at signup (see Sections 3, 8 and 11).
• Subscription status: whether your plan is “free” or “pro”, enforced and stored on our backend.
• Photos that include other people: you may upload only photos of yourself or images that do not identify anyone else. The Terms of Use prohibit uploading a photo of an identifiable person without that person’s consent. If an image you upload nonetheless includes another person, you are responsible for having a lawful basis to do so; we process that image only as part of your own entry, under the same security and retention rules as your other data, and we will remove it on a valid request.

What we deliberately do NOT collect:
• No advertising trackers
• No third-party analytics SDKs
• No AI provider of any kind; MySkync does not use AI or machine learning
• No precise location (only the country you provide at onboarding)
• No payment card details (Apple and Google handle billing for Pro subscriptions)
• No reading from Apple Health, HealthKit or any other external source: all data comes from what you enter yourself.

3. Why we collect it (legal basis)
Account data and core app functionality: to provide the skin-tracking service you sign up for. Article 6(1)(b) GDPR (performance of a contract).

Onboarding and daily entry data (special category health data): this data is processed on two cumulative legal bases. First, Article 6(1)(b) GDPR, because processing it is necessary to provide the tracking service that is the entire purpose of MySkync. Second, because this is health data, Article 9(2)(a) GDPR, your explicit consent, captured via a separate, unticked consent step at onboarding: you must actively check a box reading “I consent to MySkync processing my skin condition, photos and related health information to provide tracking and insights”, distinct from accepting the Terms of Use, before this data is collected.

Because tracking your skin and health data is the entire purpose of the App, there is no reduced-functionality account that omits it.
See Section 9 on how to withdraw this consent.

Parental authorisation record (users aged 16 and 17): to evidence that the guardian permission required for a minor to accept the Terms of Use has been obtained.
Article 6(1)(f) GDPR (our legitimate interest in forming a valid contract with a minor and in safeguarding minors), read together with our accountability obligation under Articles 5(2) and 24 GDPR.
• Subscription and plan enforcement: Article 6(1)(b) GDPR (performance of a contract).
• Security and abuse prevention: Article 6(1)(f) GDPR (legitimate interest).
• Customer support correspondence: Article 6(1)(b) or (f) GDPR.

4. How we use it
To show you your own entries, timeline, SkinBalance score and insights; run Before/After comparisons you request; enforce free versus Pro feature access; respond to support requests; fix bugs and keep the App secure; and comply with our legal obligations.

We do NOT use your data to: train any AI or machine-learning model; send you advertising; build a marketing profile of you; or sell or share your data with anyone outside the vendors listed in Section 7.

5. Where your data lives
Your data is stored using Google Firebase (Firestore for entries and profile data, Firebase Storage for photos), hosted in the europe-west4 region (Netherlands), physically inside the European Union.

Data in transit is encrypted (TLS) and Firebase encrypts data at rest by default. Access to the Firebase project is restricted to authorised Skync Labs personnel. Firestore is protected by an automated backup schedule (see Section 8), and our Firebase Storage bucket has soft delete enabled (also Section 8); object versioning is off.

6. Rule-based scoring and insights (no AI)
MySkync does not use artificial intelligence or machine learning anywhere in the App. Your SkinBalance score is calculated by a fixed points formula (for example, based on your logged sleep, water intake, stress level and routine completion). Insights shown to you are selected from a fixed set of rules and pre-written templates, filled in with your own numbers (for example, “On {{count}} days…”).

This processing happens entirely on our own backend (Firebase Cloud Functions). We do not send your entries, photos or onboarding data to any external AI provider, and this data is never used to train a model of any kind.

These features do not produce a decision with legal or similarly significant effects on you (see Section 10).

7. Who else handles your data
We rely on the following providers. Those that act as our processors handle your data only on our instructions and under a data processing agreement with us.

The app stores, Apple and Google, act as independent controllers for the billing they operate: they handle payment data under their own terms, not as our processors. Where a provider is incorporated outside the EU, the transfer is covered by the European Commission’s Standard Contractual Clauses (Module 2, 2021/914) and, where applicable, the EU-US Data Privacy Framework.

Processors (under a data processing agreement):
Google LLC / Google Firebase (US-incorporated company): authentication, database (Firestore), file storage (Firebase Storage), and backend processing (Cloud Functions) for scoring, insights, comparisons and account deletion.

Your data itself is hosted in Google’s europe-west4 region (Netherlands); Google LLC’s US incorporation means limited administrative access to the underlying infrastructure may occur from outside the EU, which is why we rely on the Standard Contractual Clauses and the EU-US Data Privacy Framework described above.

Independent controllers:
Apple Inc. (US company, EU-US DPF certified): App Store distribution and, if you subscribe on iOS, billing for MySkync Pro. Apple acts as a separate controller for that payment data under its own terms and does not receive your entries or photos.

Google LLC (Google Play) (US company): Play Store distribution and, if you subscribe on Android, billing for MySkync Pro. Google relies on the European Commission’s Standard Contractual Clauses for transfers outside the EEA, and using Google Play means the billing is governed by Google’s controller-to-controller data protection terms: Google acts as a separate controller for that payment data, not as our processor, and does not receive your entries or photos.

TransIP B.V. (Netherlands): email and support inbox hosting (support@myskync.com). Data stored in the EU (Amsterdam). Processor, under a data processing agreement.

We do NOT share your data with advertisers, data brokers, marketing networks, or any AI provider.

If a third-party subscription-management provider (for example RevenueCat) or any analytics or crash-reporting tool is added in the future, it will be added to this list, along with what it receives, before it goes live, and this Privacy Policy will be updated first.

8. How long we keep it
Account, onboarding and entry data: we keep this for as long as your account is active, meaning until you choose to delete it.

There is no fixed end date, because you decide how long you use MySkync, and you can delete your account and all its data at any time (see below and Section 9).

If your account is inactive for 6 months, we will send you a reminder so you can decide whether to keep or delete it. This is a service message about your account, not a marketing email.

Live data:
Permanently and immediately deleted by our account-deletion Cloud Function as soon as you confirm account deletion.

Your user profile, all entries and all photos are removed from Firestore and Firebase Storage in the same operation, and are no longer visible or accessible to you or to us through the App or our normal tools.

Firestore backup copies:
Our database has an automated backup schedule for disaster-recovery purposes, independent of the live deletion above.

Backup snapshots are retained for up to 98 days, after which they are automatically overwritten. Restoring from a backup is an exceptional, manually triggered process we would use only to recover from a technical failure, not a way to browse or re-access an individual deleted account.

Storage soft delete (photos):
Our Firebase Storage bucket has soft delete enabled, which briefly retains a recoverable copy of a deleted file for up to 7 days before permanent, automatic erasure. Object versioning is switched off. This 7-day window exists to protect against accidental data loss (for example a bug deleting the wrong file), not for any other use.

Parental authorisation record (users aged 16 and 17):
Kept as evidence that valid guardian permission to accept the Terms of Use was obtained.
A minor’s contract may be set aside for up to three years after the minor reaches 18 (art. 3:52 Dutch Civil Code), so this record retains its evidential value until then. Because we hold only your age range and not your date of birth, in practice we keep it for 5 years from the date it is created, after which it is deleted.

Customer support emails: 2 years from the date of last contact.
Pro content after a downgrade:
If you move from Pro to the free plan, content you created under Pro is kept but hidden, and becomes visible again if you resubscribe.
If you do not resubscribe, it is deleted 24 months after the downgrade.
You can access and export your data on any plan (see Section 9).

9. Your rights under the GDPR
• Access (Art. 15): support@myskync.com
• Rectification (Art. 16): most fields are editable in-app
• Erasure (Art. 17): in-app, Settings, then Delete account (see Section 8 for timing)
• Restriction (Art. 18): support@myskync.com
• Data portability (Art. 20): request via support@myskync.com, free of charge, delivered in a machine-readable file
• Object (Art. 21): support@myskync.com
• Withdraw consent (Art. 7(3)): your explicit consent under Article 9(2)(a) is what allows us to process your health data. Because that consent is a mandatory condition for processing this special category of data, withdrawing it means we can no longer lawfully process it, even though our contract with you would otherwise cover it. Since tracking your health data is the entire service, there is no reduced version to fall back to: withdrawing consent and deleting your account are therefore the same action.
From Profile, then Settings, then Account, then “Delete my data”, you can withdraw consent and erase your account and all its data in one step, at any time, in one tap. This satisfies Article 7(3)’s requirement that withdrawal be as easy as giving consent.
Once deleted, you would need to register again, and give consent again, to use MySkync in future.

Lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)
We respond to all rights requests within one month, which we may extend by up to two further months for complex or numerous requests, informing you within the first month (Article 12(3) GDPR).

10. Profiling and automated decision-making
The SkinBalance score and the insights generated from your entries constitute profiling as defined in Article 4(4) GDPR: automated processing of your personal data to evaluate certain personal aspects relating to you, in this case aspects of your skin condition and habits.

We are explicit about this rather than treating it as something other than profiling.

This profiling does not fall within the restriction in Article 22(1) GDPR, because it is not a decision “based solely on automated processing” that “produces legal effects concerning you or similarly significantly affects you”. Specifically:

The score and insights are shown only to you, for your own information; we do not use them to make any decision about you.

They do not determine your access to the App, to any feature, or to your account: access to Pro features is determined solely by your subscription status, never by your score or insights.

They have no legal effect (for example they do not affect any contract, right, benefit or entitlement) and no similarly significant effect (for example no differential treatment, pricing or restriction results from them).

Because Article 22 is not engaged, you do not have a standalone right under that article to contest this profiling or obtain human intervention in a “decision”, as there is no automated decision being made about you to contest.

You retain your other rights in Section 9 in full, including the right to object to this processing (Art. 21) and to withdraw your consent to it (Art. 7(3), Section 9).

11. Children
MySkync is intended for users aged 16 and over.
Under Article 8 GDPR, as implemented in the Netherlands by Article 5 of the UAVG (Uitvoeringswet AVG), the age at which a person can validly give their own consent to an information society service is 16. Because MySkync relies on your own explicit consent to process your health data (Section 3), and cannot rely on the consent of a person under 16, we do not offer the service to anyone under 16: account creation is blocked if you select an age range under 16 at signup.

If you are 16 or 17, we knowingly process your data, including your health data. At that age you are above the data-protection consent age and give your own valid explicit consent for that data.

Separately, because you are still a minor under Dutch civil law, accepting the Terms of Use as a binding contract requires the permission of your parent or guardian; at signup we ask you to confirm that this permission has been given, and we keep a timestamped record of that confirmation (see Sections 2, 3 and 8). The data-protection consent age of 16 and this contractual-capacity requirement are two separate questions.

We take particular care with the data of users who are minors, given their greater vulnerability, as set out in our data protection impact assessment.

12. International transfers
Your entries, photos and profile data are stored physically in the European Union (Google’s europe-west4 region, Netherlands).
Google LLC, our infrastructure provider, is incorporated in the United States, which means limited administrative access to that infrastructure could occur from outside the EU.
Where this applies, we rely on the European Commission’s Standard Contractual Clauses (Module 2, 2021/914) and, where applicable, the EU-US Data Privacy Framework, as annexed to our contract with Google.

13. Security
We rely on Firebase’s built-in security measures, including encryption in transit and at rest, Firebase Authentication for access control, and Firestore security rules restricting each user to their own data.

If we ever become aware of a security incident affecting your data, we will notify the Autoriteit Persoonsgegevens within 72 hours per Article 33 GDPR, and we will notify affected users without undue delay per Article 34.

14. Changes to this Policy
If we update this Policy, we will publish the new version in the App with a new “Last updated” date. For material changes that reduce your rights, we will notify you at least 30 days in advance by email or in-app banner.

15. Contact
Skync Labs
Thamerhorn 28, Uithoorn, 1421 CE, The Netherlands.
KvK 42058858, BTW 281314755B01.
Email: support@myskync.com

Delete your data
You can permanently delete your MySkync account and everything in it at any time.
There is no form to fill in and no waiting period to start the process.

The easy way: Delete from inside the app
Open MySkync on your phone
Go to Profile, then Settings, then Account
Tap “Delete my data”

Confirm
Your account, entries and photos are removed by our automated deletion Cloud Function. We do not require you to give a reason.

Or by email
If you cannot access the app, email support@myskync.com from the address you used to sign up, with “Delete my account” in the subject line.
We will confirm receipt within 72 hours and then trigger the same immediate deletion process on your behalf.

What gets deleted
• Your account profile (email, onboarding data)
• Every daily entry: skin state, sleep, water, stress, routine, products, notes
• Every photo you uploaded
• Your SkinBalance history and generated insights
• Your subscription and plan status record
• What does not get deleted

Once you delete your account, your data is immediately removed from our live, active systems: you and we can no longer see or access it through the App or our normal tools.
A few narrow, automated exceptions exist purely for technical disaster-recovery purposes, not for our use:
• Firestore database backups: automated snapshots taken for disaster recovery may retain a copy of your entry and profile data for up to 98 days before being automatically overwritten (see Section 8).
• Storage soft delete: your photos may remain recoverable for up to 7 days after deletion, due to a bucket-level safety setting that protects against accidental data loss, before being permanently erased (see Section 8).
• Customer support correspondence, if you separately emailed us, is retained for 2 years per Section 8, but is not linked back to your deleted account data.
• Parental authorisation record (if you were 16 or 17 when you registered): a timestamped record that guardian permission was given is kept for 5 years, separately from your account. It contains no health data, only proof that permission was confirmed (see Section 8).

We do not access, restore or use backup or soft-delete copies except in the event of a genuine technical failure requiring disaster recovery.

How long it actually takes
• Live data removed from active systems: immediately, in the same operation as your deletion request
• Firestore backup snapshots fully purged: within 98 days
• Soft-deleted photos permanently purged from Storage: within 7 days

What about my Pro subscription?
If you have a paid MySkync Pro subscription, it is managed by Apple or Google directly. Cancel from your App Store or Play Store subscriptions screen.
Subscription history is retained with Apple or Google per their policy; we do not store your payment details.

Questions
Email support@myskync.com.