Privacy policy.

Account data: your email address and authentication details.

Vault content you choose to save: appointments, providers, products, routines, spending and receipts, events, inspiration, notes, and photos. This can include sensitive beauty and wellness information, such as records you tag as injectables, laser, or medical-adjacent. You control what you add.

Billing data: if you subscribe, our payment processor Stripe collects your payment details. We receive subscription status and a customer reference, never your card number.

Product catalog search text: if you use catalog lookup, Beauty Vault temporarily relays the product or brand words you type. The query is not added to your vault unless you choose and save a result.

Device and usage basics needed to run the service, such as push notification tokens if you enable reminders, and your phone number if you turn on text reminders.

We use your data to operate Beauty Vault: storing your vault, syncing it across your devices, sending reminders you turn on, processing payments, and powering features you invoke.

Catalog lookup sends only the product or brand search text through a Beauty Vault server. Your account identity, email address, and vault records are not sent to the catalog providers. Do not type names, contact details, or other personal information into the catalog search.

AI features (routine extraction, receipt analysis, photo feedback, Ask Vault, Beauty Twin) send the relevant content to our AI provider, Google Gemini, to generate results for you. AI processing happens only when you use those features.

Product ingredient lookup is AI-assisted and is not a verified manufacturer-label database. Results may be incomplete or wrong; verify the saved list against the current product label and consult an appropriate professional for allergy or medical questions.

We do not sell your personal data, we do not use your vault content for advertising, and we do not train AI models on your data.

Your vault is private by default. A Beauty Passport shows its selected scope before you create a provider link. A trusted-person invitation is different: once accepted, it grants permission-based access to your entire non-private vault until you revoke it; private records stay hidden. You can also export your data from the app.

We rely on a small set of processors to run the service: Supabase (database, authentication, and photo storage), Vercel (hosting), Google Gemini (AI features), Stripe (payments), Twilio (text reminders), and Resend (email, including optional email-to-vault import). Each receives only the data needed for its role.

Open Beauty Facts and, when needed, Open Food Facts provide community product-catalog matches. A catalog provider receives only the sanitized product or brand query relayed by Beauty Vault; it does not receive your account identity or vault records from Beauty Vault.

When you submit a public social link for inspiration or routine capture, Beauty Vault uses Cobalt to retrieve the submitted public media and Google Gemini to extract the details you asked to save. Beauty Vault does not connect to your social account or read followers, messages, or private posts.

If you connect an external calendar (Google or Outlook), we access it only to sync appointments per the permissions you grant, and you can disconnect at any time.

Your data is encrypted in transit, stored with per-user access controls (row-level security), and photos are stored in access-controlled storage. We keep your data for as long as your account exists.

You can export your vault from Settings at any time. Deleting your account from Settings permanently removes your account, vault records, photos, and billing customer record. Backups expire on a rolling schedule after deletion.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. The in-app export and delete tools cover the common cases; for anything else, contact us and we will help.

Beauty Vault is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

We may update this policy as the service evolves. If we make material changes, we will notify you in the app or by email before they take effect.

Questions?