Privacy Policy

Last updated: 6 August 2026

Dermi is built on a simple promise: the pictures of your face and your products are analyzed on your phone and are not uploaded to us. This policy explains exactly what we collect, what we don't, and the choices you have.

1. Who we are

Dermi ("Dermi," "we," "us," or "our") is a mobile app that helps you understand your skin and your skincare products. This Privacy Policy applies to the Dermi mobile application for iOS and Android and this website. By using Dermi, you agree to the practices described here.

2. Information we collect

Information you give us

• Skin profile answers. During onboarding you tell us things like your skin type, the concerns you'd like to improve, your age range, and (optionally) whether you'd like cycle-aware guidance. This shapes your recommendations.
• Products on your shelf. Products you add or scan so we can help you optimize what you own.
• Account & Subscription information. If you create an account or subscribe to Dermi Pro, we store your account identifier and subscription state (such as active plan and expiration date) to grant access to premium features. Payment credentials (credit cards, billing details) are processed directly by Apple (App Store) or Google (Google Play) — Dermi never receives or stores your financial information.
• Support messages. If you email us, we receive your message and contact details.

Information created when you scan

• Skin-scan results (derived data, not photos). When you scan your face, the analysis runs on your device. We store the resulting numbers — for example your Skin Score and sub-scores such as hydration, clarity, and texture — so we can show your routine and track progress over time. The photo itself is not uploaded.
• Product-scan results. When you scan a product's ingredients, the text is read on your device and matched against ingredient information to produce a verdict. We may store the resulting product and ingredient list tied to your account so your shelf and history persist. The product photo is not uploaded.

Information collected automatically

• Basic app and device data needed to run the service reliably, such as app version, device type/operating system, and a unique account identifier used to sync your data across sessions.

3. What stays on your device — face data

Two of the most sensitive things Dermi touches — photos of your face ("face data") and photos of product packaging — are processed locally on your phone. When you take a skin scan, the photo is analyzed by an on-device engine that detects blemishes and computes tone/texture signals. That analysis happens entirely on your phone, using on-device Apple/Core ML and computer-vision models — the face photo itself is never uploaded, transmitted to Dermi's servers, or sent to any third party.

What leaves your device is only the derived result: numeric scores (for example your Skin Score and sub-scores like clarity or texture) and, where relevant, the normalized coordinates of a detected blemish's location on the face — never image pixels or anything that reproduces the photo. We store these derived numbers, tied to your account, for as long as your account remains active, so your history and progress stay available; they are deleted when you delete your account (see "Your rights & choices" below). We do not retain the face photo itself in any form — it is not written to our servers, is not stored in our databases, and is not shared with any third party, advertiser, or analytics provider.

4. How we use your information

• To build and personalize your Skin Score, routine, and product recommendations.
• To save your shelf, history, and progress so they're there when you come back.
• To verify and maintain your subscription status across your devices.
• To operate, maintain, secure, and improve the app.
• To provide customer support and respond to your requests.
• To comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use your scan data for advertising.

5. Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process your information on these legal bases: performance of a contract (to provide the app's features and subscriptions you request), consent (for example, camera/photo access and any optional cycle-related information, which you can withdraw at any time), legitimate interests (to keep the app secure and improve it), and legal obligation where required.

6. How information is shared

We share information only in these limited ways:

• Service providers. We use trusted infrastructure providers to run Dermi — including Google Firebase (authentication and data storage), RevenueCat and Superwall (subscription status and entitlement validation), our hosted API, and identity providers you choose to sign in with (Apple, Google). They process data on our behalf under their own terms and security commitments.
• Legal reasons. If required by law, or to protect the rights, safety, and security of our users, the public, or Dermi.
• Business transfers. If Dermi is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; we'll notify you of any change in control.

We never sell your personal information, and we don't share your scan data with advertisers. Your face data (the photo from a skin scan) is never shared with any third party — it is processed only on your device and never reaches us or anyone else.

7. How long we keep it

We keep your account and derived scan data (scores and blemish-location coordinates — not photos) for as long as your account is active so your history and progress remain available. If you delete your account, we delete or de-identify the associated data within a reasonable period, except where we must retain limited information to meet legal obligations. Face data is not retained by us at all: the photo exists only transiently on your device during a scan and is discarded there; we never receive a copy to retain in the first place.

8. Your rights & choices

• Access, correction, and deletion. You can request a copy of your data, ask us to correct it, or delete your account and its data by contacting us at the address below.
• Permissions. You can revoke camera or photo access anytime in your device settings (some features won't work without them).
• Withdraw consent. Where we rely on consent, you can withdraw it at any time.
• Regional rights. Depending on where you live (for example, the EEA, UK, or California), you may have additional rights, including the right to object to certain processing or to lodge a complaint with your local data-protection authority. California residents: we do not sell or "share" personal information as those terms are defined under the CCPA/CPRA.

9. Security

We use industry-standard safeguards — including encryption in transit and access controls — to protect your information. Keeping the most sensitive images on your device is itself a core part of our security design. No method of transmission or storage is ever 100% secure, but we work hard to protect your data.

10. Children

Dermi is not directed to children. You must be at least 13 years old (or the minimum age of digital consent in your country, whichever is higher) to use the app. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we'll delete it.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in the app. Your continued use of Dermi after an update means you accept the revised policy.

12. Contact us

Questions about this policy or your data? We're happy to help.

Dermi
Email: akshat.chaturvedi@unlustapp.com

← Back to Dermi