This Privacy Policy explains what information the BestLook app (“BestLook”, “we”, “us”), developed and operated by Hung Do, collects, how it is collected, every way it is used, who it is shared with, how long it is kept, and how you can delete it. Questions: hungf.hp@gmail.com.
See section 2, which covers face data in full.
When you first open the app we create an anonymous account for you through Firebase Authentication. We store an account identifier, the name you type in, an optional profile photo if you set one, and a referral code if you enter or share one. We do not ask for your email address or phone number.
The optional questions you answer when you start the app: age range, beauty goals, skin type, skin concerns, allergies, skincare budget and similar preferences. We use them to personalize your advice.
If you use the AI Coach, the messages you write are sent to OpenAI to generate a reply (see section 3). We do not keep the conversation on our servers.
If you buy a subscription or scan pack, Apple or Google processes the payment. We receive your purchase and subscription status through RevenueCat. We never receive your card or bank details.
We collect your device model, operating system, app version, language, time zone, the in-app actions you take, crash reports and a push notification token (through Google Analytics for Firebase, Firebase Crashlytics and Firebase Cloud Messaging). Our network provider (Cloudflare) tells our server the country and city your IP address belongs to, and we store that approximate location with your account. We do not collect your precise GPS location.
Free users see ads served by Google AdMob. On iOS, AdMob uses your device’s advertising identifier only if you allow tracking when the app asks. Otherwise it shows non-personalized ads. Face data is never used for advertising.
Feedback you send in the app, and emails you send us, together with whatever you choose to include.
We do not create, collect or store facial geometry, face templates, faceprints or any other biometric identifier, and we do not use face data to recognize, identify or authenticate anyone. The app only reads the single photo you choose. It does not scan your photo library.
Only when you choose a photo and start a scan, and only after you have agreed on the in-app consent screen. That screen explains what is sent and to whom before anything leaves your device. The photo is uploaded over an encrypted connection (HTTPS) to our server, which stores it and sends it for analysis.
We do not use face data for any other purpose. In particular, we do not sell or rent it, we do not use it for advertising or marketing, we do not use it to identify you, and we do not use it (or allow anyone else to use it) to train artificial intelligence models.
| Recipient | What they receive | Why | How long they keep it |
|---|---|---|---|
| Google Firebase Cloud Storage (Google LLC) | Your face photos | Stores your photos for your account | Until you delete the photo or your account |
| Groq, Inc. (United States) | Your face photo | Scores your face and writes the analysis | Not retained by default. Logs are kept for up to 30 days, only to troubleshoot or investigate abuse, unless the law requires longer |
| OpenAI, L.L.C. (United States) | Your face photo, its analysis, your beauty profile answers and AI Coach messages | Writes your tips, advice, plan and Coach replies, and translates explanations | Up to 30 days for abuse monitoring, then deleted, unless the law requires longer or an image is held for review by OpenAI’s child-safety screening |
Our own server stores the face analysis and a link to each photo in our database, which is hosted by Railway. We do not share face data with anyone else, except when the law requires us to (for example, a valid court order).
Every third party that receives face data from us is bound by its written agreement with us (its services agreement and data processing terms) to process the data only to provide its service to us, to keep it confidential and secure, and not to use it to train its models. Groq and OpenAI encrypt data in transit and at rest and are independently audited to SOC 2 Type II. We share face data only with third parties that provide the same or equal protection of face data as stated in this Privacy Policy.
Your photos and their analyses stay in your account, so that you can follow your progress, until you delete them or delete your account. They are not deleted automatically after a fixed period. What Groq and OpenAI receive is kept by them only as described in the table above.
Copies that Groq or OpenAI hold are deleted on their own schedule, within the periods shown in the table above.
BestLook’s analysis and advice are produced by two third-party AI services, Groq and OpenAI. Before anything is sent to them, the app shows a consent screen that lists the data that will be sent (your face photo, your beauty profile answers and your AI Coach messages), names both companies, and explains what they may do with it. Nothing is sent unless you tap “Agree and continue”. You can take back your consent at any time in Settings → AI photo analysis.
Under their API terms, neither service may use the data we send to train its models. Their own policies explain how they handle data: Groq, OpenAI.
| Provider | Purpose |
|---|---|
| Google Firebase: Authentication, Cloud Storage, Analytics, Crashlytics, Cloud Messaging, Remote Config (privacy) | Accounts, photo storage, usage analytics, crash reports, notifications, settings |
| Google AdMob (privacy) | Ads for free users |
| RevenueCat (privacy) | Subscription and purchase status |
| Apple App Store, Google Play | Payments and app distribution |
| Railway | Hosting for our server and database |
| Cloudflare | Network security and delivery for our server |
| Groq, OpenAI | AI analysis (see sections 2 and 3) |
We do not sell your personal information.
We keep account information, your beauty profile and purchase status while your account exists. Analytics data is kept by Google Analytics for Firebase for no longer than 14 months. When you delete your account we delete your photos and face analyses as described in section 2.7, and we deactivate the account.
Data travels over encrypted connections (HTTPS). Photos are stored at private, unguessable addresses, and our database is accessible only to our server. No method of storage or transmission is completely secure, but we work to protect your information and limit who can access it.
Our service providers, including Groq and OpenAI, process data in the United States and in other countries where they operate. Wherever your data is processed, it is protected as described in this policy.
BestLook is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child has provided us with information, contact us and we will delete it.
When we update this policy we change the effective date above. If we change what face data we send to AI services, or who we send it to, the app will ask for your consent again before sending anything.
Hung Do · hungf.hp@gmail.com