Privacy Policy

Last updated: 15 July 2026

Proof28 was built around a simple promise: your face is not our product. This policy explains exactly what data we collect, what stays on your device, what leaves it and when, and the rights you have over all of it. We've written it to be read, not skimmed past.

1. Who we are

Proof28 is an iOS skincare tracking app that helps you find out whether your skincare routine is working, using consistent daily photos and AI-assisted visual comparison. Proof28 is the data controller for the personal data described in this policy.

Website: proof28.com · Contact: support@proof28.com

2. Your photos — the short version

In detail, there are exactly two moments a photo is transmitted:

• When you capture your Day 1 baseline photo, it is checked by an automated AI quality review (is a face clearly visible, is the lighting usable?) so your 28-day cycle starts from a photo that comparisons can actually be made against. You are told this is happening in the app.
• When you choose to run an AI comparison, the two photos you select are transmitted for visual analysis and the result is returned to you as text.

In both cases the transmission is encrypted, the photos are processed to generate your result, and they are not saved to Proof28's servers. What we store is the text of the analysis result — never the photos themselves.

3. The data we collect

Data stored only on your device

• Your daily photos (front, left and right angles), including your baseline photo.
• Generated exports you create, such as your Proof Report PDF and Proof Cards, until you choose to share them.

Data stored in your account (synced to our servers)

• Account details: your email address and the name you provide.
• Skin profile: your skin goal, skin type, additional concerns, sensitivity level, and any allergies, sensitivities or ingredient preferences you add. This is information about your skin that you choose to give us so the app can personalise your experience.
• Products and routine: the skincare products you add (name, brand, category, ingredient lists) and your AM/PM routine steps.
• Daily check-in records: the date, which routines you completed, any notes you write, and lifestyle factors you log (such as sleep, diet or stress). Note: check-in records reference your photos by an identifier local to your device — the photos themselves are not uploaded.
• AI analysis results: the text observations returned by the AI, and which days were compared.
• Subscription status: whether you are on a free or paid plan (but no payment details — see section 6).

We do not collect your precise location, contacts, browsing history or advertising identifiers, and we do not use third-party advertising or tracking SDKs.

4. How AI processing works

Visual skin analysis is performed using Anthropic's Claude API. When an analysis runs, the photo(s) are sent from your device through our secure server-side function to Anthropic, which returns text observations describing visible differences (for example changes in redness, texture, clarity, blemishes, tone or glow).

• Only the photo(s) required for that specific analysis are transmitted — never your whole photo history.
• The output is text only. No biometric template, faceprint or identification profile is created, stored or derived at any point.
• Anthropic does not use data submitted through its API to train its AI models. Photos are processed to generate your result and handled under Anthropic's privacy policy.
• AI observations are visual descriptions for personal tracking only. They are not medical assessments (see our Terms of Use).

5. Where your data is stored

Your account data (section 3, "synced" list) is stored with Supabase, our database provider, hosted in the European Union (EU West — Ireland). This keeps your data within UK/EU data-protection jurisdiction. Data is encrypted in transit, and access is restricted to your authenticated account.

Your photos and any locally-generated reports are stored in the app's private storage on your iPhone, protected by your device's own security (passcode/Face ID and Apple's sandboxing).

6. Subscriptions and payments

All purchases and subscriptions are processed entirely by Apple through the App Store. Proof28 never receives, sees or stores your payment card details. We receive only your subscription status (which plan is active) so we can unlock the right features. Payment processing is governed by Apple's privacy policy.

7. Third-party services

• Anthropic — AI visual analysis of the photos you submit for comparison (section 4).
• Supabase — account data storage and authentication, hosted in EU West (Ireland) (section 5).
• Apple — App Store distribution and all subscription/payment processing (section 6).

We do not sell personal data to anyone, and we do not share it with data brokers, advertisers or analytics companies.

8. Our legal basis for processing

• Contract — processing your account, routine and check-in data is necessary to provide the service you signed up for.
• Consent — sending photos for AI analysis, and processing the skin-related information you volunteer (goals, sensitivities, allergies), happens with your consent, which you can withdraw at any time by not using those features or deleting your account.
• Legitimate interests — keeping the service secure and preventing abuse.

9. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erasure — have your data deleted ("right to be forgotten");
• Restrict how we process your data;
• Data portability — receive your data in a usable format;
• Object to processing based on legitimate interests.

To exercise any of these rights, email support@proof28.com. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

10. How long we keep your data

Your account data is kept for as long as your account is active. If you request deletion of your account, all account data is permanently deleted from our servers within 30 days. Photos stored on your device are under your control at all times and are removed when you delete them or uninstall the app.

11. Children

Proof28 is not intended for anyone under 17 years of age, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you by email or in-app notification before they take effect. The "Last updated" date at the top always reflects the current version.

13. Contact us

Questions, concerns, or a data request? Email support@proof28.com — a human reads every message.