Privacy Policy

1. What We Collect

We collect information you provide directly:

• Account information — name, email address, password
• Skin profile — skin type, concerns, concern locations, Fitzpatrick type, age range, health context
• Journal data — daily skin ratings, conditions, sleep, stress, activity, diet, breakout zones, notes
• Cycle data — period start dates, cycle length (if you choose to track)
• Product data — products you add to your shelf, routine assignments
• Chat conversations — messages exchanged with Barry
• Wearable data — sleep, activity, and readiness scores (only if you connect a device)

We also collect basic usage data (pages viewed, features used) to understand how the App is used and improve the experience.

2. How We Use Your Data

Your data is used to:

• Personalize your skincare guidance, routines, and daily insights
• Surface the patterns and product correlations hiding in your journal
• Generate your weekly reports and trend detection
• Send notifications you've opted into (morning ritual, evening check-in)
• Process payments and manage your subscription
• Improve the App and develop new features

We do not sell your personal data for money. To promote The Bar 360°, we use advertising tools (the Meta Pixel and Conversions API) that share limited data with Meta — a hashed, non-reversible version of your email and name, along with technical identifiers (such as device/browser information and IP address) and certain actions (such as starting a trial or subscribing) — to measure and optimize our ads. Under some laws (like California's CPRA) this may be considered “sharing” for cross-context behavioral advertising. You can opt out — see “Your Rights” below.

3. AI & Your Data

Barry is built on Bren's expertise as a licensed esthetician with nearly two decades studying skin and the psychology beneath it. To generate his responses, your profile and relevant journal data are sent to a third-party AI processing provider to deliver personalized guidance.

This data is processed per that provider's data usage policies and is not used to train AI models. Your conversations are stored in our database to maintain chat continuity but are not shared with anyone outside the service.

4. Data Storage & Security

Your data is stored securely on Supabase (hosted on AWS infrastructure). All data is encrypted in transit (TLS) and at rest. We use row-level security policies to ensure you can only access your own data. Authentication tokens are managed via secure, HTTP-only cookies.

5. Third-Party Services

We use the following third-party services to operate the App:

• Supabase — Authentication and database hosting
• Stripe — Payment processing (we never see or store your card details)
• Third-party AI provider — AI-powered skincare guidance
• Vercel — App hosting and deployment
• Fresha — Consultation scheduling
• Oura / Fitbit — Wearable data sync (only if you connect)
• Meta Platforms, Inc. (Facebook/Instagram) — advertising measurement via the Meta Pixel and Conversions API; receives limited event data, a hashed version of your email and name, and technical identifiers (device/browser info and IP address)

Each provider processes data under their own privacy policies. We only share the minimum data required for each service to function.

6. Cookies

We use essential cookies for authentication and session management, and a referral cookie to attribute signups to the member who referred you. We also use the Meta Pixel, which may set third-party cookies (such as Meta's _fbp cookie) and collect device and activity data to measure and optimize our advertising. You can control these through your browser settings and your Meta ad preferences.

7. Your Rights

You have the right to:

• Access your data — your profile, journal, and chat history are viewable in the App at any time
• Correct your data — edit your profile, journal entries, and products from within the App
• Delete your data — delete your account from the Profile page, which removes all personal data
• Export your data — contact us at hello@thebar360.app to request a copy of your data
• Opt out of communications — manage notification preferences from your Profile
• Opt out of ad sharing — California residents can ask us not to share personal information for cross-context behavioral advertising by emailing hello@thebar360.app

If you are a California resident, you have additional rights under the CCPA, including the right to know what data we collect and the right to request deletion. If you are in the EU/EEA, you have rights under the GDPR including data portability and the right to restrict processing. To exercise any of these rights, contact hello@thebar360.app.

8. Data Retention

We retain your personal data for as long as your account is active. When you delete your account:

• Personal data (profile, journal, chat, products) is permanently deleted within 30 days
• Payment records are retained by Stripe for up to 7 years as required by tax and financial regulations
• Anonymized, aggregated data (e.g., average app usage statistics) may be retained indefinitely but cannot identify you
• Database backups may contain your data for up to 30 days after deletion, after which they are cycled out

9. Children's Privacy

The Bar 360°™ is not intended for users under 16 years of age. We do not knowingly collect data from anyone under 16. If we become aware that we have collected data from a user under 16, we will delete the account and associated data promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you via email or in-app notice. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions about your privacy or how we handle your data? Contact us at hello@thebar360.app.