Privacy Policy

1. What We Collect

We collect information you provide directly:

• Account information — name, email address, password
• Skin profile — skin type, concerns, concern locations, Fitzpatrick type, age range, health context
• Journal data — daily skin ratings, conditions, sleep, stress, activity, diet, breakout zones, notes
• Cycle data — period start dates, cycle length (if you choose to track)
• Product data — products you add to your shelf, routine assignments
• Chat conversations — messages exchanged with Bren
• Wearable data — sleep, activity, and readiness scores (only if you connect a device)

We also collect basic usage data (pages viewed, features used) to understand how the App is used and improve the experience.

2. How We Use Your Data

Your data is used to:

• Personalize your skincare guidance, routines, and daily insights
• Power AI-driven analysis of your skin patterns and product correlations
• Generate your weekly reports and trend detection
• Send notifications you've opted into (morning ritual, evening check-in)
• Process payments and manage your subscription
• Improve the App and develop new features

We do not sell your personal data to third parties. Ever.

3. AI & Your Data

Bren's guidance is powered by AI trained on 10+ years of professional esthetician expertise. When you use the chat feature or receive shelf analysis, your skin profile and relevant journal data are sent to our AI provider (Anthropic) to generate personalized responses.

This data is processed per Anthropic's data usage policies and is not used to train AI models. Your conversations are stored in our database to maintain chat continuity but are not shared with anyone outside the service.

4. Data Storage & Security

Your data is stored securely on Supabase (hosted on AWS infrastructure). All data is encrypted in transit (TLS) and at rest. We use row-level security policies to ensure you can only access your own data. Authentication tokens are managed via secure, HTTP-only cookies.

5. Third-Party Services

We use the following third-party services to operate the App:

• Supabase — Authentication and database hosting
• Stripe — Payment processing (we never see or store your card details)
• Anthropic (Claude) — AI-powered skincare guidance
• Vercel — App hosting and deployment
• Fresha — Consultation scheduling
• Oura / Fitbit — Wearable data sync (only if you connect)

Each provider processes data under their own privacy policies. We only share the minimum data required for each service to function.

6. Cookies

We use essential cookies for authentication and session management. We use a referral cookie to attribute signups to the member who referred you. We do not use third-party advertising or tracking cookies.

7. Your Rights

You have the right to:

• Access your data — your profile, journal, and chat history are viewable in the App at any time
• Correct your data — edit your profile, journal entries, and products from within the App
• Delete your data — delete your account from the Profile page, which removes all personal data
• Export your data — contact us at hello@thebar360.app to request a copy of your data
• Opt out of communications — manage notification preferences from your Profile

If you are a California resident, you have additional rights under the CCPA, including the right to know what data we collect and the right to request deletion. If you are in the EU/EEA, you have rights under the GDPR including data portability and the right to restrict processing. To exercise any of these rights, contact hello@thebar360.app.

8. Data Retention

We retain your personal data for as long as your account is active. When you delete your account:

• Personal data (profile, journal, chat, products) is permanently deleted within 30 days
• Payment records are retained by Stripe for up to 7 years as required by tax and financial regulations
• Anonymized, aggregated data (e.g., average app usage statistics) may be retained indefinitely but cannot identify you
• Database backups may contain your data for up to 30 days after deletion, after which they are cycled out

9. Children's Privacy

The Bar 360°™ is not intended for users under 16 years of age. We do not knowingly collect data from anyone under 16. If we become aware that we have collected data from a user under 16, we will delete the account and associated data promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you via email or in-app notice. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions about your privacy or how we handle your data? Contact us at hello@thebar360.app.