DraftNot yet in effect and under legal review. Nothing on this site is legal advice.
Saura Privacy Policy
Who we are
Saura is a skincare companion app for iPhone. In this policy, "Saura", "we" and "us" mean [TO FILL: legal name], [TO FILL: postal address], who is responsible for the processing described here. Contact: privacy@saura.app.
[LAWYER: EU/UK representative under GDPR Art. 27 / UK GDPR Art. 27, if required: name and address.]
The short version
- Saura keeps your things on your phone. Your face photos, check-ins, journal and chat, About me, your product shelf and any dermatologist notes are stored on your iPhone. There is no Saura account.
- Nothing is sent to an AI service unless you say yes. Some features use OpenAI. Before the first time, Saura asks you, names OpenAI and lists what is sent. You can say "Not now" and keep using Saura on your phone only.
- Dermatologist notes and things your skin reacts to need a second, separate yes.
- Feedback is sent only when you press Send. Settings → Send feedback shows everything that goes with your message before it is sent.
- No ads, no tracking, no selling or sharing of your data for advertising, no analytics SDKs.
- Saura describes how skin looks and tracks it over time. It does not diagnose, treat or give medical advice, and it never changes anything your dermatologist told you.
What stays on your phone
These are stored only on your iPhone, in Saura's own app storage, until you delete them:
| What | Notes |
|---|---|
| Face photos from check-ins (front, left, right) | Stored with iOS "complete" file protection (unreadable while the phone is locked); excluded from device backups. |
| Short head-sweep videos (if "Keep sweep videos on this phone" is on) | Complete file protection; excluded from device backups. |
| Check-in results, routine progress | Cosmetic observations such as "looks dry here". Excluded from device backups. |
| Journal and chat history, daily conversation summaries | Excluded from device backups. |
| About me: name you choose to show, skin type, concerns, goals, preferences, ingredients you avoid or react to | Excluded from device backups. |
| Your product shelf and product photos | Excluded from device backups. |
| Dermatologist notes you add, the instructions you confirm from them, and your health-data consent record | Excluded from device backups. The note's text is read on the phone. The full recognized text is not saved; the lines you confirm are kept with each instruction. |
| Optional email address from setup | Stored on the phone only. It is not sent anywhere unless you choose to use it as the reply address on a feedback message (below). |
| Feedback you wrote that could not be sent yet | Kept on the phone (complete file protection, excluded from device backups) until it is sent or you delete it on the feedback page. |
| Settings and your answers to Saura's permission questions | Stored on the phone in the app's settings. |
Device backups. Everything Saura stores in its app storage (face photos, sweep videos, check-in records, journal, chat, About me, your shelf and dermatologist notes) is excluded from iCloud Backup and computer backups, so it stays on this iPhone and is not restored to a new one. Only small app settings, such as your language and your answers to Saura's permission questions, are kept in the app's settings, which iOS may include in your own device backup.
On-device processing. Several things happen entirely on your phone and are never sent to us: finding where your face is in a photo (Apple Vision, used to place markers, not to recognize who you are); speech recognition with Apple's on-device speech engine where your language supports it; Apple Intelligence on-device models where your iPhone supports them; reading the text of a dermatologist note (Apple's on-device text recognition); barcode scanning; and the weekly check-in reminder (a local notification).
iCloud sync. Saura does not sync your data with iCloud. If a sync feature is added, we will update this policy before it is released and ask for your permission in the app first. Health information (dermatologist notes, prescribed products, reactions) will not be stored in iCloud. [OWNER: this sentence depends on decision B3 in docs/APP-STORE-LAUNCH.md. It matches App Review Guideline 5.1.3(ii). If B3 is ever decided otherwise (for example user answer 2 in docs/STORAGE-SYNC-RAG.md), this sentence and the App Review notes must change first.]
What leaves your phone, and only if you allow it
Some features work better with OpenAI: reading your skin photos, writing down what you say, answering in every supported language and speaking the answer. They are used only after you choose "Allow" on the "Use OpenAI for photos and replies?" screen. You can switch this off at any time in Settings → Privacy → Use OpenAI for photos and replies. With it off, Saura works on your phone only.
When it is on, Saura may send the following, only when you use the matching feature:
| Data | When |
|---|---|
| Your face photos (resized to 1,024 pixels) | When you ask for a photo read |
| Short voice clips | When you use the mic; while hands-free is on, what is said near the phone (Saura shows a ring and a "Hands-free" caption while it listens, and tells you once before the first time) |
| What you say or type, recent turns of the same conversation, a short summary of the day's conversation | When you chat |
| Your skin details from About me (skin type, concerns, goals, things you prefer to avoid) | With chat and routine questions |
| Products you own, and a product label photo when you choose "Read the label better" | With routine questions; never products marked as from your dermatologist |
| Saura's own replies | To turn them into speech, and to translate them into your language |
Health data needs a separate permission. Dermatologist instructions, prescribed products and things your skin reacts to are only sent after you turn on "Let OpenAI read my dermatologist notes" (Settings → Privacy, or when you add a note), which also asks you to confirm you are 18 or older. Even then, only the note lines you approve on a preview are sent — never the image of the note — and Saura tries to remove your name, birth date and record numbers first. Without this permission, Saura removes health information from anything it sends and uses Apple voices for speech. See also our Consumer Health Data Privacy Policy.
How it gets there
Requests go from the app through a small Saura server ("proxy") that runs on Cloudflare. The proxy holds Saura's OpenAI key, checks that the request comes from a genuine copy of the app (Apple App Attest), limits daily use per device, and passes the request to OpenAI. It streams the answer back and does not store or log photos, audio, text or replies.
The proxy keeps only:
- a per-device record, named by a one-way hash of an App Attest key created by your phone (not your name, Apple ID, phone number or advertising identifier), with that key's public part and today's usage counters. It deletes itself after 2 days without use;
- one-time security challenges, gone after 5 minutes;
- one log line per request, printed by the proxy, with the route, status, size and duration — no device identifier, IP address, content or error text.
Cloudflare, as our hosting provider, necessarily processes your IP address and request metadata to deliver the request. The proxy also uses your IP address, only in memory and only as a key, to limit bursts of requests to its App Attest sign-in routes; it does not store or print it. Cloudflare Workers Logs also keeps an invocation log for each request, with details of the request, the response and related metadata, which can include your IP address. It is kept for 3 days on Cloudflare's Workers Free plan and 7 days on Workers Paid (Cloudflare). See Subprocessors.
What OpenAI does with it
We send every request with OpenAI's "do not store" setting. OpenAI states that API data is not used to train its models, and that it keeps abuse-monitoring logs, which may contain the content, for up to 30 days, unless longer retention is required by law. OpenAI also states that images its safety classifier flags for child sexual abuse material are kept for manual review. Saura cannot delete what OpenAI keeps from the app. [TO FILL: if OpenAI grants Zero Data Retention or Modified Abuse Monitoring, update this paragraph and the in-app wording together.]
Feedback you send us
Settings → Send feedback lets you send us a message. It is its own action: nothing is sent until you press Send, it does not need the OpenAI permission, and it never goes to OpenAI. By voice, "send feedback" only opens the page.
What is sent, all shown on the page first:
- the kind you pick (problem, idea or other) and your message (at most 4,000 characters). The page asks you not to include personal health details;
- a reply email address, only if you enter one (it is prefilled with the email you saved in Saura, and you can clear it);
- if Include app details is on (it is by default): the app version and build, the iOS version, the device model (for example "iPhone16,1"), the app's language, which voice input Saura uses (OpenAI or Apple) and whether the OpenAI features are on;
- a random message ID, so a message that is retried is not stored twice.
Never sent with feedback: photos, your journal, About me, conversations, or what Saura noticed on your skin.
It goes to the same Saura proxy on Cloudflare, with the same App Attest check, and is stored in Saura's database on Cloudflare (D1) together with the time it arrived and the proxy's one-way device identifier (the hash described above). We store it so we can read it, answer it if you gave an email, and let you delete it. The proxy does not store your IP address with it, and its log line has no message text. Each device can send up to 10 messages a day.
If Saura can't reach the server, the message waits on your phone and is sent later; you can see and delete waiting messages on the feedback page.
Sent feedback is deleted automatically 365 days after it arrives. You can delete everything you sent earlier with Delete sent feedback on the feedback page, or by emailing us (see Delete your data). [LAWYER: legal basis for feedback — consent (Art. 6(1)(a)), given by pressing Send, or legitimate interests (Art. 6(1)(f)) — confirm.]
What we use it for
Only to provide the features you use, and to read and answer the feedback you send us: reading your photos, understanding what you say, answering, building and reading out routines, translating, and protecting the service from abuse and runaway cost. We do not use your data for advertising, marketing, profiling, selling, or training AI models, and we do not combine it with data from other companies.
Face photos are used to describe how skin looks. They are not used to identify you or to create a face template. [LAWYER: confirm this keeps them outside "biometric data" under GDPR Art. 9, BIPA and similar laws.]
Saura makes no decisions about you that have legal or similarly significant effects.
Legal bases (EEA, UK and Switzerland)
- Consent (GDPR Art. 6(1)(a)) for sending data to OpenAI through the proxy.
- Explicit consent (GDPR Art. 9(2)(a)) for dermatologist notes, prescribed products and reactions.
- Legitimate interests (Art. 6(1)(f)) for the proxy's anti-abuse checks and usage counters. [LAWYER: confirm.]
- Consent (pressing Send) for feedback you send us. [LAWYER: confirm, see "Feedback you send us".]
Giving any of this is optional. If you don't, Saura keeps working on your phone, with fewer features.
International transfers
OpenAI and Cloudflare are based in the United States and may process data there and elsewhere. Transfers from the EEA/UK rely on the Standard Contractual Clauses (and the UK Addendum) in their data processing agreements. [TO FILL: confirm the OpenAI DPA is executed; consider OpenAI's European data residency.]
How long data is kept
| Where | How long |
|---|---|
| On your phone | Until you delete it (per item, in Settings, or with Forget everything) or delete the app. |
| Saura proxy, per-device record | Deleted automatically after 2 days without use. |
| Saura proxy, security challenges | 5 minutes. |
| Feedback you sent (message, optional email, app details, device hash) | 365 days after it arrives, then deleted automatically; earlier if you use Delete sent feedback or email us. |
| Saura proxy, request logs | Request metadata, kept by Cloudflare Workers Logs for 3 days (Workers Free plan) or 7 days (Workers Paid plan), then deleted. |
| OpenAI | Up to 30 days for abuse monitoring, or longer if the law requires. |
Your choices and rights
- Withdraw consent: Settings → Privacy → Use OpenAI for photos and replies (off). For health data: Settings → Privacy → Let OpenAI read my dermatologist notes (off). Withdrawing is as easy as giving it and takes effect at once. It does not undo what was already sent.
- Delete: see Delete your data. Everything on the phone can be deleted in the app; Forget everything removes photos, journal, chat and About me from the phone.
- Access, correct, export: your data is on your phone and can be viewed and edited in the app. We hold no copy of it, except feedback you chose to send us (see "Feedback you send us").
- Depending on where you live (for example the EEA, UK, California, Colorado, Connecticut, Virginia, Washington, Nevada), you may have rights to access, correct, delete, port, restrict or object, to withdraw consent, and to appeal a decision about your request. Contact us at privacy@saura.app. We answer within the time the law requires (for example within one month under GDPR, and within 45 days under Washington's My Health My Data Act). Because we keep no account and no copy of your content, most requests are answered by the in-app controls.
- EEA/UK: you may complain to your data protection authority.
Children
Saura is not directed to children and is not for anyone under 13. The dermatologist-note features require you to confirm you are 18 or older. If you believe a child has used Saura's cloud features, contact us. [LAWYER / OWNER: age rating, Texas SB 2420 age-assurance flow and COPPA decision — see docs/APP-STORE-LAUNCH.md.]
Security
On the phone: iOS file protection, backup exclusion for everything Saura stores, no Saura account, no analytics. In transit: HTTPS only, App Attest, per-device limits, and a proxy that stores no content. No system is perfectly secure. If a breach affects health information, we will notify affected people and regulators as the law requires (including the U.S. FTC Health Breach Notification Rule).
Do Not Track, sale and sharing
Saura does not track you across other companies' apps or websites, does not sell personal data and does not "share" it for cross-context behavioural advertising. It does not respond differently to Do Not Track signals because it does no tracking. This website sets no cookies and uses no analytics.
Changes
We will post changes here with a new "Last updated" date. If a change means more data leaves your phone, the app will ask you again before it happens.
Contact
[TO FILL: legal name] · [TO FILL: postal address] · privacy@saura.app