Privacy Policy

Draft until Beautylogue’s App Store release.

Who we are

Beautylogue is made by Blacktop Social LLC in New York. Privacy questions and requests: legal@blacktop.social. Help with the app: support@blacktop.social.

In short: your photos stay on your phone and are sent to one AI provider, Anthropic, only to write the review you asked for. We don’t sell your information, we don’t use it for advertising, and the iPhone app contains no advertising, analytics or crash-reporting code.

Your account

You can use Beautylogue’s catalogue and routines without an account. Face reviews, Beautylogue+, sync and Circle need one. You sign in with Apple, with Google, or with a one-time code sent to your email or, for US and Canadian numbers, by text message.

We keep your email address or phone number, and an id from Apple or Google if you use them. Apple may give us a private relay address instead of your email. Sign-in is run by Supabase. Email codes are sent by Resend and text codes by Twilio, which receive your address or number only to deliver the code. We use your email or number to sign you in and to reply when you write to us, never for marketing.

Blacktop Social makes several apps and keeps one sign-in record per person across them, noting which of its apps you use.

Photos and reviews

Your photos are not stored on our servers. On the iPhone, each review and its photo are saved on the phone itself, where you can archive or delete them at any time. They are included in your iPhone’s own iCloud or computer backup if you use one, which we can’t see. An inspiration photo is kept on the phone and sent only with the reviews you choose to read toward it, with any name you give it.

To review a photo, the app sends it (and any side views you add) to Anthropic through our server, and the written review comes back. To survive your phone locking mid-review, the finished text (never the photo) is held on our servers under a one-time id until your phone has it, for no more than an hour. Beautylogue+ “What changed” also sends the written notes from your previous face review, never its photo.

Your first face review is free: you see part of it, and its full text (never its photo) is held on our servers for up to 30 days, so Beautylogue+ can open it without reading your photo again. It is deleted when it is opened, after 30 days, or when you delete your account. We keep the dates of your face reviews for 400 days to apply the free month’s limit.

Spot follow-up chats send the written review, recent messages and any photo you add to a message; the conversation and its photos stay on your phone.

If you photograph a product’s ingredient list, Anthropic reads it, the photo is discarded, and the ingredient list is added to Beautylogue’s shared product records without anything that identifies you. Barcodes and product names you search are looked up in our product records and in Open Beauty Facts, without your identity.

On the web, saved photos and results stay in your browser’s storage, and clearing this site’s data removes them.

Face photos

A face review describes what is visible in your photo: skin, brows, lips, structure and styling. We do not create or keep a faceprint, a face template or any measurement that could identify you, and we never use your photos to recognise you or anyone else. A review may describe skin tone and undertone to suggest colours; we never ask for, store or infer your race or ethnicity as a category.

You agree to this, and confirm you are 18 or older, before your first review. You can withdraw that agreement in You, under Your data.

Our AI provider

Anthropic’s Claude writes face reviews, spot checks, follow-up replies and answers to your questions, reads ingredient labels you photograph, and checks board posts before they appear. We send it only what each feature needs, as described on this page. Under Anthropic’s business terms it may not train its models on what we send or use it for advertising, and it deletes it within 30 days (keeping it up to 2 years only if its safety systems flag it for review). Beautylogue uses no other AI provider.

Your catalogue and routines

On the iPhone, your catalogue, routines, check-offs, the concerns you pick and the ingredients you avoid stay on the phone. With Beautylogue+, your catalogue and routines are also kept on our servers so they follow you to another device; if Beautylogue+ ends, that copy stays with your account until you delete it or your account. Your concerns and avoided ingredients are sent with reviews and questions so the answer can take them into account. Reminders are scheduled on your phone; nothing is sent to us to deliver them.

Questions you ask

When you ask one of the questions under a face review or in Build my routine, that screen’s written notes, the names and ingredients of your products, and what you are working on are sent to Anthropic to write the answer. No photo is sent with a question, and the answer is not kept on our servers.

Beautylogue+ and purchases

Beautylogue+ is bought through Apple; Apple handles payment and we never see your card. RevenueCat manages subscriptions for us. It receives your Beautylogue account id, Apple’s purchase and renewal records, basic device details (model, iOS and app version, country) and your IP address, plus two things we set: whether your account is in the 10% comparison group that always sees the launch offer, and any free time earned from invites. It does not receive your name, email or photos.

We keep a copy of purchase records as billing records: the first purchase of each subscription for as long as the business needs it, and other renewal events for 400 days. They stay after account deletion. On the web, where offered, Beautylogue+ is billed by Stripe, which receives your email address and payment details.

Weather swaps

Only if you turn on weather swaps (Beautylogue+): your phone finds your approximate location, or uses a town you type, and asks Apple’s map service for the town’s name. The phone keeps the place, rounded to about 11 km. Once a day it sends that rounded point to our server, which asks Apple Weather for the forecast. We don’t save the point; it can appear briefly in our hosting provider’s request logs.

Circle

When you’re signed in, the app sends us, as numbers only, how much of today’s morning and evening routine is done, whether the day was kept, and your streak. We keep these for 60 days.

Anyone you give your invite code to can add you as a friend in one tap, without a request. Friends see your handle, initials, streak, whether you’re done today, and products you choose to recommend with any note you add. A friend can start a 7- or 14-day buddy run with you; during it you each see the other’s morning and evening progress. Blocking someone ends the friendship and any buddy run and stops their code adding you again. Friends never see your photos, reviews, concerns or catalogue.

Board posts and replies are seen by all signed-in members under your handle, and stay until you delete them or your account. Before they appear, posts, replies, handles and recommendation notes are checked by a word filter and by Anthropic’s Claude. Reports, with any reason given, are kept until we have reviewed them.

If you choose “Count me in” for People like you, we keep the concerns you picked and the products you keep until you leave. Others see only counts, rounded down to the nearest 10, from accounts at least a week old and groups of 20 or more, never who.

Your iPhone install, and invites

The iPhone app gives each install a random id, kept in this iPhone’s keychain (not copied to other devices). It is sent with the app’s requests so we can count the free first review, credit invites and limit abuse. When you sign in, we link the install to your account. Deleting the app does not erase the keychain, so the id comes back if you reinstall; erasing the iPhone removes it. No name, contacts or address book is read. An invite code is six random characters.

Health information

Some of what you give Beautylogue can describe your health, such as spot-check photos and symptoms, skin and scalp concerns, and ingredients you avoid. How we handle it is set out in our Consumer Health Data Privacy Policy .

Who we share it with

Only service providers that run Beautylogue for us, under contracts that limit them to doing that: Anthropic (AI), Supabase (accounts and database), Vercel (hosting), RevenueCat and Apple (subscriptions), Apple (Sign in with Apple, maps and weather), Google (only if you sign in with Google), Resend (email codes), Twilio (text codes) and, on the web, Stripe (payments). Our servers and these providers keep technical logs (IP address, device type, time of request) for a short time to run and protect the service.

We may also disclose information when the law requires it, or to protect someone’s safety. Other members see only what the Circle section describes. We don’t sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of; we treat a Global Privacy Control signal as a request not to, and our site does not otherwise respond to Do Not Track signals.

How long we keep it

• Photos: never on our servers. Anthropic deletes them within 30 days.
• A review’s text in transit: until your phone has it, at most an hour.
• Your first face review’s held text: until it is opened, at most 30 days.
• Dates of your face reviews: 400 days. Circle’s daily numbers: 60 days.
• Handle, friends, picks, posts and replies: until you delete them or your account. People like you: until you leave.
• Purchase records: as described under Beautylogue+ and purchases.
• Your account and synced data: until you delete your account. Removed data can remain in our database provider’s encrypted backups until they are overwritten on its regular schedule.

Delete your account

In the iPhone app: You, then Delete my account. This deletes, at once and for good, everything Beautylogue keeps on our servers for you: your synced catalogue and routines, check-offs, goals, any held review, your Circle handle, friends, buddy runs, picks, board posts and replies, reports you made, and People like you. Reviews and photos saved on the phone are deleted from the phone too; your phone-only catalogue and settings stay until you delete the app.

We keep only what we must: purchase records, for billing and tax, and an unlinked record that this iPhone install has used its free review and invite rewards, so they can’t be claimed twice. Your sign-in (email, phone number, or Apple or Google account) is shared by Blacktop Social’s apps and is not deleted by this; email legal@blacktop.social from your account’s address and we will delete it, and revoke Sign in with Apple, within 30 days. Cancelling Beautylogue+ is separate: in your iPhone’s Settings, under your name, then Subscriptions.

On the web, or if you can’t use the app, email legal@blacktop.social from your account’s address and we will do the same within 30 days.

Your choices and rights

You can see, correct, export and delete your information, and withdraw consent: in the app (You, then Your data, or Delete my account), or by emailing legal@blacktop.social. Wherever you live in the US or Canada, we answer within 30 days (45 where the law allows), after confirming the request comes from your account’s email or phone. If we refuse, you can appeal by replying to our answer. We won’t treat you differently for using these rights.

Nobody under 18

Beautylogue is for people 18 and over, and we do not knowingly collect anything from anyone younger. The iPhone app asks you to confirm you’re 18 or older when you sign in and before your first photo; the web asks for your date of birth before photo analysis and keeps only whether you passed. We don’t store a birth date. If we learn an account belongs to someone under 18, we delete it and its data. Tell us at legal@blacktop.social.

Security, and where data is processed

Data is encrypted in transit. Account data sits in private database tables reachable only through our server, and photos never reach our database. No system is perfectly secure; please report problems to legal@blacktop.social.

We are based in the United States, and our providers store and process information there and wherever else they operate, where it may be accessible to authorities under local law. Canadian residents can ask us for access to or correction of their information, or withdraw consent, at legal@blacktop.social, and may complain to the Office of the Privacy Commissioner of Canada (in Quebec, the Commission d’accès à l’information).

Changes

If we change this policy in a way that matters, we’ll update the date at the top and tell you in the app before the change applies.