Privacy Policy

Last updated: 1 November 2026

Short version: there’s no account. Your photos, plan and progress stay on your phone. When the app reads a scan or a product label, that one photo goes through our server to our AI provider, Anthropic, and the answer comes back. We don’t keep the photo. Payments go through Apple. No ads, no tracking, no analytics.

Who we are

Glow Season is made and published by Kadirhan Yilmaz, Samsun, Türkiye (“we”, “us”). We are responsible for the personal data described here. Contact: hello@glowseason.app.

What stays on your phone

• Your setup answers: gender, age range and goals.
• Your scan results, scores, plan and the tasks you tick.
• Your daily photos, in the app’s private folder.
• The products you add to your shelf.

We can’t see any of this. Deleting the app deletes all of it. If your iPhone backs up to iCloud, Apple’s backup includes the app’s data under your Apple Account, as it does for any app.

Photos that leave your phone

The app asks for your permission before your first scan. After that, a photo leaves your phone only in these cases:

• Scans and check-ins. Your scan photo, and your daily photo on check-in days (about twice a week), go to our server and from there to Anthropic’s Claude API. Claude describes what it can see (skin, face shape, hair) as structured results. The app turns those into your score and plan on your phone.
• Product labels. When you add a product, the photo of its label goes the same way so the ingredient list can be read.

Daily photos on other days never leave your phone. Photos travel over encrypted connections (HTTPS). Our server passes each photo straight to Anthropic and returns the answer. It doesn’t write the photo or the results to storage or logs.

Anthropic (Anthropic, PBC, USA) processes the photo for us as a service provider. Under its commercial terms it doesn’t train its models on this data, and it deletes it within 30 days. It keeps it longer only if the data is flagged under its Usage Policy. See Anthropic’s Privacy Center.

We don’t use your photos to identify you. We don’t create or keep face templates. The timelapse lines your photos up using face points that your phone finds and then discards. Those points are never stored or sent. We don’t sell or share your photos.

Legal basis: your consent, given on the screen before your first scan, and providing the service you asked for (GDPR Art. 6(1)(a) and (b); KVKK Art. 5). You can withdraw consent at any time by not scanning and deleting the app.

The free scan check

Your first scan is free. To stop scripts from abusing that, the app uses Apple’s App Attest to prove the request comes from the real Glow Season app on a real iPhone. App Attest creates a random key on your phone. Our server checks Apple’s signature and keeps the key’s ID, a random string, so it can’t be used twice. The ID isn’t linked to you or your photo.

Your IP address

Like any website, our server sees the IP address of each request. We use it only to limit how many free scans one address can ask for per minute, and we don’t store it. Our server runs on Cloudflare, which processes requests under its privacy policy.

Purchases

Apple takes the payment. We never see your name, email or card. To know whether you’re subscribed, the app and our server use RevenueCat (RevenueCat, Inc., USA), which receives:

• a random ID the app creates, not linked to your name or email,
• the purchase receipt from Apple (product, price, date, store country),
• basic technical details (device type, iOS and app version).

We use this to unlock what you paid for and to see total sales. Legal basis: performing our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5/2-c). RevenueCat stores it in the USA under its Data Processing Addendum.

Reminders and sharing

If you turn on reminders, your phone schedules them. There’s no push server. When you share your timelapse, the video is made on your phone and handed to the app you pick. Nothing comes to us.

What we don’t do

No account. No ads. No tracking across other apps or websites. No analytics or crash-reporting tools. No selling of data. This website uses no cookies and loads nothing from other sites.

Children and teens

Glow Season is for ages 13 and up. Setup stops anyone who says they’re under 13, and we don’t knowingly collect personal data from children under 13. If you think a child under 13 has used the app, write to us and we’ll help. Parents can block purchases with Screen Time.

Where your data goes and how long it stays

• Your phone: until you delete the app.
• Our server (Cloudflare): photos and results aren’t kept. Used App Attest key IDs are kept so they can’t be reused.
• Anthropic (USA): up to 30 days, as above.
• RevenueCat (USA): as long as your subscription needs it, and as long as tax and accounting law requires.

Anthropic and RevenueCat are in the USA, so using Glow Season from elsewhere means a transfer abroad. It takes place under each provider’s data processing terms, including the EU Standard Contractual Clauses.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR, Türkiye’s KVKK or US state laws such as California’s), you can ask to access, correct, delete or export your data, object to its use, and complain to a regulator.

Most of your data exists only on your phone, so deleting the app deletes it. For subscription records, write to hello@glowseason.app with the order ID from Apple’s receipt. We’ll answer within 30 days. You can also complain to your local data protection authority.

Changes

If this policy changes, we’ll update the date above and mention important changes in the app.