Privacy Policy

This Privacy Policy explains how TATLIDEV LTD (“we”, “us”), the developer of the Gluvy app for iPhone, collects, uses and protects information when you use the Gluvy app and the website gluvy.app.

Summary

You don’t need to create an account. Gluvy signs you in with an anonymous ID, without your name, email or password.
Your journal, progress selfies, water and sleep logs and plan progress stay on your iPhone.
The face scan during onboarding runs only on your device. The photo is not uploaded.
The AI face analysis for Pro subscribers is different: if you start it, your selfie is sent to our server, which forwards it to OpenAI for analysis. We keep the text result of one analysis per user, not the photo.
We use Apple, Google Firebase, RevenueCat, OpenAI, Tenjin and Cloudflare to run the app. We do not sell your personal information.

Who we are

The Gluvy app and gluvy.app are operated by TATLIDEV LTD, which is responsible for the personal data described in this policy. You can reach us at [email protected].

Information that stays on your device

The following data is created and stored only on your iPhone. We do not upload it to our servers and cannot see it:

Journal entries: skin condition, sleep, water intake, mood, diet, exercise and hair notes.
Progress selfies you take in the journal.
Plan and course progress, streaks, milestones and the focus areas chosen during onboarding.
App settings, such as reminder times and language.

This data is deleted when you delete it in the app or uninstall Gluvy. It may be included in your own iCloud or device backups, which Apple manages under its own privacy policy.

Face scan during onboarding

During onboarding, Gluvy can look at a photo of your face to suggest focus areas for your plan. This scan is processed only on your device using Apple’s on-device Vision framework. The photo is not sent to us or to anyone else.

AI face analysis (Pro)

Gluvy Pro subscribers can request an AI face analysis. It only happens when you start it and take or choose a selfie. Then:

The app resizes the photo (to at most 1024 × 1024 pixels) and sends it over an encrypted HTTPS connection to our server at api.gluvy.app, together with your anonymous user ID token and the app language.
Our server checks your anonymous ID with Firebase and your subscription status with RevenueCat.
Our server forwards the photo to OpenAI, which analyses it and returns a short text result: a summary and three facial areas to focus on in your routine (for example jawline, eyes or forehead).
Our server sends the result back to the app.

What we store: we keep the text result of one analysis per user, linked to your anonymous user ID, so that the app can show it again and so that each account receives one analysis. We do not store your photo on our server; it is held in memory only while the request is processed.

OpenAI: OpenAI processes the photo as our service provider under its API terms. OpenAI states that it does not use data sent through its API to train its models by default, and that it may keep API data for up to 30 days to detect abuse before deleting it, unless the law requires longer.

The analysis is a wellness suggestion for your face yoga, gua sha and skincare routine. It is not a medical assessment, and it does not identify you.

Anonymous account

When you open Gluvy, Firebase Authentication (Google) creates an anonymous user ID for your installation. It does not contain your name, email address or phone number. We use it to secure requests to our server, such as the AI face analysis.

Subscriptions and purchases

Subscriptions are sold and billed by Apple through the App Store. We never receive your payment card details. We use RevenueCat to check which subscription you have and to restore purchases. RevenueCat receives purchase and transaction information from Apple, an app user ID and basic device information (such as the device’s identifier for vendors).

Analytics, crash reports and app configuration

Firebase Analytics (Google) collects usage events (for example, which screens are opened, which courses are started and completed, and subscription events), device and app information (model, iOS version, app version, language) and an approximate location at country or region level derived from the IP address. We use it to understand which content is useful and to improve the app. We do not use it to identify you.
Firebase Crashlytics (Google) collects crash reports, including the state of the device and app at the time of the crash, so we can fix bugs.
Firebase Remote Config (Google) delivers app settings, such as which content is shown and whether an update is required.
Firebase Cloud Messaging (Google) stores a device token to deliver notifications, but only if you allow notifications.
Tenjin helps us measure which of our marketing campaigns lead to installs and subscriptions. It receives installation and purchase events and the device’s identifier for vendors. Gluvy does not ask for permission to track you across other companies’ apps and websites, and it does not access your device’s advertising identifier.

Contact messages

If you contact us through the in-app contact form, we collect your email address and your message, together with your device model, iOS version, app version, language and time zone, so we can answer and troubleshoot. These messages are stored in Google Cloud Firestore. If you email us directly, we receive the information in your email.

Course videos and the website

Course videos are delivered through Cloudflare’s network, which processes your IP address to deliver them. The website gluvy.app is also served through Cloudflare. It uses no cookies, no advertising and no analytics scripts; our servers and Cloudflare may keep short-lived technical logs (such as IP address and browser type) for security and to keep the service running.

How we use information and our legal bases

We use the information described above to:

provide the app and its features, including the AI face analysis you request (performance of our contract with you);
manage your subscription and restore purchases (performance of a contract);
answer your messages (performance of a contract and our legitimate interest in supporting users);
measure and improve the app, fix crashes and measure our marketing (our legitimate interests in running and improving a useful app);
send notifications you allowed (your consent, which you can withdraw in iOS Settings at any time);
meet legal obligations, such as tax and accounting rules.

Service providers

We share information only with the providers that help us run Gluvy, and only for the purposes above:

Apple (App Store, payments, on-device Vision framework)
Google Firebase (Authentication, Analytics, Crashlytics, Remote Config, Cloud Messaging, Cloud Firestore)
RevenueCat (subscription management)
OpenAI (AI face analysis, Pro only, when you request it)
Tenjin (install and campaign attribution)
Cloudflare (content delivery, network security, DNS)
the cloud server provider that hosts api.gluvy.app

Each provider processes data under its own terms and privacy policy. We may also disclose information if the law requires it, or to protect our rights and the safety of users. We do not sell your personal information.

International transfers

Our providers may process data in the United States and other countries outside your own. Where the law requires it, these transfers rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

How long we keep information

Data on your device: until you delete it or uninstall the app.
AI face analysis result: for as long as your anonymous account exists, or until you ask us to delete it. The photo itself is not stored by us.
Contact messages: as long as needed to handle your request and for a reasonable period afterwards, unless you ask us to delete them sooner.
Analytics and crash data: for the retention periods set in our Firebase settings, after which they are deleted or aggregated.
Subscription records: as long as needed to provide the subscription and to meet legal obligations.

Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or under US state laws such as the CCPA), you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain uses, and to withdraw consent. You can also lodge a complaint with your local data protection authority.

To use these rights, email [email protected]. Because your Gluvy account is anonymous, it helps to send the request from the in-app contact form, so we can find the data linked to your installation. We will not discriminate against you for using your rights.

You can also:

turn off notifications in iOS Settings;
delete journal entries and selfies in the app, or uninstall the app to remove all data stored on the device;
cancel your subscription at any time in your Apple ID settings.

Children

Gluvy is not intended for children under 13 (or the minimum age in your country). We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

Security

We use encryption in transit (HTTPS) for all communication between the app and our server, verify every AI analysis request with your anonymous ID token, and limit access to the data we keep. No method of transmission or storage is completely secure, but we work to protect your information.

Changes to this policy

We may update this policy when the app or the law changes. We will post the new version on this page with a new “Last updated” date and, for significant changes, let you know in the app.

Contact

TATLIDEV LTD Privacy questions: [email protected] Support: [email protected]