Privacy Policy

The basics

Roona (“we”, “us”) is a skincare-journal app for iOS and Android, plus the website at roona.app. It's made and run by one independent developer—not a company—and we're the ones responsible for your data. Questions any time: support@roona.app.

Local first

Your routines, check-ins, photos, and products live on your device as the working copy of your journal, and it works without a connection.

Signing in backs up your structured journal—routines, check-ins, products, notes, and profile—to Roona's cloud on every account, so it can be restored across devices. Progress and scan photos are backed up only with Roona Plus.

Your profile picture is the one image that syncs on every account, free or Plus. It's kept in your own private folder in our cloud storage so your profile still looks like you on a new device.

Routine reminders are scheduled by the app on your device. Roona has no push server: we never send you a notification from our servers, and we don't collect a push token.

If Plus ends, your journal and its cloud sync keep working; photo backup pauses, and existing photo backups are retained until you delete them or your account.

What we collect

Account — your email and name (or what Google/Apple share when you sign in), plus optional profile details like age or sex if you choose to add them. Passwords are handled by our sign-in provider (Supabase); we never see them in plain text.
Your journal — routines, products, check-offs, check-ins, notes, streaks, and your profile. This lives on your device and is backed up to our cloud when you're signed in, on every account.
Photos — progress photos and scan photos. They live on your device; they're backed up to our cloud only while Roona Plus is active. Your profile picture is the exception: it's stored in your private cloud folder on every account. Photos you take for the shelf scanner or the ingredient label reader are sent for recognition and never stored on our servers—see Other AI features.
AI readings and ingredient explanations — the text of a reading or an ingredient breakdown you ask for is kept with your account so you can look at it again later, along with a small job record (time and status). Not the analysis copy of the photo—see below.
Subscriptions — if you get Roona Plus, we see your subscription status, never your card number (the app store handles payment).
Usage - we use PostHog for screens opened, taps, app version, device and installation identifiers, performance measurements, and automatic crash and error reports. While you are signed in, PostHog receives your Roona account identifier and email address, and analytics can be linked to your account. PostHog also receives your IP address and derives an approximate country and city from it. We use this information to understand app usage and fix problems, without advertising profiling or selling your data. Roona currently has no in-app analytics opt-out. Email support@roona.app to request deletion of your analytics profile.
Older app versions - versions before 2.0 also sent skin-quiz answers to PostHog, including skin type, concerns, sensitivity, age range and routine experience; some early versions also sent the pregnancy answer. Roona 2.0 does not send quiz answers to analytics; please update the app to stop this.
Early-access email — if you ask to be notified at launch, we store that email address, plus the IP address and browser string of the request to keep out spam sign-ups, so we can send you one message when Roona is out. We don't add you to a newsletter and we don't share it; email support@roona.app any time to be removed.
Web deletion requests — if you use the account deletion page, we store the email address you enter, the reason if you give one, and the IP address and browser string of the request, so we can verify it's really you and stop abuse.
Website visits — we count page views on roona.app ourselves, without cookies and without tracking you across sites. We don't store your IP address or browser string: they're combined with a secret that changes every day and turned into a short code that only tells us "same visitor, same day", and that code is deleted after 120 days. We do keep a count per country — your IP address is matched against a list of address ranges on our own server, so it's never sent anywhere, and only the country is kept. Nothing here is sent to an advertising network.

AI readings

Roona uses external AI processing services. The recipient depends on the feature and request.

Before live AI sends personal data, Roona explains the required inputs, lets you switch optional context off, and asks for explicit agreement. Optional journal context may be enabled initially; review the switches before continuing. Agreement also enables journal-based weekly and monthly reflections until you turn AI data sharing off. You can withdraw consent at any time under You > AI and privacy. Turning it off blocks new AI processing; it does not erase results or copies already processed.

Roona's analysis service receives the scan photo and the consented context in request memory and does not write that analysis copy to Roona's database or object storage. The service forwards them to external AI processing services to produce the reading, depending on the request. Each provider's training and retention practices are described under AI providers below.

Roona never uses scan photos for advertising or marketing. Scan photos you keep in your journal are backed up to the cloud only with Roona Plus and stay in that photo backup until you delete them or your account.

AI readings are informational and cosmetic only—not medical advice or a diagnosis.

Other AI features

Roona Plus also includes the AI routine builder, routine improvements, the shelf advisor, the shelf scanner, the ingredient label reader, and weekly and monthly reports. Each one sends only the journal context that feature needs—your skin profile and goal, routines, check-ins, shelf, products, earlier readings, and ingredient analyses—to external AI processing services to produce the result, depending on the feature and request, under the provider-specific terms described below. None of them send your progress or scan photos.

The shelf scanner and the ingredient label reader send the photos you take of your products or their labels. Those images are held in our service's memory only for as long as recognition takes: they are never written to our database or storage, never added to your journal, and never used for advertising or marketing. At external AI processing services they follow that provider's handling described below.

Scanning a product barcode looks it up in Open Beauty Facts, a public product database. The lookup is made by our server, so Open Beauty Facts receives the barcode and nothing else—not your IP address, your account, or anything from your journal.

AI providers

These are external services, not on-device AI. Depending on the feature and request, an AI processor receives the selected photo and disclosed journal inputs to generate the result. Commercial API inputs and outputs are not used for model training by default; explicit opt-in data sharing or feedback submissions can be exceptions.

Processors with abuse-monitoring logs may retain inputs and outputs in those logs for up to 30 days by default. Retention can be longer when required by law or reasonably necessary to protect services or others from harm. Retention also depends on the API feature and applicable shorter or zero-retention controls.

Processors with default API deletion delete API inputs and outputs within 30 days by default. Exceptions include longer-retention services such as file storage, agreed controls, usage-policy enforcement, and legal requirements. For flagged usage-policy violations, these processors may retain inputs and outputs for up to 2 years and safety classification scores for up to 7 years. Data explicitly submitted as feedback may be retained for 5 years. This is a separate retention policy from the abuse-monitoring logs described above.

Roona's temporary analysis upload, your saved journal and photo backups, and an AI processor's retained inputs and outputs are separate copies. Deleting a journal item does not necessarily immediately erase a processor's safety or legally required records. Contact support@roona.app for information about the recipients and retention applicable to your request or to exercise your data rights.

Face data

The camera preview is processed on your device to check the number of faces, face position, distance, and head angle; Roona also samples frame brightness for capture guidance. These temporary measurements are not saved or sent off the device, and Roona does not create a face template, faceprint, embedding, identity match, or biometric identifier.

When you confirm a capture, Roona stores the resulting JPEG scan photo in the app's private storage on your device until you delete the photo, delete your account, or remove the app. The photo is used only to produce your requested skin reading, show your private journal and comparisons, and, if Roona Plus photo backup is active, restore your photos across your devices. The separate copy sent for AI analysis follows the retention described in AI readings above.

International processing

Roona's hosting and external AI processing services may process personal data in countries outside where you live, including the United States, where privacy laws may differ. This includes selected photos and journal inputs you agree to send for AI processing. Roona remains responsible for the data it shares and requires its processors to provide the same or equivalent privacy and security protection. Contact support@roona.app for details about recipients, processing locations, and applicable transfer safeguards.

How we keep it, and keep it safe

We keep your data while your account is active. It's protected with encryption in transit, per-account access rules so no one else can read your journal, hashed passwords, and secure on-device storage for your login. Website visitor codes are deleted after 120 days. No system is ever 100% secure, but we take it seriously.

Deleting your data

Delete any scan, photo, or product from the app at any time; the deletion also syncs to your cloud journal, on every account.

Deleting a photo removes its on-device files and queues removal of any Roona Plus cloud-backup copy. Removing your profile picture clears the synced copy too. Deleting the app removes the on-device copy; your cloud journal backup, and with Plus any backed-up photos, may still exist until you remove the items in the app or delete your account.

Deleting your account

You can delete your account at any time from You > Delete account, via our account deletion page (no login needed), or by emailing support@roona.app.

When you request deletion, your account is deactivated immediately and permanently deleted after 30 days. Signing in again within those 30 days lets you cancel the deletion and restore your account.

Deletion removes your sign-in identity, your reading and ingredient-analysis records, and your cloud journal backup (including your profile picture and any backed-up photos) from our servers, and clears your on-device journal—routines, check-ins, and photos—from this device once deletion is final. You may also choose to erase photos from your device immediately when you request deletion.

We keep an anonymized record of the reason for deletion, no longer linked to you, to understand why people leave. Deleting your account does not cancel any App Store or Google Play subscription; manage that in your store account.

Subscriptions

Purchases are processed by Apple or Google and by RevenueCat, which receives the Roona account identifier and purchase information, without your journal or photos through that path. Roona Pro is a one-time purchase and does not renew.

Your rights

You can view and edit most of your data right in the app, and request a copy by emailing support@roona.app. If you're in the EU/UK or California, you have some extra rights—like access, deletion, objecting to certain processing, and no “sale” of your data (which we don't do anyway). Just email us and we'll help.

Kids

Roona isn't for children. You need to be at least 13 (or older where your country requires). We don't knowingly collect data from anyone under that age—if you think we have, email support@roona.app and we'll delete it.

Changes & contact

If we make meaningful changes, we'll update the date at the top and, where it matters, let you know in the app. Questions or requests are always welcome at support@roona.app.