Privacy Policy (Android)

Last updated: October 2026

Kelvia is built so that there is very little about you for anyone to hold.

WHO IS RESPONSIBLE

Kelvia is run by İbrahim Melikşah Köse, an individual developer in İstanbul, Türkiye — not a company. That makes him the data controller for everything described below, and the person you write to about any of it. Full details are at the end.

WHAT STAYS ON YOUR PHONE

Your onboarding answers, your skin profile, your scan history and your routine are stored on this device only. We have no server that holds them, no account system, and no way to look them up. If you delete the app, they are gone. This app does not take part in Android's backup service, so there is no copy anywhere else.

Since version 1.0.2, also kept only on this phone: reminders, which are planned with Android's own alarms and shown as notifications by the phone itself, and never show a finding about your skin (while a free trial runs, its end date is kept for the day-before reminder); your routine marks, weekly notes, the reason you gave for stopping a product and your answer when a new product's first two weeks are up; your avoid list and the barcodes you add to your shelf; the home-screen widget's data, which holds only how many products are in today's routine and whether you marked them; and your photo diary — those photos are encrypted like progress photos, never analysed and never sent. "Delete all my data" removes all of it.

Progress photos, when you leave that setting on, are written into the app's own storage and encrypted by the app itself, with a key held in this phone's hardware keystore. We never upload them, and they are never sent to us or to anyone else. There is no backup exception on Android: the app opts out of Android's backup service, so the photos exist on this phone and nowhere else.

YOUR PHOTOS AND THE ANALYSIS

When you scan your face or a product, the photo does not travel alone. So that the analysis can be about you, your skin profile — your skin type, your concerns and their severities, your onboarding answers — and the names of the products in your routine are sent with it. None of it is stored. If you paste or type a product's ingredient list instead of photographing the label, that text takes the photo's place on the same path and is not stored either.

The request first passes through Cloudflare's relay in the United States, which hands it to our server without writing it down. Our server runs on OVHcloud's infrastructure in Milan, Italy — inside the European Union — and passes the request on, again without writing it down and through Cloudflare's network, to Google's Gemini API, which produces the analysis. On our side the photo is never written to a disk or a log, and once the result comes back we hold nothing at all. What Google does at its end is not ours to promise, but we are on their paid tier, whose terms say Google does not use what is sent to improve its products, and under which no human reviewer reads it. What remains is abuse monitoring: Google keeps a log of what is sent for a limited period — up to 55 days by default — solely to detect and prevent violations of its usage policy. How long Google holds anything under its own terms is described in the privacy notice.

Before a photo is sent it is re-encoded, which strips the metadata a camera embeds — including where the picture was taken.

OUR SERVER

Our server is hosted for us by OVHcloud in Milan, Italy, inside the European Union; Cloudflare only relays requests to it and carries its calls to Google. The few records that stay on the server are listed one by one in the privacy notice: scan counters kept behind a digest of the anonymous identifier, a daily counter kept behind a digest of your internet (IP) address to limit abuse, the name-search cache, and — if you subscribe — the subscription record. They are backed up once a day on the same server, and each backup is deleted after 7 days.

WHAT IDENTIFIES YOU

Nothing you would recognise as your identity. The app generates a random identifier for itself the first time it runs and sends it with each analysis so that the weekly allowance can be applied. It is not derived from your phone's hardware, it is not linked to your name, email or Google account, and "Delete all my data" replaces it with a new one.

If you subscribe to Kelvia Premium, the app hands our server the purchase token Google Play gives the subscription, and our server asks Google Play which plan it is, when it ends and whether it is in the free trial, so the larger allowance can be applied. When the subscription renews, is cancelled or is refunded, Google Play tells our server so. Payment details never reach us; Google Play handles the payment.

We never ask for your name, your email address or your date of birth.

USAGE ANALYTICS

This version of the app sends no usage analytics of its own. It notes which screens are opened and which actions are taken — for example "a product scan finished" — only in the phone's own system log, which stays on the phone and is not sent to us. If a future version starts sending anonymous usage statistics, this policy will say so, and name the service, before that version is released.

One thing comes with a component rather than from us. Three quick checks run on the phone itself with Google's ML Kit: whether a label photo is readable, whether a face photo is usable, and reading a barcode. The images never leave the phone for these checks. ML Kit does, however, send Google diagnostic and usage data about itself — such as the device model and Android version, the app's name and version, which ML Kit feature ran, how long it took and any error code — under an identifier for this installation of the app. It carries no photo, no text that was read, no barcode and nothing about your skin. We never receive it; Google says it uses this data for diagnostics and usage analytics and does not pass it to third parties.

DELETING EVERYTHING

Settings → Delete all my data removes your profile, both kinds of scan history, your routine and every stored photo, and issues a new anonymous identifier. Because no server record is tied to your identity, that really is all of it. What stays on the server are the scan counters behind an irreversible digest of the old identifier: the daily one expires by itself within about a day, the weekly one within about eight days, and the daily backup can hold them for up to 7 days more. They cannot be traced back to you. Deleting your data does not cancel a subscription — that is done in Google Play — and a subscription record expires by itself one day after the subscription ends.

AGE

Kelvia is for people aged 18 and over.

CONTACT

İbrahim Melikşah Köse
Fındıklı Mahallesi, İpek Sokak, Meriçlife Sitesi 25-45C, Kat 2, Daire 21
Maltepe / İstanbul, Türkiye
melberlabs@gmail.com