Privacy Policy

Last updated: October 2026

Kelvia is built so that there is very little about you for anyone to hold.

WHO IS RESPONSIBLE

Kelvia is run by İbrahim Melikşah Köse, an individual developer in İstanbul, Türkiye — not a company. That makes him the data controller for everything described below, and the person you write to about any of it. Full details are at the end.

WHAT STAYS ON YOUR PHONE

Your onboarding answers, your skin profile, your scan history and your routine are stored on this device only. We have no server that holds them, no account system, and no way to look them up. If you delete the app, they are gone — with one exception we explain below, your own iCloud backup.

In the iPhone app, since version 1.0.2, also kept only on this phone: reminders, which are planned with iOS's own local notifications and never show a finding about your skin (while a free trial runs, its end date is kept for the day-before reminder); your routine marks, weekly notes, the reason you gave for stopping a product and your answer when a new product's first two weeks are up; your avoid list and the barcodes you add to your shelf; the home-screen widget's file, which holds only how many products are in today's routine and whether you marked them; and your photo diary — those photos are encrypted like progress photos, never analysed and never sent. "Delete all my data" removes all of it.

Progress photos, when you leave that setting on, are written into the app's own storage and encrypted by iOS whenever your phone is locked. We never upload them, and they are never sent to us or to anyone else. One honest exception: if you have iCloud Backup switched on, your phone backs them up the way it backs up the rest of the app's data. That backup is between you and Apple — it is yours, and we cannot reach it.

YOUR PHOTOS AND THE ANALYSIS

When you scan your face or a product, the photo does not travel alone. So that the analysis can be about you, your skin profile — your skin type, your concerns and their severities, your onboarding answers — and the names of the products in your routine are sent with it. None of it is stored. If you paste or type a product's ingredient list instead of photographing the label, that text takes the photo's place on the same path and is not stored either.

The request first passes through Cloudflare's relay in the United States, which hands it to our server without writing it down. Our server runs on OVHcloud's infrastructure in Milan, Italy — inside the European Union — and passes the request on, again without writing it down and through Cloudflare's network, to Google's Gemini API, which produces the analysis. On our side the photo is never written to a disk or a log, and once the result comes back we hold nothing at all. What Google does at its end is not ours to promise, but we are on their paid tier, whose terms say Google does not use what is sent to improve its products, and under which no human reviewer reads it. What remains is abuse monitoring: Google keeps a log of what is sent for a limited period — up to 55 days by default — solely to detect and prevent violations of its usage policy. How long Google holds anything under its own terms is described in the privacy notice.

Before a photo is sent it is re-encoded, which strips the metadata a camera embeds — including where the picture was taken.

OUR SERVER

Our server is hosted for us by OVHcloud in Milan, Italy, inside the European Union; Cloudflare only relays requests to it and carries its calls to Google. The few records that stay on the server are listed one by one in the privacy notice: scan counters kept behind a digest of the anonymous identifier, a daily counter kept behind a digest of your internet (IP) address to limit abuse, the name-search cache, and — if you subscribe — the subscription record. They are backed up once a day on the same server, and each backup is deleted after 7 days.

WHAT IDENTIFIES YOU

Nothing you would recognise as your identity. The app generates a random identifier for itself the first time it runs and sends it with each analysis so that the weekly allowance can be applied. It is not derived from your phone's hardware, it is not linked to your name, email or Apple ID, and "Delete all my data" replaces it with a new one.

If you subscribe to Kelvia Premium, the app hands our server the App Store's signed record of the subscription — its transaction number, the plan, when it ends, and whether it is in the free trial — so the larger allowance can be applied. The same goes, once, for the App Store's record of when you first downloaded Kelvia, which decides the welcome week. Payment details never reach us; Apple handles the payment.

We never ask for your name, your email address or your date of birth.

USAGE ANALYTICS

Apart from the ad measurement below, this version of the app sends no usage analytics to anyone. It notes which screens are opened and which actions are taken — for example "a product scan finished" — only in the phone's own system log, which stays on the phone and is not sent to us. If a future version starts sending anonymous usage statistics, this policy will say so, and name the service, before that version is released.

AD MEASUREMENT (META)

Kelvia is advertised on Instagram and Facebook. To learn whether those ads work, the iPhone app includes Meta's software development kit (SDK), and it stays switched off unless you allow tracking in Apple's prompt, which appears once, after a short explanation. If you allow it, Meta Platforms, Inc. (United States) receives only the fact that the app was installed and opened, together with your device's advertising identifier and the technical details Meta's SDK attaches to such events (such as device model, operating system version, language and time zone) — and, if the SDK itself crashes, a report of that crash. No scan, photo, skin finding, profile, routine or purchase is ever sent. If you do not allow it, nothing at all is sent to Meta. You can change your answer at any time in Settings → Privacy & Security → Tracking; Kelvia's own Settings shows the current answer. What Meta does with these events is governed by Meta's own privacy policy.

DELETING EVERYTHING

Settings → Delete all my data removes your profile, both kinds of scan history, your routine and every stored photo, and issues a new anonymous identifier. Because no server record is tied to your identity, that really is all of it. What stays on the server are the scan counters behind an irreversible digest of the old identifier: the daily one expires by itself within about a day, the weekly one within about eight days, and the daily backup can hold them for up to 7 days more. They cannot be traced back to you.

AGE

Kelvia is for people aged 18 and over.

CONTACT

İbrahim Melikşah Köse
Fındıklı Mahallesi, İpek Sokak, Meriçlife Sitesi 25-45C, Kat 2, Daire 21
Maltepe / İstanbul, Türkiye
melberlabs@gmail.com