CosmeShelf Privacy Policy

CosmeShelf is an iOS application developed and operated by an independent developer (hereafter "we", "the Developer"). This Privacy Policy explains what information CosmeShelf handles and how it is used.

Note on regions: CosmeShelf is available in several countries. If you are located in the United Kingdom or the European Economic Area (EEA), the section "Your Rights in the UK and EEA (UK GDPR / EU GDPR)" below applies to you in addition to the rest of this policy. Where there is any conflict, the rights granted to you under applicable law prevail.

Information We Handle

CosmeShelf does not operate any user account system. We do not collect directly identifying information such as your name, email address, or phone number.

The information handled by the app falls into two categories (in addition, we keep records for usage limits and abuse prevention, anonymous totals of the choices made on the consent screen, anonymous totals of shares made from the app, and votes in THE BEST ISSUE, and we match product names against anonymous statistics without storing them so that the app can show those statistics; see "Usage Limits and Abuse Prevention", "Counting Consent Choices", "Counting Shares", "Votes in THE BEST ISSUE" and "Anonymous Statistics Shown in the App").

1. Your Shelf Data (stored in your iCloud)

The following data is created and stored locally on your device, and synced to your personal iCloud (private database) via Apple CloudKit:

• Photographs you take of your cosmetics
• Product information you record (brand, product name, color number, category, barcode number, notes, etc.)
• Looks you save (combinations of items)
• Wishlist entries

In addition, settings such as the order of your Looks, the occasion of each Look you place there, and the estimated number of uses until a product runs out are stored in your personal iCloud through iCloud's settings sync.

This iCloud data is accessible only by you, through your Apple ID. We do not have access to it.

2. Aggregated Usage Data (stored on our servers)

With your consent, the following data is sent to and stored on servers we operate (Cloudflare):

• My Style preferences (age range, skin type, cosmetics spending range, purchase channels, decision factors, frequency of trying new products, future interest categories)
• When you added items to your shelf or wishlist, moved them Off Shelf (including the reason you chose and whether you would buy them again), or deleted them
• Attribute information of products registered on your shelf (name, brand, category, shade number, shade name, scent name, size, SPF, PA, etc.)
• Attribute information of products on your wishlist (name, brand, category, etc.), the domain of any link you saved, when you added them, and whether you later bought them and moved them to your shelf or removed them
• Barcode numbers of products on your shelf or wishlist (when a barcode appears in a photo you take, or when you scan one in the app; see "Barcodes")
• Whether a product's name was kept as read from your photo, corrected by you, or entered by you because it could not be read (if corrected, the name as originally read; also whether the AI inferred part of the name when reading it)
• Prices of products on your shelf or wishlist (amount and currency, including whether you entered the price yourself, it was read from a price tag in a photo you took for your wishlist, it was carried over when you moved an item from your wishlist to your shelf, or you used a list price or typical price that the app showed in the price field)
• How many days you recorded using a product (for example, through Looks) and the last day you used it
• The days you use a Look (when you tap "Wear Today"), together with that Look's occasion and products
• How much of a product on your shelf is left (the level you set yourself with the gauge, and roughly when it changed) and how many of the same product you have (including spares)
• Whether the items in a Look or on your wishlist were chosen by you or added from the app's suggestions
• The occasion of a Look (Weekday, Day Off, Day Out, Date, Night Out, Workout, Travel or Special, and the more specific occasion within it, such as Office, Yoga or Flight; including names you gave yourself in Looks in version 5.3 or earlier)
• What you choose in THE BEST ISSUE, the year-end best-of feature (the category, and the name and barcode number of each product you choose; only when you choose them in December)

This data does not contain directly identifying information such as your name, email address, or photographs. Each record is associated only with a randomly generated identifier created on your device.

Important — how this identifier is treated: Because this identifier links multiple records about the same device over time, under certain laws (including the EU/UK GDPR) this data may be treated as pseudonymized personal data rather than fully anonymous data, for as long as it remains linkable to your device identifier. We treat it accordingly and apply the protections described in this policy.

This data is stored using Cloudflare's database infrastructure, currently located in the Asia-Pacific region. See "International Data Transfers" below.

Legal Basis for Processing (UK / EEA users)

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:

• Consent (Art. 6(1)(a)): for collecting and using the Aggregated Usage Data described in section 2 (including showing it in the app as anonymous statistics), and for providing aggregated/statistical data to third parties. You give this consent through the in-app consent screen, and you may withdraw it at any time (see "Consent and Opt-out" and "Your Rights" below). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Legitimate interests (Art. 6(1)(f)): for the transient processing of the image and product details you submit to identify products and to generate Look / recommendation suggestions, for basic security and abuse prevention of our backend, including the usage limits described in "Usage Limits and Abuse Prevention", for the transient matching of product names and your device's country or region against anonymous statistics, as described in "Anonymous Statistics Shown in the App", for keeping anonymous totals of the choices made on the consent screen, as described in "Counting Consent Choices", for keeping anonymous totals of shares made from the app, as described in "Counting Shares", and for counting the votes in THE BEST ISSUE of people who have not consented to usage data sharing, as described in "Votes in THE BEST ISSUE". We have balanced these interests against your rights.

We do not process special categories of data (Art. 9) or use the data for automated decision-making that produces legal or similarly significant effects on you.

Consent and Opt-out

• You can enable or disable the Aggregated Usage Data described in section 2 at any time via the initial consent screen, or via Settings → Data Settings → Usage data sharing.
• While set to "Off", none of the data described in section 2 is sent to our servers.
• When you switch it off, the app sends our servers a one-time notice containing only the identifier generated on your device, a "consent withdrawn" flag, and the time you withdrew, so that we can record the withdrawal.
• You may switch back from Off to On at any later time.
• Withdrawing consent stops future collection. Data previously sent remains stored on our servers, linked to the identifier generated on your device, until you delete it (see "Your Rights" and "Data You Delete"). From the moment you withdraw, that data is no longer used for statistics or provided to third parties.

Purposes of Use

We use the Aggregated Usage Data for the following purposes:

• Improving the app and its features
• Improving the accuracy of recommendation features
• Showing anonymous statistics within the app (see "Anonymous Statistics Shown in the App")
• Statistical research about the cosmetics industry
• Providing data to third parties (such as cosmetics manufacturers, retailers, and research institutions) as aggregated statistical data that does not identify individuals, for the purposes above. When provided, only aggregated statistical data — not individual records — is shared, aggregated over a sufficient number of records to prevent re-identification.

Data Retention

• Shelf Data: retained in your iCloud until you delete it. We have no access to it and do not retain it on our servers.
• Aggregated Usage Data: retained for up to 24 months from your last activity, after which it is automatically deleted. It is also removed sooner if you delete it (in the app or on request) or withdraw consent and request deletion. We periodically review and remove data that is no longer needed.
• Usage-limit and abuse-prevention records: the per-device count of free uses is deleted automatically 12 months after your last use; IP-derived fingerprints and daily subscription counts within a few days; App Attest keys 180 days after their last use; links between a subscription and the devices using it 90 days after their last use; records of refunded or revoked purchases after 400 days (see "Usage Limits and Abuse Prevention").
• Consent-screen totals: kept as anonymous daily totals per country or region. They contain no identifier and cannot be linked to you (see "Counting Consent Choices").
• Share totals: kept as anonymous daily totals per country or region. They contain no identifier and cannot be linked to you (see "Counting Shares").
• Votes in THE BEST ISSUE from people who have not consented to usage data sharing: deleted automatically after the results are finalized at the end of February of the following year; the link used to limit each device to one set of votes per year is deleted automatically on March 1 of the following year (see "Votes in THE BEST ISSUE"). Votes from people who have consented are part of the Aggregated Usage Data.

International Data Transfers

Depending on the feature you use, your data may be processed in different locations, all outside the UK/EEA. In each case we rely on appropriate safeguards under Article 46 GDPR.

Aggregated Usage Data → Cloudflare (Asia-Pacific). The data described in section 2 is stored using Cloudflare's database infrastructure, currently located in the Asia-Pacific region. Transfers from the UK/EEA are made under the European Commission's Standard Contractual Clauses (with the UK Addendum for UK users), which Cloudflare incorporates into its Data Processing Addendum.

Images and product details → United States (Anthropic). When you photograph a cosmetic for identification, use the Look / recommendation features, when the app works out a product's size on your shelf or roughly how many uses it has, or when it checks the list price shown in the price field, the image and/or the relevant product details (such as brand, product name, category, and size), together with the name of the occasion you are creating a Look for, are sent to Anthropic's Claude API and processed in the United States (see "Image Recognition"). This transfer is made under the European Commission's Standard Contractual Clauses (with the UK Addendum / UK International Data Transfer Agreement for UK users), which Anthropic incorporates into its data processing terms. The data is processed transiently and is not stored on our servers; Anthropic does not use API inputs to train its models.

Image and list price searches. When the app searches for candidate product images, only the product name — not personal data — is sent to a third-party search provider, and only thumbnail URLs are returned. When it searches for the list price shown in the price field, only the product name, brand and size and the country or region — not personal data — are sent, and only search results (such as page titles, store names and prices) are returned. As no personal data is transferred, this is not an international transfer of your personal data.

Matching against anonymous statistics → Cloudflare. The product names, brands and barcode numbers, and your device's country or region setting, that the app sends so it can show anonymous statistics are handled by our servers (Cloudflare) only transiently for matching, and are not stored. The type, standard size and dimensions worked out for each product, and the list price found for each product and country or region, are stored without any link to whose product it is (see "Anonymous Statistics Shown in the App").

Image Recognition

When you photograph a cosmetic, the image is sent to our backend proxy and then to Anthropic's Claude API for product identification. Anthropic processes the image on our behalf under its data processing terms. The image is processed transiently and is not stored on our servers. For details of Anthropic's own practices, see its privacy policy (https://www.anthropic.com/legal/privacy).

Image Suggestions

When you select an image for a cosmetic in the app, we search the web for candidate images based on the product name. The search is performed via our backend proxy, and only thumbnail URLs of the results are retrieved.

Barcodes

When a product barcode appears in a photo of a cosmetic you take or choose from your library, the app reads the barcode on your device and records its number in your Shelf Data. You can also scan a barcode with the camera from an item's detail screen. Barcodes are always read on your device; no photo or video is sent anywhere for this. The number is sent to our servers only as part of the Aggregated Usage Data in section 2, and only if you have consented. You can remove the number at any time from the item's detail screen.

Anonymous Statistics Shown in the App

The app aggregates the records of people who have consented to usage data sharing and shows them in the app, for example:

• When you put together a Look: products that are often worn with the cosmetics you chose
• For products on your wishlist: whether most people who had them used them up, or let them go because they did not suit them
• On an item's detail screen: products often used together with it
• Products that were added to many people's shelves in the previous month
• In the price field of an item's detail screen, for products whose list price is not known: a typical price (from the prices entered by people in the same country or region)
• For products on your shelf: roughly how many uses they last (from the records of people who used up the same product; when there are not enough records, worked out from the product's size and the amount used each time)
• In January, the products most chosen in the previous year's THE BEST ISSUE (the top products in each category, including the votes of people who have usage data sharing switched off; see "Votes in THE BEST ISSUE")

Statistics are counted per country or region (the country or region in each profile) and worldwide, and are shown only when records from at least five people have been gathered. They are never shown in a way that reveals whose records they are, and the numbers of people are not shown. Records of people who switch usage data sharing off are removed from the statistics from the next day.

To show these, when you open your wishlist or an item's detail screen, or put together a Look, the app sends the product names, brands and barcode numbers, together with your device's country or region setting, to our servers (Cloudflare) to match them against the statistics. When you put together a Look, it also sends the names of products you already own, have on your wishlist or have moved Off Shelf, so that they are not suggested to you. When you open the results of THE BEST ISSUE, it also sends the names and barcode numbers of the products you chose, so that it can mark the ones you chose too (the identifier generated on your device is not sent). When you open your shelf, only your device's country or region setting is sent. If your device's country or region is not available, the country derived from your connection is used instead. When the app works out roughly how many uses a product on your shelf has, or its size on your shelf, it sends the product's name, brand, category and size (and, for its size, a reduced copy of the product's photo).

When the app shows a list price or typical price in the price field of an item's detail screen, and when you tap "Fill in prices" on the total screen, it sends the product's name, brand and size, together with your device's country or region and currency settings. The list price is the regular price shown by the brand's official store or an authorized retailer in that country or region. Our server searches a third-party search provider with the product's name, brand and size and the country or region, and checks the results with Anthropic's Claude API. For products whose list price is not known, the typical price is the usual price in that country shown in the search results or, when there is none, a price estimated by the Claude API. A list price or typical price is entered as the price only when you tap it.

These are sent whether usage data sharing is on or off, but they are used only for matching and are not stored (except that the type, standard size and dimensions worked out from a product's name and size, and the list prices found, are stored per product (list prices per product and country or region), without any link to whose product it is, so that the same product does not need to be worked out again; photos are not stored), and they are not linked to the identifier used for the Aggregated Usage Data in section 2 (requests are still counted against short-term rate limits, as with any other feature; see "Usage Limits and Abuse Prevention").

Usage Limits and Abuse Prevention

To enforce the number of free uses and daily usage limits, and to protect our backend from abuse, we record the following on our servers (Cloudflare), whether usage data sharing is on or off:

• A random identifier generated on your device for counting (separate from the identifier used for the Aggregated Usage Data in section 2), together with how many times you have used features such as product identification and Look creation. Deleted automatically 12 months after your last use.
• A one-way fingerprint derived from your IP address, together with that day's usage count. The IP address itself is not stored. Deleted automatically within a few days.
• To confirm that requests come from the genuine app, the public key and identifier of a key created on your device through Apple's App Attest, linked to the per-device identifier above. When the key is created, your device communicates with Apple, and Apple certifies that the key belongs to the genuine app. Deleted automatically 180 days after its last use.
• If you subscribe to Atelier, we verify the Apple-signed purchase record sent by the app, and record the subscription's identifier together with that day's usage count. Deleted automatically within a few days.
• If you subscribe to Atelier, to prevent a purchase record from being shared, the per-device identifiers of the devices that use the subscription, linked to the subscription's identifier. The number of devices per subscription is limited, well above normal use. Deleted automatically 90 days after their last use.
• The identifiers of purchases that were refunded or otherwise revoked, based on notifications Apple sends us, so that those purchase records can no longer be used for Atelier. Deleted automatically after 400 days.

This information is used only for usage limits and abuse prevention. It is not used for statistics or provided to third parties.

Counting Consent Choices

When you choose "Agree" or "Don’t agree" on the consent screen the first time you open the app, we record only that one more choice of that kind was made, by day and by the country or region set on your device, on our servers (Cloudflare, Asia-Pacific region). This record contains nothing that could tell us who made the choice: no identifier generated on your device and no IP address. It is sent once, whether or not you agree to usage data sharing. If you tell us in the age check that you are under 16, nothing is counted.

We use these totals to improve the app and to show how many people the Aggregated Usage Data comes from, and they may be included in the aggregated statistical data we provide to third parties.

Counting Shares

When you share a cover, card or video made in the app through the share sheet (only when you choose where to share it and the share is completed; nothing is counted if you cancel), we record only the following, as totals by day and by the country or region set on your device, on our servers (Cloudflare, Asia-Pacific region):

• What you shared (My CosmeShelf, Today's Cosmetics, THE BEST ISSUE, an item card or THE BEST ISSUE results) and whether it was made with your own background photo
• In which form (post, story or video)
• The type of destination (such as Instagram, TikTok or saving to Photos)

This record contains nothing that could tell us who shared: no identifier generated on your device and no IP address. We do not record the account you shared to, or what you posted or wrote. It is sent whether or not you agree to usage data sharing. If you tell us in the age check that you are under 16, nothing is counted.

We use these totals to improve the app's sharing features and to understand how the app spreads, and they may be included in the aggregated statistical data we provide to third parties.

Votes in THE BEST ISSUE

When you choose "Cast my vote" in THE BEST ISSUE in December, the app sends what you chose (the category, and the name, brand and barcode number of each product) together with your device's country or region setting to our servers (Cloudflare, Asia-Pacific region), and it is counted as your vote. You can vote whether usage data sharing is on or off.

• If you have consented to usage data sharing, your votes are stored as part of the Aggregated Usage Data in section 2, together with the identifier generated on your device.
• If you have not, your votes are sent with a number created on your device only for that year's vote, and are not linked to the identifier used for the Aggregated Usage Data in section 2. This number is used only to replace your earlier votes when you choose again. These votes are deleted automatically after the results are finalized at the end of February of the following year.
• To limit each device to one set of votes per year, we record a one-way code derived from the per-device identifier described in "Usage Limits and Abuse Prevention", linked to this number. It is deleted automatically on March 1 of the following year.

Votes are used to count the ranking in each category. Results show only products chosen by at least five people, as rankings without the numbers of people (see "Anonymous Statistics Shown in the App"). These results may be included in the aggregated statistical data we provide to third parties.

Third-Party Analytics

CosmeShelf does not use third-party analytics or tracking SDKs such as Google Analytics. Your activity is recorded only on our backend, and only when you have consented under "2. Aggregated Usage Data" above (except for the usage counts described in "Usage Limits and Abuse Prevention", the totals described in "Counting Consent Choices" and "Counting Shares", and the votes described in "Votes in THE BEST ISSUE").

Your Rights in the UK and EEA (UK GDPR / EU GDPR)

If you are located in the UK or EEA, you have the following rights regarding personal data we hold about you:

• Right of access — to obtain confirmation of, and a copy of, the data we hold linked to your device identifier
• Right to rectification — to correct inaccurate data
• Right to erasure ("right to be forgotten") — to request deletion of your data
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time, without affecting prior lawful processing

You can exercise several of these directly in the app, under Settings → Data Settings:

• Export data — download a copy of the data we hold linked to your device identifier (access / portability)
• Delete server data — delete that data from our servers (erasure)
• Usage data sharing — turn collection off at any time (withdraw consent)
• Your identifier — view the identifier our records are keyed to

For any other request, or if the in-app options do not work, contact us at the address below. Because our records are keyed only to a device-generated identifier and contain no directly identifying information, we may ask you to provide that identifier (shown under Settings → Data Settings) so we can locate the relevant records.

You also have the right to lodge a complaint with your local supervisory authority (for example, the ICO in the UK, or your national Data Protection Authority in the EEA).

Data Controller: The Developer of CosmeShelf. Contact details are provided in the "Contact" section below.

Data You Delete

Shelf Data

Items you delete in the app are removed from your device and from your iCloud immediately.

Aggregated Usage Data

When you switch Settings → Data Settings → Usage data sharing to "Off", no further usage data is sent from your device (only the one-time notice described in "Consent and Opt-out"), and data already sent is no longer used for statistics or provided to third parties. To delete data already sent, use Settings → Data Settings → Delete server data; this removes the records associated with your device identifier from our servers. You can also contact us at the address below and we will delete them for you.

Business Transfers

If CosmeShelf's business is transferred to another party, for example through a merger, acquisition, or sale of assets, the Aggregated Usage Data described in section 2 may be transferred to that party, on the condition that it continues to be handled in accordance with this policy. We will notify you in this policy and in the app before this happens.

Children

CosmeShelf is not directed to children under the age required for an Apple ID in your region, and we do not knowingly collect data from such children.

Changes

If this policy changes materially, we will update the date at the top of this page and notify you within the app. Where required by law, we will seek your renewed consent.

Contact

contact@cosmeshelf.com