Privacy.

The short version

You can search and browse without an account. With optional consent,beautydew labs uses a first-party random session identifier to connect activity within a visit. When you are signed in, actions such as viewing a product, saving it, setting a profile preference, or submitting content can be recorded against your account. Some convenience data stays only in this browser. The sections below distinguish those states and explain what access and account deletion currently do.

Account and saved data

If you create an account, we store the account identity and sign-in records needed to authenticate you, plus profile fields and product features you choose to save. Depending on what you use, that can include a skin or hair profile, shelf and routine history, follows, reviews, community contributions, alerts, reaction reports, organization roles, and commerce records. No advertising-data-broker or ad-pixel integration is present in the current app code.

Check-in and journal notes are private by default. Reviews, public routines, forum posts, and other features explicitly presented as publishing actions can be visible to other visitors; their final ownership, licence, moderation, and removal terms require the review listed at the end of this policy before open launch.

Label scans, shared results, and photos

Skin journal photos are uploaded only when you choose Save. We store a resized copy without camera metadata, the date you choose, and any optional note. Only your signed-in account can view or download them; they are not published to the community or sent for AI analysis. They remain until you delete the photo or your account. Deletion removes access immediately and queues the stored file for removal, retrying if storage is unavailable. Your data export includes journal details and signed-in download links; you can also download each photo directly from your journal.

When you use a photo to read an ingredient label, optical recognition runs in your browser. The photo is not uploaded merely because you scanned it; recognized label text is sent to the server for ingredient matching.

If you choose Save scan while signed in, we store the decoded result and, when you selected a photo, that photo. The photo is re-encoded before storage, removing camera metadata such as GPS location. Your list at Saved scans is account-only.

A saved or deliberately shared result also receives a random result URL. That result page does not require sign-in and can be opened by anyone who has the URL; it is marked not to be indexed by search engines. It displays the decoded label result, not the saved photo. Do not share the URL if the recognized label text itself is sensitive.

Saved and shared scan records are removed after 180 days. Deleting a saved scan removes it from account history immediately and attempts to purge its photo straight after. Deleting your account removes the saved scan records immediately, and their photo files straight after — if the file store is briefly unavailable, the 180-day sweep clears whatever is left.

Data kept only on this device

Browser storage is used for convenience features such as a signed-out shelf, one product-fit hint, comparisons, recent products and searches, routine drafts, and temporary interface choices. Those records are not sent to the server merely because they exist in browser storage. You can clear them with the feature's own control where one is offered, or through the browser's site-data settings.

When you sign in, the signed-out shelf is offered to the account import flow and cleared locally after a successful import. A local search- history opt-out is checked before recent searches are written and clears the existing local recent-search list when turned on. Server analytics does not store the raw search phrase in its event metadata.

After optional consent, local storage also keeps a random, 30-minute activity-session state for audience measurement. Its random id is sent only if the page has been visible for at least ten seconds and the browser reports a trusted pointer, keyboard, or scroll interaction. It contains no page text, search phrase, account detail, or interaction coordinates.

Website analytics

On the canonical production website, Google Analytics measures page visits and interactions such as searches, completed formula scans, source opens, and outbound purchase clicks. The tag does not load on local development, preview deployments, or non-canonical deployment aliases. Google can process browser or device information, referring pages, approximate location, and pseudonymous identifiers. We do not intentionally send account emails, phone numbers, postal addresses, raw formula text, personal routine answers, or raw search phrases to Google Analytics, and the implementation does not enable Google's user-provided-data feature.

Recognized personal routine and profile answers in a page URL stop the Google tag for that browser document. Our product-fit activation event records that a selection was made, without sending or storing the selected concern in that event. These controls reduce collection; they do not replace the consent and privacy choices described below.

Browsers that identify themselves as automated and browsers deliberately marked as internal are excluded before the Google tag loads. Because any sophisticated automated browser can imitate an ordinary browser, a raw Google Analytics user count is still a diagnostic estimate, not an exact count of people. We use a separate qualified session measure for the audience headline: one random 30-minute browser session that reaches ten visible seconds and a browser-trusted interaction. That is an exact count of consented sessions meeting the stated rule, not proof of a unique human. Visitors who decline are not included, so a lower count after this gate launches is not evidence that traffic fell.

With optional consent, behavioral activity is recorded in our own database. Signed-in rows can carry an account id. Signed-in and signed-out rows can carry the same random session id, so activity before and after a sign-in during one visit can remain connected. Product-view events are retained for 30 days; search and outbound-buy events for up to 365 days; other analytics events for up to 180 days; and qualified sessions for up to 180 days. Account deletion removes account-linked event and qualified-session rows, plus every row in either table sharing a session with them.

Optional analytics, visit attribution, sampled PostHog replay and browser error reports stay off until you choose Accept optional. Choose Reject optional to keep them off. Cookie preferences in the footer lets you change that choice; withdrawing reloads the page so already-loaded third-party tools stop running. Your choice is remembered for 180 days on this browser. If we cannot save the preference, optional tracking stays off. Browser Do Not Track and Global Privacy Control signals also keep it off. Essential sign-in, security, requested account features and transaction records continue to work. Owner and counsel review of launch markets, legal bases and provider terms remains required.

Google explains its processing in its partner-sites privacy explanation.

Traffic investigation with PostHog

When the PostHog investigation pilot is enabled, we send page visits, browser characteristics, and limited interaction events from public catalog pages to PostHog. A browser fingerprint can label a visit as suspicious; that label is not proof that the visitor is automated. We sample 1% of eligible sessions for masked session replay.

Recording masks page text and form inputs, and blocks forms, dialogs, images, and account navigation. Account, login, checkout, routine, and other private pages are excluded. URLs with query strings or fragments are excluded. Collection stops before navigation to an excluded page and stays off for that document. Request bodies, headers, and console logs are not recorded.

This pilot uses session storage for random browser identifiers, without linking them to your account. PostHog receives network information when your browser connects to it. Browsers marked as internal, browsers sending Do Not Track or Global Privacy Control, local development, and preview deployments are excluded. This investigation does not block visitors from using the website.

PostHog privacy information

Error monitoring

When configured, Sentry receives browser errors only after optional consent. Server error monitoring for service reliability and security continues independently of browser consent. An error report can include a sanitized route, stack trace, browser or server-runtime details, and a random request correlation id.

The current configuration does not intentionally send Sentry an account identity, cookies, request or response headers, request or response bodies, query parameters, local stack variables, generative AI inputs or outputs, arbitrary diagnostic extras, or breadcrumbs. Session replay, release-health sessions, Sentry Logs, metrics, and profiling are not enabled. A final scrubber removes common credentials, identity fields, private route identifiers, and database statements before an event leaves the application.

Retailer and affiliate-link measurement

An outbound retailer action can create an internal analytics event linked to the random browser session. The redirect service also keeps a separate commission-reconciliation record containing a random click id, destination, product or offer where known, retailer/network, surface, observed price, and time. That click ledger does not contain an account id or the analytics session id. An affiliate network can return the random click id with a reported conversion so commission can be reconciled. The destination retailer and any configured affiliate provider process the visit under their own privacy terms.

First-touch campaign tags and the referring domain can be stored in a first-party cookie and copied to an order if native commerce is later enabled. The cookie stores the referrer's domain, not its full URL, and it does not change the price shown to the visitor.

Email

Marketing email is opt-in and off by default. The public form joins the weekly watchlist for observed new listings and price drops. An account opt-in also permits one delivered-purchase review request and at most two reminders for an abandoned signed-in bag; a guest checkout address alone is never consent. You can opt in at sign-up, through the watchlist form, or in Email preferences, and unsubscribe without signing in. A suppression record is kept so a marketing address that opted out is not silently re-added.

When transactional email delivery is configured, account, security, safety, and order messages requested by the feature are separate from marketing consent. Provider delivery must be tested before the new site promises email recovery or receipts.

Access and correction

A signed-in member can use the privacy center and request a structured export at Download my data. The export offers 15 explicit categories rather than claiming to export an undefined “everything.”

Account deletion and retained records

Account deletion is permanent, but it is not a promise that every record vanishes. The lists below are rendered from the same code-owned erasure plan used by the deletion flow. Self-service deletion pauses while an order, return or refund is active; while the member is the sole owner of an organization; while a reaction report remains under review; or when a staff reviewer is attached to a retained safety record. Those states must be resolved with the relevant operational team first.

These are implemented data dispositions, not a counsel-approved retention schedule. No fixed statutory response time or long-term retention period is promised here until the policy review below is complete.

Questions or help with a request

Use the privacy center while signed in. If you cannot access the account or need help resolving a deletion blocker, email jaewonlee9642@gmail.com. We do not publish a response-time promise until the operating process and applicable legal deadline have been approved.