Privacy Policy
This policy explains how the Barrier Code mobile app and the website skinbarrierapp.com process your personal data. The app and the website process data in different ways. Last updated: 2026-11-04.
1. Who is responsible for your data
The data controller is PROSKYNA, UAB, Vijoklių g. 16B, Lindiniškių k., LT-14181, Vilniaus r. sav., Lithuania. For questions about your personal data, contact info@skinbarrierapp.com.
2. Data stored on your phone
The following data is stored on your phone:
- Skin journal entries, notes and photos;
- analysis history: scanned products, dates and results;
- the Shelf, the Daily routine and photos of product packaging, except a photo that you add yourself to a public review;
- your name or preferred form of address, if you entered it;
- the ingredient database and searches in it;
- PDF reports created on the phone.
When you delete the app, its data on the phone is removed, but files you exported earlier or phone backups may remain separately. To move your data, use Settings → Export data and Import data. You choose where the export file is saved.
3. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Skin profile: skin type, sensitivity, conditions, body zones, ingredients to avoid, language | To tailor the assessment of the product’s composition to the skin you selected | Explicit consent (GDPR Art. 9(2)(a)) and performance of a contract (Art. 6(1)(b)) |
| Anonymous account identifier | To link the app account and its records | Performance of a contract, Art. 6(1)(b) |
| Scan and PDF counters | To apply the limits of the free plan | Performance of a contract, Art. 6(1)(b) |
| Consent records | To prove that consent was obtained | Legal obligation, Art. 6(1)(c) |
| Label photo and recognised text | To recognise the ingredient list when you choose the cloud service | Consent, Art. 6(1)(a) |
| Daily counter for cloud recognition | To limit abuse | Legitimate interest, Art. 6(1)(f) |
| Reviews you submit and the related skin profile | To show reviews in the “Experiences” section | Consent, Art. 6(1)(a); for health data – explicit consent, Art. 9(2)(a) |
| App crash data | To find and fix errors | Legitimate interest, Art. 6(1)(f) |
| Subscription data | To provide PRO features | Performance of a contract, Art. 6(1)(b) |
The skin profile is health data. When you launch the app for the first time, it asks for your separate explicit consent. You can withdraw your consent by deleting your account.
A photo of the ingredient list is sent to the cloud recognition service only if you choose this option and give your consent. If you do not consent, recognition is done on the phone.
The app does not collect your phone number, precise location, contacts or advertising identifiers, does not show ads and does not use usage statistics. The app does not need your e-mail address. The website receives an e-mail address only when you enter it yourself (section 10a). We do not sell your personal data.
4. Reviews (“Experiences”)
From the Shelf you can voluntarily write a review of a cosmetic product.
- What is sent: the product name, type and ingredient list; the body zone; skin type, sensitivity and conditions; the rating, length and frequency of use; your comment, if you give one; a photo of the packaging, if you add one; the anonymous account identifier.
- Who sees it: a review is checked before it is published. Other “Experiences” users see the published review and the skin profile linked to it. Your name and account identifier are not shown to others.
- Sensitive data: the skin profile may reveal information about your health. If you do not want it to be shown to others, do not submit a review.
- What to upload: do not include your name, contact details or other personal data in the comment. The photo you upload must show only the product packaging.
- How to remove it: you can delete a review on the Shelf, in the product card; the review photo is removed with it. When you delete your account, all its reviews are removed.
- Reports of inappropriate content: while a report is being reviewed, the review number and the reporter’s anonymous account identifier are kept.
5. Service providers and data recipients
The app uses the following services. We do not pass data to anyone else.
| Service / provider | What data is processed |
|---|---|
| Firebase Cloud Functions / Google | The photo of the ingredient label and the recognised text are passed along the recognition chain; the account identifier is used to check the daily limit. |
| Google Cloud Vision / Google | The label photo, usually cropped and reduced in size; the account identifier is not passed on. |
| Google Gemini / Google | Only the text recognised from the label, not the photo. |
| Firebase Authentication / Google | The anonymous account identifier. |
| Cloud Firestore / Google | The skin profile, counters, consent records and reviews. |
| Firebase Storage / Google | The packaging photo of a review, if you upload one. |
| Firebase App Check / Google, Apple, Google Play | Request authenticity check data (Apple App Attest / Play Integrity). |
| Firebase Crashlytics / Google | Device model, OS and app version, installation identifier, crash data. |
| RevenueCat / RevenueCat, Inc. | Subscription receipt, anonymous purchaser identifier, device data, country. |
| App Store / Apple; Google Play / Google | Payment processing; the app does not receive payment card data. |
Usually only the cropped area of the ingredient list photo is sent. If cropping fails, the whole frame may be sent, and other information may happen to be visible in it. Skin journal photos and Shelf packaging photos are not sent to this recognition chain; a packaging photo that you voluntarily add to a review is processed separately.
6. Where data is stored and processed
A European Union region (Belgium) has been chosen for Cloud Firestore, Firebase Storage and the server functions. The providers of the Cloud Vision, Gemini, Crashlytics and RevenueCat services may also process data outside the EU / EEA, including in the USA.
Such transfers are covered by the safeguards provided for by law – a European Commission adequacy decision or standard contractual clauses.
7. How long we keep data
| Data | Retention period |
|---|---|
| Skin profile, counters, consent records | As long as you use the app or until you delete your account (Settings → Delete account). |
| Reviews and their photos | Until you delete the review or your account. |
| Reports of inappropriate reviews | While the report is being reviewed. |
| Daily counter for cloud recognition | Only the count for the last day is kept; after you delete your account, it may remain on the server. |
| Crash data | Google keeps it for 90 days and then starts deleting it. |
| Subscription data | While the subscription is valid and for as long as accounting and tax laws require. |
| Journal, photos, analysis history, Shelf | On the phone, until you delete them or delete the app; you keep any exported copy yourself. |
| Technical logs of the server functions | 30 days (the Google Cloud default period). |
When a PRO subscription ends, access to the paid features is restricted, but your data is not deleted automatically.
8. Your rights
Under the General Data Protection Regulation (GDPR), where applicable, you have the right to:
- access your personal data (Art. 15);
- have inaccurate data rectified (Art. 16);
- request erasure of your data (Art. 17);
- restrict the processing of your data (Art. 18);
- receive your data and have it transferred (Art. 20);
- object to the processing of your data where there are grounds for it (Art. 21);
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
You can edit your skin profile in the app. You can delete your account and export your data in Settings: Settings → Delete account, Settings → Export data. For your other rights, contact info@skinbarrierapp.com.
If you believe that your data is being processed unlawfully, you can contact the State Data Protection Inspectorate: vdai.lrv.lt, ada@ada.lt.
9. Age
The app is intended for persons aged 14 and over; we do not knowingly collect data of younger persons.
10. This website
- Cookies and tracking. The website does not use cookies, visitor analytics or advertising tracking; fonts and other files are not loaded from other servers.
- Language choice. The website language you choose is saved in your browser and is not sent to us.
- Server logs. The website is hosted by UAB “Interneto vizija”. The server logs may record the IP address, the time of the request, the page opened and the browser type. They are used to keep the website working and secure (GDPR Art. 6(1)(f)).
- External links. Links to the App Store, Google Play and scientific publications lead to third-party websites, which are subject to their own privacy rules.
10a. Notice when the app is released
On the website’s “Home” page you can leave your e-mail address so that we let you know, once, when Barrier Code can be downloaded from the app stores.
- What we collect: your e-mail address, the website language you chose (LT or EN) and the time you signed up.
- Why: only for one notice that the app has been released. We will not send newsletters and will not use the address for advertising.
- Legal basis: your consent (GDPR Art. 6(1)(a)).
- Where it is kept: the form sends the e-mail address to the info@skinbarrierapp.com mailbox, which is provided by UAB “Interneto vizija”. It processes the data only on our behalf, as a service provider; we do not pass the address to third parties for their own purposes. The address is not stored in the website’s database; the form itself does not use cookies.
- How long: until the notice is sent, but no longer than 6 months from sign-up. If the app is not released within that time, the address is removed and you can sign up again.
- How to withdraw: write to info@skinbarrierapp.com. The address will be removed from the waiting list and you will not receive the notice. Withdrawal does not affect the lawfulness of earlier processing.
11. Changes to this policy
When we update this policy, we will change the date shown at the top. We will inform you in the app about significant changes to how the app processes data. If the law requires new consent, we will ask for it before we start the processing concerned.