Privacy Policy

1. Who we are and the scope of this policy

This Privacy Policy explains how Blemmy LLC, a Tennessee limited liability company (“Blemmy,” “we,” “us,” or “our”), handles information when you use the Blemmy iPhone app, visit blem.my, or contact us. Blemmy LLC is responsible for the processing described in this policy.

Washington residents should also read our separate Consumer Health Data Privacy Policy.

2. Information processed in the app

The app processes and stores the following information on your device:

• photos you take and information about each photo, such as date and time, camera and device information, crop and orientation, head orientation (yaw, pitch, and roll), face-to-camera distance, lighting or exposure measurements, quality warnings, and processing version;
• skincare product information, including product name, brand, category, and notes;
• routine schedules and completion or skip history;
• onboarding answers about your skin concerns, goals, skin type, skincare spending, existing routine, and tracking goal, along with your onboarding progress; and
• reminder preferences and app settings.

Blemmy uses this information to provide the features you request, including Guided Capture, photo alignment and comparison, progress views, routines, and reminders. The processing occurs on your device. Photos, retained photo information, products, routines, completion or skip history, and onboarding answers and progress may also sync through your private iCloud database as described in Section 5. Reminder preferences and app settings remain on your device. We do not operate an account system or Blemmy server that receives your app data.

3. Camera, face tracking, and face data

During Guided Capture, Blemmy uses Apple’s Vision and AVFoundation frameworks with your iPhone’s front camera to detect that a face is present and estimate its position, orientation, movement, and distance from the camera. On iPhones with a TrueDepth camera, distance is measured from the camera’s depth data; on other iPhones, it is estimated from the spacing of your eyes in the camera image. Blemmy also detects facial landmarks, including eyes and pupils, to provide framing and pose guidance and help you take more consistently aligned photos. Blemmy analyzes eye landmarks in saved photos to align them for comparisons and timelapses, and detects the face area in a saved photo to focus the redness and texture views. All of this analysis occurs on your device.

Live camera frames and raw depth maps are processed temporarily on your device and are not saved. Facial landmark and face area coordinates, whether derived from live frames or saved photos, are also processed temporarily on your device and are not stored as coordinate data.

Blemmy retains the photo you choose to take and the photo consistency measurements listed in Section 2 until you delete them. It does not retain a face mesh, facial expressions or blend-shape values, raw depth maps, or a biometric template. Blemmy does not use face data to identify or authenticate you, build an advertising profile, or infer your identity. Live face analysis and measurements are processed on your device. The retained photo and photo consistency measurements may sync through your private iCloud database, but Blemmy LLC cannot access them.

Blemmy does not share face data with third parties, does not send it to Blemmy LLC, and does not use it for advertising or analytics. If you turn on App Lock, iOS handles Face ID; Blemmy receives only whether authentication succeeded and never receives your Face ID data.

4. Age assurance

Blemmy is intended for people age 13 and older. Where iOS reports that local law requires an age check, Blemmy uses Apple’s Declared Age Range framework to request an age range for the Apple Account. Blemmy receives only the range or a status indicating that no range was shared. It never receives the account holder’s birth date. The result is used on the device only to decide whether the app is available. Blemmy does not transmit or retain the result, and a declined, canceled, uncertain, or failed request can be tried again.

5. iCloud sync, backups, Photos, and sharing

When iCloud is enabled for Blemmy in iOS Settings, photos, retained photo information, products, routines, completion or skip history, and onboarding answers and progress sync through the private CloudKit database associated with your Apple Account. Apple provides and processes this iCloud service. Blemmy LLC cannot view, retrieve, or manage the contents of your private database. Synced data uses your iCloud storage and is subject to your iCloud settings and Apple’s terms and privacy practices.

CloudKit sync is separate from device backups. Blemmy data may also be included in an iCloud or computer backup, depending on your device and backup settings. If you choose “Save to Photos,” the selected image is copied to your Photos library. If you then share that image from Photos, a copy is sent to the person, app, or service you choose. Once a copy leaves Blemmy, its handling depends on your settings and the selected recipient or service.

6. Device permissions

Blemmy asks for access only when it is needed for a feature you choose:

• Camera: to provide photo guidance and take photos.
• Photos (add only): to save an individual image when you request it.
• Notifications: to schedule optional photo, routine, and trial reminders locally on your device. Apple may also deliver silent notifications so CloudKit can sync changes. Blemmy LLC does not operate a custom push-notification server or use notification tokens for advertising or user-visible reminders.

You can change permissions in iOS Settings. Blemmy does not request access to your precise location, contacts, microphone, or advertising identifier. Changing a permission does not delete information you previously saved.

7. Purchases and Apple services

Apple processes subscriptions through the App Store. Blemmy uses StoreKit on your device to retrieve product information, determine offer eligibility, and verify an active entitlement. We do not receive your payment-card details. Apple provides Blemmy LLC with aggregate App Store Connect Analytics reports about discovery, downloads, app usage, subscription performance, and stability. App usage and diagnostics depend on your device's analytics sharing settings. These reports do not include your Blemmy photos, products, routines, photo metadata, or history. Apple handles its information under its own privacy policy.

8. Communications with us

If you email us, we receive the email address, message, attachments, and ordinary delivery information you provide. Please do not send skin photos or sensitive health information unless it is necessary for your request. We use communications to respond, provide support, protect Blemmy, and comply with law. Our email-routing and mailbox providers process those messages for us. We retain them only as long as reasonably needed for those purposes, including any legal, security, or recordkeeping needs.

9. Website information

This website does not use user accounts, advertising cookies, or cross-site tracking. We use Cloudflare Web Analytics to understand aggregate website traffic and performance. Its browser beacon measures visits, page views, page-load timing, Core Web Vitals, URL paths without query strings, referring sites, country, device type, browser, and operating system. Cloudflare states that Web Analytics does not use cookies or local storage, fingerprint visitors, or track individuals across sites. We use its aggregate reports only to improve the website’s reliability, performance, and content. We do not use them for advertising, profiling, or identifying visitors.

The analytics beacon reports through Blemmy’s Cloudflare-served domain. Cloudflare says it retains unsampled beacon data for seven days before aggregation and makes analytics available for the previous six months. Cloudflare and our website host also process limited technical information needed to deliver and secure the site, such as IP address, browser and device information, request date and time, requested page, referring page, and security signals. We use this information only for site delivery, analytics, reliability, abuse prevention, and security. Technical logs are kept according to the shortest periods reasonably needed for those purposes and provider settings.

Because the site does not use advertising or cross-site tracking technologies, it does not change its behavior in response to “Do Not Track” or Global Privacy Control signals.

10. How information is disclosed

We do not sell or rent personal information, and we do not share personal information for cross-context behavioral advertising. We disclose information only as follows:

• Apple services: to provide private CloudKit sync when iCloud is enabled for Blemmy, and when your settings or choices use an Apple backup or Photos.
• Service providers: to Cloudflare for website hosting and analytics, and to our email providers for communications. Their processing is limited to providing those services.
• Legal and safety reasons: when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or establish or defend legal claims.
• Business changes: in connection with a merger, financing, reorganization, or sale of assets, subject to applicable law and appropriate notice.

Blemmy LLC cannot access your private CloudKit database and cannot disclose its contents from a Blemmy server.

11. Retention, deletion, and security

In-app information remains on your device and, when sync is enabled, in your private iCloud database until it is deleted. Deleting an item or using “Delete All Data” removes it from the current device and sends the deletion to iCloud and your other devices when they connect. Deleting the app alone may leave synced data in iCloud. Copies already placed in Photos, a backup, a shared copy, or another service must be managed through the relevant service or recipient.

Blemmy stores app images using iOS data protection and relies on Apple’s platform and private CloudKit database protections. Blemmy marks original photo assets for CloudKit encryption. We use reasonable administrative and technical measures for the limited website and communication information we receive. No storage or transmission method is guaranteed to be completely secure.

12. Your choices and privacy rights

You can save individual photos to your Photos library and share them from there. Blemmy does not provide a JSON export of photo metadata, routines, or history, or an export of face measurements or facial landmark coordinates. You can delete individual photos or use “Delete All Data” in Blemmy’s Privacy settings to delete all photos, products, routines, and history stored by the app; deleting all data also turns off Blemmy reminders. You can manage Blemmy’s iCloud access in iOS Settings. Turning off access stops future sync but may not remove data already stored in iCloud. Because Blemmy LLC cannot access your private database, we cannot retrieve, manage, or delete its contents for you.

You can control whether Apple shares app usage and diagnostics with Blemmy LLC under Settings > Privacy & Security > Analytics & Improvements > Share With App Developers. This choice does not affect Blemmy's core features.

Depending on where you live, you may have rights concerning personal information we do hold, including rights to request access, correction, deletion, restriction, portability, or an objection to certain processing. You may also have a right to appeal a decision or complain to your local privacy regulator. Send requests to privacy@blem.my. We may need to verify your identity and may retain information where law permits or requires it. We will not discriminate against you for exercising a privacy right.

13. International information

Blemmy is based in the United States. Apple and our website and communication providers may process information in the United States and other countries, where privacy laws may differ. Where required, we use legally recognized safeguards for international transfers of information handled on our behalf.

For people in the European Economic Area, United Kingdom, or Switzerland, the legal bases for the limited processing described here depend on the context: providing app features or support you request, our legitimate interests in operating and securing Blemmy and responding to communications, consent where required, and compliance with legal obligations. You may object to processing based on legitimate interests and may withdraw consent at any time where consent applies, without affecting earlier lawful processing. You may complain to the data-protection authority where you live or work.

14. Children’s privacy

Blemmy is intended only for people age 13 and older. We do not knowingly receive personal information from anyone under 13. If you believe a person under 13 has sent personal information to us through email or the website, contact us so we can review and delete it as appropriate. In-app information remains on the user’s device and may sync through the user’s private iCloud database, which Blemmy LLC cannot access.

15. Changes to this policy

We may update this policy as Blemmy changes. We will post the revised version here and update the effective date. If a change materially affects how information is handled, we will provide additional notice where appropriate or required by law.

16. Contact

Questions or privacy requests can be sent to:

Blemmy LLC
116 Agnes Road, Suite 200
Knoxville, TN 37919
United States
privacy@blem.my