Legal
Privacy Policy
Last updated 14 September 2026 · Applies to the Femlura mobile app and this website.
The short version.
Your selfie is sent for one analysis and then discarded. It is never written to our database and never stored on our servers. The only lasting copy is the one kept on your own phone. We keep the numbers and text that come back — your scores, observations and routine — because that is what the app shows you later. We do not run ads, we do not sell data, and you can delete everything from inside the app.
On this page
Who we are
Femlura is a cosmetic skin-appearance app published by Abdelrahman Masoud, Cairo, Egypt (“we”, “us”). We are the controller of the personal data described here. You can reach us at theamasoud@gmail.com.
Your photos
This is the part most people want to know about, so it comes first.
When you take or choose a selfie, the image is sent to our analysis service and passed to Google's Gemini API, which reads it and returns scores and written observations. We then discard the image. It is not written to our database, not placed in file storage, and not retained by us after the request finishes. The same applies to photos of products you take for My shelf.
Femlura uses the paid tier of the Gemini API. Under Google's published terms for that tier, Google does not use the images or text we send to improve its products, and processes them as a data processor under its Data Processing Addendum. Google does keep a short-lived log of requests for the sole purpose of detecting abuse, which is described in its terms rather than controlled by us — we mention it so that “discarded” is not read as a promise we are not in a position to make on Google's behalf.
We ask first. Before your first analysis, the app shows you exactly what will be sent, names Google as the recipient, and sends nothing until you agree. You can re-read that disclosure — and withdraw your agreement — at any time from Settings, under AI photo analysis. If you withdraw it, nothing further is sent and we ask again before your next scan.
A copy of each selfie is kept on your own device, in the app's private storage, so that your results screen and your before/after comparison keep working after the analysis is over. That copy never leaves your phone unless you choose to share it yourself. Deleting the app removes it, and you can clear it at any time from Settings.
Femlura does not perform facial recognition and does not attempt to identify anyone. The analysis describes the visible appearance of skin.
Face data
Because the selfie shows your face, it counts as face data. This section says, in one place, everything we do with it.
What we collect. One ordinary photograph of your face, taken with the standard camera or chosen from your photo library, each time you run a scan. That is the only face data involved. The app does not create or collect a face mesh, facial map, facial coordinates, facial landmarks, depth data, or any biometric template, and it does not use the device's face-tracking or face-detection features.
How we use it. Solely to produce your cosmetic skin analysis and the routine built from it. We do not use face data to identify you, to recognise you across scans, to verify who you are, to build a profile of you, for advertising or marketing, or for any purpose unrelated to the analysis.
Who it is shared with. Google, as our processor, receives the photo for the duration of the analysis request through its Gemini API, under the terms described above. Nobody else does. We do not sell, lease, or otherwise provide face data to advertising platforms, analytics providers, data brokers, or anyone else, and we require Google to use it only to deliver the analysis.
Where it is stored. On our side, nowhere. The photo passes through our analysis service in memory, is forwarded to Google, and is dropped when the request finishes; it is never written to our database or to file storage. The one lasting copy is the one saved in the app's private storage on your own phone.
How long we keep it. On our servers: not at all beyond the seconds the request takes. On your phone: until you delete it. Google keeps only the short-lived abuse-detection log described above.
How to delete it. Settings offers two actions: delete your photos, which removes every saved selfie and product photo from the device while keeping your results; and delete your account, which removes those photos together with your profile, scans, routines and shelf. Both take effect immediately and need no contact with us. Uninstalling the app also removes the on-device copy.
Consent. The app asks before any face data leaves the device, and sends nothing until you agree. You can withdraw that agreement at any time from Settings under AI photo analysis.
What we collect
Your account
On first launch the app creates an anonymous account — a random identifier, with no email address and no name. You can use Femlura this way indefinitely. If you choose to sign up or sign in with email, we store your email address so the account can follow you to another device.
What you tell us during setup
The onboarding questions, which shape your routine: an optional display name, your language, age band, skin type, main concern, main goal, sun exposure, how established your current routine is, how much time you want to commit, your time zone, your chosen reminder times, and whether you opted in to marketing messages.
Your results
For each scan we store the overall score, the six measure scores (hydration, pores, texture, pigmentation, redness and oiliness), which of them were marked as focus areas, the date, whether the photo came from the camera or your gallery, and which model version produced the result. Not the photo.
The written parts — the observations and any note suggesting you see a professional — are returned to your device and stored there, not on our servers.
Your routine
The morning and evening routines generated for you, their individual steps and suggested ingredients, and which steps you have checked off on which day. The check-off history is what produces your streak.
My shelf
For products you photograph: the product name and brand as transcribed from the label in your own photo, any correction you type yourself, and the fit assessment, conflicts and gaps generated for your skin. Again, not the photo.
Subscription
Whether you have an active subscription, and the identifiers needed to keep that status in sync. Payment is handled by Apple — we never see your card details.
Notifications
Routine reminders are scheduled by your phone and do not involve our servers at all. If you allow notifications, we may store a device push token so we can send service messages, along with a record of what was sent so you are not sent the same thing twice.
Abuse prevention
We count how many analyses each account runs in a rolling 24-hour window, so that a single account cannot run up unbounded costs. This is a counter, not a log of what you scanned.
How we use it
- To produce your skin analysis and build your routine.
- To show you your history, streak and progress over time.
- To keep your subscription status accurate and unlock paid features.
- To send the reminders and messages you asked for.
- To keep the service working and prevent abuse.
We do not use your data for advertising, we do not sell it, and we do not share it with data brokers. There are no third-party advertising or ad-tracking SDKs in the app.
Who else processes it
We use a small number of service providers to run Femlura. They act on our instructions and only for the purposes below.
| Provider | What they do for us | What they receive |
|---|---|---|
| Supabase | Hosting, database and sign-in | Everything listed under “What we collect” |
| Google (Gemini API) | Analysing your photo, writing your observations and routine | The photo, for the duration of the request, plus your scores and setup answers |
| RevenueCat | Keeping subscription status in sync | Your account identifier and subscription state |
| Apple | Processing App Store payments and delivering the app | Handled entirely by Apple under their own terms |
Each of these providers is engaged under its published data-processing terms, which we have accepted. Those terms require them to act only on our instructions, to keep the data secure, and to afford it a level of protection equivalent to the one described in this policy. None of them is permitted to sell your data, to use it for their own advertising, or to use it for any purpose of their own beyond delivering the service described above.
Each provider also publishes its own privacy terms, which you can read directly: Supabase, Google (Gemini API), RevenueCat and Apple.
Where it is stored
Our database is hosted in the European Union (Ireland). Some of our providers operate outside the EU, which means data may be transferred internationally; where that happens we rely on the safeguards those providers offer for such transfers.
How long we keep it
- Photos: not retained at all on our side. The device copy stays until you delete it or remove the app.
- Scan results, routines and check-offs: kept while your account exists, because they are your history.
- Subscription records: kept while your account exists, and afterwards only where we must for accounting or legal reasons.
- Abuse counters: rolling, and discarded as they age out.
Your rights and choices
Depending on where you live, you may have the right to access your data, correct it, delete it, receive a copy of it, object to certain processing, or withdraw consent. You can exercise the main ones directly in the app:
- Delete your photos — Settings, without touching your results.
- Delete your account — Settings. This removes your profile, scans, routines and shelf.
- Turn off reminders — Settings, at any time.
- Use the app anonymously — simply never add an email address.
For anything else, write to theamasoud@gmail.com. If you are in the EEA or the UK and are unhappy with our response, you may complain to your local data protection authority.
Children
Femlura is not directed at children and is not intended for anyone under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Security
Traffic between the app and our servers is encrypted in transit. Your session credentials are held in your device's secure keychain. Database access is restricted per-account, so one account cannot read another's data. No system is perfectly secure, but not storing your photos removes the most sensitive thing we could otherwise lose.
Changes to this policy
If we change how we handle your data we will update this page and move the date at the top. Material changes will be surfaced in the app.
Contact
Abdelrahman Masoud · Cairo, Egypt · theamasoud@gmail.com