Privacy Notice
PureGlow, operated by Hayder Zalazil. Last updated 2026-09-25.
Your photographs are scored by Anthropic's AI. They are never stored on our servers and never used to train anything, and Anthropic deletes them within 30 days. The copies you compare against week by week stay on your phone. We do not sell your data.
If you live in Washington, Nevada or another state with a consumer health data law, see also our Consumer Health Data Privacy Policy.
Who we are
PureGlow is an iPhone app and the server it talks to, operated by Hayder Zalazil ("we", "us"). We decide what happens to the information described here. Questions go to contact@purglows.com.
How a scan works
When you take a scan, your phone first checks the frame itself — light, focus and whether a face is in the oval — and refuses it if it is not good enough to score. That check runs entirely on your phone, using Google's ML Kit face detector, which finds the face in the frame and which way the head is turned. It stores nothing and does not send the image anywhere.
Only a photograph that passes is sent to be scored: three on your first scan (left, front and right), and one each week after that (front). It goes over an encrypted connection to our server, which forwards it to Anthropic, PBC — the company whose AI scores it — and keeps nothing. Nothing that identifies you goes with it: no name, no email, no account number. Your photographs are sent to Anthropic three times per scan and scored each time, and the middle result is the one you see, because an AI model does not give quite the same answer twice.
What comes back is ten scores for how your skin looks, each from 0 to 100, and on your first scan up to four features picked from a fixed list — "high cheekbones", for example. Nothing else comes back: no description written about you and no diagnosis. Every sentence the app shows you was written by us in advance.
The photograph is not retained by us after scoring. The copy you keep, and compare against week by week, is the one on your phone.
Face data
Some US states — Illinois, Texas, Colorado and Washington among them — treat photographs of a face, and anything read from its shape, as biometric data and protect it specially. We handle the photographs you take in PureGlow, and the reading of them, that way wherever you live. This section is our written policy for it.
- What. The photographs of your face you take in the app; the face detection that runs on your phone while you frame the shot; and the AI's reading of the photographs.
- Why. Only to score how your skin looks, to build and adjust your program from those scores, and to show you your progress. Never to identify you, to recognize you in other photographs, or to verify who you are.
- Consent. Before the camera opens for the first time, the app tells you what is sent, to whom and why, and asks. Nothing is sent until you tap "I agree", and our server will not score a photograph until it holds a record that you did. If you do not agree, the camera does not open. If what the app asks you changes, it asks again before your next scan.
- Who receives it. Anthropic, only to score the photographs, under terms that bar it from using them to train its models. No one else, unless a law, a court order or a subpoena requires it. We never sell, lease or trade it, and never profit from it in any other way.
- Our retention schedule. On our server, a photograph is held in memory only while it is being scored — seconds — and then discarded; it is never written to storage. At Anthropic, photographs are deleted within 30 days of receipt; Anthropic keeps them longer only if its automated safety systems flag them as breaking its usage policy (up to 2 years) or if the law requires it. On your phone, they stay until you delete them. We cannot see them there.
- Destruction. Face data we hold is destroyed as soon as the purpose it was collected for is done — for a photograph, once it has been scored — and never later than any law that applies to you requires.
- If something goes wrong. Photographs travel only over encrypted connections, and the only key that can reach the AI lives on our server, never in the app. If we learn of a security incident affecting your information, we will contain it, find out what happened, and tell you — and any regulator the law requires us to tell — without unreasonable delay and within the time limits the law sets.
The ten scores describe your skin, not the shape of your face. The features are labels from a list of 24 shared by everybody, cannot identify anyone, and stay on your phone.
What stays on your phone
- The front photograph from each scan, which is the one you compare week by week. The two side photographs from your first scan are used for scoring and not kept. Your phone's own backups, if you make them, may contain these photographs too.
- Your program, your answers, every step you have ticked off, and the sleep and water you log.
- The features the AI picked out.
- What time of the morning suits your reminder, which the app learns on your phone. Reminders are scheduled on your phone and are not sent through our servers.
Deleting the app deletes all of it.
What reaches our servers
Your agreement
When you tap "I agree", our server keeps a record of it, with or without an account: an identifier your phone makes for the record; your installation's token and, once you sign in, your account; which version of the consent screen you saw, with a fingerprint of its exact words; which version of our Terms of Use you accepted; when you agreed, by your phone's clock and by ours; and when you last scanned. No photograph, no score and no email. It is how we can show that you agreed before any photograph was scored, which the face data laws expect us to be able to do.
Without an account
To stop the service being abused and to hold the one-scan-a-week rule, our server gives your installation a random token that is not tied to who you are, and keeps: when your last scan was (for about a week), whether your first scan's features have been read (for about 13 months), and counts of today's scan attempts (for a day). It also sees your IP address, as every server does, and uses it only to count installations, sign-ins and waiting-list sign-ups from one address each day; those counts expire within a day.
With an account
Only if you sign in with Apple. Then we also keep:
| What | Why |
|---|---|
| An account identifier from Sign in with Apple, and your email address if you choose to share it | So your program survives a new phone |
| Your onboarding answers: skin type, goal, age band, routine level, sex, and the sleep and water you said you usually get | To understand which routines work for whom |
| Your first Glow Score and the potential calculated beside it | To check that people who start in the same place end up in the same place |
| Your ten scores each week, and which products were in your program | To see which products actually move which score |
| The shape of your program: how long it runs, when maintenance starts, which habits you were given, and for each step the product, the week it arrives, which half of the day it runs in, how many days a week, and whether it was optional | A product only means something alongside how it was actually prescribed |
| How many steps you were given and how many you ticked | Without it, "this product did nothing" and "this person did nothing" look identical |
| How many hours you slept and how many glasses of water you drank, as weekly averages and as a count of the nights you answered | Both change skin faster than most products do. Without them a week that went nowhere looks like a product that does not work |
That is the complete list. It is enforced in code, not just stated here: every value we accept has to be a number, a true/false, or a short identifier, so a photograph, an email address or a sentence cannot be stored in those records even by mistake.
The waiting list
If you join the waiting list on purglows.com, we keep your email address, when you joined, and a short label for where you signed up — a part of the page, or the ad that brought you — and nothing else: not the page address, and not your IP address, which is only counted against a daily limit and then forgotten. We use your address for one thing: to tell you when PureGlow is ready. We never sell it or share it, and we delete it a year after you join. To be removed sooner, write to contact@purglows.com.
Who else is involved
| Who | What they receive, and why |
|---|---|
| Anthropic, PBC | Your photographs, to score them. Nothing that identifies you is sent with them. |
| Cloudflare, Inc. | Hosts our server and database, and so handles your IP address and the requests your phone makes. |
| Apple | Sign in with Apple, if you use it, and App Store purchases. We never see your payment details. |
| The ML Kit face detector on your phone sends Google information about the detector itself: device model and system version, app version, a per-installation identifier Google says is not meant to identify you, and performance and error reports. Never your photographs. |
Anthropic and Cloudflare act on our behalf, under terms that let them use what they receive only to provide their service to us. Apple and Google handle what they receive under their own privacy policies. We work only with providers that protect your data at least as carefully as this notice promises.
We do not sell your data, share it for cross-context behavioral advertising, or use it for targeted advertising, and there are no advertising networks, data brokers or advertising trackers in the app.
How we use it
- To score your scans, build your program and adjust it as you go.
- To remind you, if you allow notifications.
- To keep your program when you change phones, if you have an account.
- To learn, from account records, which routines work for whom.
- To prevent abuse, enforce the weekly scan limit, and comply with the law.
Never for advertising, and never to make decisions about you with legal or similarly significant effects.
Deleting everything
Settings → Delete everything. One action removes your program, your answers, every photograph on the device, and your account and all of its records on our side but one: the record that you agreed to the scans you took, which is the proof that they were agreed to and is kept for the time set out below. It is immediate and cannot be undone. You do not have to email anyone to do it.
How long we keep it
Photographs: never on our servers; at Anthropic, up to 30 days, with the exceptions above; on your phone, until you delete them. Installation counts: from a day to about 13 months, as above. Account records: while your account exists. When you delete it, the records go with it and we keep only a marker — Apple's anonymous identifier for your sign-in and the date it was deleted, with no email and nothing else — so the same sign-in is not silently given a fresh, empty account. Records of your agreement: five years after your last scan, or after you agreed if you never scanned, because five years is how long a claim about face data can be brought in Illinois; then they are deleted automatically. They are kept that long even if you delete everything, and hold no photograph, no score and no email. Waiting-list addresses: a year after you join, then deleted automatically.
Your rights
Depending on where you live, you may have the right to know what personal data we hold about you, to access, correct, export or delete it, to opt out of its sale, of targeted advertising and of profiling (we do none of these), and not to be treated differently for using any of these rights. Your photographs and the health-related parts of your program are used only to give you the service you asked for, and only with your consent.
Deletion is built into the app. For anything else, write to contact@purglows.com, or have an authorized agent write for you. We will check the request is really from you before acting on it, and answer within 45 days. If we turn a request down, you can appeal by replying with the word "Appeal"; we will answer that within 45 days, and if you are still not satisfied you can contact your state attorney general. We honor Global Privacy Control signals, though as we neither sell nor share personal data there is nothing more for them to switch off.
Children
PureGlow is for adults, 18 and over. It is not directed to children, and we do not knowingly collect personal information from anyone under 18, including children under 13. If you believe a child has used it, write to contact@purglows.com and we will delete their information.
This is not medical advice
PureGlow scores how skin looks and suggests ordinary skincare products. It does not diagnose, treat or prevent any condition. If something about your skin concerns you, see a clinician.
Changes
When this notice changes, the date at the top changes with it. If a change affects what we collect, who receives it or how face data is used, we will tell you in the app before it takes effect, and ask for your consent again before using face data in any new way.
Contact
Hayder Zalazil. contact@purglows.com