Vedara — Privacy Policy

Last updated: 31 October 2026

This Privacy Policy explains what information the Vedara mobile app ("Vedara", "we", "us") collects, how it is used, and the choices you have. It applies to anyone who uses Vedara on Android.

If you have questions about this policy, contact us at pieriesstudio@gmail.com.

1. Who we are

Vedara is an AI-powered skincare companion for face, neck, and head, developed and published from New Zealand. Vedara works fully without an account. Signing in is optional and only enables backing up and syncing your data across your devices (see Section 3).

2. What information Vedara handles

When you use Vedara, the following kinds of information are involved:

• Profile information you enter yourself. Your name (if you give one), age range, gender, skin type, skin goals, lifestyle answers, dislikes, ingredient sensitivities, notes, and answers to the "Deep Dive" questionnaire.
• Products and routines you save. Names, brands, ingredients, categories, and any personal notes you attach.
• Photos you choose to analyze. Photos you take with the in-app camera or pick from your device to use Vedara's vision-based features (for example, ingredient label scans or skin photos).
• Chat messages. The text of messages you send to Vedara's chat feature, plus the AI's replies.
• App settings. Theme choice, personalization toggle, reminder times, and similar preferences.
• Account information (only if you sign in). If you choose to create an account to back up and sync, we store the email address and account identifier provided by your sign-in provider (Google). Signing in is optional; if you never sign in, no account information is collected.
• Routine reminder notifications (optional). If you turn on AM or PM routine reminders in Settings, Vedara uses Android's notification system (the POST_NOTIFICATIONS permission) to post a local reminder at the time you choose. The notifications are generated entirely on your device — Vedara has no push-notification server, and the contents of the notification (e.g., "Time for your evening routine") are never sent off-device. You can deny the notification permission at any time, and Vedara will continue to work without reminders.
• Coarse location (optional, on-device only). If you grant the location permission, Vedara reads your device's last-known approximate location once to derive your local currency code (for example, "NZD" if you're in New Zealand). To do this, Android's location lookup service (provided by Google) may briefly process that approximate location. Vedara never stores it and never sends it to our servers or AI providers — only the derived currency code is cached on your device. If you deny the permission, Vedara falls back to your device's locale and works normally.
• Crash reports (automatic). If the app crashes, it uploads a report to our backend (Supabase) the next time you open it. A report contains the technical error details, the app version, your Android version, your device model, and your account identifier if you are signed in. It does not include your profile, notes, products, or chats.
• Network and usage limits (automatic). When you use an AI feature, our backend records your IP address, or your account identifier if you are signed in, with a count of recent requests. We use this only to limit how many requests can be made per hour and to prevent abuse.

Vedara does not collect: your phone number, contacts, advertising ID, browsing history, or usage analytics. We only ever receive your email address if you choose to sign in (see "Account information" above). Vedara does not track your location continuously, does not store coordinates, and does not send your location to our servers or AI providers.

3. Where this information is stored

• On your device (always). All profile data, products, notes, routines, chat history, and app settings are stored locally on your device using Android's standard app-data storage (SharedPreferences and the app's private files directory). If you never sign in, your data stays only on your device, and uninstalling the app or wiping its data deletes it. (A reinstall or new phone starts fresh — backup is what signing in is for.)
• In the cloud (only if you sign in). If you create an account to back up and sync, your app data — profile, products, routines, notes, check-ins, deep-dive answers, and chat history — is also stored on our backend provider, Supabase, so it can be restored and kept in sync across your devices. Each account's data is private to that account, enforced at the database level (row-level security); it is never shared with or visible to other users, and we do not sell it.
• Deleting your cloud data. You can permanently delete your account and all associated cloud data at any time from Settings → Account → Delete account in the app, on the web at https://vedara-app-legal.netlify.app/delete-account, or by emailing us (see Section 7). Uninstalling the app removes the on-device copy.

4. Information sent to third-party AI providers

To answer your questions, generate routines, analyze ingredients, and process photos, Vedara sends certain information to third-party AI providers:

• Google Gemini (Google LLC) — used for chat, deep-dive analysis, condition-check reasoning, routine generation, and photo/vision analysis.
• Groq (Groq, Inc.) — used as a fallback for some text and photo tasks when Gemini is unavailable.

To keep our API keys secure, these AI requests are relayed through our backend on Supabase (Supabase Inc.) before reaching the provider. Supabase passes the request through to the AI provider and does not retain the request content. Supabase privacy policy: https://supabase.com/privacy

When you use a feature that calls one of these providers, the following may leave your device:

• The text of your chat message or prompt.
• Relevant parts of your skin profile (e.g., skin type, goals, age range, condition-check answers) that the feature has been told to use.
• Any photo you submit for vision-based features.

These providers process the data under their own privacy policies and terms:

• Google Gemini API: https://ai.google.dev/gemini-api/terms
• Google Privacy Policy: https://policies.google.com/privacy
• Groq Privacy Policy: https://groq.com/privacy-policy

We do not control how those providers handle the data once it reaches them. Please do not include information in chats or photos that you would not want a third-party AI service to process.

5. Photos and biometric information

Photos of your face may contain biometric information, which is treated as sensitive personal data under some laws (for example, the EU GDPR and laws in some US states). Whenever you submit a photo:

• The photo is transmitted to the AI providers above for analysis and then discarded by Vedara once a response is returned.
• We do not retain copies of photos on any Vedara-controlled server.
• We do not build a biometric template of your face, and we do not use photos to identify or recognize you.
• Only submit photos of yourself. Do not submit photos of other people.

By submitting a photo, you consent to it being processed by the AI providers listed in Section 4.

6. Children

Vedara is not intended for use by anyone under the age of 18. We do not knowingly collect information from anyone under 18. If you are under 18, please do not use the app.

7. Your rights and choices

You can see and change your data directly in the app, and you have rights over it under laws like the EU/UK GDPR, the California CCPA/CPRA, and the New Zealand Privacy Act 2020:

• Access: Everything in your profile is visible inside the app. For data you've backed up to the cloud, email us for a copy.
• Rectification / edit: Change any answer, product, or note at any time in the app.
• Erasure / delete: Delete individual items or reset your profile in the app. If you signed in, permanently delete your account and all cloud data via Settings → Account → Delete account, or on the web at https://vedara-app-legal.netlify.app/delete-account. Uninstalling the app removes the on-device copy.
• Restriction & objection: Stop using the chat, photo, and AI-powered features at any time, or email us to restrict how your data is processed.
• Data portability: Email us to request a copy of your cloud data in a portable, machine-readable format.
• Withdraw consent: Where we rely on your consent (AI features, photos, health information, cloud backup), withdraw it any time by stopping use, signing out, or deleting your account.

To exercise any of these, use the in-app controls or email pieriesstudio@gmail.com. We don't charge for this and won't discriminate against you for exercising your rights.

Complaints. If you believe we've mishandled your data, you can complain to a data protection authority — in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz); in the EU/UK, your national supervisory authority. For data already processed by Google or Groq, you can also exercise rights directly with them via their privacy policies (Section 4).

8. Security

We rely on Android's standard sandboxing to keep app data isolated on your device. Network traffic to AI providers is sent over HTTPS. No method of storage or transmission is 100% secure — please use a device passcode or biometric lock to protect access to your phone.

9. International transfers

The AI providers listed in Section 4 are based in the United States and may process data outside of New Zealand, the EU, and the UK. Our backend provider, Supabase (Supabase Inc., a US company), stores signed-in users' data in a data centre in Tokyo, Japan. When you use AI-powered features or sign in to back up your data, your information may be transferred to and processed in those countries.

10. Legal basis for processing (EU/UK GDPR)

Where the GDPR applies, we rely on these legal bases:

• Your consent — for processing your skin/health information, photos (which may contain biometric data), chat content, and for backing up your data to the cloud when you sign in. You can withdraw consent at any time (Section 7).
• Performance of the service you request — to provide the app's core features you ask for (for example, generating routines and recommendations from the information you enter).
• Legitimate interests — to keep the service secure and prevent abuse (for example, rate-limiting requests). We balance these against your rights and do not use them for advertising.

We do not process your data for advertising, and we do not sell it.

11. Data retention and deletion

• On your device: kept until you delete it in the app, clear the app's data, or uninstall.
• Cloud (signed-in users): kept until you delete your account, at which point it is permanently removed — deleting the account cascades to all of your stored data. See Section 7 for how.
• Photos: sent to the AI provider for analysis and not retained by us afterward; we keep no copies on any Vedara-controlled server.
• AI providers (Google, Groq): retain prompts and photos for their own periods under their policies (Section 4); we don't control their retention.
• Account records: deleted promptly on request; we do not keep backups of deleted accounts beyond brief, standard hosting operation.

12. California privacy rights (CCPA/CPRA)

If you are a California resident: in the preceding 12 months, Vedara collects the categories of personal information described in Section 2 — identifiers (your email/account id, only if you sign in), health-related and other information you enter, photos, and user-generated content — for the business purposes described in Sections 4, 10, and 11.

• We do not sell or share your personal information, including for cross-context behavioral advertising. Because we do not sell or share, no "Do Not Sell or Share My Personal Information" link is required.
• We use sensitive personal information (such as health-related skin information and photos) only to provide the features you request — not for any secondary purpose that would require a "Limit the Use of My Sensitive Personal Information" option.
• You have the right to know, delete, and correct your information, and not to be discriminated against for exercising these rights. Exercise them through the in-app controls or by emailing pieriesstudio@gmail.com.

13. Automated processing and profiling

Vedara uses AI to generate personalized recommendations from the information you provide (a form of profiling for personalization). These are suggestions to help you choose skincare — they are not decisions that produce legal or similarly significant effects, and you always make the final choice. Vedara is not a medical device and does not provide medical diagnoses; for serious or persistent skin concerns, consult a dermatologist.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will be revised when changes are made. If a change is material, we'll surface a notice inside the app the next time you open it.

15. Governing law

This Privacy Policy is governed by the laws of New Zealand. Any dispute relating to it will be handled in the courts of New Zealand.

16. Contact

Questions, complaints, or requests about this Privacy Policy?

Email: pieriesstudio@gmail.com