Privacy Policy
Divine Beauty Secrets
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Divine Beauty Secrets is an account-free beauty journal. The app stores your optional name, skin type, language and reminder preferences, ritual steps and completion dates, skin observations and notes, saved advice, tags and selected photos on your device. Photos are selected through the system photo picker; the app does not read your whole library. Selected images are resized and re-encoded for local storage. If you enable private synchronization, skin observations and saved-advice entries, including their notes and tags, are encrypted on your device and sent to the application backend. Photos, your name, skin type and rituals are not uploaded. A random installation secret is stored in the device Keychain. The backend receives a derived authorization credential, stores its hash as a namespace and stores encrypted collection snapshots. Network requests also expose technical connection information such as IP address, request time and route to the hosting infrastructure. Public pages do not require cookies or login.
How we use information
Local data supports your daily care checklist, personal skin diary, inspiration board and preferences. Optional synchronization stores encrypted snapshots for the same installation. It does not create an account or offer email-based recovery, and data cannot be recovered if the installation secret is lost. Local notifications remind you at your chosen time. The public advice endpoint may be requested to check for a compatible editorial update; bundled advice remains available offline. Technical connection information is used to deliver and protect the service. There is no advertising, analytics SDK, payment system, outbound email or geographic map integration.
Service providers and sharing
The application backend is hosted on Railway, which processes service traffic and persistent storage as the hosting provider. Railway and its infrastructure may process connection and operational logs. The application server intentionally does not log request headers, authorization credentials or request bodies. No other third-party SDK receives diary data, and selected photos are not sent to the backend. Apple's operating system provides Keychain, the photo picker and local notifications. We do not sell personal data or use it for targeted advertising. We may disclose information if required by applicable law.
Data retention
Local records remain on your device until you remove them or use Delete all my data. The skin diary screen displays the last 30 days; older observations remain in local storage and optional encrypted snapshots until deletion. Server snapshots remain until they are replaced or deleted using the installation credential. Deleted synchronized items may remain as encrypted deletion markers so a later synchronization does not restore them. The application does not impose a fixed automatic expiry. We have not established a specific retention period for Railway infrastructure logs or provider backups, and do not promise immediate removal from those systems. Device or provider backups may retain earlier copies according to the relevant system's settings and retention.
Deleting your information
Use Profile, then Delete all my data, and confirm to clear local rituals, journal entries, selected photos, saved advice and profile preferences. If synchronization was enabled, the app also requests deletion of both server collections for this installation. When offline or the server is unavailable, local content is cleared and a pending deletion flag is retained; the app retries deletion when reopened or when you select Retry server deletion. The Keychain secret is retained to authorize that request. SQLite secure deletion is enabled for active server storage. Deletion does not recall copies in operating-system or hosting backups; those follow the provider's retention. Uninstalling the app alone does not send a server deletion request. If the secret is lost, we cannot identify or recover a snapshot from a name or email address.
Permissions and your choices
Photo access uses Apple's system picker and only the images you choose are imported. You can cancel selection without granting broad library access, and remove imported photos from Inspiration or delete all app data. Notifications are requested only when you enable a daily reminder. You can turn reminders off in the app or revoke notification permission in iOS Settings at any time. Revoking a permission does not erase content already stored. The app does not request location, contacts, camera or microphone access.
Your privacy rights
You can view and edit your local profile, rituals, diary entries and inspiration, disable synchronization, and delete your data in Profile. Depending on where you live, you may have rights to access, correct, erase or restrict processing of personal information and to complain to a relevant authority. For privacy questions or requests, contact CwenhildAldermere@icloud.com. Do not send your installation secret. Because no account or email identifier is attached to encrypted snapshots, we may be unable to associate a request with server data without the app's authorized deletion operation.
Security
The client uses AES-GCM authenticated encryption for synchronized content and a key derived from the installation secret. A separate one-way derivation produces the authorization credential sent to the server; the original secret and encryption key are not sent. Production connections must use HTTPS. The server authorizes each private request using that installation credential and separates stored collections by its hash. Device files use iOS file protection and the installation secret uses device-only Keychain accessibility. Server storage uses restricted file permissions, request-size limits and parameterized SQLite queries. No system can guarantee absolute security. Anyone who obtains the installation secret or authorization credential may gain relevant access, so keep your device protected.
Children’s privacy
Divine Beauty Secrets is intended for adults interested in personal beauty and care, not for children. We do not knowingly seek children's personal information. If you believe a child has provided information through the app, contact CwenhildAldermere@icloud.com. Beauty guidance and personal observations are educational and do not provide medical diagnosis or treatment.
Changes to this policy
This policy may be updated when the application's processing or hosting practices change. The current policy will be published on this page with its effective date and linked from the app's Profile section. Material processing changes will be reflected in the app and policy before those changes are introduced. Please review the policy periodically. Privacy contact: CwenhildAldermere@icloud.com.