Privacy Policy
Last updated 30 July 2026 · Applies to the Nail AI iPhone app and this website.
Nail AI asks you to photograph your own hands. We have tried to write this plainly, because a policy you can't follow isn't consent. The short version: your nail photo is sent for analysis only after you explicitly agree, it travels without your name or email attached, and you can delete any scan — or your whole account — from Settings at any time.
This policy is operated by Ali Dinç, Eskişehir, Türkiye ("we", "us"). Questions, requests or complaints: alcmdnc@gmail.com.
Contents
1. What we collect
| Account details | If you register, your email address and a securely hashed password. Optionally a display name and profile picture. |
|---|---|
| Guest identifier | You can use Nail AI without registering. In that case we generate a random identifier, stored in your device's keychain, so your scan history survives reinstalling the app. It is not an advertising identifier, it is not shared with anyone, and it is sent only to our own sign-up endpoint. |
| Nail photos | The images you choose to scan. See section 2 — this is the part that matters most. |
| Scan results | Your health score, the individual metrics behind it, the written report, and the date of each scan. |
| Onboarding answers | The few preference questions asked when you first open the app, used to tailor guidance and style suggestions. |
| Subscription status | Whether you have an active subscription, and how many free scans remain. Purchases are processed by Apple — we never see your card details. |
| Technical data | Standard server logs (IP address, timestamps, error diagnostics) needed to run and secure the service. |
What we do not collect
Nail AI contains no third-party analytics, advertising or tracking SDKs. We do not track you across other apps or websites, we do not build advertising profiles, and we do not sell or rent your personal data to anyone. There is no App Tracking Transparency prompt because there is nothing to track.
2. How your photos are handled
Nothing is analysed until you have read the consent screen and agreed to it. That consent is recorded with a version number, and our server refuses to run an analysis without it. If you withdraw it, no further photos are analysed.
Before the photo leaves your phone
- Your phone checks the image quality first, so blurry or dark shots are caught locally rather than uploaded.
- Location data and other camera metadata (EXIF) are stripped from the image on your device, before it is sent anywhere.
Where it goes
The photo is uploaded to our server, which passes it to OpenRouter, the provider that runs the vision model producing your result. OpenRouter processes the image on our behalf in order to return the analysis.
Your name, email address and account details are never sent with the photo. The image is not linked to your identity on the provider's side.
We do not use your photos to train AI models, and we do not permit our providers to use them to train theirs.
Nail AI is not a medical device. It provides general cosmetic and wellness guidance, not a diagnosis. Its output can be wrong. Always speak to a doctor or a qualified professional about any health concern — see the Terms of Use.
3. Why we process it
If you are in the UK, EU or another region with similar law, our legal bases are:
- Performance of a contract — running your account, storing your scan history, and providing the subscription you paid for.
- Your explicit consent — analysing your nail photos. Because a photograph of your body analysed for health-related indicators may constitute special category data, we rely on your explicit consent, which you give on the consent screen and can withdraw at any time.
- Legitimate interests — keeping the service secure, preventing abuse, and fixing faults.
- Legal obligation — where we must retain records, for example for tax purposes.
4. Who else is involved
We share data only with the providers needed to run the service, and only as far as each needs:
| OpenRouter | Runs the vision model that analyses your nail photo. Receives the image, never your identity. |
|---|---|
| Apple | Processes all purchases and manages subscriptions. Apple's own privacy policy applies to that transaction. |
| RevenueCat | Tells our app whether your subscription is active. Receives a pseudonymous user identifier and purchase status — not your card details. |
| Railway | Hosts our backend server and database. |
| Cloudflare | Hosts this website. |
We may also disclose data where the law genuinely requires it, or to establish or defend legal claims. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
5. How long we keep it
- Scans and photos — kept so you can track progress over time, until you delete them or delete your account.
- Account data — kept while your account exists.
- On deletion — deleting your account removes your account record, your scans and the stored images from our live systems immediately. Copies may persist for a short period in the routine database backups taken by our hosting provider, Railway, until those backups are rotated out in the normal course; they are not restored or used for any other purpose.
- Server logs — kept for a short period for security and debugging, then discarded.
6. Your rights and controls
In the app, without contacting anyone, you can:
- Delete any individual scan.
- Permanently delete your entire account — Settings → delete account.
- Withdraw your AI analysis consent, which stops all future analysis.
- Turn care reminders on or off. Reminders are scheduled locally on your device; they are not push notifications sent from our servers.
Depending on where you live, you also have the right to access a copy of your data, correct it, export it in a portable form, restrict or object to processing, and withdraw consent. To exercise these, email alcmdnc@gmail.com. We respond within 30 days. If you are in the EU or UK and are unhappy with our response, you may complain to your local data protection authority.
7. Security
Traffic between the app and our servers is encrypted in transit (HTTPS/TLS). Passwords are stored hashed, never in plain text. Authentication uses short-lived tokens. Access to production systems is limited to those who need it. No system is perfectly secure, but if a breach affects your data we will notify you and the relevant regulator as the law requires.
8. Children
Nail AI is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.
9. International transfers
Our providers may process data outside your country, including in the United States. Where required, these transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.
10. Changes
If we change this policy we will update the date at the top. For changes that materially affect how your photos or personal data are handled, we will tell you in the app and, where the law requires it, ask for your consent again.
11. Contact
Privacy questions, data requests or complaints: alcmdnc@gmail.com
Ali Dinç, Eskişehir, Türkiye