Privacy Policy

This policy explains how the Cleopatra Daily app ("Cleopatra", "the app", "we") handles personal data. It applies to the iOS and Android app. The current version is available at https://www.cleopatradaily.app/en/privacy/.

The short version

An account is optional and there are no passwords. Without one you give us no e-mail address; with one we keep only your e-mail address or an anonymous Apple or Google user ID.
Almost everything you enter stays on your device, in an encrypted database.
Health-related data and progress photos are used only with your explicit consent. If you withdraw that consent, the data is deleted.
Progress photos are encrypted and never leave your device.
The AI coach sends your question and a minimal context to our server and to OpenAI only after you switch the coach on. Your name, notes, journal, check-ins, photos and product names are never sent.
Sync is optional and end-to-end encrypted. We cannot read your synced data.
No advertising, no tracking, no analytics, no sale of data.
You can export or delete all your data in the app at any time, even offline.
Cleopatra is not a medical device and does not give medical advice.

1. Who is responsible for your data

The controller of your personal data is:

Joanna Wargalla
ul. Zawiszy 4 lok. 1, 01-167 Warszawa, Poland
E-mail: [email protected]

Data protection contact: [email protected]. We have not appointed a Data Protection Officer because the conditions of art. 37 GDPR do not apply: health-related data is processed on your device, not on our systems.

2. How the app identifies you

When you install the app, it generates a random install ID (a UUID) and stores it in the secure storage of your device (Keychain / Keystore). This ID is not linked to your name or e-mail. Without an account it is used for the AI coach question limits and for Premium status.

Optional account. Everything works without an account. If you sign in (Settings → Account), Premium and the coach question limits follow you to your other devices. You can sign in:

with your e-mail address: we e-mail you a six-digit code (valid for 10 minutes); we store your e-mail address and, briefly, a hash of the code;
with Apple or Google: we receive a signed token from Apple or Google and store only the anonymous user ID it contains. We do not ask Apple or Google for your name or e-mail address. For Apple we also keep a token that lets us revoke the sign-in when you delete the account.

The account has a random account ID, which then replaces the install ID for the coach question limits and as the RevenueCat customer ID. Our server keeps hashes of your sign-in sessions (valid up to one year) and, if you use sync, the storage identifier of your encrypted sync copy, so it can be deleted with the account. The account gives no access to your synced data: it stays encrypted with your recovery code, which we never receive. Nothing from your profile, plan, journal or health data is stored with the account.

You can sign out or delete the account in the app at any time (Settings → Account). Deletion removes the account, its sign-in methods and sessions, the linked sync copy and the coach question counters, deletes the RevenueCat customer and revokes Sign in with Apple. Deleting an account does not cancel a store subscription. Legal basis: performance of the service you requested, art. 6(1)(b) GDPR.

3. Data stored on your device

Most data is processed only on your device, in a local database encrypted with SQLCipher. The encryption key is kept in the iOS Keychain or Android Keystore and is bound to this device only. Android backups of the app are disabled; iOS backups contain only encrypted data.

Profile and app use (legal basis: performance of the service you requested, art. 6(1)(b) GDPR):

optional first name, language, daily time budget, goals, style questionnaire answers
age group (teen or adult) and the time you confirmed it
routines, daily plan items, lesson progress and reviews
products you add (name, brand, notes, ingredient list, barcode)
AI coach conversations (your messages and the answers)
reminder settings and app settings (app lock, hidden previews, hidden numbers, Body notice)
a consent log (which consent, granted or withdrawn, policy version, time)

Health-related data (special category data, art. 9 GDPR) – only with your explicit consent "health data":

skin type, sensitivity and concerns (for example acne or redness)
hair texture, scalp and concerns (for example shedding or thinning), face concerns
sleep quality and stress
check-ins (skin feel, hair shedding, sleep hours, energy, stress, note)
hair journal (washing, heat styling, shedding, breakage, treatment, note)
in the future: Body trackers (for example weight, water, fasting, exercise), stored locally under the same consent

Legal basis: your explicit consent, art. 9(2)(a) and art. 6(1)(a) GDPR.

Body calculators. The Body section (adults only) offers calculators such as BMR, TDEE, BMI and body fat estimates. The values you type in (age, height, weight, measurements) are not stored.

We ask for your explicit consent before any health-related data is saved. You can use the app without giving it; some personalised features will then be unavailable.

You can withdraw consent at any time in Settings. After you confirm, the app deletes the health-related data stored on your device. Withdrawal does not affect the lawfulness of processing before it.

5. Progress photos

Monthly progress photos (face, top of the hair, hair length) are optional and require a separate consent "photos".

Photos are reduced in size and stripped of EXIF and location data.
They are encrypted with AES-256-GCM using a key that never leaves your device.
They are never uploaded, not even with sync.
Decrypted copies exist only temporarily in the cache while a photo is on screen.

If you withdraw the photos consent, the photos are deleted after confirmation. Legal basis: explicit consent, art. 9(2)(a) and art. 6(1)(a) GDPR.

6. AI coach

The AI coach works only after you agree to it in the chat (consent "AI coach"). It runs through our own server (Cloudflare Workers) and uses OpenAI's API.

What is sent:

your question and up to 12 recent messages from the same conversation
minimal context: goals, phase, daily time, a style summary, IDs of active ingredients in your routines, IDs of completed lessons, the current screen, your language
only if you also gave the health data consent: your skin and hair type and concerns
the random install ID, or your account ID if you are signed in

What is never sent: your name, notes, journal, check-ins, photos and product names.

OpenAI is called with storage of responses switched off (store: false). Your message is also checked by OpenAI's moderation service. OpenAI may keep API inputs and outputs for up to 30 days to detect abuse and then deletes them. Under OpenAI's API terms, data sent through the API is not used to train its models.

Questions about self-harm, eating disorders, medical emergencies and doses of supplements or medicines receive fixed safety answers without calling the AI model.

Our server logs only technical metadata (safety category, outcome, model, response time) – no questions, no messages and no IP addresses in our application logs. To enforce the question limits, it keeps question counters per install ID – numbers only, never the content of questions: the free total counter (3 questions in total) for up to 2 years, and the Premium daily and monthly counters for about 2 days and about 40 days.

Legal basis: consent, art. 6(1)(a) GDPR, and explicit consent, art. 9(2)(a) GDPR, for any health context sent. You can switch the coach off in Settings.

7. Optional sync and backup

Sync is off by default. If you switch it on (consent "cloud sync"):

your database (without photos and device-only settings) is encrypted on your device with AES-256-GCM before upload
the key comes from a random recovery code shown only to you
we store only ciphertext in Cloudflare R2, under an identifier derived from your key, plus a hash of an access token
we cannot read your synced data; if you lose the recovery code, we cannot restore it

The server copy is deleted when you turn sync off with deletion or delete all data (the app retries until the server confirms). Legal basis: your consent, art. 6(1)(a) GDPR, and, because the encrypted copy may include health-related data, explicit consent, art. 9(2)(a) GDPR.

8. Barcode lookup

When you scan or type a barcode, the app sends the barcode number and, technically, your IP address to Open Beauty Facts (Open Food Facts association, France) to fetch product information. Open Beauty Facts is an independent recipient with its own privacy policy. The product data is published under the Open Database Licence (ODbL). Legal basis: performance of the service you requested, art. 6(1)(b) GDPR.

9. Premium purchases

Premium is optional. Payment is processed by Apple (App Store) or Google (Google Play) as independent controllers; we do not receive your card details.

RevenueCat, Inc. (USA) manages subscription status. It receives the random install ID (or, while you are signed in, your account ID) as customer ID and store receipts and transactions. When you sign in, purchases made on the device are moved to the account ID. Our server asks RevenueCat whether an install ID has Premium and caches the answer for 10 minutes (60 seconds if not Premium). When a subscription changes, RevenueCat sends our server an event containing the random customer ID and the event type; the server only drops the cached Premium status for that ID and stores nothing from the event.

If you delete all data, the app uses a new install ID. The old RevenueCat record stays linked only to the old random ID; if you send us that ID, we will have the record deleted. Deleting an account deletes its RevenueCat customer.

Legal basis: contract, art. 6(1)(b) GDPR; tax and accounting obligations, art. 6(1)(c), mainly on the stores' side.

10. Security and abuse prevention

To protect the service, our server applies rate limits per install ID and IP address and the coach question limits. Cloudflare's platform logs may contain request metadata such as the IP address; they are kept for up to 7 days. Legal basis: legitimate interest in security and preventing abuse, art. 6(1)(f) GDPR.

11. Recipients and processors

Cloudflare, Inc. (USA) – hosting of the coach, sync and account server (Workers, KV, R2, D1), the website and forwarding of e-mails sent to our addresses; processor
Google (Gmail) – the mailbox in which we receive and answer e-mails sent to contact@ and [email protected], including anything you write in them; processor
Resend (USA) – delivery of sign-in code e-mails (e-mail address and the code); provided by Plus Five Five, Inc.; processor
Apple and Google as sign-in providers – only if you choose Sign in with Apple or Google; independent controllers
OpenAI (OpenAI Ireland Limited, Dublin, with OpenAI, L.L.C., USA) – AI coach; processor
RevenueCat, Inc. (USA) – subscription status; processor
Apple and Google – app distribution and payments; independent controllers
Open Beauty Facts (France) – barcode lookups; independent recipient

Each processor works for us under a data processing agreement (art. 28 GDPR).

12. Transfers outside the EEA

Cloudflare, Google, OpenAI, RevenueCat and Resend are US companies or their groups, so data may be transferred to the USA. Such transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it (Cloudflare) and otherwise on the European Commission's Standard Contractual Clauses (art. 46(2)(c) GDPR). You can ask us for a copy of these safeguards at [email protected].

13. How long we keep data

On your device: until you delete it, withdraw the related consent, or uninstall the app.
Coach question counters (numbers only): free total counter up to 2 years; Premium daily counter about 2 days, monthly counter about 40 days.
Premium status cache: 10 minutes (60 seconds if not Premium).
Our server logs: metadata only, up to 7 days.
OpenAI: up to 30 days for abuse detection, then deleted.
Sync copy: until you delete it.
Account: until you delete it; sign-in codes 10 minutes (deleted once used); sessions up to 1 year.
RevenueCat, Apple, Google: according to their policies and tax law.
Consent log: on your device as proof of consent while the data exists; deleted with "delete all data".

14. Security measures

encrypted database (SQLCipher) and encrypted photos (AES-256-GCM)
keys in Keychain / Keystore, bound to this device
HTTPS only; end-to-end encrypted sync
on the server: input validation, size and rate limits, security headers, secrets kept only on the server
logs without personal or health data
optional app lock (biometrics or passcode) for Body and photos; private screens hidden in the app switcher

No system is perfectly secure, but we design the app to keep as little data as possible outside your device.

15. Age requirements

Cleopatra is for people aged 16 or older. The Body section is for adults 18 or older. At onboarding we ask for your birth date only to work out your age group; the birth date is not stored, only the age group and the confirmation time. Legal basis: legal obligation, art. 6(1)(c) in connection with art. 8 GDPR, and our legitimate interest in offering age-appropriate content, art. 6(1)(f) GDPR.

16. Your rights

Under the GDPR you have the right to:

access your data and receive a copy
rectify inaccurate data
erasure ("right to be forgotten")
restriction of processing
data portability
object to processing based on legitimate interest
withdraw consent at any time, without affecting earlier processing
lodge a complaint with a supervisory authority

In Poland the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also complain in the EU country where you live or work.

17. How to use your rights

In the app (Settings):

see what is stored (number of records per category)
export all records as a JSON or CSV file
share individual photos (without metadata)
switch each consent on or off
delete all data: the database, photos and keys, reminders, install ID, the sync copy and your account, if you have one (queued if offline); works offline
delete only the account (Settings → Account)

By e-mail: write to [email protected]. Without an account we may not be able to identify you in our systems; data on your device is under your control. For server-side data (for example a sync copy or a RevenueCat record) we may ask for the install ID to locate it. We reply within one month, extendable as allowed by the GDPR.

18. Automated decisions

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Calculators and the AI coach provide information only.

19. No advertising, no tracking

Cleopatra contains no advertising, no advertising or analytics SDKs, no tracking and no crash-reporting tools. We do not sell or share your data for marketing. If we add an opt-in error reporter in the future, it will exclude personal and health data, and we will update this policy first.

20. Device permissions

Camera – to take progress photos and scan barcodes
Photo library – to pick an image you choose
Notifications – for reminders; they are scheduled locally, with no push server
Face ID / biometrics – for the optional app lock; the check happens in the device's system, and we receive no biometric data

You can change permissions in your device settings at any time.

21. Links

Evidence links in lessons open in your system browser. Websites you visit there have their own privacy policies.

22. Not a medical device

Cleopatra is an educational app about beauty, style and wellbeing. It is not a medical device and does not diagnose, treat or give medical advice. For health concerns, consult a doctor or another qualified professional. In an emergency, call 112.

23. Changes to this policy

We may update this policy when the app or the law changes. We will inform you in the app. If a change affects a consent you gave, we will ask for your consent again. Each consent is recorded with the policy version.

24. Contact

Joanna Wargalla, ul. Zawiszy 4 lok. 1, 01-167 Warszawa, Poland · [email protected] · [email protected]. Help: https://www.cleopatradaily.app/en/support/