In one sentence
Michi keeps the numbers, not your face. A scan is analysed and the image is gone from our side in the same request. We do not sell anything about you, we run no advertising identifiers, and we embed no third party analytics in the app.
Your face photo, in detail
This is the part worth reading closely, because it is the part people care about.
- It is never written to our storage. The photo passes through our server in memory and is not saved to a database, a bucket, or a log. Only the structured result is stored: seven scores between 0 and 100, a global score, a photo quality flag, a skin type, and up to three concerns.
- It is sent to one analysis provider. We use OpenAI to read the image. We do not permit your photo to be used to train their models. Under their standard API terms, they may hold a copy for a short period for abuse monitoring before deleting it. That window is theirs, not ours, and we would rather write it here than let you assume it does not exist.
- A copy can stay on your phone, if you keep one. The before and after feature compares your first photo with today's. Those images are written to your device storage, never uploaded. Deleting them is one action in the app, and deleting the app removes them with it.
- We keep the surroundings, not the picture. Alongside the scores we store capture conditions such as brightness, framing and the hour of day, because a photo taken at midnight under a yellow lamp is not comparable to one taken at a window. None of that is the image.
What we store on our servers
- An account. By default it is anonymous: an identifier, your country, your language and your time zone. There is no name and no email address, and no sign-in of any kind.
- What you told us about your skin. Skin type, sensitivity, concerns, goals, age band, and the routine built from them.
- Your scan history. The scores and the date, so a curve can exist. No images.
- Your progress. Which steps you ticked and on which day, your streak, and the looks you have unlocked.
- A device record. Platform, app version, OS version, time zone, and a notification token if and only if you turned reminders on.
One thing we want to be plain about. The identifier that ties your phone to your account is stored in the system keychain, and on iOS the keychain survives deleting the app. Reinstalling therefore finds your account again rather than starting a blank one. That is deliberate, it is what keeps your history from vanishing, and it also means a free allowance already used is still used. If you want a genuinely clean slate, delete your account from the settings screen first.
What never leaves your phone
- Diary notes and the photos you attach to them.
- Your before and after images.
- The camera preview, which is not recorded at any point.
Who else touches your data
The short list, and what each one is for.
- Cloudflare hosts the service and stores the database.
- OpenAI analyses face photos and product labels, as described above.
- Apple and Google process subscription payments. We never see your card.
- RevenueCat tells our server whether a subscription is active. It receives an account identifier and a subscription status, not your skin data.
- Expo delivers reminder notifications, if you enabled them.
There is no advertising network, no data broker, and no analytics SDK in this list, because there is none in the app.
Children
Michi is not built for children. If you tell us you are under 18, the face scan is hidden and no face photo is ever sent for analysis. The rest of the app, the routine and the reminders, keeps working, because a teenager learning to care for their skin is not something to lock out.
Your rights
- Delete everything. Settings, delete account. Your sessions end immediately and your data is erased within 30 days. There is a short window in which you can restore the account if you change your mind, and after that it is gone.
- Get a copy, or ask us to correct something. Write to the address below and we will answer.
- Turn off reminders at any time, in the app or in your phone settings. The token is deleted when you do.
If you are in the European Union or the United Kingdom, the legal basis for the scan is your consent, given when you take the photo and withdrawable by deleting your account. The routine and the reminders rest on performing the service you asked for.
Changes
If this policy changes in a way that affects what we do with your data, the app will tell you before the change applies. The date at the top of this page always reflects the version in force.
Contact
Questions, requests, or something on this page that does not match what you observe in the app: [email protected]. A page that is never contradicted is a page nobody read, so please do contradict it.