This Privacy Policy explains how SunTan ("SunTan", "we", "us") collects, uses and protects information when you use the SunTan mobile application and related services (the "App"). We designed SunTan to be useful with as little personal data as possible. If anything below is unclear, email us at tomazovsenjak7@gmail.com.
Contents
1. Who we are
SunTan is operated by Tomaz Ovsenjak sp. ("we"), based in Ljubljana, Slovenia. For privacy questions you can contact us at tomazovsenjak7@gmail.com.
2. Data we collect
We try to collect as little personal data as possible. Categories of data and where they live:
| Category | Examples | Where it lives |
|---|---|---|
| Profile | Skin type, shade goal, optional name, age range | On your device & your private iCloud |
| Location | Approximate location to fetch the right UV index and weather | Sent to weather provider; not stored on our servers |
| Health-adjacent | Tanning sessions, exposure time, vitamin-D estimates | On your device; optionally written to Apple Health with your permission |
| Camera & photos (face data) | Skin-scan photo for the skin-type estimate; optional tanning progress photos | On your device only — never uploaded to us or any third party |
| Device & usage | App version, anonymous feature usage & onboarding events | Apple App Analytics & PostHog (anonymous) |
| Subscription | Purchase status, transaction ID | Apple in-app purchase & RevenueCat (our processor) |
| Support | Email address, message content if you contact us | Our email provider |
We do not collect contacts, microphone, calendar or browsing history, and we do not use precise advertising identifiers or build advertising profiles. Camera photos are handled only as described in Camera, photos & face data below and never leave your device.
3. Camera, photos & face data
Two optional features let you take pictures of your face and skin: a one-time skin scan during onboarding (to estimate your Fitzpatrick skin type) and optional progress photos you can attach to a tanning session to track your tan over time. Apple classifies these images as face data. Here is exactly how they are handled.
How it is processed, and where
- Face data is captured and processed entirely on your device. The skin scan uses Apple's on-device image processing to compute an average skin colour, which becomes a skin-type estimate. We do not create a facial-recognition template, face map or other biometric identifier, and we do not use TrueDepth or depth data.
- Face data is used only for those two purposes — estimating your skin type and letting you review your own progress photos. It is never used to identify you.
- You can skip the camera entirely and complete the skin-type estimate with a short questionnaire instead.
Whether face data is retained, for how long, and why
- The skin-scan photo and any progress photos are stored only on your device, in the App's private storage. They are never transmitted to us or to any third party, because we operate no server that could receive them.
- We impose no server-side retention period because we never receive this data — it remains entirely under your control. Photos are kept only for as long as you choose to keep them, so that you can view your skin profile and progress over time.
- Face data is permanently deleted when you delete the photo within the App or uninstall SunTan. It is never stored indefinitely on any server, and no server-side copy exists.
Sharing face data with third parties
We do not share face data with any third party. Our analytics provider (PostHog) receives only anonymous, non-image usage events, and our subscription provider (RevenueCat) receives only your subscription status. Neither receives your photos or any face data. Because no third party receives face data, no third party stores it.
4. How we use data
- Run the App. Calculate safe-exposure windows, build routines, send local notifications, show the UV forecast for your area.
- Improve quality. Diagnose crashes and understand which features are useful (in aggregate, never identifying you personally).
- Manage subscriptions. Verify and restore purchases through Apple.
- Customer support. Reply to your email and resolve problems.
- Legal compliance. Comply with applicable laws and respond to lawful requests.
5. Legal basis (GDPR)
If you are in the European Economic Area, the United Kingdom or Switzerland, our legal basis for processing depends on the purpose:
- Contract — to provide the App you asked us to provide.
- Legitimate interest — to keep the App secure, understand aggregate usage and prevent abuse.
- Consent — for optional integrations like Apple Health, location and push notifications. You can withdraw consent any time in iOS Settings.
- Legal obligation — when we must keep certain records (e.g. tax, payments).
6. Sharing & processors
We do not sell personal data. We share limited data with vetted service providers who process it only on our instructions:
- Apple — App Store, in-app purchases, push notifications, App Analytics, iCloud (when you opt in), and Apple WeatherKit for the UV index & weather at your approximate location.
- RevenueCat — subscription management.
- PostHog — anonymous product analytics (feature usage and onboarding events; no photos, no face data).
- Email provider — to receive and reply to your support emails.
None of the processors above ever receive your camera photos or face data, which stay only on your device.
We may also disclose information when required by law, to protect our rights, or in connection with a corporate transaction (with notice where feasible).
7. Retention
- On-device data stays as long as the app is installed; you can delete it any time from Settings → Reset.
- Camera photos & face data stay only on your device and are permanently deleted when you remove the photo or uninstall the App. We never receive or store them.
- Crash and aggregate analytics are kept up to 13 months in pseudonymous form.
- Subscription records are retained as long as required by tax and accounting law.
- Support emails are kept for up to 24 months after the last reply.
8. Your rights
Depending on where you live, you may have rights to access, correct, delete or export your data, to object to or restrict certain processing, and to lodge a complaint with a data-protection authority. To exercise these rights, email tomazovsenjak7@gmail.com. Most data lives on your device — you can delete it instantly from Settings → Reset, or by removing the App.
California residents have additional rights under the CCPA/CPRA, including the right to know and the right to delete. We do not "sell" or "share" personal information as those terms are defined under California law.
9. Security
We use TLS in transit, hardened cloud infrastructure, and the principle of least privilege. No system is perfectly secure, but we work hard to protect your data and will notify you of any incident that legally requires notification.
10. Children
SunTan is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.
11. International transfers
Some of our processors are based outside the EEA/UK. Where required, we rely on the European Commission's Standard Contractual Clauses (or equivalent) to safeguard transfers.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, where the change is material, notify you in-app or by email before it takes effect.
13. Contact
Tomaz Ovsenjak sp.
Ljubljana, Slovenia
tomazovsenjak7@gmail.com