Privacy Policy

Last updated: October 20, 2026.

The short version

Nitavera analyzes your photo entirely inside your own web browser, on your own device. Your photo is never uploaded to us or any server, and we never see it. Your scan photos, answers and results stay in your browser, except what you choose to send to the Assistant chat (see Third-party services). Unsigned questionnaire answers stay in this open tab until you sign in; after sign-in, they are saved in this browser. If you sign in with Google, we store your verified email address, name and account identifier on our server, but not your photo or scan history.

What we collect

Your photo: analyzed on your device, never uploaded. A small thumbnail of each of your last 12 scans is saved in this browser for your progress view until you clear history or browser data. It is not transmitted anywhere.
Questionnaire answers & results: held in the open tab before sign-in, then stored locally in your browser after verified sign-in so the app can build your plan and track progress. You can clear saved data anytime (New scan / Clear history, or by clearing your browser data).
Account info (if you sign in with Google): we verify your Google sign-in on our server and store your Google account identifier, verified email address, name and signup date in a private server record. Pro is free for a verified account with no current time limit. The signup date remains in the account record but does not end Pro access. A secure browser cookie keeps you signed in on this browser for a limited time. Your photos and scan history remain on this device and do not sync between devices. To request account deletion, contact hello@nitavera.com.
Feedback (only if you send it): your message, rating, optional email, the page you were on and your browser type are stored privately for the founder. Photos and scan data are never included.

Third-party services

Facial-landmark model (Google MediaPipe): to map your face precisely, the app may download a face-detection model from a public CDN (jsDelivr / Google) when you are online. Your photo is not sent — only the model is downloaded to your device. If offline, the app falls back to on-device skin detection. The app also loads its code libraries for face detection, the 3D preview, label reading (OCR) and barcode reading from the jsDelivr CDN when you use those features. The OCR library also downloads its English language data from the same CDN. No photo is sent to the CDN.
Nitavera Assistant chat (included with free Pro signup): when you use the assistant, the questions you type, the conversation so far, plus a short summary built from your profile and activity - skin type, sensitivity, concerns, any skin conditions you selected, whether you are under 18, how many scans you have on record, safety status (such as pregnancy or isotretinoin use), your latest scan scores, your current routine, the products in your plan and on your shelf, and your most recent product verdict, never your photo - are sent to our server and our AI provider to generate a reply. A notice is shown right in the chat.
Product lookups: if you scan a barcode or type/photograph a product's name, the barcode number or that product name (no photo itself, no personal data) is sent to our own server, to check our shared product list, and directly from your browser to Open Beauty Facts — a free, open cosmetics database — to look up the ingredient list. For barcodes, our server may also look the number up in a wider barcode lookup service to find the product's name. If you are signed in and type a product name we cannot find, or scan a barcode we can name, and then paste its ingredient list, that name and list are automatically sent to our own server and added to a shared product list so other people can find it by name. The request contains no photo, profile or account detail.
Local UV & weather ("today's skin weather"): once you've used Nitavera (a saved profile or scan), the app automatically looks up your local UV and weather about once a day. It asks your browser for permission and sends your location only if you allow it; you can revoke that anytime. Your approximate location (rounded to about 1 km) is sent to Open-Meteo only for that lookup. We don't store it. Open-Meteo, like any website, sees your IP address. Your photo is never involved. First-time visitors are never asked.
Payments: New checkout is closed, and signing up for Pro does not ask for a card. Existing paid subscriptions, if any, are separate and may still be processed by Stripe; we do not see your card. Hosting and serverless functions run on Netlify.
Quiz drafts: before sign-in, your quiz answers are kept in this tab's session storage for up to 24 hours so a reload does not lose them. Closing the tab clears the draft. After verified sign-in, your saved profile stays in this browser. Answers are never included in anonymous action records.
Anonymous visit actions (pilot): we store a random tab-session ID in session storage and send that ID with an action label for landing entry, scan or product entry, scan start, scan completion, product check, Google sign-in prompt view, loaded button or click, a coarse sign-in error, upgrade prompt view or a new verified signup. This lets us compare recent actions within a tab, not identify a person across tabs or devices. Each record can also carry a short label from the link you came in on (for example, the ingredient page whose button you clicked) and one coarse category for where you arrived from: direct, search, social, AI assistant or other. We do not store the address of the site you came from. We also record when a tab's first finished scan or product check happens after a new signup in that same tab. We do not put your name, email, photo, skin result, questionnaire answers or exact page URL in these action records. Known signed-in test accounts are excluded, but anonymous testing may still be counted. We keep individual action records for at least 48 hours, then an hourly cleanup turns them into coarse action counts and deletes the individual records; cleanup failures can extend retention until fixed. We schedule deletion of those coarse counts after 90 days; cleanup failures can extend that retention too. The pilot ends on October 29, 2026 (UTC); no new action records are taken after that. Clearing our site data removes the browser's tab ID; it does not erase action records already sent. Blocking session storage prevents this action tracking. Hosting services still see normal request metadata, including IP address in their access logs.
Anonymous usage analytics: we count some named in-app actions, with no details, separately without the tab-session ID.
Page-speed measurement: every page loads Netlify's performance measurement script (Netlify Real User Monitoring), which sends page-load timings, the page path (without the query string), your browser, operating system, device type and screen size to Netlify. It does not use cookies and does not honor Do Not Track. Like any request, it reaches Netlify's servers, which can see your IP address. The home page also loads a small badge image from letslaunch.today, so that site sees your IP address and browser details.
Page counts and time on page: each page sends one small request to our own server with the page path, the site you came from (host name only) and, when you leave, how many seconds the page was visible. We store only daily totals per page. To count each visitor once a day we use a short one-way hash of your network address and browser type mixed with a daily secret; the hash list is deleted after the day ends, and nothing links a visit to an account or to another day. We do not store your address or browser details. For page counts only: if your browser sends Do Not Track or Global Privacy Control, we do not send or count these requests.

Your face data & your rights

Your photo is treated as sensitive and is processed on your device and never uploaded; only a small thumbnail of each of your last 12 scans stays in this browser until you clear history or browser data. Your local scans and photos can be deleted at any time (use New scan / Clear history, or clear your browser data). Clearing browser data does not delete your server-side account record; contact hello@nitavera.com to request that. We do not sell your data. We share it only with the services described on this page: our AI provider for the Assistant chat, Open Beauty Facts for product lookups, Open-Meteo for UV and weather, Google for sign-in and the face-detection model, Netlify for hosting and page-speed measurement, letslaunch.today for a badge image on the home page, Stripe for any existing paid subscriptions, and the shared product list (product names and ingredient lists only, never a photo, profile or account detail), which other people using Nitavera can see. Depending on where you live, you may have rights under laws such as the GDPR and U.S. state privacy laws; contact us to exercise them.

What we do NOT do

We do not upload, sell, or share your photos.
We do not store your photos or scan history in the account record.
We do not run advertising trackers.

Children

Nitavera is intended for general audiences. It is not directed at children under 13, and we do not knowingly collect information from them.

Medical disclaimer

Nitavera provides cosmetic, educational guidance only. It is not a medical device, not a diagnosis, and not a substitute for professional advice. Always consult a dermatologist or doctor for skin concerns that are painful, scarring, changing, or not improving.

Contact

Questions about privacy? Reach out at hello@nitavera.com.