Skip to content

Privacy Policy

Last updated: October 20, 2026

This Privacy Policy explains how Flynn Kavanaugh, operating as Dewpoint, at 120 S Salisbury St, Unit 11, West Lafayette, IN 47906, handles your information when you use the Dewpoint website or iOS app. For questions or requests, email privacy@dewpointapp.com.

1. What we collect

Account and app information

We collect information you provide to create and use your account, organize your skincare, or contact us:

  • Your email address, password and authentication data (including optional two-step sign-in authenticator settings), invite code used at signup, display name, and date of birth. Your date of birth lets us verify the minimum age of 16.
  • Products on your shelf and in your morning and evening routine (catalogue selections or custom product names), routine step order, notes, opened-on dates, period-after-opening (PAO) months, and printed expiry dates you choose to save.
  • Reminder switches (morning routine, evening routine, weekly progress photo), reminder times, date-format preference, time zone, and last-opened timestamp.
  • On the website only: your email address, signup page source, and optional general skin type if you join the launch waitlist.
  • Consent timestamps and policy versions (for Terms of Use, Privacy Policy, and Consumer Health Data Privacy Policy), so we can record what you agreed to.

Health-related information

Your skin quiz answers and results (including skin type, sensitivity status, sensitivity triggers, primary and secondary concerns, breakout type, routine depth, sunscreen habit, and confidence), your allergy and sensitivity avoid list, daily calendar logs (morning and evening completion, completed routine items, skipped routine steps, daily skin-look states, and custom or preset tags such as Period, Travel, High stress, Poor sleep, New product, or weather), progress photos, and skin-related notes on your progress log, routine, and shelf can be health-related information.

The allergy and sensitivity avoid list is optional and stores entries only if you switch it on in Settings. You can delete your allergy list at any time from Settings.

The optional Pregnancy flag in Settings (which highlights products containing ingredients the American Academy of Dermatology lists to avoid during pregnancy) is stored only on your device in local storage and is never sent to our servers or saved to your account.

We use your stored skin and health information to score and explain your quiz result, generate step-by-step routine guidance, organize your routine and shelf, check the ingredient data we hold for conflicts and avoid-list matches, and show your daily habits, streaks, and progress over time. Account features process this information only with the separate health-data consent given at signup. You can withdraw that consent at any time as explained in section 7.

The public quiz can run before signup. Its progress and a pending result stay in your browser or device storage until you sign in, accept our current policies, and save the result to your account. Read our Consumer Health Data Privacy Policy for the categories, purposes, and rights that apply.

Notifications, device permissions, sharing, and technical data

Website reminders (Web Push): When you turn on notifications in a web browser, we store your Web Push subscription endpoint, encryption keys, and browser user agent, along with delivery records (reminder type, local date, send time, and delivery or failure counts). Your time zone and last-active time help schedule reminders and pause them if you haven't opened the app for a week.

iOS app reminders (local notifications): In the iOS app, reminders are scheduled directly on your phone using local device notifications for a rolling 7-day window. The iOS app does not create Web Push subscriptions or send push notification tokens to our servers.

Camera, photo library, and photo processing: When you add a progress photo, you can choose an image or (in the iOS app, if you grant permission) take a photo with your camera or pick one from your photo library. Photos taken in the iOS app are not saved back to your camera roll. Before upload, Dewpoint resizes and re-encodes your photo as a JPEG on your device, which strips embedded camera metadata such as EXIF GPS location and device details.

Sharing links and streaks: Saved quiz results have a random share-link slug (/r/<slug>). If you share that link (or use the iOS share sheet), anyone with the link can see only three fields: your skin type, sensitivity status, and concerns. That link never exposes your full quiz answers, breakout type, allergy list, routine, progress photos, or notes. If you share or copy your consistency streak from the Share page, only the text you choose to send is shared.

Invite-code checks and error logs: When an invite code is checked, we use your IP address and failed-attempt timestamps to rate-limit brute-force guessing (up to 5 failed attempts per IP or 100 overall in 15 minutes). If the app hits an unexpected error, details such as the page path, error message, and stack trace may be sent to our hosting environment so we can fix it.

2. Why we use it

We use your information to run the website and iOS app, personalize your routine and ingredient checks, send the reminders you switch on and necessary account emails (such as signup confirmation, password reset, email change, and verification codes), enforce two-step sign-in and rate limits, answer support requests, and meet legal obligations. Launch-list emails are used only for people who opted into the waitlist on the website. Your health-related information is used only to provide the app features described above, with your separate consent — never for advertising or to train AI models.

3. Who we share it with

We do not sell your personal or health information, share it for cross-context behavioral advertising, or include third-party advertising or analytics SDKs. In the iOS app, Apple's privacy manifest records NSPrivacyTracking = false with no tracking domains. These service providers and external sites handle only what is needed when you use the app:

  • Lovable Cloud / Supabase: hosting, database storage, authentication (including leaked-password checks and two-step sign-in), and private progress-photo storage.
  • Lovable Cloud email delivery (using Mailgun and Amazon SES): your email address and verification link or code when sending signup confirmation, invite, login link, password reset, email change, or reauthentication emails from noreply@dewpointapp.com (via notify.dewpointapp.com).
  • Apple, Google, or Mozilla push services (website only): your browser push endpoint and encrypted reminder payload when Web Push notifications are turned on in a browser.
  • Amazon (website only): the product link and our Amazon Associates tag only when you click an Amazon affiliate link on the website. Amazon affiliate links are not shown in the iOS app.
  • Brand stores, retailers, and cited references: your browser (or the in-app browser sheet on iOS) connects to an external retailer, brand store, or reference site (such as PubMed, Cochrane, or the American Academy of Dermatology) only when you tap a link to open it.
  • Our hosting environment: page and runtime error details when an unexpected application error occurs.

We do not put quiz answers, allergy lists, daily logs, progress photos, or notes in account emails or push notifications, and we never send your stored health information to Amazon or any retailer.

4. Cookies and device storage

Dewpoint uses browser and device local storage (rather than advertising cookies) to keep the app working on your device:

  • Sign-in session: keeps you signed in and stores your authentication tokens until you sign out or delete your account.
  • Quiz progress and pending result: saves in-progress quiz answers in quiz_progress while you take the quiz and holds an unsaved result in pending_quiz_result until it is saved to your account.
  • Pregnancy caution toggle: saves your optional Pregnancy flag setting in dewpoint_pregnancy_mode locally on your device only; it is never sent to our servers.
  • Activity heartbeat and interface preferences: records when your time zone and last-active timestamp were last synced in dewpoint:heartbeat:<userId> (at most once every 6 hours), whether you dismissed the Getting Started card in dewpoint_getting_started_dismissed, and which Products sub-tab you last viewed in products_tab.

Signing out or deleting your account removes your sign-in session, deletes this browser's Web Push subscription from our database, and cancels any scheduled local reminders in the iOS app. To clear device-only settings such as the Pregnancy toggle or unsaved quiz progress on a shared device, clear site data in your browser or uninstall the iOS app.

We do not use advertising cookies, web beacons, or tracking pixels. If you click an external link to Amazon or another retailer on the web, that site may set its own cookies under its own privacy policy. We do not respond to browser Do Not Track signals because we do not track you across other websites or apps.

5. How long we keep it and deletion

We keep your account information while your account is active so we can provide the app. You can delete individual routine steps, shelf items, custom tags, progress entries and photos, or your entire allergy list at any time in the app.

You can delete your entire account at any time on the Account page (or from the policy update screen). Account deletion immediately removes your progress photos from storage and deletes your active records across all user tables — quiz results, routine items, shelf products, allergy list, daily calendar logs, progress entries, Web Push subscriptions, reminder send records, user settings, profile, and authentication login — and cancels any scheduled local notifications in the iOS app. Deletion cannot be undone, so download a copy of your data first if you want to keep it.

Automated database backups held by Lovable Cloud / Supabase are kept on a rolling cycle for up to 30 days before automatically expiring and being overwritten; you can also email privacy@dewpointapp.com to request backup removal. Website launch-list emails are kept until we send launch invitations (or end the private beta) or until you email privacy@dewpointapp.com to be removed. Failed invite-code attempt logs older than 1 day are automatically deleted when a subsequent invite-code check runs.

6. Security and incidents

We protect your information using authenticated row-level security policies, private photo storage with 60-minute signed links, client-side JPEG re-encoding that removes EXIF metadata before upload, leaked-password checks at signup and password change, and optional two-step sign-in (TOTP authenticator app) enforced at the database and storage level. No internet transmission or storage system is completely secure. Keep your password private and contact support@dewpointapp.com if you suspect someone else has accessed your account.

We will notify affected users and regulators of security incidents as required by law.

7. Your rights

You can access, export, correct, or delete your information, withdraw consent, or opt out of waitlist emails. Here is how:

  • Access and correction: view and edit your saved routine, shelf, allergy list, tags, calendar logs, and progress entries in the app, and update your display name or date of birth on the Account page. Email privacy@dewpointapp.com for other access or corrections.
  • A copy of your data: click Download my data on the Account page to export a JSON copy of your account data (including 60-minute links to your progress photos), or email privacy@dewpointapp.com.
  • Deletion: delete your allergy list in Settings, delete your entire account on the Account page, or email us.
  • Withdraw consent: you can turn off and delete your allergy list in Settings, delete your account on the Account page, or email privacy@dewpointapp.com at any time. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
  • Waitlist and marketing opt-out: email privacy@dewpointapp.com to remove your address from the website launch list. Necessary account and security emails are separate.

Send requests to privacy@dewpointapp.com. We respond within 45 days. To appeal a decision, reply to our decision email. We do not discriminate against you for exercising your privacy rights. Residents of states or countries with applicable privacy laws may have additional rights under those laws.

For rights concerning skin and health information, see the Consumer Health Data Privacy Policy.

8. Children

Dewpoint is for people aged 16 and over and is not directed to children. We require a date of birth at signup and do not knowingly collect personal information from anyone under 16. If we learn that we have collected information from someone under 16, we will delete the account and its data. Email privacy@dewpointapp.com if you believe this has happened.

9. Changes to this policy

We may update this Privacy Policy. The “Last updated” date at the top identifies this version. For significant changes, we ask you to review and accept the current policies in the app before you continue using your account.

10. Contact

For privacy questions and data requests, email privacy@dewpointapp.com. Send legal notices to legal@dewpointapp.com.

Flynn Kavanaugh, operating as Dewpoint

120 S Salisbury St, Unit 11, West Lafayette, IN 47906