Privacy Policy

The Alkimists is based in California, United States, and the Services are directed to users located in the United States. We are the controller responsible for your personal information. If you access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with local law; we do not target the Services to the European Economic Area, the United Kingdom, or Switzerland.

Information you provide

• Account information. When you sign in with Google, we receive your name, email address, and profile picture from Google, and we create an account for you. We do not receive your Google password.
• Skin profile. If you choose to create a skin profile, we collect the details you enter — such as your skin type, skin concerns, known allergies or sensitivities, life stage, and Fitzpatrick skin tone. Some of this is health-related and, in certain jurisdictions, sensitive information. See Section 4 and our Consumer Health Data Notice.
• Content you submit. Product requests, ingredient lists, reviews, ratings, saved routines, notes, and any messages you send us.
• Label photos. When you use the label-scan feature, the image you upload is processed to read the ingredient text on it.

Information collected automatically

• Usage and device data. IP address, browser type, device characteristics, operating system, referring pages, pages viewed, searches, and interactions with the Services, collected through server logs and similar technologies.
• Cookies and similar technologies. Used to keep you signed in, remember preferences, measure usage, and support affiliate links. See our Cookie Notice.

We do not collect precise geolocation, biometric identifiers, or payment card information, and we do not operate our own checkout or take payments through the Services.

We collect personal information from these sources:

• Directly from you, when you create an account, build a skin profile, or submit content.
• Automatically, from your device and browser as you use the Services.
• From Google, when you sign in with your Google account (name, email, profile picture).

If you are a resident of a state with a consumer health data law (such as Washington, Nevada, or Connecticut), please also read our Consumer Health Data Notice, which describes additional rights and how we obtain your consent.

We use personal information to:

• Create and maintain your account and keep you signed in;
• Provide ingredient analysis, product information, search, and recommendations;
• Personalize results based on your skin profile, when you provide one;
• Publish and manage the content you submit, such as reviews and product requests;
• Respond to your requests and provide support;
• Send you administrative messages about the Services, including changes to these policies;
• Send marketing emails where permitted — you can unsubscribe at any time;
• Monitor, secure, debug, and improve the Services and prevent fraud and abuse;
• Comply with law and enforce our Terms of Use.

We rely on your consent, our legitimate business interests, the performance of our agreement with you, and our legal obligations as the bases for these uses, as applicable.

When you provide a skin profile, we use automated logic to match ingredients and products to the attributes you entered. This is designed to help you and does not produce legal or similarly significant effects about you (for example, it does not affect credit, employment, or insurance). Recommendations are informational only — see our Terms of Use and the disclaimer below.

We share personal information only as described here. We do not sell your personal information for money.

• Service providers (processors). Companies that host and operate the Services on our behalf under contract — including our cloud database and authentication provider (Supabase) and our hosting provider (Vercel) — process personal information only to provide services to us.
• AI service providers. To power ingredient analysis, label reading, and search, the text and images you submit (and, where relevant, your skin profile attributes) are sent to third-party AI providers, including Anthropic, which process the data to generate results for you. We do not permit them to use your information to train their models except as allowed by our agreements with them.
• Analytics and affiliate partners.We use analytics tools to understand usage, and we participate in the Amazon Associates program and use affiliate-link tools. These partners may set cookies and receive limited information (such as clicks and device identifiers) as described in our Cookie Notice. To the extent this is considered "sharing" for targeted advertising under state law, you can opt out — see Section 10.
• Legal and safety. When required by law, to respond to legal process, or to protect the rights, safety, and property of our users, the public, or us.
• Business transfers. In connection with a merger, financing, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We keep your personal information for as long as your account is active or as needed to provide the Services. When you delete your account, we delete or de-identify your account information, skin profile, reviews, and saved content within a commercially reasonable period, except where we must retain limited information to comply with law, resolve disputes, prevent fraud, or enforce our agreements. Information in routine backups is deleted on our normal backup cycle. Analytics data that does not identify you may be retained in aggregate form.

• Account and skin profile. You can review or update your information, edit or clear your skin profile, and delete your account from within the Services.
• Marketing. You can unsubscribe from marketing emails using the link in any such email.
• Cookies. You can control cookies through your browser and, where offered, our cookie controls. See our Cookie Notice.
• Withdraw consent. Where we rely on consent, you can withdraw it at any time; this does not affect processing already carried out.

Depending on your state of residence (including California, Colorado, Connecticut, Texas, Virginia, and other states with comprehensive privacy laws), you may have the right to:

• Know whether we process your personal information and access it;
• Correct inaccurate personal information;
• Delete personal information we hold about you;
• Obtain a portable copy of information you provided to us;
• Opt out of targeted advertising, the sale of personal information, and certain profiling;
• Limit the use of sensitive personal information; and
• Not be discriminated against for exercising these rights.

How to exercise your rights

Submit a request by emailing kongmoongchi@gmail.com. We will verify your identity before acting and will respond within the time required by law (generally 45 days, with an extension where permitted). You may use an authorized agent, with proof of authorization. If we deny your request, you may appeal by emailing kongmoongchi@gmail.com; if we deny your appeal, you may contact your state attorney general.

Opt out of sale/sharing and Global Privacy Control

We do not sell your personal information for money. To the extent our use of analytics and affiliate cookies is treated as "sale" or "sharing" for targeted advertising, you can opt out by emailing kongmoongchi@gmail.com and by using our cookie controls. We honor Global Privacy Control (GPC) browser signals as a valid opt-out of sharing for the browser on which the signal is received.

California "Shine the Light"

California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing, but you may confirm this by emailing kongmoongchi@gmail.com.

The Services are intended for users 13 years of age and older, and account creation is intended for those who can lawfully consent. We do not knowingly collect personal information from children under 13, and we do not knowingly collect sensitive information from anyone under 18 without appropriate consent. If you believe a child has provided us personal information, contact us at kongmoongchi@gmail.com and we will delete it.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a data breach affecting your personal information, we will notify you and regulators as required by applicable law.

The Services rely on and may link to third parties (such as Google sign-in, Amazon, and other sites we reference). Their handling of your information is governed by their own privacy policies, which we encourage you to review. We are not responsible for the practices of third parties.

There is no consistent industry standard for Do Not Track ("DNT") browser signals, so we do not respond to them. We do, however, honor Global Privacy Control signals as described in Section 10.

We may update this Privacy Policy from time to time. We will change the "Last updated" date above and, for material changes, provide a more prominent notice or notify you directly. Your continued use of the Services after an update means you accept the revised policy.

Questions or requests about this policy, or to reach our privacy contact:

Email: kongmoongchi@gmail.com