Last updated: 1 October 2026
This policy explains what the Celly mobile application collects, why, where it goes, and what you can ask us to do about it. It describes the app as it actually behaves, not as a general template.
The same address handles privacy requests, support and general contact. We have not appointed a Data Protection Officer.
Celly is a skin and wellness application. It offers skin analysis from a photo you take, scanning of foods and products, a diary, personalised suggestions, multi-day regeneration cycles and environmental context such as local weather.
Celly is not a medical service. It does not diagnose, treat, cure or prevent any condition, and nothing it shows you is medical advice. Scores, readings and suggestions are estimates produced by software for general wellness purposes. If something about your skin concerns you, speak to a doctor or dermatologist.
During onboarding, and whenever you edit your profile, you can provide:
This information is stored on your device and in your account on our backend, so it survives reinstalling the app and follows you if you sign in on another device. It is used to personalise what Celly shows you and nothing else.
What Celly holds about your skin is a cosmetic profile: the skin type you selected, the visible characteristics you chose from a fixed list — such as visible blemishes and marks, visible redness and uneven tone, enlarged pores, dryness or the appearance of fine lines — the change in appearance you say you notice most often, your dietary preferences, and your stated cosmetic goal.
These are descriptions of how skin looks, not statements about a medical condition. Celly does not ask you whether you have a diagnosed condition, does not name diseases as answer options, and does not tell you that you have one. It does not diagnose, treat, monitor or infer any illness, and nothing it shows you is a medical assessment.
You choose whether to provide any of it. Every field is something you type or tap yourself, and Celly does not derive it from anywhere else. We use it only to operate the features you are using — personalising suggestions, building your plan, showing your diary and tracking a cycle you started. We do not sell this information, we do not use it for advertising, and we do not share it with third parties for their own purposes.
If you would rather Celly did not hold it, you can delete your account from inside the app (see Deleting your account below), which removes it from our backend.
The Google ML Kit components that perform on-device face detection and text recognition, together with the GoogleDataTransport library they rely on, may send diagnostic, performance and usage information to Google about how those components are running. According to Google's own declarations for these components, this information is not linked to your identity and is not used for tracking.
This telemetry is produced by Google's software inside the app. It does not contain your photographs, your profile or your diary.
To describe a scanned product, Celly sends the product's own details — its barcode and composition, such as name, brand, category, ingredients, nutrition values and on-pack claims — together with the language of the app, to Celly's own backend. The request is made from your signed-in Celly session.
If you allow it, Celly uses your location to show weather conditions relevant to your skin, such as UV index, humidity and temperature.
Entries you create — scanned products with their result, and your progress through a regeneration cycle — are stored on your device and also saved to your account on our backend, so they are not lost if you reinstall or change device. They are associated with your Celly account ID and are readable only by that account.
Celly records a small number of first-party product events — for example that a scan happened, or that a screen was opened — and stores them in our own backend, associated with your Celly account ID. The event contents are restricted by design: names, email addresses, phone numbers, addresses, coordinates, images and tokens are rejected before an event can be written.
To be explicit about what Celly does not use:
The separate diagnostic telemetry produced by Google ML Kit is described above.
Like any online service, our backend provider and the other providers listed below automatically record technical information when the app connects to them — such as the IP address of the connection, the time of the request, the address requested and whether it succeeded. These logs are used to operate, secure and troubleshoot the service. They are kept for the period set by each provider's own log retention and are not used to build a profile of you.
Celly uses Shorebird to deliver small corrections to the app without a full store update. When the app starts, it may ask Shorebird's servers whether a correction is available for the installed version. That request contains technical information — such as the app version, the device platform and processor type, and a random identifier generated by the update component — and, like any connection, your IP address. It does not contain your Celly account ID, your profile or your diary.
Reminders are scheduled and delivered locally by your device. Celly does not currently use a remote push notification service for these reminders, which means no message content travels through a push server for them. You can turn notifications off in your device settings.
Celly uses an external AI provider, OpenAI, only for the product analysis described above, and only with product details. Your profile, skin information, diary, photographs and answers are not sent to OpenAI or to any other external generative-AI provider.
Celly's personalised AI compatibility feature, which would use your profile, is disabled and is not active in the published app. If that ever changes, this policy will be updated before the feature is switched on.
| Service | Role | What it receives |
|---|---|---|
| Supabase | Our backend: database, authentication, server functions and storage | Your account ID, sign-in email, profile, diary, cycles, product events, coarse coordinates for weather requests, and technical logs |
| RevenueCat | Subscription, trial and entitlement status; purchases on Android | Your account ID, purchase status and technical store information |
| Apple | App distribution, billing, sign-in, system geocoding | Payment details (never shared with us), sign-in tokens, location for geocoding |
| Android distribution and billing through Google Play; on-device face detection and text recognition (ML Kit); optional Google sign-in | Payment details (never shared with us); component diagnostics not linked to you; for sign-in, your email address and basic Google profile details | |
| OpenAI | Generating general product descriptions, requested by Celly's backend | Product details only (barcode and composition), with no account identifier or personal information |
| Open Food Facts | Public food and product database | A scanned barcode, with no account identifier |
| MET Norway (Norwegian Meteorological Institute) | Weather and environmental forecast data, requested by Celly's backend | Coordinates rounded to two decimal places, with no account identifier |
| Shorebird | Delivery of app corrections | App version and device platform information, a random update identifier and your IP address; no account identifier |
These providers operate their own infrastructure, which may be located outside Italy or the European Economic Area — for example in the United States. Where information is transferred outside the EEA, it is done on the basis of the safeguards those providers make available, such as the European Commission's standard contractual clauses or an adequacy decision.
Where the GDPR applies, we rely on the following:
Celly does not collect special-category data as defined by Article 9 of the GDPR, and therefore does not ask for the separate explicit consent that such data would require. If that ever changes, this policy will be updated and consent will be requested before any such information is collected.
We keep your information for as long as your Celly account exists. When you delete your account, the associated data is removed from our backend as part of that process. We do not apply a fixed retention period beyond that, and we are not stating one here that we have not implemented.
Product descriptions generated for a product are not personal data and are kept so they can be reused. Providers listed above keep their own records under their own retention rules — for example, Apple and Google retain transaction records for their own accounting and legal obligations, independently of us, and RevenueCat keeps the purchase history linked to your former account ID until we ask it to delete it.
In the app: Profile → Delete account.
After you confirm, the request is sent to our backend, which deletes your profile, diary entries, regeneration cycles, product events and the other records held against your account, and then deletes the account itself, including the sign-in email linked to it. Only once the server confirms the deletion does the app clear the copy held on your device. If the server cannot complete the deletion, nothing is removed and the app tells you so, so you can try again.
Deleting your account in the app does not automatically remove the purchase record RevenueCat holds for your former account ID. If you want that removed too, write to cellyskinfood@gmail.com and we will ask RevenueCat to delete it.
Deleting your Celly account does not cancel your subscription. The store charges you, and only the store can stop it. On iPhone, cancel in Settings → your name → Subscriptions or through the App Store. On Android, cancel in the Google Play Store under Payments & subscriptions → Subscriptions. If you delete your Celly account without cancelling, the store will keep billing you.
Celly also offers Reset App. That clears Celly on the phone in front of you — your local skin history, scans and answers — and nothing else. Your Celly account and the data saved to it stay exactly where they are, and signing in again brings them back. Use Delete account if you want the account and its data gone.
Where the GDPR applies, you have the right to:
To exercise any of these, write to cellyskinfood@gmail.com. We may need to verify that the request comes from you. Erasure is also available directly in the app, as described above.
If you believe we have handled your data improperly you can lodge a complaint with your national supervisory authority. In Italy this is the Garante per la protezione dei dati personali.
Celly is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has provided us with personal data, write to us and we will delete it.
If this policy changes, the new version is published at this address and the date at the top is updated. Where a change materially affects how your information is used, we will say so in the app.
The rules for using Celly, including subscriptions, are in the Terms of Use. This policy is also available in Italian. Both versions describe the same practices.