Privacy Policy

1. Who we are

Locy is operated by Fauiin, based in Pennsylvania, United States. For privacy questions or requests, contact hello@fauiin.com.

2. Data we collect

Depending on how you use Locy, we may collect:

• Account information. Email address, authentication credentials, and sign-in identifiers when you create an account with email/password (including one-time verification codes), Sign in with Apple, or Google Sign-In.
• Guest sessions. You can start using Locy as a guest (anonymous session) before creating a full account. Guest data may later be migrated onto the account you create.
• Loc profile. Information you provide about your loc journey, such as start date, stage, hair type, porosity, scalp tags, self-reported climate category, goals, loc method, loc count, retwist preferences, and related profile settings.
• App preferences. Theme, language, photo-sort order, and similar settings you choose in the app.
• Progress and care data. Check-ins, care routines, retwist events, journey stats, badges, learn progress, personal product shelf and favorites, challenge participation, and similar content you save in the app.
• Photos and videos. Journey photos and videos you capture or upload, product photos you add to your shelf, scan photos, companion chat photos, and the notes and scalp tags you add to them. By default, journey, product, and scan photos and their notes stay on your iPhone and we receive only basic details about each journey photo (an identifier, capture date, stage, milestone flag, media type, and video length). We store the photos themselves only if you turn on Locy backup or send them to the companion; see Where your photos are kept. Video recording may use the microphone while you record.
• Journal entries. Dated, text-only entries you write in your Journey (for example what changed, what you used, or how your locs felt). They follow the same rule as photo notes: by default the words stay on your iPhone and we receive only each entry’s identifier and date. If you turn on Locy backup, the words are stored in your Locy account too.
• Companion and AI content. Messages you send to the AI companion, conversation history, companion state, and durable memory notes the companion stores (for example allergies or preferences you share). We also store your AI photo-analysis consent status.
• Product scanning. Scan-related records such as identified product references, ingredient analysis results, scan history, and optional “wrong result” reports (metadata only, not photos). Scanning uses a photo of the product front, not a live barcode reader. The identification photo is sent to our AI processor (OpenAI) to read the label and is not kept as a general archive. If a scan has no catalog photo, your scan photo is kept in your scan history: on your iPhone by default, or in your Locy account if you turn on Locy backup.
• Purchases. Subscription and entitlement status for Locy Plus (including activation time), free-scan usage counts, and trial eligibility signals. Purchases are processed through Apple In-App Purchase and RevenueCat. We do not receive your full payment card number.
• Device identifiers. A vendor or device identifier (on iOS, Identifier for Vendor; on Android, Android ID) used to limit free-scan quota reuse and trial reuse after account deletion or recreation. We may also send this identifier to RevenueCat as an entitlement attribute. This quota and trial use is separate from optional advertising measurement described below. It is not precise GPS location.
• Optional advertising measurement. With your App Tracking Transparency permission, TikTok receives install and open activity, advertising/vendor and SDK/session identifiers, IP address, locale, and technical device/app metadata. TikTok may infer approximate location from your IP address. See section 10 for the consent controls, limits, and third-party use of this data.
• Device and permissions. Information needed to run the app when you grant permissions (camera, photo library, microphone for journey video, local notifications, and optional App Tracking Transparency permission for ad measurement). We do not collect device GPS location for Locy.
• Analytics. Product usage events via PostHog, as described below, including partly masked session-replay screenshots of Locy-owned interface content.
• Crash and diagnostic data. In production, crash reports and limited performance traces via Sentry, such as stack traces, device/OS/app version, and navigation context. We do not attach your account identifier or default personal information (for example IP address) to those reports. We do not use Sentry session replay.

3. Where your photos are kept

On your iPhone by default. Journey photos and videos, product photos, and scan photos, along with their notes and scalp tags, and your journal entries, are saved on your iPhone. If iCloud Backup is on, they are included in your iPhone’s backup, which Apple stores under your Apple Account and Apple’s terms. We cannot access that backup. In this mode Locy does not keep a copy, so if you lose your iPhone without a backup, we cannot restore them. Locy only syncs the basic details listed above so that your timeline, stages, and stats work across sign-ins.

Locy backup (optional). If you turn on Locy backup in Settings → Your data, your photos and videos, with their notes and scalp tags, and your journal entries, are stored privately in your Locy account with our storage provider (Supabase) so they return when you sign in on a new phone. Accounts that already backed up photos with Locy before on-device storage was introduced stay on Locy backup until you turn it off. Turning it off downloads each photo and video to your iPhone, checks it, and only then deletes it from Locy.

Companion photos. A photo you send in Companion chat is uploaded so OpenAI can analyze it, then deleted from our servers once the companion’s reply is saved. If a reply fails or the photo could not be analyzed, we keep the photo so you can try again; it is deleted when you delete your account. Companion photos sent with earlier versions of Locy remain stored until you delete your account or ask us to remove them. Your iPhone keeps its own copy so the conversation still shows the photo; deleting the conversation removes that copy.

Keeping a copy. In Settings → Your data you can save your journey photos and videos to your Photos library and save your journey details (dates, stages, notes, journal entries, check-ins, and routines) as a file you choose where to keep. You can also turn on Keep a copy in Photos (off unless you turn it on), which saves each new journey photo and video to your Photos library as you add it. Those copies are outside Locy and are not affected when you delete your account.

Bringing your journey back. Deleting the Locy app removes the photos and videos it kept on your iPhone. So that you can get them back, Locy keeps a small private index in your iPhone’s Keychain: for each journey photo, which item in your Photos library holds its copy (the copy you saved, or the original you picked it from), along with that photo’s notes and scalp tags, plus your journal entries. The index stays on that iPhone only. It is not included in backups, not synced to other devices, and never sent to Locy, and it remains if you delete the app. If you install Locy again and sign in, Bring back from Photos uses it to copy your saved photos and videos from your Photos library back into Locy. This needs your permission to view your Photos library, happens entirely on your iPhone, and uploads nothing. Deleting your account in the app erases the index.

4. How we use data

We use information to:

• Provide, maintain, and improve Locy’s features
• Back up your photos and videos when you turn on Locy backup
• Authenticate you, secure accounts, and migrate guest data when you create an account
• Personalize your loc journey, routines, and companion experience (including companion memory)
• Process AI companion chat, and companion photo analysis when you consent
• Identify product-front photos and look up product information for scanning and catalog features
• Enforce free-scan limits and trial eligibility, including on a per-device basis
• Manage subscriptions and restore purchases
• Attribute shop links with an affiliate tag when you choose to open them (we do not send your account profile to Amazon)
• Understand product usage and fix issues (including analytics and partly masked session replay)
• Diagnose crashes and stability issues
• Measure Locy advertising installs and opens with TikTok when you allow tracking
• Respond to support requests and enforce our Terms
• Comply with law and protect against abuse or fraud

5. Service providers

We use companies to operate Locy and provide our services. Their roles include:

• Supabase — authentication, database, and file storage (photos and videos when you turn on Locy backup, and companion photos until they are analyzed)
• Apple and Google — sign-in and, for Apple, App Store billing
• RevenueCat — subscription entitlement management
• OpenAI — AI model processing for companion chat, companion photo analysis, and product-front scan identification
• Sentry — crash reporting and limited performance traces (United States ingest)
• Open Beauty Facts — product catalog lookup for scanning
• PostHog — product analytics and partly masked session replay (United States cloud)
• Expo — over-the-air app updates
• Cloudflare — hosting for fauiin.com, including these legal pages

If you tap a Shop link, your device opens Amazon (or another retailer) in a browser. Amazon then receives whatever that visit would normally send (for example the product URL and an affiliate tag). We do not upload your Locy profile, photos, or chat history to Amazon.

These providers may process data in the United States or other countries where they operate.

6. Analytics and crash reporting

We use PostHog (United States cloud) to understand how people use Locy and to fix issues. This includes product analytics events such as sign-in and sign-up, onboarding completion, routine logging, paywall views and purchases, companion feature events, learn-content opens, photo capture, and screen paths as you move through the app.

We also enable limited touch autocapture (for example taps on a constrained set of interface elements) so we can see which controls people use. After you sign in, analytics events may be associated with your account identifier.

We use PostHog session replay to understand product issues and improve Locy. Replay records screenshots of in-app interaction. In current versions of Locy, every image (including your journey photos and videos, product photos, and scan photos), everything you type, the companion screens, and your journey notes and journal entries are masked before a screenshot leaves your device. Other text Locy shows on screen is not masked and can appear in replay, such as profile details, routine names, check-ins, scan results, settings values, onboarding answers, and Locy paywall and restore-purchase screens. Earlier versions of Locy recorded these screens without masking, including journey media, typed text, and companion conversations. iOS-controlled system views, such as some system pickers and payment sheets, may remain masked or unavailable to replay capture.

Replay is enabled for Locy sessions and may be associated with your account identifier after sign-in. Replay is enabled for all Locy sessions and does not offer an in-app opt-out. We retain replay recordings for up to 30 days. Access is limited to the Locy product owner for product investigation; we do not routinely export recordings. Analytics and replay are configured to operate and improve Locy, not to sell your data or show third-party ads.

We use Sentry in production builds to capture crashes and a small sample of performance traces. Reports may include stack traces, device/OS/app version, and navigation context. We do not attach your account identifier or default personal information, and we do not use Sentry session replay.

7. AI and photos

When you use Scan, the product-front photo is sent to our AI processor (OpenAI) to read the label. That is part of using the scanner; it is not the same as Companion photo analysis and does not use the Companion consent screen.

When you use the AI companion, relevant text may be sent to OpenAI to generate responses. Sending a photo in Companion chat for analysis requires your explicit consent in the app, and the photo is deleted from our servers once the companion has replied (see Where your photos are kept). Your most recent journal entries and photo notes (up to 12, each shortened) are sent with each message so the companion can take them into account; they are used for that reply and Locy does not store them as part of the conversation. Companion memory notes you share (or that the companion stores with you) are kept so later chats can stay consistent; you can review and manage them in the app.

We do not sell your photos. We do not use your photos, videos, or chat content to train our own models, and we do not sell or license them for training. OpenAI processes them to generate a response under OpenAI’s terms.

AI features are for general informational and personal tracking use only. They are not medical, dermatological, or professional loctician advice. See our Terms of Service for the full disclaimer.

8. Affiliate and external links

Some Shop actions in Locy open Amazon (or another retailer) using an affiliate link. If you buy something after following that link, we may earn a commission at no extra cost to you. Product ratings and loc-compatibility notes in Locy are editorial; they are not paid placements and do not change because of commissions.

When you leave Locy for a third-party site, that site’s privacy practices apply. We are not responsible for those sites.

9. Notifications

If you allow notifications, Locy schedules local reminders on your device for care routines and related prompts. We do not collect or store a remote push-notification token for Locy.

Reminder on/off state and the time of day you choose may be stored with your account so the schedule can follow you across devices. Notification permission status itself stays on the device.

10. Advertising measurement and your choice

We do not sell your personal information for money. With your permission, advertising measurement involves sharing device and app activity as described below; applicable laws may classify that sharing as a sale or sharing even without a monetary payment. We do not show third-party advertising in Locy or use your journey photos or videos to advertise. Affiliate commissions from shop links do not involve sharing your Locy profile with the retailer.

Versions of Locy with TikTok advertising measurement enabled ask for Apple’s App Tracking Transparency permission after onboarding, once the main app is visible. If you allow tracking, TikTok’s App Events SDK receives app install and open activity to measure our ads. This sharing can constitute “sharing” for cross-context advertising under applicable privacy laws. TikTok can link this activity with data it has from other services for advertising measurement.

Along with installs and opens, the SDK sends device and technical metadata: the advertising identifier (IDFA), vendor identifier (IDFV), SDK-generated anonymous and session identifiers, IP address, locale, device model, user agent, OS and app versions, SDK version, timestamps, session context, and tracking-permission status. TikTok may infer approximate location from your IP address; Locy does not send precise GPS location to TikTok. We do not provide TikTok your Locy account identifier, email, profile, photos, videos, conversations, product scans, purchases, or subscription information. Automatic purchase and retention events, enhanced page-data reporting, Advanced Matching, and separate SDK monitor events are disabled.

Denied, restricted, or undecided permission means no direct TikTok SDK reporting. You can change your choice in iPhone Settings → Privacy & Security → Tracking → Locy. Revoking permission stops new direct reporting and clears pending SDK events; it cannot recall information already sent. Advertising permission is separate from AI photo consent and does not affect access to Locy’s features.

Apple’s aggregate app attribution system (SKAdNetwork) may also measure advertising without disclosing your advertising identifier to us. TikTok’s handling of received information is described in its Privacy Policy and Business Products Terms. For advertising privacy or deletion requests, contact hello@fauiin.com.

11. Retention and deletion

We keep your information while your account is active and as needed to provide Locy. You can delete your account and associated data from Settings in the app, or by emailing hello@fauiin.com. Deleting your account in Settings erases your Locy account data promptly (journey content, companion history, scan history, and stored photos and videos) and also erases the photos and videos Locy kept for that account on the iPhone you delete it from, along with the private index Locy keeps in that iPhone’s Keychain (described in section 3). Deleting the app alone does not erase that index. Signing out does not erase your photos and videos; they stay on that iPhone so they are there when you sign back in. Copies already in an iCloud Backup, or that you saved to Photos or Files, are outside Locy’s control and are not erased.

After deletion we may retain limited records as needed for security, fraud prevention, legal compliance, or subscription/tax records we do not fully control (for example Apple or RevenueCat purchase history). Our systems may keep a hashed email tombstone so a deleted account cannot be trivially recreated for abuse. Device-linked scan-quota and trial records may also remain so free-scan and trial limits cannot be reset by deleting and recreating an account on the same device. The in-app delete button does not wipe PostHog analytics, session replay, OpenAI processing logs, or Sentry crash reports; session replay expires within 30 days, and leftover cleanup at providers we do not control may take longer. TikTok measurement data already received is also outside the in-app account deletion process; contact us for help with a provider privacy request. We do not promise a specific TikTok retention period or automatic deletion when you delete your Locy account.

12. Children

Locy is intended for users age 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact hello@fauiin.com and we will take appropriate steps to delete it.

13. Your privacy rights

Depending on where you live, you may have rights to access, correct, or delete personal information, or to appeal a decision about a privacy request. To exercise these rights, use in-app deletion where available or email hello@fauiin.com. You can save a copy of your journey photos, videos, and details at any time from Settings → Your data.

TikTok advertising measurement may constitute “sharing” under applicable privacy laws, as described above. You can opt out by denying or revoking Locy’s tracking permission in iPhone Settings; this is also our advertising measurement opt-out. You can also email hello@fauiin.com with an advertising privacy request. Contact us to exercise other applicable advertising privacy rights. We also use product analytics as described above to operate and improve Locy.

This section is a practical summary of how to reach us. It does not claim that Fauiin meets every statutory definition of a regulated “business” under every state privacy law.

14. International transfers

Fauiin operates in the United States. If you use Locy from another country, your information may be processed in the United States and other locations where our providers operate.

15. Changes

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. If changes are material, we may provide additional notice in the app or by other reasonable means.

16. Contact

Fauiin
Pennsylvania, United States
hello@fauiin.com

Related: Terms of Service