Privacy Policy

1. Who we are

Locy is operated by Fauiin, based in Pennsylvania, United States. For privacy questions or requests, contact hello@fauiin.com.

2. Data we collect

Depending on how you use Locy, we may collect:

• Account information. Email address, authentication credentials, and sign-in identifiers when you create an account with email/password (including one-time verification codes), Sign in with Apple, or Google Sign-In.
• Guest sessions. You can start using Locy as a guest (anonymous session) before creating a full account. Guest data may later be migrated onto the account you create.
• Loc profile. Information you provide about your loc journey, such as start date, stage, hair type, porosity, scalp tags, self-reported climate category, goals, loc method, loc count, retwist preferences, and related profile settings.
• App preferences. Theme, language, photo-sort order, and similar settings you choose in the app.
• Progress and care data. Check-ins, care routines, retwist events, journey stats, badges, learn progress, personal product shelf and favorites, challenge participation, and similar content you save in the app.
• Photos and videos. Journey photos and videos you choose to capture or upload, companion chat photos, captions or notes you add, and related metadata needed to store and display them (for example capture time, stage tags, and video duration). Video recording may use the microphone while you record.
• Companion and AI content. Messages you send to the AI companion, conversation history, companion state, and durable memory notes the companion stores (for example allergies or preferences you share). We also store your AI photo-analysis consent status.
• Product scanning. Scan-related records such as identified product references, ingredient analysis results, scan history, and optional “wrong result” reports (metadata only, not photos). Scanning uses a photo of the product front, not a live barcode reader. The identification photo is sent to our AI processor (OpenAI) to read the label and is not kept as a general archive. If a scan has no catalog photo, we may keep your scan photo in your scan history until you delete that scan or your account.
• Purchases. Subscription and entitlement status for Locy Plus (including activation time), free-scan usage counts, and trial eligibility signals. Purchases are processed through Apple In-App Purchase and RevenueCat. We do not receive your full payment card number.
• Device identifiers. A vendor or device identifier (on iOS, Identifier for Vendor; on Android, Android ID) used to limit free-scan quota reuse and trial reuse after account deletion or recreation. We may also send this identifier to RevenueCat as an entitlement attribute. It is not a precise location, advertising ID, or tracking ID for ads.
• Device and permissions. Information needed to run the app when you grant permissions (camera, photo library, microphone for journey video, and local notifications). We do not collect device GPS location for Locy.
• Analytics. Product usage events via PostHog, as described below, including unredacted session-replay screenshots of Locy-owned interface content.
• Crash and diagnostic data. In production, crash reports and limited performance traces via Sentry, such as stack traces, device/OS/app version, and navigation context. We do not attach your account identifier or default personal information (for example IP address) to those reports. We do not use Sentry session replay.

3. How we use data

We use information to:

• Provide, maintain, and improve Locy’s features
• Authenticate you, secure accounts, and migrate guest data when you create an account
• Personalize your loc journey, routines, and companion experience (including companion memory)
• Process AI companion chat, and companion photo analysis when you consent
• Identify product-front photos and look up product information for scanning and catalog features
• Enforce free-scan limits and trial eligibility, including on a per-device basis
• Manage subscriptions and restore purchases
• Attribute shop links with an affiliate tag when you choose to open them (we do not send your account profile to Amazon)
• Understand product usage and fix issues (including analytics and unredacted session replay)
• Diagnose crashes and stability issues
• Respond to support requests and enforce our Terms
• Comply with law and protect against abuse or fraud

4. Service providers

We use trusted companies to operate Locy. They process data only as needed to provide their services to us:

• Supabase — authentication, database, and file storage (including photos and videos)
• Apple and Google — sign-in and, for Apple, App Store billing
• RevenueCat — subscription entitlement management
• OpenAI — AI model processing for companion chat, companion photo analysis, and product-front scan identification
• Sentry — crash reporting and limited performance traces (United States ingest)
• Open Beauty Facts — product catalog lookup for scanning
• PostHog — product analytics and unredacted session replay (United States cloud)
• Expo — over-the-air app updates
• Cloudflare — hosting for fauiin.com, including these legal pages

If you tap a Shop link, your device opens Amazon (or another retailer) in a browser. Amazon then receives whatever that visit would normally send (for example the product URL and an affiliate tag). We do not upload your Locy profile, photos, or chat history to Amazon.

These providers may process data in the United States or other countries where they operate.

5. Analytics and crash reporting

We use PostHog (United States cloud) to understand how people use Locy and to fix issues. This includes product analytics events such as sign-in and sign-up, onboarding completion, routine logging, paywall views and purchases, companion feature events, learn-content opens, photo capture, and screen paths as you move through the app.

We also enable limited touch autocapture (for example taps on a constrained set of interface elements) so we can see which controls people use. After you sign in, analytics events may be associated with your account identifier.

We use PostHog session replay to understand product issues and improve Locy. Replay records screenshots of in-app interaction without redacting Locy-owned interface content. This can include typed account credentials, profile details, routines and care notes, journey media and captions, companion conversations and attachments, scan content and results, settings values, onboarding answers, and Locy paywall and restore-purchase screens. iOS-controlled system views, such as some system pickers and payment sheets, may remain masked or unavailable to replay capture.

Replay is enabled for Locy sessions and may be associated with your account identifier after sign-in. Replay is enabled for all Locy sessions and does not offer an in-app opt-out. We retain replay recordings for up to 30 days. Access is limited to the Locy product owner for product investigation; we do not routinely export recordings. Analytics and replay are configured to operate and improve Locy, not to sell your data or show third-party ads.

We use Sentry in production builds to capture crashes and a small sample of performance traces. Reports may include stack traces, device/OS/app version, and navigation context. We do not attach your account identifier or default personal information, and we do not use Sentry session replay.

6. AI and photos

When you use Scan, the product-front photo is sent to our AI processor (OpenAI) to read the label. That is part of using the scanner; it is not the same as Companion photo analysis and does not use the Companion consent screen.

When you use the AI companion, relevant text may be sent to OpenAI to generate responses. Sending a photo in Companion chat for analysis requires your explicit consent in the app. Companion memory notes you share (or that the companion stores with you) are kept so later chats can stay consistent; you can review and manage them in the app.

We do not sell your photos. We do not use your photos, videos, or chat content to train our own models, and we do not sell or license them for training. OpenAI processes them to generate a response under OpenAI’s terms.

AI features are for general informational and personal tracking use only. They are not medical, dermatological, or professional loctician advice. See our Terms of Service for the full disclaimer.

7. Affiliate and external links

Some Shop actions in Locy open Amazon (or another retailer) using an affiliate link. If you buy something after following that link, we may earn a commission at no extra cost to you. Product ratings and loc-compatibility notes in Locy are editorial; they are not paid placements and do not change because of commissions.

When you leave Locy for a third-party site, that site’s privacy practices apply. We are not responsible for those sites.

8. Notifications

If you allow notifications, Locy schedules local reminders on your device for care routines and related prompts. We do not collect or store a remote push-notification token for Locy.

Reminder on/off state and the time of day you choose may be stored with your account so the schedule can follow you across devices. Notification permission status itself stays on the device.

9. Sale and advertising

We do not sell your personal information. We do not show third-party advertising in Locy. We do not use your progress photos or videos for advertising. Affiliate commissions from shop links are not a sale of your personal information.

10. Retention and deletion

We keep your information while your account is active and as needed to provide Locy. You can delete your account and associated data from Settings in the app, or by emailing hello@fauiin.com. Deleting your account in Settings erases your Locy account data promptly (journey content, companion history, scan history, and stored photos and videos).

After deletion we may retain limited records as needed for security, fraud prevention, legal compliance, or subscription/tax records we do not fully control (for example Apple or RevenueCat purchase history). Our systems may keep a hashed email tombstone so a deleted account cannot be trivially recreated for abuse. Device-linked scan-quota and trial records may also remain so free-scan and trial limits cannot be reset by deleting and recreating an account on the same device. The in-app delete button does not wipe PostHog analytics, session replay, OpenAI processing logs, or Sentry crash reports; session replay expires within 30 days, and leftover cleanup at providers we do not control may take longer.

11. Children

Locy is intended for users age 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact hello@fauiin.com and we will take appropriate steps to delete it.

12. Your privacy rights

Depending on where you live, you may have rights to access, correct, or delete personal information, or to appeal a decision about a privacy request. To exercise these rights, use in-app deletion where available or email hello@fauiin.com.

We do not sell personal information. If a law defines “sharing” for cross-context behavioral advertising, we do not engage in that practice for Locy. We do use product analytics as described above to operate and improve the product.

This section is a practical summary of how to reach us. It does not claim that Fauiin meets every statutory definition of a regulated “business” under every state privacy law.

13. International transfers

Fauiin operates in the United States. If you use Locy from another country, your information may be processed in the United States and other locations where our providers operate.

14. Changes

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. If changes are material, we may provide additional notice in the app or by other reasonable means.

15. Contact

Fauiin
Pennsylvania, United States
hello@fauiin.com

Related: Terms of Service