Panly — Privacy Policy

Your beauty collection, the prices you paid, your photos and your spending history are stored on your iPhone, not on our servers. Two things do leave your device, and only with your knowledge: the single photo you take when you scan a product, which is read by a third-party AI service so the label can be identified, and — if you choose to sign in — a backup of your shelf held under your account. We do not sell your data, we do not use it for advertising, and we do not track you across other apps or websites. You can export everything, delete your account, or permanently erase everything from inside the app at any time.

Panly (“we”, “us”) is an iOS app for tracking the beauty products you already own and the money you spend on them. This policy explains what happens to your information when you use it. If anything here is unclear, email us at help@panly.app.

Nearly everything Panly knows about you never leaves your iPhone. This includes: the products in your collection, including brand, name, shade, size, category and expiry dates; prices you choose to enter (prices are always optional — “I don’t remember” is a valid answer, and Panly never invents a price you didn’t provide); product and progress photos you take or import; your usage history, empties, challenges, Project Pan goals and wishlist; your answers during setup — spending baseline, goals, purchase habits — and the savings figures calculated from them. This information is held in the app’s private storage on your device and in your own iCloud device backup if you have backups enabled. We have no ability to read it, and it is not uploaded to us in bulk.

Recognising a product happens in the cloud, not on your phone, and involves third-party AI providers. A photograph is transmitted only at the moment you take a scan. Scanning is optional: every product can be added by hand instead, and if you revoke camera and photo access in iOS Settings, nothing is ever transmitted and the rest of the app continues to work.

Scanning a product happens in up to three steps. Each step only runs if the one before it did not already identify the product:

1. Barcode. If a barcode is visible, your iPhone reads it on the device itself. Nothing is transmitted for this step.
2. Reading the label (AI). A single photograph of that product is transmitted over an encrypted connection to Google’s Gemini AI models, reached through our infrastructure provider Rork, so the brand, product name, shade and size can be read from the packaging and returned to you.
3. Looking the product up (AI). If the product name still could not be established, a short text description is sent to the AI search provider Perplexity, again through Rork, so the product can be identified. This description contains only what was observed about the product itself: the barcode if one was read, the brand, any text legible on the packaging, and a physical description of the packaging such as its shape and colour. No photograph is sent in this step.

Additionally: only the one image needed for that scan is transmitted, at the moment you scan; the image and the lookup description are used to return a result to you — they are not retained afterwards, not attached to your identity, and not used to train models; your collection, prices, savings figures and other photos are never sent as part of a scan or a lookup; the lookup step is skipped entirely whenever the label alone was enough; nothing is transmitted for a scan you do not take. Label reading is carried out by Google (Gemini) and the product lookup by Perplexity, both reached through our infrastructure provider Rork and acting on our instructions as processors. They may process this information on servers outside your country, including in the United States. Panly shows you where each detail came from — read from the label, found online, or entered by you — and leaves a field blank rather than guessing at it.

Panly can be used entirely without an account. After subscribing, you are offered the option to sign in with Apple or Google so your shelf survives a lost or replaced phone. Signing in is optional and can be skipped; nothing is withheld if you do.

If you do sign in, we store on our servers (hosted with Supabase, on our behalf): the account identifier issued by Apple or Google, your email address, and the name and profile picture they provide; the display name you choose in the app, your currency and your language setting; a backup of your shelf — products, empties, purchases, challenges, wishlist and setup answers — together with the device name and the time it was last saved. Product photographs are not part of this backup; they stay on your device. These records are protected so that only your own account can read them. They are used to restore your shelf, to keep your name in the app, and to count how many people use Panly. They are never sold, never used for advertising and never shared with advertisers.

You can delete your account from inside the app at any time: Profile → Delete account. This permanently erases your account record and your cloud backup from our servers, disconnects the Apple or Google sign-in, and erases the collection, photos, history and settings held on your device. It takes effect immediately and cannot be undone. Your App Store subscription is held by Apple, not by us, and is not cancelled by deleting your account — cancel it in your Apple ID settings if you wish it to stop. If you would rather we did it for you, email help@panly.app and we will action it within 30 days.

Panly is a paid subscription app. We never see or receive your payment details — all payments are handled by Apple through your App Store account. To know whether your subscription is active, we use RevenueCat, a subscription management provider. RevenueCat receives a randomly generated identifier for your installation, together with the purchase, renewal and trial information Apple returns. This is used only to confirm your access, keep it working when you reinstall or change device, and produce anonymous revenue statistics. It is not linked to your name or email address, and it is never used for advertising.

Panly records anonymous events describing how the app is used — for example that an onboarding screen was reached or a subscription screen was viewed. These are written to your device’s own system log to help diagnose problems. They describe interactions with the app rather than the contents of your collection, they are not tied to your identity, and at present they are not transmitted to us or to any third party. If we ever introduce an analytics provider, we will update this policy and tell you in the app before doing so.

If you allow notifications, reminders are scheduled locally on your device — for weekly summaries, expiry warnings, challenge milestones and wishlist cooling-off periods. Their contents are generated on your device and are not sent through our servers. You can turn any category off in the app, or all of them in iOS Settings.

We do not sell or rent your personal information. We do not use your data for advertising, and we do not track you across other apps or websites. We do not post anything on your behalf — share cards are created on your device only when you tap share, contain only what is shown in the preview, and you choose where they go; they are never uploaded to us. We do not require an account, a name or an email address to use the app. We do not send anything to an AI provider beyond the single scan you took, and never your collection, prices or other photos.

Export: Profile → Your data → Export my data produces a complete, readable copy of everything Panly holds. Erase: Profile → Your data → Delete all my data permanently removes your collection, photos, history and setup answers from your device; this cannot be undone. Delete your account: Profile → Delete account erases your account, your cloud backup and your device data together. AI scanning: revoke camera and photo access at any time in iOS Settings and no photograph can be transmitted — manual entry continues to work. Subscription: manage or cancel at any time in your Apple ID settings. Deleting the app removes the data stored on your device. If you would like us to confirm deletion of the anonymous subscription record held by RevenueCat, email help@panly.app.

Data on your device is kept until you delete it or remove the app. Account records and shelf backups are kept until you delete your account, after which they are removed from our production systems immediately and from routine encrypted backups within 30 days. Scan images are not retained after a result is returned. Anonymous subscription records are kept by RevenueCat for as long as needed to honour your access and meet accounting obligations.

Panly is not directed at children under 13, and we do not knowingly collect information from them.

Depending on where you live, you may have the right to access, correct, export or erase your personal information, or to object to certain processing. Because your data lives on your device, the export and erase tools in the app satisfy most of these requests immediately. For anything else, contact help@panly.app and we will respond within 30 days.

Our providers may process the limited information described above on servers outside your country, including in the United States, under safeguards required by applicable law.

If we make a material change, we will update the date at the top of this page and, where the change is significant, tell you in the app.

Questions about privacy: help@panly.app.