Last updated: April 18, 2026 My Skin Day (“we”, “our”, “the App”) is a mobile skincare application developed by Filip Bojda (sole proprietor). We are committed to protecting your privacy and handling your personal data transparently, in full compliance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and applicable data protection laws. This Privacy Policy explains what data we collect, why we collect it, how we use it, and what rights you have regarding your personal information. 1. Data Controller The data controller for My Skin Day is: Filip Bojda Email: [email protected] Website: myskinday.com 2. Data We Collect 2.1 Account Data • Email address (if you sign up with email) • Apple ID identifier (if you sign in with Apple) • Authentication provider type 2.2 Profile Data • Age range • Skin type (oily, dry, combination, normal, sensitive) • Skin concerns (acne, wrinkles, dark spots, redness, etc.) • Language preference 2.3 Biometric Data (Special Category — GDPR Article 9) Important: We process facial photographs to analyze your skin condition using artificial intelligence. This constitutes biometric data processing under GDPR Article 9. We request your explicit consent before any analysis takes place. You can withdraw consent at any time. • Facial photographs taken via the device camera • AI-derived skin scores (hydration, redness, imperfections, pores, wrinkles) • Skin analysis history and progress data

2.4 Usage Data • App usage patterns (screens visited, features used) • Skin journal entries • Routine completion data • Subscription status 2.5 Device & Technical Data • Device type and operating system version • Anonymous device identifier • Approximate location (for weather-based skincare recommendations only, with your permission) 3. How We Use Your Data We use your data for the following purposes: • AI Skin Analysis: Facial photos are processed by our AI engine to generate skin condition scores and personalized recommendations. • Personalized Skincare Routines: Your profile and analysis history help us adapt your daily skincare routine. • Progress Tracking: Analysis results are stored to show your skin’s evolution over time. • Weather Adaptation: Location data (when permitted) is used to fetch weather conditions and adjust skincare advice. • Subscription Management: To manage your premium subscription via RevenueCat. • App Improvement: Anonymized usage patterns help us improve the app experience. 4. Legal Basis for Processing (GDPR Article 6 & 9) • Explicit Consent (Art. 6(1)(a) and Art. 9(2)(a)): For biometric data processing (facial photos and skin analysis). You provide this consent via our dedicated biometric consent screen. • Contract Performance (Art. 6(1)(b)): For account management, providing the app’s core features, and subscription services. • Legitimate Interest (Art. 6(1)(f)): For app improvement, security, and fraud prevention. 5. Photo Processing & Storage Real-time analysis: Your facial photos are analyzed in real-time by our AI service. Photos are transmitted securely for analysis and are not permanently stored on our servers. Analysis results (numerical scores and text recommendations) are stored locally on your device and synced to your account. 6. Data Storage & Security 6.1 Local Storage: Analysis results, routines, and journal entries are stored locally on your device. 6.2 Cloud Sync: Account data, profile, and analysis history are synced to our cloud infrastructure hosted by Supabase (servers located in the EU). Data is encrypted in transit (TLS 1.2+) and at rest. 6.3 Payment Processing: Subscription payments are handled entirely by Apple (App Store) and RevenueCat. We never access or store your payment information. 7. Data Sharing We do not sell your personal data. We share data only with the following service providers, strictly for the purposes described: • Supabase (EU) — Authentication and database hosting • RevenueCat (USA) — Subscription management (anonymous purchase data only) • OpenAI (USA) — AI vision analysis (photos are processed and not retained by OpenAI per their API data usage policy) • Open-Meteo (EU) — Weather data (location coordinates only, no personal data) For transfers to the USA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission.8. Data Retention • Account data: Retained as long as your account is active. • Analysis history: Retained as long as your account is active, or until you delete it. • Facial photos: Not permanently stored. Processed in real-time and discarded after analysis. • After account deletion: All personal data is deleted within 30 days, except data we are legally required to retain. 9. Your Rights (GDPR Articles 15–22) You have the following rights regarding your personal data: • Right of Access (Art. 15): Request a copy of your personal data. • Right to Rectification (Art. 16): Correct inaccurate data. • Right to Erasure (Art. 17): Request deletion of your data (“right to be forgotten”). • Right to Restriction (Art. 18): Restrict processing of your data. • Right to Data Portability (Art. 20): Receive your data in a machine-readable format. • Right to Object (Art. 21): Object to processing based on legitimate interest. • Right to Withdraw Consent (Art. 7(3)): Withdraw your consent at any time, without affecting the lawfulness of prior processing. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority. 10. Children’s Privacy My Skin Day is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. An age verification gate is presented upon first use. If we become aware that we have collected data from a child under 16, we will promptly delete it. 11. Cookies & Tracking My Skin Day is a mobile application and does not use browser cookies. We do not engage in cross-app tracking. The app uses Apple’s App Tracking Transparency framework, and tracking is only enabled with your explicit permission. 12. Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of any material changes via the app or email. The “Last updated” date at the top of this policy indicates when it was last revised. 13. Contact Us For any questions or concerns about this Privacy Policy or your personal data, please contact: Filip Bojda — Data Protection Officer Email: [email protected] © 2026 My Skin Day. All rights reserved.