Tongue Lens
Privacy first

Privacy policy

How your photos, wellness insights, purchases, and technical app data are handled.

TONGUE LENS PRIVACY POLICY

Effective date: October 23, 2026

This policy explains how Tongue Lens handles your photos, wellness insights, purchases, and other data in the Tongue Lens iOS and Android apps, the Tongue Lens quiz on our website, and the Tongue Lens web app. Tongue Lens provides wellness reflections and lifestyle suggestions; it does not diagnose or treat medical conditions.

1. Who is responsible

The data controller is Mathias Gillitz (sole proprietor), Bahnhofstraße 6b, 84558 Kirchweidach, Germany. For privacy questions or requests, email support@tonguelens.com.

2. Your photos and insights

In the iOS and Android apps, scan photos, insights, scores, and your scan history are saved on your device. Device backups may include app data, depending on your settings. In the web app, scan photos, insights, scores, your scan history, and the age and gender you enter are saved in your browser's storage on that device, kept separately for each account signed in on that browser. We do not offer cloud storage or sync.

When you request an analysis, a copy of the photo is sent over an encrypted connection to our analysis service (hosted by Supabase), which forwards it to OpenAI and returns the insights. From the web app, the photo first passes through our web server (hosted by Vercel), which checks that your account has an active subscription and a scan left for the day. The request to OpenAI does not include your name, email address, age, gender, purchases, or advertising identifiers. Photos can reveal health-related information, so we analyze them only with your consent and only to create the analysis you asked for.

We do not store photos on our servers. For scans in the apps, we do not store the results either. For scans in the web app, we keep an encrypted copy of the result for 24 hours, so it can be delivered again if your connection drops, and then delete it; we also record the day on which your account used its scan, without the photo or result. Our hosting providers keep standard operational logs.

OpenAI does not use API data to train its models by default and may keep it for up to 30 days for abuse monitoring. See OpenAI's API data controls.

To prevent abuse, our analysis service counts requests per IP address. It stores only a keyed hash of the address, not the address itself, and deletes these counters automatically after a few days.

3. The quiz on our website

Your quiz answers stay in your browser tab. We do not send them to our servers or anyone else, and your browser deletes them when you close the tab.

The quiz asks for camera access only when you choose to take a photo; you can upload one instead. Your photo also stays in your browser tab: it is not uploaded or analyzed before you pay. After payment, it is passed to the web app in a part of the link that browsers do not send to servers, and the web app analyzes it as described in section 2.

When you enter your email address, we store it in our Supabase database together with the quiz page you started from (which can name a tongue sign, for example "white tongue"), the name of the ad source and campaign that brought you to us, and the date. We use these records to understand how many visitors reach our offer and to answer questions about your purchase. We do not send marketing emails to this address, and we delete these records after 12 months. Your email address is also used to set up your purchase and account (section 5).

To show prices in US dollars or euros, the quiz uses the country derived from your IP address by our hosting provider, or your browser language. We do not store this.

4. Onboarding statistics in the apps

While you go through onboarding in the iOS or Android app, the app sends anonymous statistics to our Supabase database: which onboarding screens were reached, your answers to "how did you hear about us", age range, and gender (if you provide them), the platform and app version, and the date. These records contain no name, account, device, or advertising identifier and are not linked to your scans or purchases. We use them to improve onboarding.

5. Accounts and purchases

In the apps, Apple or Google processes payments; we never see your card or bank details. RevenueCat validates purchases, restores access, and manages subscriptions using transaction details and an anonymous app user ID. The apps have no user accounts, and we do not send photos, insights, or onboarding answers to RevenueCat. See RevenueCat's privacy policy.

On the web, purchases belong to a Tongue Lens account identified by your email address. If you buy from the quiz with a new email address, the account is created when the payment succeeds and you are signed in on that browser. Otherwise, you sign in with a one-time code that we email to you. Supabase runs these accounts and stores your email address, when the account was created and last used, and technical sign-in logs, including IP addresses. Your browser keeps a sign-in cookie.

Stripe processes web payments; we never see your full card or bank details. Stripe receives your email address, payment details, and billing address, and creates invoices. We store your Stripe customer ID, your subscription status, the time zone used to count one scan per day, and the days on which you scanned. We do not send photos, insights, or quiz answers to Stripe. Stripe also uses payment data to prevent fraud and meet its own legal obligations as an independent controller. See Stripe's privacy policy.

Web subscriptions and app store subscriptions are separate: one does not unlock or cancel the other.

6. Analytics and advertising measurement

iOS app. To understand which ads bring new users, the iOS app shares technical data with advertising measurement providers. The Android app does not. The provider depends on your app version:

  • Version 0.0.9 includes the TikTok App Events SDK. It sends install, app-launch, purchase, and trial events (including product, price, and currency) to TikTok, together with technical data such as SDK identifiers, Apple's identifier for vendor (IDFV), IP address, and device and app information. This version does not ask for tracking permission and cannot access your advertising identifier (IDFA).
  • Version 0.0.10 and later use AppsFlyer instead. AppsFlyer receives installs, sessions, and trial or purchase events with technical data such as its own identifier, IDFV, the anonymous RevenueCat ID, IP address, and device and app information. RevenueCat sends AppsFlyer purchase and subscription events, including prices. The app asks for Apple's tracking permission (ATT). If you allow it, the IDFA can be used and conversion data shared with our advertising partner, currently TikTok. If you do not, there is no IDFA use and no device-level sharing with advertising partners; Apple's aggregated SKAdNetwork measurement still works.

Quiz website. Vercel Web Analytics counts page visits and quiz steps without cookies and without storing an identifier on your device. We also count how far visitors get through the quiz, checkout, and the first scan in the web app in our own database (Supabase): each screen reached is stored as a separate anonymous entry with the quiz page you started from, the advertising source and campaign named in the link, whether you use a phone or a computer, and the day. These entries contain no identifier, answers, email address, photo, or score, are never linked to each other or to you, and nothing is stored on your device for them; the purchase entry is added by our server when Stripe confirms the payment. If you came from a Google ad and buy, our server reports the purchase to Google Ads, so we can measure which ads lead to purchases: the click identifier Google added to the ad link, the amount, currency and time of the payment, and an order number, but no name, email address, answers or photo. Until it is sent, the click identifier is stored with the payment at our payment provider Stripe, for at most 90 days. We do this only for visitors outside the European Economic Area, the United Kingdom and Switzerland, and not when your browser sends a Global Privacy Control signal. Only if you accept in the consent banner, we also load Google (Google Analytics and Google Ads), Meta, and TikTok advertising tags, to measure which ads lead to quiz starts and completions, email sign-ups, checkouts, and purchases (including the amount, currency, and an order number).

These providers use cookies or similar identifiers and receive your IP address, browser information, and the address of the page you are on, which can name the tongue sign the page is about (for example /white-tongue). You can change your choice at any time with "Privacy settings" at the bottom of the quiz. The web app itself uses no analytics or advertising tags; it only adds the anonymous step counts described above for visitors coming from the quiz.

We never send photos, scores, insights, scan history, quiz or onboarding answers, or your email address to analytics or advertising providers. TikTok may use the data it receives for measurement and ad optimization as described in its Business Products (Data) Terms and privacy policy. See also the privacy policies of AppsFlyer, Google, and Meta.

7. Cookies and browser storage

The quiz and the web app store only what they need to work on your device: your quiz progress and photo (until you close the tab), your scan history and profile answers in the web app, your sign-in cookie, and your choice in the consent banner. Cookies and identifiers for analytics and advertising are set only with your consent, as described in section 6.

8. Legal bases

  • Explicit consent (GDPR Art. 6(1)(a) and 9(2)(a)) to analyze your tongue photo, which can reveal health-related information.
  • Consent (GDPR Art. 6(1)(a); in Germany also § 25(1) TDDDG) for the optional analytics and advertising tags on the quiz website and for tracking permission on iOS.
  • Performance of a contract (Art. 6(1)(b)) to provide your account, purchases, and the features you request.
  • Legal obligations (Art. 6(1)(c)) to keep payment and tax records.
  • Legitimate interests (Art. 6(1)(f)) for security and abuse prevention, onboarding statistics, cookieless website statistics, the quiz email records, measuring purchases from Google ads for visitors outside Europe, and advertising measurement in the iOS app without tracking permission.

You can withdraw consent at any time, for example by declining further scans or changing your privacy settings. This does not affect processing that took place before.

9. How long we keep data

  • Data on your device or in your browser: until you delete it.
  • Web app results on our servers: 24 hours, encrypted.
  • Web account, subscription status, and scan days: until you ask us to delete your account.
  • Payment and invoice records: as long as tax and commercial law requires (in Germany, generally up to 10 years).
  • Quiz email records: 12 months.
  • Abuse-prevention counters: a few days.
  • Support emails: as long as needed to handle your request and meet legal obligations.

Provider-held data, such as logs, is kept as described in their policies.

10. Your choices and rights

  • Delete your scan history at any time with "Delete Scan History" on the Profile screen in the apps or the web app, by uninstalling the app, or by clearing the website data in your browser.
  • Cancel app subscriptions through the App Store or Google Play. Cancel web subscriptions under "Subscription & billing" on the Profile screen of the web app. Deleting the app does not cancel a subscription.
  • To delete your web account, email us. We will also cancel an active web subscription when we delete the account.
  • Change camera, photo, and tracking permissions in your device or browser settings, and analytics and advertising choices with "Privacy settings" on the quiz website.

Deleting data in the app or browser does not delete records already held by us or our service providers. Contact us and we will help with those requests. Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing, to data portability, and to withdraw consent. You may also lodge a complaint with a data-protection authority. We do not sell your personal data.

11. Service providers and transfers

We use Supabase (analysis service, database, web accounts, and sign-in emails), Vercel (hosting for our website, the quiz, and the web app, and cookieless website statistics), OpenAI (AI analysis), Stripe (web payments), RevenueCat (app purchases), Google, Meta, and TikTok (advertising measurement on the quiz website, with your consent; Google Ads also for purchases from Google ads as described in section 6), AppsFlyer and TikTok (advertising measurement in the iOS app, as described above), and Apple and Google (app stores and operating systems). Some providers process data outside the European Economic Area, including in the United States, on the basis of the EU–U.S. Data Privacy Framework or the European Commission's standard contractual clauses, under their data-processing terms.

12. Security

All network requests from the apps, the quiz, and the web app are encrypted (HTTPS). Web app results kept on our servers are encrypted, and data on your device is protected by your operating system's and browser's security features. No system is completely secure.

13. Children

Tongue Lens is not intended for children under 16. Contact us if you believe a child has provided personal data to us.

14. Changes

We will update this policy when the apps, the website, our providers, or our data practices change, and update the effective date above. Where the law requires it, we will notify you or ask for your consent.

For questions, contact support@tonguelens.com.