Serum Privacy Policy

Serum is made by ChesKat Enterprises, LLC ("we", "us"), a Colorado limited liability company. This policy explains what Serum does with your information.

Serum is offered in the United States only.

The short version

Your products, your notes, your tags and your photos are stored on your iPhone. We have no account system, no server holding your shelf, and no way to look at it.

Serum does send us usage data: the kinds of products you own and how your routine goes. It is not tied to your name, your email address, or any account you hold with us, and it never includes your notes or your photos. The switch for it is on the first screen you see, pre-set to on, and nothing is sent until you accept that screen. You can turn it off there or at any time afterwards.

One thing to know: the data is stored in Apple's CloudKit, and Apple attaches to every record an identifier for the iCloud account that saved it. We explain what that does and does not mean below.

Serum records nothing about your body — not your skin type, not whether your skin is sensitive, nothing. One optional question, your age band, is off by default and only ever sent if you switch it on.

We do not sell your personal information, and we do not share individual records, except in the three cases described under "When a record may leave our hands" below. We may publish statistics about groups of users; see "What we do with it" below.

What Serum stores on your device

• Products you add: name, brand, category, ingredients, how full the bottle is, and any photo you attach.
• Your ritual: the schedule Serum builds from those products.
• Routines you complete: which sessions you finished, and when.
• Journal entries: photos, notes, and tags you save after a routine.
• Spa sessions: home rituals and professional treatments you log, including the provider name if you enter one.
• Preferences: reminder times, your chosen ritual, and your privacy choices.

All of it lives in Serum's private storage on your device. Serum does not copy this store to iCloud.

Usage data

Your choice, and how to change it

The switch is on the first screen, labelled Help improve Serum, beside the safety information, pre-set to on, so that accepting that screen is a deliberate choice about both. Nothing is recorded or sent until you accept that screen.

You can turn it off at that moment, or at any time afterwards: open Serum, tap the lock icon on the Today screen, and switch off Share usage data, which is the same switch under its later name.

What is sent

For each thing that happens, one record containing only:

• What kind of event it was: that Serum was opened for the first time; a product added, edited, used up, or given up on; a routine finished, abandoned, or a step skipped; your ritual rebuilt; a home spa session completed, and which of Serum's steps it included; a professional treatment logged; a reorder link tapped.
• The date it happened, to the day, and for a routine whether it was the morning or the evening one. Never a clock time.
• About the product: its category, its ingredient families (for example "retinoid", "niacinamide"), its bottle size, how full it was, and how many days you had it in the app.
• Brand and product identifier, only when you chose the product from Serum's built in catalogue. In that case the text was already ours. If you typed the product in yourself, or changed its name or brand after choosing it, neither its name nor its brand is included in this record.
• Which shop a reorder link went to (Ulta, Sephora or Amazon), when you tap one. Never what you searched for, and never whether you bought anything.
• How many products were on your shelf at the time.
• Which app version you were using, and which country, taken from your phone's region setting. Country only, never a city and never a location.
• A random identifier created on your device. It lets us tell that two records came from the same shelf, which is what makes it possible to see how long a product lasts before it is replaced. It is a number we generate. It is not your Apple Account, your device identifier, your advertising identifier, or anything Apple gives us.

What Apple adds, and what it means

The records are stored in Apple's CloudKit. Apple attaches to every record it stores an identifier for the iCloud account that saved it. We cannot switch this off, and we cannot remove it.

What it is not: it is not your name, your email address, or your phone number, and Apple does not let us look up who it belongs to. We do not use it to identify anyone, and our analysis groups records by the random identifier above, not by it.

What it is: it is stable for your iCloud account within Serum. That means records saved from the same iCloud account can be recognised as coming from the same account, including records from before and after you turn sharing off, and including the catalogue submissions described below. If you would rather no record carry it, keep sharing switched off.

One optional question

Separately from the above, you may choose to tell us your age band: under 25, 25 to 34, and so on.

It is off unless you turn it on, under the lock icon on the Today screen, it is optional even then, and turning the setting off deletes your answer rather than merely stopping new ones being sent.

It is recorded as a band, never as a date of birth or an exact age, because a band describes only a segment of people, never an individual.

What is never sent

• Product names or brands you typed, except in the one case described under "Helping the catalogue" below.
• Your notes, your tags, or anything you wrote in your journal.
• Your photos. Progress photos and product photos never leave your device through Serum, in any setting. There is nowhere in Serum that uploads them.
• The name of a spa or provider you enter.
• Which professional treatment you had. If you log a peel, a laser session or an injectable, we are sent only that a treatment was logged, so that we can see how often people use the feature. The type stays on your phone, where Serum uses it to work out how long to pause your actives.
• Your name, email address, contacts, precise location, or health records.
• Anything about your body. Serum does not ask your skin type, whether your skin is sensitive, or any other description of you, and does not record one. What it knows is what is on your shelf and what you did with it.
• Clock times. Dates are recorded as days, plus morning or evening for a routine.

Helping the catalogue

If you add a product by typing it in rather than choosing it from Serum's catalogue, and you have usage data switched on, Serum also sends the brand and product name you typed, together with the category, ingredient families, texture and bottle size you selected for it, so we can consider adding that product to the built in catalogue for everyone. The first screen says so. This goes to a separate table from everything above, it does not carry the random identifier we generate, and nothing is added to the catalogue until a person has reviewed it. Like every record, it does carry Apple's account identifier described above.

Because a submission carries no identifier of ours, we cannot find and delete a particular submission on request; see "Asking us to delete what has already been sent" below. A submission that is reviewed and accepted becomes part of our catalogue and is ours to keep; one that is not accepted may be deleted.

If you would rather not send this, switch off Share usage data.

Where it goes and who can see it

These records are stored in Apple's CloudKit, under our Apple Developer account. Apple hosts the data on our behalf and processes it under Apple's own terms. Only we have access to the records, and we do not give access to anyone else. We use no other analytics provider, no advertising software, and no third party tracking software of any kind. There is no advertising identifier in Serum and Serum does not ask for tracking permission, because it does not track you.

What we do with it

We use these records to work out which products people actually keep using, which ones get abandoned, and where Serum's catalogue and scheduling need work.

We may publish or sell aggregated research: statements about groups, such as "38% of people who use a retinoid also own a niacinamide serum". We will not sell or give anyone the individual records themselves, and we will not provide anyone with a list of what any one person owns. If that ever changes, we will update this policy and ask you again before it applies to you.

When a record may leave our hands

There are three cases where a record could leave our hands other than as an aggregate, and none of them is a sale.

• Where the law requires it: a subpoena, a court order, or a lawful request from a regulator or law enforcement. We provide what is required and no more.
• To protect Serum, our users or others: where we reasonably believe disclosure is needed to enforce our terms, to investigate misuse, to prevent harm, or to establish, exercise or defend a legal claim.
• If Serum or our company changes hands: in a merger, sale, financing or reorganisation, the records may pass to the new owner, who takes them subject to this policy.

In every other case, the promise above stands: statistics about groups, never individual records.

Turning it off

Turning off Share usage data stops any new records being made, deletes the random identifier, deletes your optional answers, and deletes any records still waiting on your device to be sent.

Records already sent stay in CloudKit. Once the random identifier is deleted, we can no longer connect them to any future records through it. They do still carry Apple's account identifier, as described above.

How long it is kept

Records that have been sent are deleted from your device after 30 days.

Records held in CloudKit are kept for no more than three years from the day they are sent, and are reviewed at least once a year. We delete anything we no longer have a use for at that review, whether or not three years have passed.

Asking us to delete what has already been sent

You can. The records carry the random identifier described above and nothing else that points at you, so we need that identifier to find them. It is shown to you on the privacy screen, under the lock icon on Today, headed Your anonymous ID.

Email contact@cheskatenterprises.com with that identifier and we will delete every record carrying it, and confirm when it is done.

Two honest limits on this. If you have already switched Share usage data off, the identifier was deleted from your phone at that moment, by design, and we have no way to work out which records were yours: nobody can, including us. So if you think you may want this, copy the identifier down before you switch sharing off. And a record that has already been counted into a published aggregate cannot be taken back out of it, because the aggregate contains no records, only totals.

A third: catalogue submissions carry no identifier, so a request cannot reach them. They contain a product's brand and name and nothing about you.

Security

Usage records travel to and sit in Apple's CloudKit, protected by Apple's security and by permissions we set so that only we can read them. Your shelf, journal and photos are protected by your device's own passcode and encryption. No system is perfectly secure, and we cannot guarantee that data will never be lost or accessed without authorisation.

Reorder links

When a product is close to running out, Serum may offer a link to buy it again from a retailer such as Ulta, Sephora, or Amazon.

• These are affiliate links. If you buy something after following one, we may earn a commission at no extra cost to you. This is disclosed on the screen where the link appears, not only here.
• Following one opens the retailer's own site, in your browser or in their app. From that point you are on their property and their privacy policy applies, not ours. If we use an affiliate network to handle the link, the network sees the click and the search terms too.
• Serum does not send the retailer your shelf, your notes, your photos, or your identity. The link carries the product name being searched for and our affiliate code, nothing more.
• If usage data is switched on, we record that a reorder link was tapped, for which category of product, and which of the three shops it went to. We do not learn whether you bought anything, and we are not sent what you searched for.

Subscriptions

Serum Pro is sold through Apple's App Store. Apple handles the transaction and tells us only whether an active subscription exists on your Apple Account. We never see your payment details. Apple's own privacy policy governs what Apple collects when you subscribe.

Permissions Serum asks for

• Camera: only to photograph a product or take a progress photo, at the moment you choose to.
• Photo library: only to let you pick an existing photo, at the moment you choose to.
• Notifications: to send the routine reminders you set up, to tell you when a step in a routine or a home spa has finished so you know to carry on, and to tell you when a product is close to running out. They do not name a product, an ingredient, or a treatment, so nothing on your lock screen says what is on your shelf or what you have had done; the detail is in the app when you open it. You can control what any notification shows on a locked screen in iOS notification settings, under Show Previews.

You may refuse or withdraw any of these in iOS Settings. Serum continues to work without them; you simply lose the feature concerned.

Keeping and deleting your data

Serum keeps the data on your device until you delete it. You can remove individual products and journal entries in the app, and there is a Delete everything button on the privacy screen, under the lock icon on Today, which removes your shelf, your ritual history, your journal and every photo in one step. Deleting the app removes everything on the device too, because there is no copy anywhere else. We cannot restore any of it for you, so if it matters to you, keep your own copies of important photos.

Deleting on the device does not reach the usage records already sent, which are described under "Turning it off" above.

If your device backs up to iCloud or to a computer, that backup may include Serum's data, photos included. That backup is yours, is governed by Apple's terms, not ours, and we cannot see it.

Age

Serum is for people aged 18 and over, and you confirm that on the first screen before anything is recorded.

We do not knowingly collect information from anyone under 18, and we have designed it so that we could not find out by accident: the optional age question offers "Under 25" as its youngest answer and nothing below it. We do not ask for a date of birth anywhere.

If you believe someone under 18 has been using Serum, contact us. We will help you remove the data from the device, and delete any records we can identify.

Your rights

Because your shelf, your journal and your photos are held only on your device, the fastest way to see, change, export or delete them is in the app itself. We do not hold a copy.

The usage records described above are deliberately not linked to your name, your email address, or any account with us. We cannot match a request to particular records from your name or your email address, and we will not ask you for either in order to try. The one handle that does work is the random identifier on your own privacy screen: see "Asking us to delete what has already been sent" above.

Switching off Share usage data is the practical way to stop future records and discard pending ones.

United States

If you are in Colorado, you have rights under the Colorado Privacy Act, including access, correction, deletion, portability, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. Serum does none of those three. The switch described above is available to everyone, regardless of where they live.

To exercise a right, email us at the address below. We will respond within 45 days, and we will tell you if we need longer. If we decline a request, you may appeal by replying to our response, and we will answer the appeal within 45 days. If we still decline, you may contact the Colorado Attorney General.

If you are in California, you have rights under the CCPA and CPRA, including the right to know, to delete, to correct, and to opt out. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Residents of other states with comparable laws have comparable rights. We apply the same practices to everyone rather than varying them by state.

Changes

If we change this policy we will update the date above. Where the change is significant, we will tell you in the app and, where it affects what we collect, ask you again rather than assume your previous answer still applies.

Contact

ChesKat Enterprises, LLC Colorado, USA contact@cheskatenterprises.com https://cheskatenterprises.com/serum

Questions about this policy, and anything else about Serum, go to that address.

If you email us, we keep the correspondence for as long as we need it to handle your request and to keep a record that we did. We do not add your email address to any usage record.