Privacy Policy

1. Introduction

This Privacy Policy explains how we collect, use, store, and protect information in connection with the Foki mobile application (the "App") and our informational website (the "Website") (together, the "Service").

We take the sensitivity of the information handled by Foki, including information relating to your skin and health, seriously. Please read this Policy carefully before using the App. By using the App, you confirm that you have read and understood this Policy, and, where required, that you have given the specific consents described below.

If you do not agree with this Policy, please do not use the App.

2. Who We Are (Data Controller)

The data controller responsible for your personal data is:

Kanstantsin Ramanchuk, operating as a sole proprietorship (individual entrepreneur) under the laws of Poland ("we", "us", "our", the "Company")
Registered address: Wandy Landowskiej 18, 01-315, Warsaw, Poland
Contact email: team.fokiapp@gmail.com

For any questions about this Policy or how we handle your data, please contact us at the email address above.

3. Who Can Use Foki

Foki is intended for users who are at least 16 years old. By using the App, you confirm that you meet this age requirement. Age is self-declared during onboarding and is not independently verified. We do not knowingly collect personal data from anyone under 16. If we become aware that a user is under 16, we will take steps to delete the relevant data. If you believe a user under 16 is using the App, please contact us atteam.fokiapp@gmail.com.

4. No Account Registration: Device-Linked Data

Foki does not require you to create an account or provide a name, email address, or phone number to use the App. Instead, the data you generate within the App (routines, photos, documents, etc.) is linked to your device, not to a personal profile.

This means:

• We do not know your name, email, or other identity information unless you voluntarily provide it (for example, by emailing us).
• Your data is not automatically synced across multiple devices. If you switch devices, reinstall the App, or lose your device, your previously stored data cannot be recovered.
• Uninstalling the App deletes your locally stored data. See Section 10 for details on how this interacts with data stored on our hosting infrastructure.

5. Information We Collect

5.1 Information You Provide Directly

• Product entries: Photos, names, and descriptions of skincare products you add to your personal product list.
• Routine data: Routines you create and records of when you mark them as completed.
• Specialist visit information: Dates, notes, and any details you choose to record about appointments with cosmetologists, dermatologists, or other specialists. This may include names or other details of third parties, such as a practitioner's name, which you provide voluntarily; see Section 13 of our Terms & Conditions.
• Health-related documents: Files or photos you upload, such as lab results or dermatological analyses.
• Supplement data: Supplements you add and records of when you mark them as taken.

5.2 Information Collected Automatically

• Device identifier: Used in place of a user account, to associate your data with your device.

5.3 What We Do Not Collect

• We do not currently use any analytics tool (such as Google Analytics) within the App.
• We do not embed any advertising SDKs, pixels, or conversion-tracking tools within the App.
• We do not require or collect your name, email, or phone number to use the App.

If any of the above changes in the future (for example, if we add analytics or advertising integrations), we will update this Policy and, where required by law, request your consent before activating such tools.

6. Special Category Data (Health Data)

Some of the information described in Section 5.1, in particular your health-related documents (such as lab results), and information about visits to dermatologists or cosmetologists, may constitute a special category of personal data ("health data") under Article 9 of the General Data Protection Regulation (GDPR).

We only process this data on the basis of your explicit, separate consent, given via a dedicated consent checkbox during onboarding (distinct from your general acceptance of this Policy). You may withdraw this consent at any time by tapping "Withdraw consent and delete my data" in your Profile settings within the App. Because the processing of this data is essential to the App's core functionality, withdrawing your consent will result in the deletion of all your data, and will prevent further use of the App unless you provide consent again. You may also request deletion by emailing us at team.fokiapp@gmail.com, in particular if you no longer have access to the App. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.

7. How We Use Your Information

We use the information described above to:

• Provide the core functionality of the App (routines, product tracking, specialist visit planning, supplement tracking, photo and document storage);
• Store your content so that it remains available to you within the App on your device;
• Maintain, secure, and improve the App;
• Respond to your requests (e.g., data deletion requests) sent to team.fokiapp@gmail.com;
• Comply with applicable legal obligations.

We do not use your data to provide medical advice, diagnosis, or treatment recommendations. See our Terms & Conditions for our full medical disclaimer.

8. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases:

• Consent (Article 6(1)(a) GDPR): for storing your health-related documents, and for any future optional features requiring consent (e.g., analytics, if introduced).
• Explicit consent (Article 9(2)(a) GDPR): specifically for special category (health) data described in Section 6.
• Performance of a contract (Article 6(1)(b) GDPR): to provide the App's core functionality that you request by using it, as governed by our Terms & Conditions.
• Legitimate interests (Article 6(1)(f) GDPR): for non-health-related processing necessary to secure the App, prevent misuse, and maintain service stability. We do not rely on legitimate interests for special category data.

9. How We Store and Protect Your Data

We do not operate our own servers. All App data is stored using Microsoft Azure cloud infrastructure, hosted in EU-based data centres. We do not currently transfer your personal data outside the European Economic Area in the course of ordinary App operation.

We apply reasonable technical and organisational measures to protect your data, including restricted access and standard security practices offered by our infrastructure provider. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

10. Data Retention and Deletion

You may withdraw your consent and delete all your data at any time by tapping "Withdraw consent and delete my data" in your Profile settings. This will immediately delete your data stored within the App.

Uninstalling the App deletes the data stored locally on your device.

Because your data is also stored on our Azure infrastructure (linked to your device rather than a personal account), you may also request complete deletion of your data by emailing us at team.fokiapp@gmail.com. We will act on verified deletion requests without undue delay, and in any event within one month, as required by Article 12(3) GDPR (extendable by a further two months for complex requests, in which case we will inform you).

We do not retain data for longer than necessary for the purposes described in this Policy.

Please note: because there is no account system, we may ask you to provide reasonable information to help us identify which data corresponds to your request (e.g., approximate dates of use, device type). We cannot guarantee identification of specific device-linked data from an email request alone in all cases.

11. Third-Party Service Providers

We work with the following categories of third-party service providers, who process data on our behalf or in their own capacity as separate controllers:

• Microsoft Azure: Cloud hosting and storage (EU region). Data involved: all App data described in Section 5.
• Apple Inc.: App Store distribution. Data involved: App Store account data (handled by Apple under its own privacy policy).

We do not sell your personal data to third parties.

12. Advertising

We currently promote the App through Instagram/Meta's advertising platform (Ads Manager) using static image creatives. We do not have any advertising SDK, Meta Pixel, or Conversions API integrated into the App, and we do not transmit any in-app user data to Meta or any other advertising platform. When you view or interact with an ad on Instagram, Meta collects and processes data about that interaction under its own privacy policy, as a separate, independent controller; this is not data we share with them.

We do not currently "sell" or "share" personal information for purposes of cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA). If this changes in the future (for example, if we integrate advertising SDKs), we will update this Policy and provide any additional rights or opt-outs required by applicable law.

13. International Data Transfers

All App data is currently stored within the European Economic Area via Microsoft Azure's EU data centres. We do not routinely transfer your personal data outside the EEA.

14. Your Rights (GDPR)

If you are located in the EEA or UK, you have the following rights regarding your personal data:

• Right of access: to obtain confirmation of and access to your data;
• Right to rectification: to correct inaccurate data;
• Right to erasure: to request deletion of your data (see Section 10);
• Right to restrict processing: in certain circumstances;
• Right to data portability: to receive your data in a structured, machine-readable format (contact us, see Section 19);
• Right to object: to processing based on legitimate interests;
• Right to withdraw consent: at any time, without affecting prior lawful processing;
• Right to lodge a complaint with a supervisory authority. In Poland, this is: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, www.uodo.gov.pl

You may also lodge a complaint with the supervisory authority in your own EU/EEA country of residence.

To exercise any of these rights, contact us at team.fokiapp@gmail.com.

15. Children and Minors

Foki is not directed at children under 16, and we do not knowingly collect personal data from individuals under that age. See Section 3 for more detail.

16. California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights regarding your personal information:

• Right to know what personal information we collect, use, and disclose;
• Right to delete your personal information (see Section 10);
• Right to correct inaccurate personal information;
• Right to limit use of sensitive personal information: note that we only process sensitive categories of data (such as health-related information) with your explicit consent and for the purposes described in this Policy;
• Right to non-discrimination for exercising your privacy rights.

As described in Section 12, we do not currently sell or share personal information for cross-context behavioral advertising. To exercise your rights, contact us atteam.fokiapp@gmail.com.

17. Cookies (Website)

Our informational Website (which hosts this Policy and our Terms & Conditions) does not include forms, sign-ups, or login functionality, and does not knowingly collect personal data from visitors. Our website hosting provider may set limited technical cookies necessary for the Website to function or for basic, aggregated visit statistics. Where required, a short cookie notice is displayed on the Website.

The App itself does not use browser cookies (as it is not a website), though it may use local on-device storage mechanisms to operate, as described elsewhere in this Policy.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will update the "Last Updated" date at the top of this Policy and, where changes are material (for example, introducing new data collection such as analytics), we will seek any additional consent required by law before the change takes effect.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

Email: team.fokiapp@gmail.com
Postal address: Wandy Landowskiej 18, 01-315, Warsaw, Poland