Privacy Policy

Who we are

Toro is an app developed and operated by Daniel Hyunjoe Rha, an individual developer based in Toronto, Canada. When this policy says "we", "us", or "our", it means Daniel Hyunjoe Rha.

If you have questions about this policy, contact us at danhyunrha@gmail.com.

What data we collect

We collect only what is necessary to provide the app's core functionality:

Account information — your email address and password (or sign-in token from Apple or Google) when you create an account.
Skin profile — skin type, skin conditions (e.g. acne, rosacea, eczema), known sensitivities, and medications you choose to enter. This data is entered voluntarily and is used solely to personalize ingredient analysis.
Scan history — barcodes you scan and the products associated with them, stored to power your timeline and your companion's state.
Usage data — basic app interaction logs (e.g. feature usage, crash reports) to help us fix bugs and improve the app. This data is not linked to your identity.

We do not collect your precise location, contacts, camera roll, or any data beyond what is listed above.

How we use your data

To authenticate your account and keep it secure.
To personalize ingredient analysis results to your skin profile.
To maintain your scan history and companion state across devices.
To process your subscription through RevenueCat (if you upgrade to a paid plan).
To send transactional messages (e.g. password reset) — we do not send marketing emails.
To diagnose crashes and improve app stability.

We do not sell your data. We do not use your data to train AI models or share it with advertisers.

Third-party services

Toro uses the following third-party services, each with their own privacy practices:

Supabase — database and authentication infrastructure. Your account data and scan history are stored on Supabase servers. Supabase Privacy Policy.
RevenueCat — subscription management. Processes purchase receipts from the App Store and Google Play. RevenueCat Privacy Policy.
Firebase (Google) — push notifications. Used only to deliver scan-related notifications if you opt in. Firebase Privacy Policy.
Google Sign-In / Apple Sign-In — optional authentication methods. We receive only a unique identifier and email address from these providers.
Google Gemini — AI model used to generate ingredient analysis for Toro Pro subscribers. Ingredient and product data is sent to Gemini's API to produce personalized summaries. No personally identifiable information or health profile data is included in these requests. Google Privacy Policy.

Health-related data

Your skin profile (conditions, sensitivities, skin type) may be considered health-related information. We treat it with extra care:

It is never sold or shared with third parties for advertising or research.
It is used only to generate personalized ingredient analysis within the app.
You can delete your skin profile at any time from the Profile section of the app.

Data retention and deletion

Your data is retained for as long as your account is active. If you delete your account, all associated data — including your skin profile, scan history, and companion state — is permanently deleted within 30 days.

To delete your account, go to Settings → Delete Account in the app, or email us at danhyunrha@gmail.com.

Children

Toro is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

Your rights

Depending on where you live, you may have the right to access, correct, or delete the personal data we hold about you. To exercise any of these rights, contact us at danhyunrha@gmail.com.

Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

Contact

Daniel Hyunjoe Rha
Toronto, Canada
danhyunrha@gmail.com