妝櫃（BeautyShelf）隱私政策

BeautyShelf — Privacy Policy

Last updated: 13 September 2026

Nothing leaves your phone unless you tap to send it. BeautyShelf has no account, no cloud sync and no analytics. Your products, opening dates, expiry dates, prices, reviews, routines, skin notes, medications, ingredient watchlist, photos and saved shelves are stored only in the app's own sandbox on your device. The developer cannot see any of it and has no mechanism to.

Automatic activity is download only. When you open the product picker the app fetches a public product catalogue from beautyshelflab.com; the request carries no parameters and no identifiers, so the host only sees that a phone fetched the file plus the IP address any connection carries. Release builds also check Expo's EAS Update service (u.expo.dev) for app updates; that request carries the platform, app version and a random app-generated identifier used to deliver updates, never your identity or any shelf content. Expo is a third party; see expo.dev/privacy.

Sent only when you tap. "Read ingredients on the website" opens your browser with the printed ingredient text in the URL fragment (after #), which browsers do not send to servers. "Update public shelf" uploads exactly what you see in the app's public preview: your nickname, age range, skin type and concerns only if you set your profile to public (a private profile sends none of them); your bio only if you set it to public; and for each product you marked public, its photo, brand, name, category, shade, volume, ingredients, reviews (including fixed tags such as "caused a reaction"), archived status and reason, and resale flag; plus routines you marked public. Expiry and opening dates, purchase dates, prices, stores, batch codes, spare counts, notes, medications, skin notes, your watchlist and every private product are never sent: the upload format has no fields for them, and the server stores only whitelisted fields.

There is no account. On first publish the server issues a random shelf code and a secret; the secret lives only on your phone (and in backups you export) and the server keeps only its hash. We hold nothing that can link a shelf to a person. Shelves and photos are stored on Cloudflare (KV and R2) under an unguessable URL at beautyshelflab.com/u/…/ marked noindex. The "discoverable" switch is on by default and can be turned off in the app; discoverable shelves are listed in the app's explore view, and their ingredients and reviews may be curated into the website's product pages credited to your nickname. Photos are never reused. Tapping "Unpublish" deletes the shelf, its photos and its identity within a minute, with no backups. Viewing someone else's shelf only tells the server which shelf you opened.

Permissions. Camera and Photos are used to attach a product photo; photos stay on the device unless the product is public and you tap to publish. Reminders are local notifications; no push token is requested.

Backups are created only when you choose to export one. The file contains all your data including photos and your shelf secret, and is not encrypted; where you store it is your choice, and the app never uploads it.

No analytics, no advertising or advertising identifiers, no third-party SDKs other than Expo's update service, and your data is never sold or shared. BeautyShelf collects no personal data and therefore none from children. A public shelf is content you choose to publish and anyone with the link can see it; if you are a minor, please talk to a parent or guardian before publishing. Changes will be reflected in the date above, and any future feature that transmits data automatically will be disclosed in the app and require your consent. Questions: [email protected].