You can sign in with your Google account. When you choose "Continue with Google", AweDerma asks Google only for the basic email and profile scopes. We do not request access to Gmail, Google Drive, Contacts, Calendar or any other Google service.

What Google data we access:

• your Google account email address;
• your name (first and last name as shown on your Google profile);
• your Google profile picture URL, which Google includes in the basic profile.

How we use it: only to create your AweDerma account and to sign you in to it.

• Your email address identifies your account. If you already have an AweDerma account with the same email, Google sign-in signs you in to that existing account instead of creating a new one.
• Your name is used as your display name when a new account is created.
• Your profile picture URL is received as part of the profile but is not currently saved to your account.
• We never receive or store your Google password.

Sharing: we do not sell Google user data, we do not share it with third parties except the infrastructure providers that host and run AweDerma (listed in section 4), and we do not use it for advertising, ad targeting, profiling for ads, or to train AI models.

Storage, retention and deletion: your email address and name are stored in your AweDerma account record in our database (hosted by Turso) over encrypted connections. They are kept for as long as you keep your account and are deleted when you delete your account (see section 7). You can also revoke AweDerma's access at any time from your Google Account settings under "Third-party apps & services"; this stops future Google sign-ins but does not delete your AweDerma account by itself.

Limited Use: AweDerma's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Account data. Email address, name, a password stored only as a one-way bcrypt hash (never in plain text), whether your email is confirmed, account role, optional profile details you add (such as a handle, bio, skin type, climate, location and goals), and reminder settings.
Why: to create your account, sign you in, personalise your routine and contact you about your account.
Kept: until you delete your account. One-time links for email confirmation and password reset are stored only as a hash and expire after 7 days and 1 hour respectively, or as soon as they are used.

Journal and routine entries. Notes, daily logs, routine steps, routine profiles and skin-check reports you create.
Why: this is the core service: to show your journal, routine and progress back to you.
Kept: until you delete the entry or your account.

Photos. Images you upload to a journal entry, a skin check or the clinical desk. They are stored in a private Vercel Blob storage bucket with random, unguessable file names and are served only through awederma.com.
Why: to show the photo with your entry. Photos you submit for an AI skin check are also sent to the AI model to produce that check (see section 3).
Kept: until you ask us to delete them. Deleting your account removes the entries that link to your photos; to have the image files themselves erased, email us (section 9) and we will delete them.

Chat messages. The messages you send to AweDerma's AI chat and its replies.
Why: to answer you and, when you ask, to update your journal or routine.
Kept: your chat history is saved in your own browser (local storage) on your device, not in our database. Clearing your browser data removes it. Anything chat saves to your journal or routine is kept as described above.

Technical logs. When you use AweDerma, our hosting provider records standard request logs (such as IP address, browser user agent, page or API path, time and errors). Our API logs may also include the text of chat requests while we troubleshoot.
Why: to keep the service running, debug problems and prevent abuse.
Kept: for a short period under Vercel's standard log retention, after which they are deleted automatically. We do not use logs for advertising or to build profiles.

On your device. Your browser stores a sign-in token (valid for 7 days), your theme and chat history in local storage so you stay signed in. Signing out removes the sign-in token. We do not use advertising cookies.

AweDerma's chat and skin-check features send your message, any photo you submit for a skin check, and the context needed to answer (such as recent conversation and relevant journal or routine details) to third-party AI models through OpenRouter. We configure OpenRouter to route only to model providers that state they do not train on or retain your prompts for their own purposes. Google user data received through Sign in with Google is not used to train AI models.

AI answers are general skincare information, not medical advice, and can be wrong. Please avoid sharing details you would not want processed by an AI service.

We do not sell or rent personal data. We share it only with the service providers that run AweDerma on our behalf, only for the purpose listed:

• Vercel: hosts the website and API, stores uploaded photos (Vercel Blob) and keeps short-lived request logs.
• Turso: hosts the database that holds account, journal and routine data.
• OpenRouter and the AI model providers it routes to: process chat messages and skin-check photos to generate replies.
• Resend: sends account emails (email confirmation, password reset, email-change confirmation) from no-reply@awederma.com, so it receives your email address and the email content.
• Google: provides optional Sign in with Google (section 1).

A small number of AweDerma team members with administrator access can view account information to operate the service and help with support. We may also disclose data if required by law.

• All traffic to awederma.com uses HTTPS.
• Passwords are stored only as bcrypt hashes; reset and confirmation links are stored only as hashes.
• Photos are kept in private storage that is not publicly listed.
• Administrator tools are restricted to a small number of AweDerma team accounts.
• No system is perfectly secure. If we learn of a breach affecting your data, we will notify affected users by email.

AweDerma is a consumer journaling tool, not a healthcare provider, and it is not designed for storing medical records. We do not claim HIPAA compliance. Do not use AweDerma for medical emergencies, and talk to a dermatologist or doctor about medical concerns.

• Access: your profile, journal and routine are visible to you in the app. Email us for a copy of the data we hold about you.
• Correct: edit your name, profile, journal and routine in the app, or change your email and password in Settings.
• Delete: delete your account at any time in Settings. This permanently removes your account record, journal entries, routines, skin-check reports and pending email links. To also erase uploaded photo files, or if you cannot sign in, email us and we will delete your data within 30 days.
• Google access: revoke AweDerma's Google sign-in access at any time in your Google Account settings.

AweDerma is not intended for children under 13 (or the minimum age required in your country), and we do not knowingly collect their personal data. If you believe a child has created an account, email us and we will delete it.

If we change this policy, we will update the "Last updated" date at the top of this page. For significant changes, such as a new use of your data or of Google user data, we will also notify account holders by email or with a notice in the app before the change takes effect.

Questions, requests or complaints: zac@awederma.com.