This policy explains what information the Merydiem website and iPhone app (together, the "Service") collect, why, where it is kept, who helps us run the Service, how long we keep it, and how to delete it. Merydiem ("we", "us") is run by its founder, Parmis. Questions: parmis@merydiem.com.
The short version: we use what you tell us to build your routine and score products for you. We don’t sell your data and we don’t show ads. If you scan a product label, the photo is sent to Merydiem and kept, so we can check it and add the product. You can delete your account at any time from the Profile tab (see section 7).
1. What we collect
Your account
Email address and password. Used to sign you in, confirm your account and reset your password. Your password is stored only in scrambled (hashed) form by our database provider; we can’t read it.
Username, the date you joined, and, if you were invited, the username of the person who invited you (so they can earn glow points).
Profile photo, if you add one. Only the cropped square you save is uploaded, not the original picture.
What you tell us about your skin
Your ranked skin concerns, skin type, fungal-acne answer, how elaborate you want your routine, your budget, and anything you’d like to avoid (for example fragrance). These are your "preferences".
Routines you save (the products, their name, and the preferences they were built with).
Rankings: the scores you give products.
Reviews you write.
Wishlist: products you save for later.
Routine tracker: which routine you used on which day, and your skin check-ins (how your skin feels and any issues you tick).
Scans and products you send us
Scan photos. When you scan a label, the text is read on your device (on the iPhone by Apple’s built-in text recognition; on the website by a text-recognition program running in your browser). The photo itself is then uploaded to Merydiem and kept, together with the product name you entered, the text read from it, the ingredient list after any edits you make, and the result.
Ingredient lists you type in yourself, and product requests you send us (name and note).
If you are signed in, these are linked to your account. If you are not, they are linked to a random device ID created by the app on your device (it isn’t your name or your phone’s identifier), which we use only to apply the limit on free scans.
Social features
Who you follow and who follows you; accounts you block; reports you make (what you reported, and a copy of the reported review, profile or routine title taken from our database); glow points and what earned them.
Technical information
Push notification token (iPhone app only, and only if you allow notifications), so we can tell you when a product you sent us has been added or when someone you follow ranks a product. It is removed when you log out.
Usage counts and limits: how many times a day your account asks for routines, searches, product pages and scores, and when your account loaded the product catalogue. We use these to keep the Service fast and to stop automated copying.
Abuse protection: for the "does this email have an account?" check on the login screen we keep your network (IP) address and a scrambled form of the email typed, for one day. For scans sent without an account we keep a scrambled (salted hash) form of your network address for two days.
Our hosting providers keep standard technical logs (such as IP addresses and the time of a request) for security and to keep the Service running.
If you delete your account, the reason you pick, stored without your name, email or account.
Stored on your own device
The app keeps some things in your browser’s or phone’s local storage: your sign-in session, your preferences, a copy of the product names and brands for offline use (removed when you sign out), the random device ID, scan counters, and your reminder setting. Evening check-in reminders in the iPhone app are scheduled on your phone itself. We don’t use advertising or tracking cookies, and the Service contains no analytics or advertising trackers.
2. Why we use it
To run your account and sign you in.
To build your routine and calculate your Personalized Score from your preferences.
To show the social features you choose to use (profiles, follows, reviews, public routines, rankings for your followers).
To check scans and requests by hand and add products to our catalogue, and to tell you when we have.
To keep the Service safe: limits on free scans and requests, the content filter on reviews, usernames and routine titles, reports and blocking, and protecting the catalogue from copying.
To answer you when you contact us.
We don’t sell your personal information, we don’t use it for advertising, and we don’t share it except with the service providers below, who process it on our behalf.
3. Who can see what
Other signed-in members can see your username, profile photo, join date, glow points, who you follow and who follows you, your reviews, your wishlist, the products and name of any routine you leave public, and a summary of your tracker progress (days logged and streak, not what you logged). Routines are public by default; you can make any routine private.
People who follow you can also see your product rankings. Average user scores on product pages are shown only once at least three people have ranked a product, and never say who.
Only you can see your email address, preferences, private routines, tracker entries and check-ins, blocked accounts, glow history and scan photos.
People who aren’t signed in can’t see any of the above.
Merydiem (Parmis) can see everything stored in our database, to run and moderate the Service. Reviews with a link are held until we have looked at them.
4. Where it is stored
Our database, file storage (profile photos and scan photos) and server functions are provided by Supabase. The database and files are stored in Supabase’s London (UK) region. Some server functions may run in the Supabase region nearest to you, but the data they read is stored in London. We also keep daily backup copies of our database tables privately for 30 days.
5. Who helps us run the Service
Supabase: database, sign-in, file storage and server functions (everything listed in section 1 that leaves your device).
Netlify: hosts the website (it serves the pages to your browser).
Resend: sends our account emails (confirming your email and resetting your password), so it processes your email address.
Apple: delivers push notifications to iPhones through the Apple Push Notification service, using your push token. Scan text recognition on the iPhone runs on your phone.
MailerLite: if you sign up for updates on the website’s Contact page, it stores the email address you enter there.
jsDelivr: the website loads two code libraries (the database connection and the text-recognition program) from this public code network, which sees your network address when it sends them.
6. How long we keep it
Your account information, preferences, routines, rankings, wishlist, tracker entries, follows and blocks: until you delete your account (or we close it for breaking the Terms).
Reviews: until you delete them. If you delete your account, your reviews stay on the Service under an anonymous name (for example “user1234”) with nothing linking them to you, unless you delete them first or ask us to remove them.
Scan photos, typed ingredient lists and requests: kept so we can add and check products. If you delete your account they are kept with nothing linking them to your account. Email us if you want yours removed.
Push tokens: until you log out or delete your account.
Abuse-protection records: one day (email check) and two days (scans without an account). Catalogue load records: 30 days. Daily usage counts (a number per day under your account’s internal ID) are not removed when you delete your account, but nothing links that ID to you afterwards.
Reports you made: kept so we can act on them; if you delete your account they are kept without your account.
Backups: 30 days.
The reason you give for deleting your account: kept, without anything identifying you.
7. Deleting your account and your choices
To delete your account in the app or on the website: open the Profile tab, open Settings near the bottom of the page, and tap “Delete account”, the last item at the very bottom of Settings. You’ll see what will be deleted and be asked why you are leaving, then your account is deleted straight away: your sign-in, profile and username, profile photo, preferences, saved routines, rankings, wishlist, tracker entries, follows, blocks, glow points and push tokens. Reviews, scans and your leave reason are kept without anything linking them to you, as described above.
You can also change your preferences at any time, make any routine private, remove your profile photo, delete a review, turn notifications off in your iPhone’s Settings, and unsubscribe from emails using the link in any email.
If you want a copy of the information we hold about you, want something corrected or deleted, or can’t get into your account, email parmis@merydiem.com and we will help.
8. Changes
We will update this page when the Service changes what it collects or how it uses it, and change the date at the top.