CalmSkin is a chronic urticaria (hives) diary. It records some of the most personal information there is — your symptoms, your photos, your medication. This policy explains, in plain language, exactly what happens to it.
The short version. Your check-ins, your severity scores, your medication plan and your flare photos are stored on your device. We do not upload them, we cannot read them, and we do not sell or share them with anyone. The only time information leaves your device is when you choose an optional feature that needs the network — asking the AI assistant a question, exporting or sharing a report yourself, or (on builds that offer it) creating an account. We run no advertising, no analytics and no tracking SDKs of any kind.
1. Who we are
CalmSkin (“the app”, “we”, “us”) is provided by VoltageLab team. We are the data controller for the limited personal data described below.
Questions, requests or complaints: support@voltagelab.com.
2. What CalmSkin stores on your device
The following stays in the app’s private storage area on your iPhone or iPad, protected by iOS app sandboxing and device encryption. It is not transmitted to us and we have no ability to access it:
- Daily check-ins — hive counts, itch severity, sleep impact, notes and any triggers you record, plus the UAS7 scores derived from them.
- Flare photos you take or import, and the date and label attached to each.
- Your medication plan — names, doses, schedules and treatment events you enter.
- Reminders you schedule. These are local notifications produced by your device; no reminder passes through a server.
- App preferences — display name, language, appearance, and whether Face ID / Touch ID unlock is switched on.
If your device is backed up to iCloud or to a computer, this data is included in that backup under Apple’s terms and your own backup encryption settings. That backup is yours; we have no access to it.
3. Camera, photo library and Face ID
- Camera / Photo library. Access is requested only at the moment you add a photo to a log entry, and only the specific images you select are copied into the app. CalmSkin does not scan, index or read your photo library.
- Face ID / Touch ID. If you turn on biometric lock, the check is performed entirely by iOS. Your biometric data never reaches the app and is never transmitted anywhere. CalmSkin receives only a yes-or-no result.
4. The AI assistant (optional)
If you use the in-app assistant, the following is sent over an encrypted HTTPS connection to our API, solely to produce an answer:
- the question you type;
- up to the last 20 messages of that conversation, so the reply makes sense in context;
- any photo you explicitly attach (and, if you ask for a comparison, the earlier photo you choose to compare it with);
- a small amount of app context you have consented to share, such as recent severity scores, and your language setting.
Our server forwards that request to an AI model provider to generate the response. The providers we use are Google (Gemini) and, as a fallback, OpenAI, in each case under their business/API terms, which prohibit using submitted content to train their models. We do not build a profile from your questions, and we do not use them for advertising.
Requests are processed transiently. We keep no conversation database: assistant messages live in your app on your device. Our servers may retain short-lived technical logs (timestamp, request size, error codes) for security and abuse prevention, typically for no more than 30 days.
You are in control. If you never open the assistant and never enable the optional AI weekly insight, no symptom data and no photo ever leaves your device by this route. The AI weekly insight is off unless you switch it on in More → Data & privacy, and you can switch it off again at any time.
5. Accounts, sync and purchases
Some builds of CalmSkin offer optional features that involve a service provider. Where a feature is not offered in your version of the app, no data is collected for it at all.
| Feature | What is involved |
|---|---|
| Optional account | If you choose to create an account or sign in with Google, Google Firebase Authentication processes your email address, a unique user ID and sign-in timestamps on our behalf. Signing in is never required to use CalmSkin. |
| Subscriptions | Purchases are processed by Apple and managed through RevenueCat, which tells the app whether your subscription is active. We never see or store your card number, billing address or Apple ID password. |
| Crash / analytics | None. CalmSkin contains no analytics SDK, no advertising SDK and no third-party tracker. |
6. Tracking and advertising
CalmSkin does not track you. We do not collect an advertising identifier (IDFA), we do not link your data with data from other companies or apps, we do not show ads, and we do not sell or “share” personal information as those terms are defined under the California Consumer Privacy Act or comparable laws. Because we do not track, the app does not present the App Tracking Transparency prompt.
7. Legal bases (EEA / UK users)
Health information is a special category of personal data under the GDPR. Where we process any of it, we do so on the basis of your explicit consent (Article 9(2)(a)) — given by choosing to use the relevant optional feature — and you may withdraw that consent at any time by turning the feature off or deleting the data. Processing needed to deliver the app and its optional account or subscription features rests on the performance of our contract with you (Article 6(1)(b)); short-lived security logging rests on our legitimate interest in keeping the service safe (Article 6(1)(f)).
8. Retention
- On-device data is kept until you delete it, or until you delete the app. Deleting CalmSkin from your device removes its data along with it.
- Assistant requests are not stored as conversation records by us; technical security logs are kept for up to 30 days.
- Account data, if you created an account, is kept until you delete the account, after which it is removed from live systems within 30 days and from routine backups within 90 days.
9. Your rights and how to exercise them
Most of your rights are exercisable directly inside the app, without contacting anyone:
- Access and portability — More → Data & privacy → Export all my data produces a readable copy of your log that you can save or send wherever you like.
- Erasure — More → Data & privacy → Delete everything permanently removes your check-ins, photos and name from the device. This cannot be undone.
- Account deletion — where accounts are available, you can request deletion of your account and any associated server-side data by emailing support@voltagelab.com from your account address; we will action it within 30 days.
Depending on where you live, you may also have the right to rectification, restriction, objection, and to lodge a complaint with your local data protection authority. Write to support@voltagelab.com and we will respond within 30 days. We never charge for these requests and never discriminate against you for making one.
10. Security
Data on your device is protected by the iOS sandbox and by the device encryption Apple applies when a passcode is set; you can add an app-level Face ID / Touch ID lock in settings. All network traffic uses HTTPS (TLS). Requests to our assistant API are additionally authenticated with a signed HMAC-SHA256 signature so that only the app can call it. No system is perfectly secure, but we limit risk primarily by not collecting your health data in the first place.
11. Children
CalmSkin is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact support@voltagelab.com and we will delete it.
12. International transfers
Our assistant API and the AI providers that serve it may process requests on servers outside your country, including in the United States. Where data is transferred out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable) as the transfer mechanism.
13. Not a medical service
CalmSkin is a self-tracking tool and an information aid. It is not a medical device, it does not diagnose or treat any condition, and the assistant’s answers are general information — not medical advice. Always speak to a qualified clinician about your symptoms and your treatment. If you think you are having a severe allergic reaction (trouble breathing, swelling of the mouth or throat, faintness), seek emergency care immediately.
14. Changes to this policy
If we change this policy we will update the date at the top, and for material changes we will make the new version available in the app before the change takes effect. Continuing to use CalmSkin after a change means you accept the updated policy.
15. Contact
Email: support@voltagelab.com