privacy policy

what we collect, and why

Reading the blog: nothing personal is required. Our hosting provider (Railway) processes your IP address to deliver the site, as any web host does.

If you create an account: your email address, name, birthday (to verify you are 18 or older), and a password we store only as a secure hash — we cannot see your password. If you sign in with Google, we receive your name, email, and Google account identifier instead of a password.

If you take the beauty quiz: your answers (skin tone, undertone, skin type, skin and hair concerns, preferences). For visitors without an account these stay in your browser only. For members they are saved to your account so your results follow you across devices.

If you save products or build routines: those lists, stored in your browser and, for members, synced to your account.

If you use the contact form: the name, email, and message you send, delivered to our inbox by our email provider (Resend).

If you sign up for the newsletter: just your email address, stored so we can send new-product and content emails through our email provider (Resend). Every newsletter email includes an unsubscribe link; you can also email us to be removed at any time.

We use this data for one purpose: making your product recommendations and dashboard work. We do not use it for advertising profiles, and we do not send your quiz answers or any personal data to AI services — recommendation text is generated by our own rule-based system.

cookies and device storage

Essential cookies: signing in sets authentication cookies and a security (CSRF) cookie. They exist only to keep you signed in safely and are not used for tracking.

Optional analytics and affiliate cookies: only if you click Accept on the cookie banner, we load Google Analytics (to understand which content helps people) and Skimlinks (which makes some outbound product links affiliate links). If you decline, neither loads. You can change your mind by clearing this site's data in your browser, which resets the banner.

Browser storage: your quiz profile, saved products, routines, and cookie choice are kept in your browser's local storage so the site works without an account. Signing out clears them from that device.

who else is involved

We use a small number of service providers, each only for its stated job:

Railway (hosting and database) · Resend (password-reset, contact, and newsletter emails) · Google (sign-in with Google, if you choose it; analytics, only with your consent) · Skimlinks (affiliate links, only with your consent) · Amazon (product links carry our affiliate tag, and product images load from Amazon's servers, which means Amazon sees your IP address like any image host would).

We do not sell your personal information. When you click an affiliate link, Amazon or Skimlinks knows the click came from glowy — that is how affiliate commissions work — but we do not hand them your account data.

your rights and controls

Download your data: members can download a complete copy of everything we store (account details, quiz answers, saved products, boards, routines) from My Profile → Privacy & Data, any time, self-service.

Delete your account: also in My Profile → Privacy & Data. Deletion is immediate and permanent: your account, quiz results, saved products, boards, routines, and sessions are all erased from our database.

Correct your data: retake the quiz any time to update your profile, or email us for anything else.

Depending on where you live (for example the EU/UK under GDPR or California under the CCPA), these rights may also be legal entitlements — access, portability, correction, deletion, and the right not to be discriminated against for using them. We honor the requests above for everyone, wherever you live. You can also contact hello@glowybeauty.me to exercise any right, and we will respond within the legally required time.

retention and security

Account data is kept while your account exists and deleted when you delete it. Password-reset tokens expire after one hour and are single-use. Passwords are hashed with bcrypt, sessions use short-lived tokens with rotation, and the API is rate-limited against abuse.

age requirement

glowy accounts are for adults 18 and older. We verify age at signup (and after Google sign-in), and we do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, email us and we will delete it.

changes

If our data practices change, we will update this page and the date at the top before the change takes effect.