Privacy Policy

Last updated: November 1, 2026

Summary: Yarvia is an AI-powered makeup coaching app. Face points measured on your photos and, on supported devices, in the live AR mirror are processed on your device and never used to identify you; the only exception is the optional voice coach, which sends small mirror frames while you talk to it (and when a voice session or step starts) so it can see you. Photos you take for AI features, coach chat messages and voice coach audio are processed by AI providers abroad (Google's Gemini models through OpenRouter, Anthropic's Claude models and TypeSafe's Jev model for makeup analysis, Anthropic's Claude models for the coach chat, TypeSafe's Jev model for reading skin tone and eye features in Know Me and for the mirror's "Is it done?" check, and Google Gemini Live). Your account data and photos are stored in Germany (EU). We never sell your data. Contact: support@yarvia.app. Turkish KVKK notice: KVKK Aydınlatma Metni.

1. Data Controller

This Privacy Policy applies to the Yarvia mobile app and the yarvia.app website. The data controller is VEAUTHY BİLİŞİM HİZMETLERİ TİCARET ANONİM ŞİRKETİ (MERSİS: 0924117108800001), İsmetpaşa Mah. Demircioğlu Cad. No: 102 İç Kapı No: 7, Merkez / Çanakkale, Türkiye. For any question or request regarding your data, contact support@yarvia.app. The notice required under Turkey's Personal Data Protection Law (KVKK) is available in Turkish at yarvia.app/kvkk.

2. Data We Collect

Account information: your email address; if you sign in with Google or Apple, that account's identifier.
Personalization preferences: name, skin tone, undertone, face/eye shape, color season and coaching level, if you provide them.
Content you create: your makeup bag, lessons, session records and coach chat messages.
Photos: photos you take or upload for features such as color season analysis, makeup analysis, Try On Me (photo try-on) and the photo try-ons in Studio, and the try-on images generated for you.
Voice coach data: if you turn on the optional voice coach, the sound from your microphone and small mirror frames during that session (see sections 3 and 4).
Subscription information: your premium subscription status. Payments are processed by the App Store or Google Play; we never see your card details.
Time zone: your device's time zone setting, so notifications and daily/weekly limits run on your local time.
Technical records: your device's notification token if you allow notifications, in-app events, lesson step durations, numeric summaries of on-device mirror measurements, error logs, crash and error reports, and connection data such as IP address.

We don't collect your device's location (GPS or any other precise location). We use the country you connect from, taken from your IP address, only to choose which region's servers and which AI provider run your AI tasks, and we don't store the country.

What's required: you can use Yarvia as a guest without giving an email address; to create an account we need your email address or a Google or Apple sign-in. Everything else you give us (personalization preferences, photos, camera and microphone access) is optional: if you don't provide it, only the features that need it won't work.

3. Face Data, Live Mirror and Camera

Face data: in features that work with a photo, such as color season analysis (Know Me), makeup analysis, Try On Me and Studio, we find face points (such as the outlines of your eyes, brows and lips) on the photo you choose, on your device. We use these points only on your device: to check that the photo shows a face, to crop the photo around your face, to place colors in the right areas and to show you where we looked. The points are not stored and are not sent to our servers or to third parties. If you pick one person in a group photo, only that face’s position in the photo goes with the try-on request, so the makeup is applied to the right person. In makeup analysis, too, only the positions of the eye, brow, cheek and lip areas in the photo (rectangular boxes) go with the analysis request, not the face points themselves, so those areas of your photo can be examined up close; the boxes are not stored. Face points are never used to recognize or identify you or anyone else, and no biometric template is created.

Live mirror (available on supported devices): face points and measurements in the live mirror are processed on your device; the live camera feed is not sent to our servers. When you leave a lesson step, only that step's duration and a numeric summary of the measurement (such as how much of the area is covered and how balanced the two sides are; never an image) are saved to your account. We also use these records and usage data to improve Yarvia and its lessons and to produce aggregate statistics that do not identify you. The one exception is the voice coach: if you start it, downscaled copies of the mirror frame are streamed to Google's Gemini Live service while you talk (at most one per second), when the session opens and when the step changes, so the coach can see you; when you ask how something looks, a small crop of your face or of that area is also sent to an AI provider. Yarvia does not store these frames. When you tap "Is it done?" in the mirror, a small crop of that area (and of the same area from the start of the step) is sent via OpenRouter to TypeSafe's Jev model or, as a fallback, to Google Gemini (USA) to produce the answer; Yarvia does not store these crops on its servers — only the type of answer (for example "done" or "fix"), a numeric summary of the measurement and the "was this right?" feedback you give are saved to your account to improve Yarvia. If the check sees no makeup at all in that area, that crop is kept only on your phone so later checks can compare your makeup with your bare face, and it is sent the same way with those checks; it is deleted from your phone when you sign out or delete your account. You can also choose a makeup-free photo of yourself for this, and your Know Me photo is used if it has no makeup: your phone cuts only the eye, lip, cheek and brow areas from it and keeps them the same way; the whole photo is not sent.

4. AI Processing

Photos: when you use a photo feature, the photo you take or choose is sent to an AI provider for analysis or image generation — only when you start that feature. For makeup analysis, Try On Me and the photo try-ons in Studio, the photo is also uploaded to protected storage linked only to your account and deleted automatically: try-on photos and generated try-on images after 60 days, makeup analysis photos after 90 days. An image you upload to create a lesson from a makeup photo is deleted when you delete that lesson; a screenshot you upload for Filter → Real Makeup is deleted when you delete your account. For color season analysis (Know Me), the photo is sent for the analysis and removed from the server’s job record when the analysis finishes; so you can open your results with your photo on any of your phones, the photo from your latest analysis is kept in protected storage linked only to your account: a new analysis replaces it, and it is deleted when you delete your account. The copy on your phone is also deleted when you sign out.
Coach chat: your messages are sent to an AI provider together with your profile preferences, makeup bag and recent analysis summaries so a reply can be generated; your chat history is stored in your account so you can pick up where you left off.
Voice coach: the sound from your microphone is streamed live to Google's voice AI service (Gemini Live) for the session; so the coach can talk to you personally, your profile preferences, makeup bag and recent lesson and analysis summaries are also given to this service when the session starts. Yarvia does not store voice recordings or transcripts. The microphone is used only while the voice coach is on.

Our photo and text features use Google's Gemini models through OpenRouter (USA); under the providers' paid-use terms, this content is not used to train their models. The voice coach uses Google's Gemini Live service (USA) directly. Makeup analysis uses Anthropic's Claude models (USA): your photo and close-up crops cut from it are sent directly to Anthropic, or through OpenRouter to Anthropic or to Google, which runs Claude on its own infrastructure; this content is not used to train the models either. In makeup analysis, the face and close-up crops cut from your photo, and in Know Me your selfie (to read your skin tone and eye features), are also sent through OpenRouter to TypeSafe's Jev model (USA); these images are processed without being stored and are not used to train models.

In the coach chat, your messages are sent with your profile preferences, bag contents and recent analysis summaries to Anthropic Claude so the reply can be written (directly, or through OpenRouter to Anthropic or to Google, which runs Claude on its own infrastructure; USA); if Claude can't be reached, the same content goes to Google Gemini through OpenRouter. This content isn't used to train models either.

In Know Me, the summary line is written by Anthropic Claude only from the features read (undertone, skin, hair and eye color), without sending your photo.

To measure and improve skin-tone reading in Know Me, we use the numerical values from the reading and the foundation shade in your bag, separated from your identity; your photo is not used for this purpose.

5. Why We Process Your Data (Legal Bases)

Providing the service you use (your account, lessons, makeup bag, sessions, credits, subscription and purchases): necessary to perform our contract with you (Terms of Service).
Sending your photos, coach chat messages and voice to AI providers when you use those features: necessary to provide the feature you asked for (our contract with you). The app also asks your permission before the first send, and you can withdraw it at any time (see section 9); under Turkey's KVKK, this permission is your explicit consent (see the KVKK notice).
Sending you notifications, if you allow them: your consent (you can turn them off in your device settings).
Keeping Yarvia secure and improving it (preventing abuse, finding and fixing errors and crashes, improving Yarvia and its lessons, and producing aggregate statistics that do not identify you): our legitimate interest in offering a safe, reliable and improving service. You can object to this processing (see section 10).
Complying with the law, for example when an authority makes a lawful request: legal obligation.

Automated decisions: analyses and suggestions in Yarvia, such as your color season or feedback on your makeup, are produced automatically and are recommendations for you. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

6. Where Data Is Stored and Security

Your account data and photos are stored on Supabase infrastructure, on servers in Germany (Frankfurt, EU). Data is encrypted in transit and protected at row level, so only you can access your own records. Some AI tasks, such as photo analysis and image generation, run on Supabase servers in the USA; your photo is only processed there temporarily and is not stored there. If you connect from the EU, the European Economic Area, the UK or Switzerland, these tasks also run on servers in Germany (Frankfurt, EU); we tell which country you're connecting from by your IP address.

7. Sharing and International Transfers

We do not sell your personal data or share it for advertising. We share it only with the providers needed to deliver the service:

Hosting and database: Supabase (data stored in Germany, EU; some AI tasks that process photos run on Supabase servers in the USA, or in Germany when you connect from the EU, the European Economic Area, the UK or Switzerland)
AI processing: OpenRouter, Google, Anthropic and TypeSafe (USA) — only when you use the relevant feature
Subscription management: RevenueCat (USA); payments by Apple App Store and Google Play
Notifications: Expo (USA)
Crash and error reporting: Sentry (reports stored in Germany, EU) — when the app crashes or an error occurs, an error report goes to Sentry so we can find and fix the problem: the technical details of the error, device model, system and app version, the technical events just before the error (with identifiers and file paths removed) and a random per-installation identifier; session and performance measurements showing how stable and fast the app runs are also sent. Your name, email, account ID, photos, voice and messages are never added to these reports, and your IP address is not stored. Error reports are deleted automatically after at most 90 days
Account emails (confirmation and password-reset links): Resend (USA)
Product and lesson image delivery: Cloudflare (USA) — catalog product photos and lesson cover images are served from our own image address, img.yarvia.app; while an image loads, your device's IP address reaches Cloudflare. Cloudflare holds only product photos and lesson covers, never your photos
Sign-in, if you choose: Google, Apple
On-device text and barcode reading: Google ML Kit (USA) — reading products from a screenshot and, on Android, barcode scanning run on your device; ML Kit sends Google only diagnostic data (device model, system and app version, performance metrics, a per-installation identifier), never the image

Lesson cover images and product images in the catalog load from our own image address (img.yarvia.app; Cloudflare, USA) or directly from retailer and brand servers; while an image loads, your device's IP address reaches that server. We send no other data.

Because these providers' servers are outside Turkey, these are international transfers; they are carried out within the appropriate safeguards required by applicable law (for Turkey, the standard contracts under KVKK article 9). These providers are contractually bound to protect your data to a standard equivalent to this policy. We may disclose data to authorities when legally required.

If you're in the EU, the European Economic Area, the UK or Switzerland: transfers of your data to providers in the USA are based on the European Commission's standard contractual clauses (with the UK and Swiss addenda) included in our providers' data processing terms or, where a provider is certified, on the EU-U.S. Data Privacy Framework. You can ask us for a copy of these safeguards at support@yarvia.app.

Business transfers: if our company is involved in a merger, acquisition or sale of all or part of its business, your data may be transferred to the new owner as part of that transaction. The new owner remains bound by this policy, and we'll let you know before your data becomes subject to a different policy.

8. Retention and Deletion

Your data is kept while your account is open; try-on and analysis photos are deleted automatically after the periods in section 4. You can delete your makeup analyses, your own lessons and your makeup bag data in the app at any time. When you delete your account (Settings → Privacy & Security → Delete my account), your photos, try-on images, chat history and all records are permanently deleted, subject to statutory retention obligations. How-to: yarvia.app/delete-account.

9. Your Consent

The first time you use a photo, analysis or coach feature, the app asks for your consent to send your data to AI providers (Google Gemini via OpenRouter; Anthropic Claude and TypeSafe Jev for makeup analysis; Anthropic Claude for the coach chat; TypeSafe Jev for reading skin tone and eye features in Know Me and for the mirror's "Is it done?" check; Google Gemini Live for the voice coach). You can withdraw it anytime in Settings → Privacy & Security → Withdraw AI consent; those features will ask again next time. Withdrawing doesn't affect processing done before.

10. Your Rights

Under applicable data protection laws (including Turkey's KVKK article 11 and, where applicable, the GDPR and the UK GDPR), you have the right to:

access your data and get a copy of it;
correct inaccurate data;
delete your data (you can also delete your account in the app);
restrict or object to its processing, including processing based on our legitimate interest;
receive the data you gave us in a machine-readable format and have it sent to another service (data portability);
withdraw your consent at any time; withdrawing doesn't affect processing done before.

Write to support@yarvia.app from the email address registered in the app so we can confirm it's you; requests are answered free of charge within 30 days.

If you're not satisfied with our answer, you can complain to a data protection authority: in Turkey, the Personal Data Protection Board (KVKK); in the EU or the European Economic Area, the authority of the country where you live or work (list of EU authorities); in the UK, the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

11. Children's Privacy

Yarvia is not designed for children under 13, and we do not knowingly collect data from this age group. If you think a child has given us their data, write to support@yarvia.app and we'll delete it.

12. Changes

We may update this policy from time to time. For significant changes, we will update the "last updated" date on this page.

13. Contact

For questions: support@yarvia.app