Skin Analysis App Privacy: What Happens to Your Face Photos

Skin analysis app privacy comes down to five questions: where your face photo is processed, whether it's stored and for how long, whether it's used to train AI models, who else receives it (including brands and advertisers), and how you delete it. A trustworthy privacy policy answers all five in plain words. If it's vague on any of them, assume the broadest use.

Below is what actually happens to a selfie during a skin scan, when a face photo counts as biometric or health data under the law, a checklist for reading any skin app's policy, and what Pori does with your photos as one worked example.

What happens to a face photo when you scan your skin?

Your photo takes one of three paths, and the privacy policy should tell you which. The app can analyze it on your phone, upload it to a server that analyzes it and throws it away, or upload it to a server that keeps it, for your account history, for product research or to train future models.

The first two paths matter more than they seem because of how Apple's App Store privacy labels work. Apple tells developers that data processed only on device is not "collected" and doesn't need to be disclosed, and that "collect" means sending data off the device in a way that lets the developer or its partners access it for longer than needed to service the request in real time. So an app that uploads your selfie, analyzes it and deletes it straight away can honestly show a shorter label than one that stores photos. The label is a starting point. The policy tells you the rest.

If you want the technical side of on-phone versus server processing, see our explainer on on-device vs cloud skin analysis.

Is a face photo biometric data?

Sometimes, and the answer depends on what the app does with the photo. The UK regulator, the ICO, explains that a photo showing someone's features isn't enough by itself to make it biometric data; it becomes biometric data when specific technical processing, such as extracting facial features, allows someone to be uniquely identified. A skin app that maps landmarks on your face (see how face mesh landmarks work) is doing technical processing, though whether that output can identify you depends on the system.

In the US, the Federal Trade Commission describes biometric information as data that depict or describe physical, biological or behavioral traits of an identifiable person. In a 2023 policy statement it warned companies against collecting biometric data in secret or in unexpected ways, and against failing to evaluate the third parties that get access to it.

Several state laws go further:

The Washington law is worth a second look for skin apps specifically. A scan that estimates acne, redness or other visible skin conditions may produce information about your physical health status, which is the category the law protects. How it applies to any one app is a legal question, but it explains why careful apps keep less data.

What should a skin app privacy policy tell you?

It should answer eight questions directly. Open the policy, search the page for the words "photo," "image," "biometric," "train," "retain," "third part," "sell" and "delete," and check each answer against this list.

Why training use matters most

Deleting a photo doesn't undo what a model learned from it. That's why regulators have started ordering companies to delete models as well as data. In 2021 the FTC finalized a settlement with the developer of the Ever photo app, which it said had turned on facial recognition for most users without letting them switch it off, and required the company to delete the models and algorithms it developed using the photos and videos its users uploaded. The same order required deleting photos of users who had deactivated their accounts. A skin app's policy should say, in one sentence, whether your selfies end up in a training set.

Why brand-run scanners need a separate check

Some free skin scanners sit on a beauty brand's website or inside a retailer's app, where the scan leads to product suggestions. In that case, read the brand's own privacy policy, since your results may be tied to a marketing profile or your purchase history. Our guide to free online skin analysis covers what those scans tend to cost you in data.

How do I check an app's privacy before I scan?

1. Read the App Store label. Under User Content, Apple lists "Photos or Videos" as its own data type. Remember the label is filled in by the developer, and upload-and-discard processing may not appear.
2. Open the full policy and check its date. An old policy on a fast-changing AI app is a reason to ask questions.
3. Search it for the eight words above and fill in the checklist. If you can't answer a question after reading, the answer is effectively "we may."
4. Look for the AI provider. Many apps send photos to a third-party model. The policy should say whether that provider can keep or train on them.
5. Test the deletion path before you build up months of history. Find the delete option or the contact address.
6. Know your rights. Depending on where you live, you can ask a business what it holds and ask it to delete it, for example under the CCPA in California.

Are face scan apps safe to use?

A face scan app is reasonably safe when its policy passes the checklist, and the risk drops sharply when photos aren't stored. The remaining risks are a breach of stored images, reuse for training you didn't agree to, and sharing with marketers. An app that deletes photos after analysis and keeps your history on your phone leaves very little to leak. An app that stores every selfie in the cloud with an open-ended retention clause is asking for more trust. When comparing apps, our AI skin analysis app comparison covers features and prices; privacy is worth adding as a column of your own.

How does Pori handle your face photos?

As one example of how a policy can answer the checklist, here is what Pori says. Its privacy policy (last updated June 3, 2026) states that photos are sent over an encrypted HTTPS connection to an AI model, are not stored on its servers beyond the time needed to produce a result, and are deleted immediately after the result is returned. It says face images aren't sold, shared for advertising or used to train third-party models, and that AI providers receive them only to process the request, under data-processing agreements. Scan results and diary entries stay on your phone, and deleting the app removes them.

That is the upload-and-discard path from the table above: the photo does leave your phone for about the 10 seconds a scan takes. In exchange you get an overall skin score from 0 to 100, a breakdown that includes Hydration & Moisture and Pores & Texture, and a skin-age estimate, with your history kept locally. The download and first scan are free; Pro costs $9.99 a week with a 3-day trial for eligible Apple IDs, or $49.99 a year (US prices as of October 2026). For more on what the scan itself does, see how AI skin analysis works.

Whatever app you use, a skin scan describes how your skin looks in one photo. It isn't a diagnosis, and it can't check a mole, so see a dermatologist about anything new, painful or changing.

What if I already uploaded photos to an app I don't trust?

Ask for deletion and stop using it. Delete your account inside the app if there's an option, then email the contact address in the privacy policy and ask the company to delete your photos, scan results and any data derived from them, and to confirm whether they were used for training. Residents of states like California and Washington have a legal right to deletion for covered data. Keep a copy of your request and the reply. Finally, revoke the app's camera and photo access in your phone's settings so nothing more goes out.