Avina

Privacy Policy

Last updated October 19, 2026

Effective Date: October 12, 2026

This Privacy Policy explains how Ysoftware LLC ("Ysoftware," "Avina," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Avina mobile applications, the Avina web application at https://avina.skin/app, the website at https://avina.skin, and related services collectively referred to as the "Services."

Ysoftware LLC is located at:
4111-e Rose Lake Dr #10237
Charlotte, NC 28217
United States

Privacy questions and requests may be sent to privacy@avina.skin.

Support requests may be sent to support@avina.skin.

1. Information We Collect

We collect only information reasonably necessary to provide, secure, maintain, and improve Avina.

Account and authentication information

Depending on how you sign in, we may process:

  • email address;
  • authentication provider information from Apple, Google, or email sign-in;
  • a unique Avina/Supabase account identifier;
  • account creation and login timestamps;
  • optional display name; and
  • optional Avina preset avatar selection.

Avina does not require you to create or store a password with Ysoftware when using the supported passwordless sign-in methods.

On supported mobile flows, Avina may create a temporary anonymous account before you complete sign-in so that onboarding progress can be preserved.

Skin profile information

You may voluntarily provide cosmetic profile information such as:

  • skin type;
  • skin concerns; and
  • skin goals.

This information is used to personalize relevant parts of Avina, such as product discovery and routine suggestions.

Avina is not designed to collect medical records, diagnoses, prescription information, pregnancy information, or other clinical records.

Routine and app information

We may store information you create or generate while using Avina, including:

  • skincare routines and routine steps;
  • scheduled routine days;
  • routine completion history;
  • streaks and achievements;
  • favorites and recently viewed products;
  • Shelf, restock, and wishlist information;
  • reminder preferences;
  • custom products;
  • product notes;
  • product names, brands, categories, sizes, and ingredient information you enter;
  • barcode scan records associated with product lookup or catalog maintenance; and
  • related app settings and preferences.

Some preferences may be stored only on your device or browser.

Product photos

Avina may allow you to take a photo or choose a photo from your device library for a custom product.

Custom-product photos are stored privately and are intended to be accessible only in connection with your account and authorized operation of the Service. They are not automatically published as catalog images.

When Avina uses the camera to scan a barcode or product label, scan frames are processed on the device and are not uploaded as scan photographs.

If you choose to save an Avina achievement or sharing image, the app may request permission to save that image to your device photo library.

Communications

If you contact us, we may collect:

  • your name;
  • email address;
  • message;
  • attachments or other information you voluntarily provide; and
  • information necessary to respond to your request.

Subscription and transaction information

If you purchase Avina Premium, the transaction is processed by the applicable payment provider.

Depending on the platform, this may include:

  • Apple App Store;
  • Google Play;
  • Stripe for web purchases; and
  • RevenueCat for subscription entitlement and purchase-status management.

We may receive information such as the subscription product, transaction or purchase identifier, subscription status, renewal status, entitlement status, and related billing metadata.

Ysoftware does not receive or store your full payment-card number when a web payment is processed by Stripe.

Device, technical, and usage information

We and our service providers may process limited technical information such as:

  • IP address;
  • browser or device type;
  • operating system;
  • user agent;
  • timezone;
  • app version;
  • pages or screens viewed;
  • app-open and app-close activity;
  • feature interactions;
  • approximate geographic information derived from IP address; and
  • diagnostic and security information.

2. Analytics

Avina uses PostHog to understand how the Services are used and to improve the product.

Mobile analytics

On iOS and Android, Avina may collect limited analytics such as:

  • screen views;
  • app lifecycle events;
  • routine-completion events; and
  • broad categories associated with certain feature usage.

Mobile analytics does not use session replay or mobile autocapture.

Avina does not intentionally send PostHog your email address, skin profile, custom-product photos, barcode values, notes, or catalog search text.

Web analytics

How PostHog web analytics starts on the Avina website and web application depends on where you are when you visit. We use the approximate location our hosting provider derives from your IP address (your country and, in the United States, your state) only to decide which of the rules below applies, and Avina does not store it for that purpose.

In the United States, except Washington and Nevada, basic web analytics runs without asking first, unless you have turned it off or your browser sends a Global Privacy Control signal. Basic web analytics may include:

  • pageviews, including the page or site that referred you and campaign parameters;
  • how far you scroll on a page;
  • clicks on links and buttons and form submissions, including which store link you choose;
  • where on a page you click and move your pointer (heatmaps);
  • actions in the web application, such as completing a routine, adding a custom product (its category only), and starting or finishing sign-in (the sign-in method only);
  • your IP address, the approximate location derived from it, and device and browser information; and
  • web performance information.

Basic web analytics is not linked to your Avina account, even when you are signed in. If you later allow analytics, it starts again under a new identifier, so earlier basic web analytics stays unlinked.

Everywhere else, in Washington and Nevada, and when we cannot determine your location, non-essential PostHog web analytics are activated only after you allow analytics through Avina’s privacy choices.

If you allow analytics, web analytics may include the information listed above and, when you are signed in to the web application, your web activity may be linked to your Avina account.

Avina does not use session replay on the web. Avina does not record what you type into forms, and on the signed-in pages of the web application it does not record the words on the items you click. Advertising click identifiers in web addresses are masked.

If you choose Essentials only, or turn analytics off, Avina does not run the non-essential PostHog web analytics covered by that choice and removes associated PostHog browser storage where supported.

You can change your web analytics preference at any time through Privacy choices at the bottom of the website’s pages, or in the web application under Profile, Privacy.

Browser signals. Avina treats a Global Privacy Control signal as a request to turn off basic web analytics in the United States. Avina does not currently respond to Do Not Track signals.

Advertising measurement

The Avina mobile apps include the AppsFlyer software development kit so that Avina can measure whether its advertising on Facebook, Instagram, TikTok, and Snapchat leads to installs and subscriptions. AppsFlyer reports these results to the ad network that showed the ad. For this purpose the app may send AppsFlyer:

  • app-install, app-open, sign-up, onboarding, checkout, and routine-completion events;
  • a device advertising identifier where you allow it (on iOS only after you allow tracking in the system prompt; on Android the advertising ID), together with device and network information such as the device model, operating-system version, and IP address;
  • your Avina account identifier once you sign in; and
  • trial and subscription events, including the amount paid and refunds, sent by RevenueCat.

Versions 1.0.1 to 1.0.4 of the app also include the Meta (Facebook) software development kit; version 1.0.5 and later do not. In those versions, on iPhone and iPad, the kit may report to Meta on its own when the app is installed, opened, or closed, together with device information such as the device model, operating-system version, and IP address, an identifier the kit creates for the app on your device, and whether you allowed tracking, and switching Ad measurement off does not stop these reports. AppsFlyer, Meta, TikTok, and Snapchat process this information under their own privacy policies, including to measure and improve the delivery of Avina’s advertising. Avina does not send them your email address, skin profile, custom-product photos, barcode values, notes, or catalog search text.

You can switch this measurement off in the app, on each device where you use Avina. Starting with version 1.0.6, it is in Profile, under Manage account, then Ad measurement; in earlier versions, it is in Profile, under Ad measurement. Profile is available once you subscribe. When you switch it off, the app stops sending information to AppsFlyer and asks RevenueCat to stop forwarding your trial and subscription events. That server-side change takes effect when RevenueCat processes it; it may be delayed if your device is offline. The app reports its installation and first opening to AppsFlyer when it first starts, before any screen can offer the setting.

If you have not subscribed, or cannot reach the setting, you can also opt out by emailing support@avina.skin from the address you use for your Avina account. We will switch Ad measurement off for your account: the next time the app opens while you are signed in, it switches the setting off on that device, stops sending information to AppsFlyer, and asks RevenueCat to stop forwarding your trial and subscription events, as described above.

On iPhone and iPad, outside the regions listed below, Avina may ask your permission to track in Apple’s system prompt. If you choose Ask App Not to Track, or later turn tracking off in Settings, Privacy & Security, Tracking, the app cannot read your device’s advertising identifier, and AppsFlyer does not pass your identifiers, your Avina account identifier, your IP address, or other information that could identify you or your device to Meta, TikTok, or Snapchat. Those ad networks may still receive anonymous campaign results, including event names and revenue where supported, and Apple’s own install reports (SKAdNetwork and AdAttributionKit), which do not identify you. In versions 1.0.1 to 1.0.4, Meta’s kit in the app may also report app installs, opens, and closes to Meta, as described above. The app still sends AppsFlyer the information listed above, and RevenueCat still sends it your trial and subscription events, so that Avina can count results in aggregate, unless you switch Ad measurement off.

On Android, deleting or resetting your advertising ID withholds only the advertising identifier; the other information above is still sent unless you switch Ad measurement off.

If your device region is in the European Economic Area, the United Kingdom, or Switzerland, the app does not send this advertising measurement information.

3. Cookies and Similar Technologies

Avina uses browser storage and similar technologies.

Essential and functional storage

These technologies may be used for purposes such as:

  • maintaining your authenticated session;
  • security;
  • remembering your theme;
  • remembering app preferences;
  • preserving onboarding or interface state;
  • remembering your privacy choices; and
  • remembering, for the current browser tab, which web analytics rule applies to your location.

These functions may be necessary for the web application to work properly.

Analytics storage

PostHog may use cookies, local storage, or similar browser technologies when web analytics run: basic web analytics in the United States as described in section 2, or after you allow analytics.

Avina does not use advertising cookies on its website. The mobile apps include the advertising measurement software described in section 2.

4. How We Use Information

We may use information to:

  • create and maintain your account;
  • authenticate you;
  • provide Avina’s routines, product catalog, Shelf, reminders, history, streaks, and other features;
  • personalize features using information you choose to provide;
  • process and maintain subscriptions;
  • provide customer support;
  • respond to requests and communications;
  • operate product and barcode lookup functionality;
  • maintain and improve the product catalog;
  • analyze product performance and usage;
  • detect abuse, fraud, security incidents, or technical problems;
  • protect Avina, our users, and our systems;
  • comply with legal obligations; and
  • enforce our Terms of Use.

Where applicable law requires a legal basis for processing, we process information as necessary to perform our agreement with you, comply with legal obligations, pursue legitimate interests such as operating and securing the Service, or based on your consent where consent is required.

5. How We Disclose Information

We do not sell your personal information.

We share device identifiers, app events, and subscription events with AppsFlyer, and through it or directly with Meta, TikTok, and Snapchat, for advertising measurement as described in section 2. Under some U.S. state laws this may be considered “sharing” for cross-context behavioral advertising; you can opt out with the app’s Ad measurement setting or by emailing support@avina.skin, as described in section 2. On iPhone and iPad, AppsFlyer passes Meta, TikTok, and Snapchat information that identifies you or your device only if you allow tracking in Apple’s prompt. Without that permission, they may receive anonymous campaign results, including event names and revenue, as described in section 2. In versions 1.0.1 to 1.0.4, Meta’s kit in the app may also report app installs, opens, and closes to Meta directly, whatever your choice, as described in section 2.

We do not operate third-party advertising inside Avina.

We may disclose information to service providers that process information on our behalf or help us operate Avina, including:

AppsFlyer

Mobile advertising measurement, as described in section 2.

Meta, TikTok, and Snapchat

Advertising measurement for Avina’s ads on Facebook, Instagram, TikTok, and Snapchat, as described in section 2.

Supabase

We use Supabase for authentication, database services, private file storage, server functions, and related infrastructure.

PostHog

We use PostHog for product analytics as described above.

Vercel

We use Vercel to host and deliver portions of the Avina website and web application.

Resend

We use Resend to deliver certain user-initiated contact communications.

Apple and Google

Apple and Google may process information when you use their authentication services or purchase subscriptions through their stores.

RevenueCat

We may use RevenueCat to process and synchronize subscription status and premium entitlements associated with mobile purchases. RevenueCat also sends trial and subscription events to AppsFlyer for the advertising measurement described in section 2.

Stripe

We use Stripe to process web subscription payments. Stripe processes payment information under its own privacy practices.

Browser notification providers

If you enable web push notifications, encrypted notification messages are transmitted through the applicable browser or operating-system push infrastructure.

Legal, safety, and business purposes

We may disclose information when reasonably necessary to:

  • comply with law, regulation, legal process, or valid governmental request;
  • protect the rights, property, security, or safety of Ysoftware, our users, or others;
  • investigate fraud, abuse, or security issues;
  • enforce agreements; or
  • complete a merger, financing, acquisition, reorganization, sale of assets, or similar corporate transaction, subject to applicable law.

6. Product Information and Catalog Contributions

Avina contains information about third-party skincare and related products.

Catalog information, including ingredient lists, may be incomplete, outdated, or incorrect. Always read the actual product label before buying or using a product, and do not rely on Avina for allergen information. See the Terms of Use for the full product and ingredient disclaimer.

Information submitted or generated in connection with maintaining the product catalog may be reviewed by authorized Ysoftware personnel where reasonably necessary to operate or improve the Service.

Private account content is not automatically made public merely because you use Avina.

7. Notifications

If you enable notifications, Avina may send reminders related to routines, restocking, or other features you request.

Mobile reminders are generally scheduled locally on your device.

Web reminders may use browser push technology.

Notification content may appear on your device lock screen depending on your device settings and may include information such as a routine or product name.

You can control notifications through Avina and your device or browser settings.

8. Data Retention

We retain personal information for as long as reasonably necessary to provide the Services, maintain your account, fulfill the purposes described in this Privacy Policy, comply with law, resolve disputes, prevent abuse, and enforce agreements.

Account-related content is generally retained while your account remains active.

When you delete your Avina account, Avina initiates deletion of account-associated records and private custom-product files. Analytics associated with your Avina account identifier is also scheduled for deletion from PostHog.

Some deletion processes may occur asynchronously and require a reasonable period to complete.

Certain limited information may remain temporarily in:

  • provider-managed backups;
  • security or system logs;
  • records required for accounting, tax, fraud prevention, legal compliance, or dispute resolution; or
  • systems where immediate deletion is technically impracticable.

Such information will not be retained longer than reasonably necessary for those purposes.

Payment providers such as Apple, Google, and Stripe maintain transaction information according to their own legal obligations and retention policies.

9. Account and Data Deletion

You may initiate deletion of your Avina account:

Account deletion is intended to permanently remove your Avina account and associated user content from Avina’s active systems, subject to limited lawful or technical retention described above.

For accounts linked to Sign in with Apple, Avina attempts to revoke the associated Apple authorization as part of the supported mobile account-deletion process.

Deleting your Avina account does not necessarily cancel an active subscription. You should separately cancel any subscription through the platform through which you purchased it, such as Apple, Google Play, or Avina’s web billing system.

10. Your Choices and Privacy Rights

You can edit many types of Avina information directly through the Service.

Depending on where you live, you may also have rights to:

  • request access to personal information;
  • request correction of inaccurate information;
  • request deletion;
  • withdraw consent where processing is based on consent;
  • object to or restrict certain processing;
  • request portability where required by law; and
  • complain to an applicable privacy or data-protection authority.

To submit a privacy request, contact: privacy@avina.skin

We may need to verify your identity before completing certain requests.

We will not discriminate against you for exercising privacy rights provided by applicable law.

11. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information.

These measures include access controls, authenticated access, private storage for user-product images, database access restrictions, encrypted network communications, and server-side handling of sensitive credentials.

No system can be guaranteed to be completely secure. You use online services with the understanding that no transmission or storage system is free from all risk.

12. International Processing

Ysoftware LLC is based in the United States.

Your information may be processed in the United States and other countries in which Ysoftware or its service providers operate.

Those countries may have privacy laws that differ from the laws where you live. Where required, we take appropriate measures relating to international processing and transfers.

13. Children

Avina is intended for users who are at least 13 years old.

We do not knowingly collect personal information from children under 13.

If you are under the age of legal majority where you live, you may use Avina only with the permission of a parent or legal guardian where required.

If you believe a child under 13 has provided personal information to Avina, contact privacy@avina.skin so we can investigate and take appropriate action.

14. Third-Party Services and Links

Avina may contain links or references to third-party services, products, brands, websites, app stores, or payment providers.

Their privacy practices are governed by their own policies, not this Privacy Policy.

15. Changes to This Privacy Policy

We may update this Privacy Policy as Avina evolves or as legal, technical, or business requirements change.

If a change is material, we may provide additional notice through the Service or another appropriate method.

The Effective Date at the top indicates when this version became effective.

16. Contact Us

For privacy questions or requests: privacy@avina.skin

For general support: support@avina.skin

Ysoftware LLC
4111-e Rose Lake Dr #10237
Charlotte, NC 28217
United States