Privacy policy
Last updated: 13 November 2026
This policy explains what data the Hinoka app and the hinoka.app website process, why, who it is shared with and how to exercise your rights.
1. Data controller
Hinoka is published by Arilem Studio, the controller of your data. Contact: hello@hinoka.app.
2. In short
- We do not sell your data.
- The app contains no advertising, no advertising tracker and no audience measurement tool.
- Your data is hosted in the European Union, in Paris.
- You can erase your profile or delete your account from the app.
3. The data we process
Your account
Your email address and, if you create a password, its encrypted hash. If you sign in with Apple or Google, the identifier that service sends us, and your first name if it shares it.
Your profile
The first name or name you choose to display, your language, your age band, your sex, your answers about your skin (tendency, reactivity, phototype, fragrances to avoid) and your hair (nature, thickness, roots, length, treatments, heat tools), what you would like to improve, and your profile photo if you add one. If you give your year of birth, it is converted into an age band and not kept. A questionnaire you started and did not finish is kept as a draft so that you can resume it.
Pregnancy and breastfeeding
You may indicate that you are pregnant or breastfeeding, so that the answers take it into account. This is health data: it is optional, stored separately, readable only by you in the app, and processed on the basis of your consent. You can change or erase it at any time from your profile.
Your use of the app
Your favourite products and brands, the last ten products you viewed, your last five searches, the catalogue products you scan (the product and the day, never the time or the place), and your “Notify me” requests.
Reviews and community
The reviews you publish (rating, text, displayed name and, if you choose so, a profile line: skin or hair, type, up to three priorities), your replies and reactions, your private messages and messaging settings, the members you block, the reports you send and the appeals you file, and the moderation decisions that concern you.
Noki
Your conversations with Noki, the assistant: your messages, the products or barcodes you attach, and its answers.
Subscription
If you subscribe: the status of your subscription, the plan, the store (App Store or Google Play) and the trial, expiry and renewal dates. We never have access to your payment method, which stays with Apple or Google.
Notifications and technical data
If you accept notifications: your device’s notification identifier. In all cases: your device’s system (iOS or Android), its language, the app version and the date of last use. We also record your consent choices (notifications, community charter) with their date.
When something goes wrong, a technical error report is sent to us. It contains neither your name nor your email address, and pregnancy and breastfeeding information is removed from it.
Camera and photos
The camera is used to read the barcode and the label of your products, and to take your profile photo if you wish. No scan image is kept. From your photo library, only the photo you choose is sent to us.
On your phone
The app keeps on your device your sign-in session, a few display preferences and a copy of the interface texts.
On the hinoka.app website
The website sets no cookie and loads no third-party content. Like any website, its host processes your IP address while serving you the pages and in its technical logs.
4. Why we process it
| Purpose | Legal basis |
|---|---|
| Creating and securing your account, running the app, personalising answers with your profile, managing your favourites, reviews, messages and subscription | Performance of the contract between us (the terms of use) |
| Taking pregnancy or breastfeeding into account | Your explicit consent |
| Sending you notifications | Your consent |
| Moderating the community, handling reports, preventing abuse, fixing technical errors, knowing which products to add to the catalogue | Our legitimate interest in offering a safe, working service |
| Answering your requests and meeting our legal obligations | Legal obligation or our legitimate interest |
5. What other members see
When you publish a review, a reply or a reaction, other members see the name you display and, if you chose so, the profile line attached to your review. In a private message, the other person sees your name and your messages. Your profile photo, your email address and the rest of your profile are not visible to other members.
6. Who we share it with
We use service providers that process data on our behalf, limited to what their service requires:
| Provider | Role | Data concerned |
|---|---|---|
| Supabase | Database, authentication and storage, hosted in Paris | All the data of your account |
| Vercel | Hosting of our servers (Paris) and of the website | The app’s requests, technical connection data |
| Anthropic | Artificial intelligence model behind Noki’s answers | Your messages to Noki, attached products and your profile answers, including pregnancy or breastfeeding if you indicated it; never your name or email address |
| RevenueCat | Subscription management | An account identifier and the subscription status |
| Expo | Sending notifications and app updates | The notification identifier and the text of the notification |
| Sentry | Technical error reports | Technical data without identity |
| Apple and Google | Signing in with your account, purchases, distribution of the app | The data needed for sign-in and purchase |
If you do not use Noki, no data is sent to Anthropic. We share your data with no brand and no advertiser. We may disclose it to an authority if the law requires us to.
7. Transfers outside the European Union
Your data is hosted in Paris. Some providers (Anthropic, RevenueCat, Expo, Sentry, Vercel, Apple, Google) are established in the United States and may process data there. These transfers are covered by the safeguards provided by the GDPR: the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework.
8. Retention
We keep your data for as long as your account exists.
- Erasing your profile. “Delete my profile” erases your answers, the pregnancy and breastfeeding information and the questionnaire draft. Your name, photo and language remain.
- Deleting your account. “Delete my account” schedules the deletion. For 30 days, you can cancel it by signing in again. After that, your account and everything attached to it are permanently erased: profile, photo, favourites, history, reviews, replies, reactions, private messages and conversations with Noki.
- Subscription. Purchase information held by Apple, Google and RevenueCat is kept according to their own rules and our accounting obligations.
9. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and the right to withdraw your consent at any time. You can edit your profile and settings in the app. For any other request, write to hello@hinoka.app: we reply within one month.
You can also lodge a complaint with the data protection authority of your country. In France, this is the Commission nationale de l’informatique et des libertés (CNIL), cnil.fr.
10. Minors
Hinoka is intended for people aged 15 and over. We do not knowingly collect data from younger children. If you believe a child under 15 has created an account, write to us so that we can delete it.
11. Security
Exchanges with our servers are encrypted. Each member can access only their own data, through rules enforced at database level. Passwords are never stored in plain text.
12. Changes
We may change this policy. The date at the top of the page shows the latest version. In case of a significant change, we will inform you in the app or by email.