GRWM Privacy Policy

Policy version: 2026-11-04

Effective date: 2026-11-04

GRWM helps you find makeup shades that genuinely match you. Doing that well means working with some personal things — photos of your face and the colour of your skin — so we want to be straightforward about what we collect, why, and how you stay in control.

The short version:

• We use your photos to find your shades — never to identify you.
• We ask first. Before you use GRWM, the app asks you to accept this policy, including how we handle face and skin data. You can withdraw in Settings, and GRWM pauses until you accept again.
• Raw capture photos are deleted automatically within about a week. What we keep is the colour readings and matches you asked for.
• You can delete your account, and everything in it, from the app at any time. It's erased 30 days after you confirm, and until then you can change your mind.
• GRWM may show sponsored products and ads, including personalised ads from ad networks. They're never chosen using your photos, skin readings or shade matches, and no advertiser ever gets those. You can opt out of personalised ads (section 3). GRWM has no third-party analytics. The apps send us crash reports, which aren't linked to your account.

"GRWM", "we", "us" and "our" mean GRWM Inc., which operates the GRWM apps for iPhone and Android, the GRWM website, and the in-store GRWM experience.

1. What we collect

Your account

• Name and email address, and a password if you set one (stored only as a salted hash — we can't read it).
• If you use Sign in with Google or Sign in with Apple: the account identifier and email that Google or Apple share with us. If you choose Apple's "Hide My Email", we only see the relay address.
• Sign-in sessions: a record of each device you're signed in on (its device name) so you can see and sign out your devices from Settings.
• Notification token: if you allow notifications, the token your phone gives the app so we can send them to that device. We stop using it when you sign out there.
• Your consent records: when you accept this policy and, separately, agree to how we handle face and skin data (or withdraw them), confirm you have the right to use the photos you upload, or agree to share your theme, we record which version of this policy it was, when, and from which app (platform and app version). See section 2.

Your shade captures

• Photos from your camera taken during a guided capture, which can include your face, neck, and a calibration card. On supported iPhones this includes depth data from the front camera. We also record your phone's model so we can account for its camera.
• What we work out from those photos: colour readings of your skin (face, neck) and lips, and the shade matches, mixes and suggestions we produce from them.
• If you ask us to look at a capture that didn't work, or we couldn't process it: a copy of that capture's photos, and the comment you add, if any (section 2).

Your looks (Look Match)

• Inspiration photos you upload — usually a picture of someone wearing a look you like — with any title you give them.
• Products you tag in a look, and the skin and lip colours we read from the photo.

Your theme

If your account can create a theme of its own, and you make one:

• The theme itself: the name you give it, the colours you pick, a photo if you add one, the stores you choose for it, and which of your looks and matched products you put on it.
• Sharing is off until you turn it on. Before your first share link, the app tells you what sharing shows and asks you to agree, and we record that agreement (see "Your consent records" above). While sharing is on, anyone who has your link can see the theme's name, its photo and the looks on it, including on a web page with no sign-in, and people who add it in the app can also see the products you chose to show. The link doesn't show your name, your email address, your captures or your colour readings. The products you show come from your own matches, so they can suggest your shade to someone who looks.
• Being found by similar match is off until you turn it on. Once your theme is shared, you can let people whose skin reads close to yours find it, by choosing one of your captures to represent it. Before the first time, the app explains this and asks you to agree, and we record that agreement. We then compare that capture's colour reading with the reading of whoever searches, and show them the closest themes first. They see what your link shows, never the reading, the capture or how close it was, but seeing your theme near the top of their list does suggest your skin tone is near theirs. Turning it off, discarding that capture, stopping sharing or deleting the theme takes it out of search at once; sharing again doesn't put it back until you choose to.
• Themes you add: which shared themes or store experiences you've added.
• Reports: if you report someone's shared theme, we keep the reason you chose and that it came from your account. The theme's owner isn't told who reported it. If someone reports yours, a member of the GRWM team looks at the theme (its name, photo, looks and products) to decide what to do, and may hide it from other people or remove it.

Your shelf and preferences

• Products you mark as owned or add to your wishlist, your preferred retailers, the store experiences you've claimed, and product requests you send us.

If you report a problem

• What you write when you send us a bug report from Settings, the kind of problem you pick, and a screenshot if you choose to attach one.
• Details that help us reproduce it, sent with the report: your app version, device model, operating system version and language (on the website, your browser), and the ID of your most recent capture, so we can look at the same result you saw. The form tells you this before you send. A report sent from an in-store device carries the store it came from and no capture.

If you request a calibration card

• Where to mail it: your name and mailing address (we ship to the United States and Canada), and which card you think fits your skin, if you say.
• Your device: your phone's platform (iPhone or Android), model, operating system version and app version, sent by the app with the request.
• The request's progress: when you asked, whether you cancelled, when we shipped it, and which cards we put in the envelope.

If you join our waitlist

• Your email address, on the GRWM website, until the apps are in the App Store and Google Play. We email you a link to confirm it's yours, and record when you did.
• Your country. The apps launch in the US and Canada first. If you're outside the US and Canada, you can still join and confirm your email, but we won't send you the launch email; we'll only email you if GRWM comes to your country.
• Optional answer: which phone you use (iPhone or Android), if you choose to say.
• Your browser's language, so our emails to you are in it where we can.
• To stop the form being abused, the website uses your IP address to limit how often it can be sent in a few minutes. It's held only in our server's memory for those minutes and isn't stored with your signup (like any request, it can appear in our server logs, section 6).

If you're a store admin

Retailers that offer GRWM in their stores can have members of their staff manage their store's GRWM setup (its look, its curated looks and the products tagged on them, and which GRWM looks its kiosks show) on GRWM's admin site. If you're one of them:

• Your account: your name, the work email we invited, the store you manage, and your password (stored only as a salted hash). If you sign in with Google, the account identifier Google shares with us.
• Sign-in codes: each time you sign in we email you a one-time code. We store it only as a hash, and it works for 10 minutes.
• A record of the changes you make on the admin site: what you changed (for example, the store's colours or a look's title), which store, and when. GRWM's team uses it to look after stores and fix mistakes.
• Your invitation: the email address we invited, the store, who on GRWM's team sent it, and when it was sent and accepted.

GRWM's team can see store admins' names, emails and change records; other retailers can't. Your store admin account is a work account for managing your store. To use GRWM yourself, sign up with a different email.

Technical information

• To keep the service secure, our servers receive standard request information such as your IP address, and the apps use Firebase App Check (Apple App Attest / Google Play Integrity) to confirm requests come from a genuine copy of GRWM. We use IP addresses to limit abuse (for example, too many sign-in attempts) and they appear in our server logs.
• Crash reports: if the GRWM app crashes, it sends a report through Firebase Crashlytics so we can find and fix the problem: what the app was doing when it crashed (the code it was running, not what was on your screen), the app version, your phone's model, operating system and state at the time (such as free memory and storage, orientation and battery level), and a random ID Crashlytics keeps on your phone to count how many phones a crash affects. Like any request, a report reaches Google with your IP address. Crash reports aren't linked to your account — we never give Crashlytics your name, email or account ID — so we can't find or delete one person's reports; they're deleted automatically after 90 days (section 6).

We don't collect your location, contacts, or the rest of your photo library — when you upload a look or attach a screenshot to a bug report, you choose the single photo to share.

2. Face and skin data

Because this is the most sensitive part of what we do, here's exactly how it works.

• Finding your face, not identifying you. To know where your skin, neck and lips are in a photo, our software detects facial landmarks — on your phone while you're lining up a capture, and on our servers when we process it. These landmarks are used only to locate the areas we measure. They are discarded as soon as processing finishes. We do not create or store face templates or faceprints, and we never use your photos to recognise or identify you or anyone else.
• Skin colour is sensitive. Your skin tone could reveal information about ethnicity, so we treat your colour readings as sensitive data: they're used to match shades for you, and they're private to your account. The one exception is the capture you choose, if you let your shared theme be found by similar match (see "Your theme" above): its reading is used to order other people's search results, and is still never shown to them.
• Never sold. We never sell, rent, trade or license your photos or face data, or profit from them in any other way. We don't sell your colour readings either. If we ever wanted to, we'd update this policy and ask for your separate consent first: it would always be optional, and saying no wouldn't change anything else about GRWM for you.
• Consent. Matching your shades is what GRWM does, and it can't work without your face and skin data, so agreeing to how we handle it is part of accepting this policy. Right after you sign up or sign in, the app shows this policy with two choices to tick: one to accept the policy, and a separate one to agree to how we handle your face and skin data. GRWM can't be used until you've ticked both (our servers check, not just the app). We ask again whenever this policy changes (section 12). In a store, every guest is asked on the store device before their own capture, even with no account.
• Withdrawing consent. You can withdraw at any time, in the app under Settings (or under Account on the GRWM web app). Withdrawing means you no longer accept this policy, so GRWM pauses: you can still sign in, read this policy, report a problem or delete your account, but nothing else until you accept again. Withdrawing doesn't erase what you've already captured. To erase it, delete your account (section 7).
• Consent records. We keep a record of each time you agree or withdraw: the policy version, the date and time, and the app (platform and version). For an in-store guest, the record is tied to that guest's capture, not to a person. If you delete your account, we keep your records with a coded form of your email instead of your account, for 5 years: it lets us check whether a given email agreed, but can't be turned back into your email. It's there so we can show you agreed if there's ever a legal dispute. After 5 years we erase the code too, and keep the records without anything that links them to you: only the policy version, the date and time, and the app (platform and version). An in-store capture that nobody claimed has no email, so when it's deleted its record is kept that way straight away. That way we can still show how consent was collected, without keeping who gave it.
• When a person looks at your photos. Normally no one at GRWM sees your capture photos. A member of the GRWM team views a capture's photos to work out what went wrong, and may run it again, in only two cases: a capture fails and you tap Ask us to take a look, or we couldn't process it even after trying again automatically. In that second case we keep a copy automatically, the screen where the capture failed tells you so, and you can tap Delete these photos now to delete it straight away (an in-store capture nobody has claimed is never kept this way). Either way it's only for that capture, and the copy is deleted 30 days after we've finished looking (or when your account is deleted, if that's sooner).
• Photos of other people. Inspiration photos in Look Match are usually of someone else. We process them the same limited way — to read skin and lip colours — keep them private to your account unless you put the look on a theme you share (section 1, "Your theme"), and delete them when you delete the look. Before your first upload, we ask you to confirm that you have the right to use the photos you upload, and we record that confirmation the same way as your consent.

3. How we use your information

We use your information to:

• Provide GRWM: run your captures, match shades, save your shelf and looks, and show your results.
• Look into a capture that didn't work, when you ask us to, or when we couldn't process it even after trying again automatically (section 2).
• Show sponsored products and ads (below).
• Investigate and fix problems you report to us, and crashes the apps report (section 1, "Technical information").
• If you let your shared theme be found by similar match, rank it in other people's searches by how close its chosen capture's reading is to theirs.
• Mail you the calibration card you request, and tell you (by notification and email) when it's on its way. We use your address only to mail your card. Your device details help us see which phones our cards are used with.
• If you join our waitlist, email you a link to confirm your address, then email you once, when the apps are in the App Store and Google Play. Your phone and country (if you give them) help us plan the launch.
• Keep your account secure: sign-in, verification and deletion codes, and protecting the service from abuse.
• Send you service emails you need (verification codes, password confirmations, account-deletion emails — the confirmation code, the date your account will be deleted, a reminder a week before, and word that you kept it or that it's been deleted — and word that your card has shipped). We don't send marketing email unless you've opted in.

Ads. GRWM may show sponsored products from brands and retailers, and ads from ad networks on screens where you wait (for example while a capture is processing). Ad networks may use information from your device (such as its advertising identifier, IP address and device type) and how you use GRWM to show you personalised ads, which privacy laws in some places call "sharing" your personal information for cross-context behavioural advertising. Ads are never chosen using your photos, skin or lip readings or shade matches, and advertisers and ad networks never receive your photos, skin or lip readings or shade matches. We don't sell your personal information for money.

When we show personalised ads, you'll be able to opt out at any time: choose Do not sell or share my personal information in Settings, or turn on Global Privacy Control in your browser, and we'll honour it. On iPhone, ad networks can use your device's advertising identifier only if you allow tracking when iOS asks. Where the law requires your consent first (for example in the EU and UK), we'll ask before showing personalised ads.

4. In-store (Store Mode)

Some retailers offer GRWM on a store device. If you do a capture in a store:

• You don't need to sign in, but you're asked to agree to how we handle face and skin data on the store device before your capture starts (section 2).
• Your capture is tied to that store's device until you claim it to your own account with the code or QR code shown.
• If you don't claim it within 48 hours, it's deleted automatically (our clean-up runs every few hours, so within about 54 hours at most).
• The store device shows your results during your visit, but we don't give the retailer your photos, colour readings, or account details. Retailers may choose which of their products GRWM recommends in their store.

5. Who we share it with

We share information with service providers who help us run GRWM, under contracts that limit them to doing so, and, when we show their ads, with advertising partners (section 3):

When you request a calibration card, the postal service that delivers it sees the name and address on the envelope.

If you share your theme, anyone you give the link to — and anyone they pass it on to — can see what the theme shows (section 1, "Your theme"). That's your choice to make, and you can stop sharing or make a new link at any time in the app; the old link stops working straight away.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or acquisition (in which case this policy would continue to apply to your information).

6. How long we keep it (retention and destruction schedule)

We keep each kind of data only as long as we need it for the purpose we collected it for, then destroy it as described below. Face landmarks (the points that locate your skin and lips in a photo) are never stored. They're discarded as soon as each photo is processed.

Where the table says "until you delete your account" or "when your account is deleted", that's 30 days after you confirm deleting it (section 7): until then the account still exists so you can change your mind, but it's signed out everywhere and your theme stops being shared straight away.

If you don't use GRWM for 3 years, we erase your captures (their colour readings, matches and photos) and your looks (with their photos). We email you 30 days before, and you can keep everything just by signing in before the date. Your account, shelf and preferences stay.

Photos kept for review

If a capture fails and you tap Ask us to take a look, or we couldn't process it even after trying again automatically, we keep a separate copy of that capture's photos (and depth data, if any) so a member of the GRWM team can work out what went wrong:

• If we kept it automatically, the screen where your capture failed says so, and Delete these photos now deletes the copy straight away. We never do this for an in-store capture nobody has claimed.

• While the review is open, we keep the copy until we've finished looking into it. If a review is still open 90 days after you sent it, we close it automatically and tell you.
• Once we resolve or close the review, the copy is deleted automatically about 30 days later, with no recoverable copy kept.
• If we run your capture again to fix it, the photos used for that run are treated like any other capture photos and deleted within about 7 days.
• When your account is deleted, the copy is deleted too, even if the review is still open.

7. Your choices and rights

• Delete your account: in the app, go to Settings → Delete account (on the GRWM web app, Account → Delete your account). We'll email you a code to confirm. Once you do, your account is scheduled for deletion 30 days later: you're signed out on every device, your theme stops being shared, and we email you the date. Until then you can sign in and choose Keep my account to cancel, and we'll remind you by email a week before. On that date we permanently erase your account, captures and photos, colour readings and matches, looks, your theme and its photo, shelf, wishlist and preferences, and email you that it's done. If you signed in with Apple, we disconnect GRWM from your Apple ID when you confirm; if you keep your account, sign in with Apple again. (If you use Sign in with Apple, please delete from an iPhone or iPad.) Two things are kept without anything that identifies you: product requests you sent us, and tags you added to our curated looks. Your consent records are kept with a coded form of your email for 5 years, then without it (section 2).
• Withdraw your consent: in Settings, at any time (section 2). GRWM pauses until you accept this policy again.
• Opt out of personalised ads: once GRWM shows ads, choose Do not sell or share my personal information in Settings, or use Global Privacy Control (section 3).
• Delete individual things: remove a look, or items from your shelf and wishlist, whenever you like.
• Leave the waitlist: use the link at the bottom of any waitlist email. We delete your address straight away.
• Your theme: stop sharing it, make a new link, take its photo down or delete it in Settings → My theme, at any time. People who added it lose it when you stop sharing or delete it.
• If you're in someone else's look: if a look on someone's shared theme is a photo of you, email privacy@grwmapp.com with the theme's link. You don't need an account. We'll take that look off the theme; the person who uploaded it keeps it in their own looks, and we tell them someone in the photo asked, not who. If it turns out the photo is of them, or they have your OK to share it, we may put it back.
• Store admins: to have your store admin account or your invitation deleted, email us (below) or ask your store's GRWM contact.
• Access or correct your data: email us and we'll help.
• Depending on where you live (for example the EU, UK, or US states like California), you may have additional rights — to access, correct, delete or receive a copy of your data, to object to or restrict certain processing, and to complain to your local data protection authority. We'll honour these requests and never treat you differently for making them.

To make a request, contact us at privacy@grwmapp.com. We may need to verify it's really you first. If you ask us by email to delete your account, there's no 30-day wait: once we've confirmed it's you, we erase it within 7 days and email you when it's done.

8. Cookies and similar storage

Our websites — the GRWM web app, GRWM's admin site (for GRWM's team and store admins) and the GRWM website — keep the cookies and browser storage that are essential always on: the ones that sign you in and remember your cookie choice. The sites can't work without them.

To keep bots out, the GRWM web app and the admin site also use Google reCAPTCHA, through Firebase App Check. It sets a Google cookie and shares information about your device and browser with Google, so it runs only after you accept it in that site's cookie banner. If you reject it on the web app, the web app stays closed and you can use the GRWM app instead, which does everything the web app does without reCAPTCHA; on the admin site, you can't sign in until you accept. You can read this privacy policy before you choose, and your rights in section 7 never depend on that choice. The GRWM website uses no cookies or storage beyond the essential ones, and the GRWM apps don't use browser cookies.

You can change your choice at any time with Cookie settings at the bottom of the web app (or under Account), of the admin site, and of the website's home page; withdrawing stops reCAPTCHA and deletes App Check's storage in your browser (Google's _GRECAPTCHA and g_state cookies can only be removed in your browser settings). You can also block or delete cookies in your browser, but the web app can't sign you in without its essential cookie.

9. Security

We protect your information with encryption in transit and at rest, private storage that's never publicly accessible (photos are only ever available through short-lived, signed links), hashed passwords and verification codes, device attestation on every app request, and access limited to the systems and people who need it. No system is perfectly secure, but we take this seriously and will notify you if a breach affects your data as the law requires.

10. Children

GRWM isn't directed to children under 16, and we don't knowingly collect their information. When you agree to how we handle face and skin data, in the app or in a store, you confirm you're 16 or older; we don't ask for or keep your age. If you believe a child has given us personal information, contact us and we'll delete it.

11. International users

GRWM is operated from the United States and your information is stored there. If you use GRWM from elsewhere, your information will be transferred to and processed in the US, with the protections described in this policy. Where the law of your country requires a safeguard for that transfer, we rely on standard contractual clauses or another mechanism that law recognises.

12. Changes to this policy

When we change this policy, we update the policy version and date at the top, and the app asks you to accept the new version before you go on using GRWM. Until you do, GRWM pauses as it does when you withdraw (section 2); you can still read the policy, sign out or delete your account.

13. Contact us

• Mail: GRWM Inc., 412 E Main St, Grass Valley, CA 95945
• Email: privacy@grwmapp.com