Privacy Policy

Last updated: July 12, 2026

This Privacy Policy explains how Polish Index ("we," "our," "us") collects, uses, shares, and protects your information when you use the Polish Index mobile application and any related services (the "Service").

Polish Index is operated by Code in Color, LLC, a Florida limited liability company.

By using Polish Index, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

Polish Index is not intended for users under 13 years of age. See Section 9 (Children).

1. Introduction

Welcome to Polish Index. We only collect data we need to operate the Service, and we minimize collection wherever possible. The sections below describe exactly what we collect, how we use it, who we share it with, and the choices and rights you have.

2. What information we collect

2.1 Information you provide

• Account information: When you create an account, we collect your email address and a password. Your password is stored only as a secure hash, never in plain text.
• Sign in with Apple or Google (optional): Instead of email and password, you can create your account using Sign in with Apple or Sign in with Google. When you do, we receive your name and email address from that provider. If you use Sign in with Apple and choose Apple's "Hide My Email" option, we receive only a private relay email address, not your real one, and that works perfectly fine with the Service.
• Profile information (optional): display name and profile photo, if you choose to add them.
• Allergen Profile (optional, stored only on your device): The optional Allergen Profile lets you flag nail polish ingredients you want to avoid, such as formaldehyde, toluene, dibutyl phthalate (DBP), camphor, triphenyl phosphate (TPHP), HEMA, and similar ingredients. This list is stored only on your own device and is never sent to us, so it is not information we collect. See Section 3 for how the feature works.
• User-Generated Content (UGC): photos you upload, reviews you write, dupe notes, polish submissions, and other content you submit to the Service.
• Communications: messages you send to our support team.

2.2 Information collected automatically

• Device information: device type, operating system, app version, language, and time zone.
• Product analytics: which screens you view, which features you use, and which searches you run. We use this to understand how the app is used and to improve it. This data is collected through our analytics provider (see Section 5). We do not use it to track you across other companies' apps or websites.
• Crash and performance data: crash logs, error reports, and performance metrics, used solely to find and fix bugs.
• Push notification token (optional): if you enable push notifications, we store the device token needed to send them. You can turn notifications off at any time in your device settings.
• Approximate location (derived from IP address, not GPS): used only to apply regional laws, for example to show the appropriate privacy choices to users in the European Union.

2.3 Information we do NOT collect

We do not:

• Collect health information. The optional Allergen Profile (the ingredients you choose to avoid) is stored only on your device and never reaches our servers, so we do not collect, hold, or process it. See Section 3.
• Collect your precise GPS location.
• Access your contacts, calendar, SMS, or call history.
• Read which other apps are installed on your device.
• Track you across other companies' apps or websites. Because we do not perform this kind of tracking, we do not show Apple's App Tracking Transparency prompt.
• Share your personal data with third-party artificial intelligence services, and we do not use your personal data to train AI models.
• Collect government IDs, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or biometric identifiers.

3. The Allergen Profile: stored only on your device

Polish Index includes an optional Allergen Profile feature that lets you flag nail polish ingredients you want to avoid, such as formaldehyde, toluene, dibutyl phthalate (DBP), camphor, triphenyl phosphate (TPHP), HEMA, and similar ingredients. The app then flags or hides polishes that contain the ingredients on your list.

We do not collect this information. Your list of ingredients to avoid is stored only on your own device, in your device's local storage. It is never transmitted to us, never received by us, and never stored on our servers. Because this information stays on your device, Polish Index does not collect, hold, or process it, and it is not part of your online account.

What this means for you

• On your device only. Your list lives on the phone or tablet where you set it up. It does not sync between devices through us, because we never receive it. If you use the app on another device, you set your list up again there.
• We cannot see it. Since the list never reaches our servers, no one at Polish Index can view it, and we could not share it even if we were asked to.
• Never shared, sold, or used for advertising. We do not share or sell this information with advertisers, marketers, insurers, employers, or anyone else, and we never use it for advertising, marketing, or to train artificial intelligence models. We could not, because we do not have it.
• You control it. You can change or clear your list at any time in My Account, Allergen Profile. Clearing it removes the list from your device. Uninstalling the app also removes it.
• Not synced to health apps. The feature does not integrate with Apple Health (HealthKit) or Android Health Connect, and it does not store anything in iCloud through us.
• Informational only. Before you set up the feature, the app shows a notice that it is for personal reference and is NOT a medical or diagnostic tool.

Important disclaimer

Polish Index is not a substitute for medical advice. The Allergen Profile is a convenience filter, not a clinical or diagnostic safety tool. Ingredient data may be incomplete or out of date. If you have a known nail polish allergy or sensitivity, talk to a medical professional and read each product's full ingredient list on the actual packaging before use. We make no guarantee that polishes filtered by your list are safe for you.

4. How we use your information

We use your information to:

• Provide the Service: sign you in, save your favorites and collections, and show you polishes that match your preferences.
• Personalize your experience: show you brands and colors you have expressed interest in. (The Allergen Profile filter runs on your device using the list you keep there; we do not receive that list. See Section 3.)
• Communicate with you: send transactional emails such as password resets and account confirmations, and respond to your support requests.
• Improve the Service: review crash logs and aggregate, non-identifying usage trends to fix bugs and decide what to build next.
• Process subscriptions: if you subscribe to a paid plan, your payment is handled by Apple (on iOS) or Google (on Android). We do not see or store your full payment card details. See Section 5.
• Comply with law and protect the Service: respond to lawful requests, enforce our Terms of Service, and prevent fraud and abuse.

We will not use your information for any other purpose without your consent.

5. How we share your information

We share your information only with the categories of recipients listed below. We do not sell your information to data brokers or advertising networks.

5.1 Service providers (sub-processors)

We use these third parties to operate the Service. Each is bound by data protection obligations (Data Processing Agreements, and Standard Contractual Clauses where required for international transfers):

• Supabase (database, authentication, and file storage). Hosting region: United States. For users in the European Union, EEA, UK, Australia, and elsewhere, we rely on Standard Contractual Clauses and equivalent safeguards for international transfers (see Section 7.2). Your account data and UGC live here, encrypted in transit and at rest. Your Allergen Profile does not live here; it stays on your device (see Section 3).
• Apple (App Store distribution, push notifications, and In-App Purchase billing for subscriptions on iOS).
• Google (Play Store distribution and Google Play Billing for subscriptions on Android).
• RevenueCat (subscription management). Helps us confirm which plan you are entitled to. RevenueCat receives a non-identifying subscription / app-user identifier, not your payment card details.
• Expo / EAS (app build and update delivery).
• Resend (sending transactional emails such as password resets and confirmations).
• PostHog (product analytics). Hosting region: European Union. We configure PostHog so that sensitive screens, including the Allergen Profile, are excluded from analytics.
• Sentry (crash and error reporting), used only to diagnose and fix problems.
• Hosting and content delivery provider for our website and any future web version (for example Vercel or Cloudflare). These serve web pages and images and do not receive your account data.

We do not share your personal data with any third-party artificial intelligence service, and we do not allow our processors to use your data to train their own AI models.

5.2 Brand websites (when you view polishes)

When you view a polish, the brand's product photo may be loaded directly from the brand's own website (a practice called image hotlinking). As part of loading that image, your device's IP address and standard browser headers are sent to the brand's content delivery network. We do not send your account information or Allergen Profile to brand websites.

Buy links that take you to a brand's store are not part of the initial launch and are planned for a later version. See Section 6.

5.3 Legal compliance

We may disclose your information when required by law, subpoena, or court order, or to protect the rights, property, or safety of Polish Index, our users, or the public.

5.4 Business transfers

If Polish Index is acquired or merged, or its assets are transferred, your information may be transferred as part of that transaction. We will notify you of any material change in ownership or in how your information is handled.

6. Affiliate Links (planned for a future version, not at launch)

Buy links and affiliate links are not present in the initial release of Polish Index. We are noting our plans here for transparency.

In a future version, when you tap a Buy link, you may be directed to a brand's own website or to Amazon. If you then make a purchase, Polish Index may earn a commission. This will never change the price you pay. When that feature launches:

• We will only add Buy links for sellers where we have an affiliate relationship (Amazon Associates, or a brand's own affiliate program). We do not add a Buy link unless there is an affiliate link behind it.
• Each Buy link will carry a clear affiliate disclosure next to it.
• The seller's site or affiliate program may set its own cookies to attribute your purchase. We will not share your Polish Index account information, email, or Allergen Profile with them. Only the click attribution is shared.

This Policy will be updated before affiliate links go live.

7. Your rights and choices

7.1 For all users (regardless of location)

• Access: Request a copy of your personal information by emailing privacy@polishindex.app.
• Correction: Update your profile in My Account, Account & Email, or email us to correct information you cannot edit yourself.
• Deletion: Delete your account at any time in My Account, Account & Email, Delete account. You can also request deletion through our web form at https://polishindex.app/delete-account (the path Google Play requires us to provide for people who have uninstalled the app). Deletion removes your account, your UGC, your favorites, and associated data from our servers. Your Allergen Profile is stored only on your device (see Section 3), so you clear it separately in My Account, Allergen Profile, or by uninstalling the app. We may keep limited records where the law requires it (for security, fraud prevention, or tax and financial compliance) for a limited period.
• Export (data portability): You can view and export your information in the app under My Account, Privacy and Data Settings, Your Information, or request a copy of your data in a portable format (JSON or CSV) by emailing privacy@polishindex.app.
• Revoke consent: Withdraw consent for any optional data collection at any time. To clear your Allergen Profile, open My Account, Allergen Profile, and clear it; this removes the list from your device.

7.2 For European Union, EEA, and UK users (GDPR / UK GDPR)

In addition to the rights above, you have:

• Lawful basis. We process your data based on: performance of our contract with you (to provide the Service), your explicit consent (for the Allergen Profile and for any marketing emails), and our legitimate interests (for crash diagnostics and basic product analytics, balanced against your rights).
• Right to restrict processing (Article 18).
• Right to object to processing based on legitimate interests (Article 21).
• Right to lodge a complaint with your local supervisory authority.

To exercise your rights, email privacy@polishindex.app. We will respond within 30 days (extendable to 90 days for complex requests, with notice to you).

International transfers. Polish Index uses service providers located in the United States and the European Union. Where data moves from the EU, EEA, or UK to the United States, we rely on Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Our processors maintain Data Processing Agreements with us.

7.3 For California residents (CCPA / CPRA)

You have the right to:

• Know what categories of personal information we collect and why.
• Delete your personal information (with limited exceptions for legal compliance, security, and fraud prevention).
• Correct inaccurate personal information.
• Limit the use of sensitive personal information. Polish Index does not collect sensitive personal information: the Allergen Profile stays on your device and never reaches us (see Section 3).
• Opt out of sale or sharing. We do not sell or share your personal information as those terms are defined under the CCPA and CPRA.
• Non-discrimination. We will not deny you service or charge you a different price for exercising your rights.

To exercise your rights, email privacy@polishindex.app with the subject line "CCPA Request." We have not sold or shared the personal information of California residents in the preceding 12 months.

7.4 Other US states

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) have rights similar to those in Section 7.3. Email privacy@polishindex.app to exercise them.

8. Data retention

We keep personal information only as long as we need it:

• Account data: until you delete your account.
• Allergen Profile: not retained by us. It is stored only on your device and is removed when you clear it in the app or uninstall (see Section 3).
• UGC: until you delete it or your account. Note that content you shared publicly may persist in other people's screenshots or shares, which we cannot reach.
• Crash logs and diagnostics: up to 90 days.
• Product analytics: retained in aggregate or de-identified form.
• Support email: up to 2 years.
• Legal and financial compliance records: as required by law, typically up to 7 years for tax and financial records.

After deletion, we keep only what is necessary for security, fraud prevention, or legal compliance, in de-identified or aggregated form where possible.

9. Children

Polish Index is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it.

At signup, we ask you to confirm that you are at least 13 years old. If you indicate that you are under 13, we will not create an account for you.

If you are a parent or guardian and believe your child under 13 has given us personal information, please email privacy@polishindex.app and we will delete it promptly.

10. Security

We protect your information with industry-standard safeguards:

• TLS encryption for data in transit.
• Encryption at rest for data stored on our servers.
• Password hashing (we never store plain-text passwords).
• Access controls that limit which team members can reach user data.
• Periodic review of our security setup.

No system is completely secure. If we discover a security incident that affects your data, we will notify you and the appropriate authorities as required by law. For breaches covered by GDPR, we will notify the relevant supervisory authority within 72 hours where required.

11. Third-party links and services

The Service may link to third-party websites, including brand sites. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes (changes that meaningfully affect your privacy), we will notify you in the app, by email, or both, before the changes take effect. The date at the top shows when the Policy was last updated. Continued use of the Service after a change takes effect means you accept the updated Policy.

13. Do Not Track signals

The Polish Index mobile app does not have a browser, so it does not receive "Do Not Track" signals. If you use a future web version of Polish Index and your browser sends a Do Not Track signal, we will continue to avoid the cross-site tracking we already do not do.

14. Contact us

Polish Index, operated by Code in Color, LLC.

• Privacy requests (access, deletion, correction, export): privacy@polishindex.app
• General support: support@polishindex.app
• Legal and copyright (DMCA) notices: legal@polishindex.app
• Security disclosures: security@polishindex.app
• Mailing address: 611 S. Ft. Harrison Ave #220, Clearwater FL 33756