Privacy Policy

Last updated: August 24, 2026

This Privacy Policy explains how Polish Index ("we," "our," "us") collects, uses, shares, and protects your information when you use the Polish Index mobile application and any related services (the "Service").

Polish Index is operated by Code in Color, LLC, a Florida limited liability company.

By using Polish Index, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

Polish Index is not intended for users under 13 years of age. See Section 9 (Children).

1. Introduction

Welcome to Polish Index. We only collect data we need to operate the Service, and we minimize collection wherever possible. The sections below describe exactly what we collect, how we use it, who we share it with, and the choices and rights you have.

2. What information we collect

2.1 Information you provide

• Account information: When you create an account, we collect your email address and a password. Your password is stored only as a secure hash, never in plain text.
• Sign in with Apple or Google (optional): Instead of email and password, you can create your account using Sign in with Apple or Sign in with Google. When you do, we receive your name and email address from that provider. If you use Sign in with Apple and choose Apple's "Hide My Email" option, we receive only a private relay email address, not your real one, and that works perfectly fine with the Service.
• Profile information (optional): display name and profile photo, if you choose to add them.
• Allergen Profile (optional, stored only on your device): The optional Allergen Profile lets you flag nail polish ingredients you want to avoid, such as formaldehyde, toluene, dibutyl phthalate (DBP), camphor, triphenyl phosphate (TPHP), HEMA, and similar ingredients. This list is stored only on your own device and is never sent to us, so it is not information we collect. See Section 3 for how the feature works.
• User-Generated Content (UGC): photos you upload, reviews you write, dupe notes, polish submissions, and other content you submit to the Service.
• Communications: messages you send to our support team.

2.2 Information collected automatically

• Device information: device type, operating system, app version, language, and time zone.
• How you found us: when you create an account, we record where you came to us from. That means the campaign tag on the link you clicked, the website that sent you, the first page you landed on, and whether you signed up on the web, on iPhone, or on Android. We use this only to understand which of our own links and posts bring people to Polish Index. It is recorded once, at sign-up. It is not shown to other members, it is never used for advertising, and it is deleted when you delete your account.
• Product analytics: which screens you view, which features you use, and which searches you run. We use this to understand how the app is used and to improve it. This data is collected through our analytics provider (see Section 5). We do not use it to track you across other companies' apps or websites.
• Website measurement and advertising measurement (our website only, and only if you agree): On our website, polishindex.app, a banner asks whether we may use analytics and share your page visits with Meta so that our Facebook and Instagram ads reach the right people. If you agree, we load Google Analytics and the Meta Pixel, and they measure which pages you view on our website. If you decline, or if you never answer, neither one loads and nothing is measured. Section 5.3 explains exactly what Meta receives and how to turn it off.
• Crash and performance data: crash logs, error reports, and performance metrics, used solely to find and fix bugs.
• Push notification token (optional): if you enable push notifications, we store the device token needed to send them. You can turn notifications off at any time in your device settings.
• Approximate location (derived from IP address, not GPS): used only to apply regional laws, for example to show the appropriate privacy choices to users in the European Union.

2.3 Information we do NOT collect

We do not:

• Collect health information. The optional Allergen Profile (the ingredients you choose to avoid) is stored only on your device and never reaches our servers, so we do not collect, hold, or process it. See Section 3.
• Collect your precise GPS location.
• Access your contacts, calendar, SMS, or call history.
• Read which other apps are installed on your device.
• Track you across other companies' apps or websites from the Polish Index mobile app. The app contains no advertising trackers and no advertising software, so we do not show Apple's App Tracking Transparency prompt. Our website works differently: if you accept the analytics banner on polishindex.app, the Meta Pixel shares the pages you visit with Meta, and Meta may use that to show you our ads. Section 5.3 explains it in full and tells you how to switch it off.
• Share your personal data with third-party artificial intelligence services, and we do not use your personal data to train AI models.
• Collect government IDs, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or biometric identifiers.

3. The Allergen Profile: stored only on your device

Polish Index includes an optional Allergen Profile feature that lets you flag nail polish ingredients you want to avoid, such as formaldehyde, toluene, dibutyl phthalate (DBP), camphor, triphenyl phosphate (TPHP), HEMA, and similar ingredients. The app then flags or hides polishes that contain the ingredients on your list.

We do not collect this information. Your list of ingredients to avoid is stored only on your own device, in your device's local storage. It is never transmitted to us, never received by us, and never stored on our servers. Because this information stays on your device, Polish Index does not collect, hold, or process it, and it is not part of your online account.

What this means for you

• On your device only. Your list lives on the phone or tablet where you set it up. It does not sync between devices through us, because we never receive it. If you use the app on another device, you set your list up again there.
• We cannot see it. Since the list never reaches our servers, no one at Polish Index can view it, and we could not share it even if we were asked to.
• Never shared, sold, or used for advertising. We do not share or sell this information with advertisers, marketers, insurers, employers, or anyone else, and we never use it for advertising, marketing, or to train artificial intelligence models. We could not, because we do not have it.
• You control it. You can change or clear your list at any time in My Account, Allergen Profile. Clearing it removes the list from your device. Uninstalling the app also removes it.
• Not synced to health apps. The feature does not integrate with Apple Health (HealthKit) or Android Health Connect, and it does not store anything in iCloud through us.
• Informational only. Before you set up the feature, the app shows a notice that it is for personal reference and is NOT a medical or diagnostic tool.

Important disclaimer

Polish Index is not a substitute for medical advice. The Allergen Profile is a convenience filter, not a clinical or diagnostic safety tool. Ingredient data may be incomplete or out of date. If you have a known nail polish allergy or sensitivity, talk to a medical professional and read each product's full ingredient list on the actual packaging before use. We make no guarantee that polishes filtered by your list are safe for you.

4. How we use your information

We use your information to:

• Provide the Service: sign you in, save your favorites and collections, and show you polishes that match your preferences.
• Personalize your experience: show you brands and colors you have expressed interest in. (The Allergen Profile filter runs on your device using the list you keep there; we do not receive that list. See Section 3.)
• Communicate with you: send transactional emails such as password resets and account confirmations, and respond to your support requests.
• Improve the Service: review crash logs and aggregate, non-identifying usage trends to fix bugs and decide what to build next.
• Process subscriptions: if you subscribe to a paid plan, your payment is handled by Apple (on iOS) or Google (on Android). We do not see or store your full payment card details. See Section 5.
• Comply with law and protect the Service: respond to lawful requests, enforce our Terms of Service, and prevent fraud and abuse.

We will not use your information for any other purpose without your consent.

5. How we share your information

We share your information only with the categories of recipients listed below. We do not sell your information, and we do not give it to data brokers. One recipient is an advertising platform: if you accept the analytics banner on our website, the Meta Pixel sends the pages you visit to Meta. Section 5.3 explains what that means, and Section 7.3 explains what it means under California law.

5.1 Service providers (sub-processors)

We use these third parties to operate the Service. Each is bound by data protection obligations (Data Processing Agreements, and Standard Contractual Clauses where required for international transfers):

• Supabase (database, authentication, and file storage). Hosting region: United States. For users in the European Union, EEA, UK, Australia, and elsewhere, we rely on Standard Contractual Clauses and equivalent safeguards for international transfers (see Section 7.2). Your account data and UGC live here, encrypted in transit and at rest. Your Allergen Profile does not live here; it stays on your device (see Section 3).
• Amazon Web Services (AWS Rekognition) (automated image moderation). Photos you upload, such as review and manicure photos, are screened by AWS Rekognition for safety before they appear in the app, so we can keep unsafe or policy-violating images out. AWS receives the image for that scan only. It is not used for advertising, and your account information and Allergen Profile are never sent with it.
• Apple (App Store distribution, push notifications, and In-App Purchase billing for subscriptions on iOS).
• Google (Play Store distribution and Google Play Billing for subscriptions on Android).
• RevenueCat (subscription management). Helps us confirm which plan you are entitled to. RevenueCat receives a non-identifying subscription / app-user identifier, not your payment card details.
• Stripe (payment processing for subscriptions purchased on our website). Stripe collects and processes your payment card details directly. We never see or store your card number. Stripe sends us your subscription status and a payment identifier, not your card details.
• Expo / EAS (app build and update delivery).
• Resend (sending transactional emails such as password resets and confirmations).
• PostHog (product analytics). Hosting region: European Union. We configure PostHog so that sensitive screens, including the Allergen Profile, are excluded from analytics.
• Sentry (crash and error reporting in the app and on our website), used only to diagnose and fix problems.
• Google Analytics (website analytics only, on polishindex.app). It loads only if you accept the cookie banner on our website, and we run it with advertising features turned off. It is not used in the mobile app.
• Vercel (hosting and content delivery for our website and the web version of Polish Index). It serves web pages and images and does not receive your account data.

We do not share your personal data with any third-party artificial intelligence service, and we do not allow our processors to use your data to train their own AI models.

5.2 Brand websites (when you view polishes)

When you view a polish, the brand's product photo may be loaded directly from the brand's own website (a practice called image hotlinking). As part of loading that image, your device's IP address and standard browser headers are sent to the brand's content delivery network. We do not send your account information or Allergen Profile to brand websites.

Buy links that take you to a brand's store are not part of the initial launch and are planned for a later version. See Section 6.

5.3 Advertising measurement on our website (the Meta Pixel)

Where this applies. This section is about our website, polishindex.app, and nothing else. The Polish Index mobile app contains no Meta Pixel, no advertising trackers and no advertising software. Nothing described in this section happens in the app.

What it is. Polish Index advertises on Facebook and Instagram. To understand whether those ads bring people to our website, we use the Meta Pixel, a small piece of measurement code provided by Meta Platforms, Inc.

It runs only if you say yes. The first time you visit polishindex.app, a banner asks whether we may use analytics and share your page visits with Meta. Until you choose "That's fine," no Meta code loads, no request is sent to Meta, and no Meta cookie is placed in your browser. If you choose "No thanks," none of it ever loads.

What Meta receives if you accept. For each page you view on our website, Meta receives the web address of that page, the site or link that sent you to us, your IP address, and the standard browser and device information your browser sends with any request. The Pixel also sets or reads two Meta cookies in your browser: _fbp, a random identifier for your browser, and _fbc, which shows that you arrived from a Meta ad. We do not send Meta your name, your email address, your password, your account details, your saved polishes, or anything you have written.

Pages the Pixel never sees. The Pixel is switched off completely on our Allergen Profile pages. It does not even load there, and no visit to those pages is recorded or sent. What you look at about ingredients you want to avoid is never shared with Meta.

Page views only. We send Meta a page view and nothing else. There are no purchase events, no cart events, no sign-up events and no custom events of any kind. Polish Index sells nothing through this advertising setup.

What Meta does with it. Meta uses this information to report how our ads perform and to decide who is shown our Facebook and Instagram ads, which can include showing our ads to you again. In this activity Meta is not simply following our instructions. For the targeting and delivery of ads, Meta and Polish Index act as joint controllers under European data protection law, and Meta also uses the information for its own purposes under its own terms and its own privacy policy at https://www.facebook.com/privacy/policy/. Meta's Business Tools Terms state that Meta may keep this event data for a maximum of two years.

How to turn it off, at any time. Go to https://polishindex.app/analytics-off and choose "Turn analytics off." That stops both Google Analytics and the Meta Pixel in that browser, and it also deletes the Meta _fbp and _fbc cookies and the Google _ga cookies already stored there. The setting is remembered for that browser, so if you use more than one browser or device, set it in each. You can also control ad personalization in your own Facebook and Instagram account settings, and clearing your browser cookies removes the identifiers.

5.4 Legal compliance

We may disclose your information when required by law, subpoena, or court order, or to protect the rights, property, or safety of Polish Index, our users, or the public.

5.5 Business transfers

If Polish Index is acquired or merged, or its assets are transferred, your information may be transferred as part of that transaction. We will notify you of any material change in ownership or in how your information is handled.

6. Affiliate Links (planned for a future version, not at launch)

Buy links and affiliate links are not present in the initial release of Polish Index. We are noting our plans here for transparency.

In a future version, when you tap a Buy link, you may be directed to a brand's own website or to Amazon. If you then make a purchase, Polish Index may earn a commission. This will never change the price you pay. When that feature launches:

• We will only add Buy links for sellers where we have an affiliate relationship (Amazon Associates, or a brand's own affiliate program). We do not add a Buy link unless there is an affiliate link behind it.
• Each Buy link will carry a clear affiliate disclosure next to it.
• The seller's site or affiliate program may set its own cookies to attribute your purchase. We will not share your Polish Index account information, email, or Allergen Profile with them. Only the click attribution is shared.

This Policy will be updated before affiliate links go live.

7. Your rights and choices

7.1 For all users (regardless of location)

• Access: Request a copy of your personal information by emailing privacy@polishindex.app.
• Correction: Update your profile in My Account, Account & Email, or email us to correct information you cannot edit yourself.
• Deletion: Delete your account at any time in My Account, Account & Email, Delete account. You can also request deletion through our web form at https://polishindex.app/delete-account (the path Google Play requires us to provide for people who have uninstalled the app). Deletion removes your account, your UGC, your favorites, and associated data from our servers. Your Allergen Profile is stored only on your device (see Section 3), so you clear it separately in My Account, Allergen Profile, or by uninstalling the app. We may keep limited records where the law requires it (for security, fraud prevention, or tax and financial compliance) for a limited period.
• Export (data portability): You can view and export your information in the app under My Account, Privacy and Data Settings, Your Information, or request a copy of your data in a portable format (JSON or CSV) by emailing privacy@polishindex.app.
• Revoke consent: Withdraw consent for any optional data collection at any time. To clear your Allergen Profile, open My Account, Allergen Profile, and clear it; this removes the list from your device.

7.2 For European Union, EEA, and UK users (GDPR / UK GDPR)

In addition to the rights above, you have:

• Lawful basis. We process your data based on: performance of our contract with you (to provide the Service), your explicit consent (for the Allergen Profile and for any marketing emails), and our legitimate interests (for crash diagnostics and basic product analytics, balanced against your rights).
• Right to restrict processing (Article 18).
• Right to object to processing based on legitimate interests (Article 21).
• Right to lodge a complaint with your local supervisory authority.

To exercise your rights, email privacy@polishindex.app. We will respond within 30 days (extendable to 90 days for complex requests, with notice to you).

International transfers. Polish Index uses service providers located in the United States and the European Union. Where data moves from the EU, EEA, or UK to the United States, we rely on Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Our processors maintain Data Processing Agreements with us.

7.3 For California residents (CCPA / CPRA)

You have the right to:

• Know what categories of personal information we collect and why.
• Delete your personal information (with limited exceptions for legal compliance, security, and fraud prevention).
• Correct inaccurate personal information.
• Limit the use of sensitive personal information. Polish Index does not collect sensitive personal information: the Allergen Profile stays on your device and never reaches us (see Section 3). On our website, the Meta Pixel is switched off entirely on the Allergen Profile pages, so no visit to them is ever sent to Meta (see Section 5.3).
• Opt out of the sale or sharing of personal information. We do not sell your personal information and we never have. We do share personal information in one narrow way, using the specific meaning California law gives that word: if you accept the analytics banner on our website, the Meta Pixel sends the pages you visit to Meta, and Meta may use that to show you our ads elsewhere. California law calls that sharing for cross-context behavioral advertising. It happens only on polishindex.app, and only after you agree to it. You can stop it at any time at https://polishindex.app/analytics-off, and you can decline it in the first place by choosing "No thanks" on the banner.
• Non-discrimination. We will not deny you service or charge you a different price for exercising your rights.

To exercise your rights, email privacy@polishindex.app with the subject line "CCPA Request." We have never sold the personal information of California residents. We began sharing website page visits with Meta for advertising, as described in Section 5.3 and only for visitors who agree to it, on August 22, 2026. Before that date we had neither sold nor shared the personal information of California residents.

7.4 Other US states

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) have rights similar to those in Section 7.3. Email privacy@polishindex.app to exercise them.

8. Data retention

We keep personal information only as long as we need it:

• Account data: until you delete your account.
• How you found us: kept for as long as you have an account, and deleted when you delete your account.
• Allergen Profile: not retained by us. It is stored only on your device and is removed when you clear it in the app or uninstall (see Section 3).
• UGC: until you delete it or your account. Note that content you shared publicly may persist in other people's screenshots or shares, which we cannot reach.
• Crash logs and diagnostics: up to 90 days.
• Product analytics: retained in aggregate or de-identified form.
• Website page visits shared with Meta: kept by Meta under Meta's own terms, which state a maximum of two years for this event data. We do not keep a separate copy of it, and it is not connected to your Polish Index account.
• Support email: up to 2 years.
• Legal and financial compliance records: as required by law, typically up to 7 years for tax and financial records.

After deletion, we keep only what is necessary for security, fraud prevention, or legal compliance, in de-identified or aggregated form where possible.

9. Children

Polish Index is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it.

At signup, we ask you to confirm that you are at least 13 years old. If you indicate that you are under 13, we will not create an account for you.

If you are a parent or guardian and believe your child under 13 has given us personal information, please email privacy@polishindex.app and we will delete it promptly.

10. Security

We protect your information with industry-standard safeguards:

• TLS encryption for data in transit.
• Encryption at rest for data stored on our servers.
• Password hashing (we never store plain-text passwords).
• Access controls that limit which team members can reach user data.
• Periodic review of our security setup.

No system is completely secure. If we discover a security incident that affects your data, we will notify you and the appropriate authorities as required by law. For breaches covered by GDPR, we will notify the relevant supervisory authority within 72 hours where required.

11. Third-party links and services

The Service may link to third-party websites, including brand sites. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes (changes that meaningfully affect your privacy), we will notify you in the app, by email, or both, before the changes take effect. The date at the top shows when the Policy was last updated. Continued use of the Service after a change takes effect means you accept the updated Policy.

13. Do Not Track signals

The Polish Index mobile app does not have a browser, so it does not receive "Do Not Track" signals.

On our website, polishindex.app, we do not respond to the older "Do Not Track" browser header, because no common standard defines what a website must do with it. What we do honor is your own answer to the analytics banner. Nothing is measured until you agree, and you can withdraw at any time at https://polishindex.app/analytics-off, which switches off both Google Analytics and the Meta Pixel in that browser and deletes the identifiers they had stored.

14. Contact us

Polish Index, operated by Code in Color, LLC.

• Privacy requests (access, deletion, correction, export): privacy@polishindex.app
• General support: support@polishindex.app
• Legal and copyright (DMCA) notices: legal@polishindex.app
• Security disclosures: security@polishindex.app
• Mailing address: 611 S. Ft. Harrison Ave #220, Clearwater FL 33756