Privacy at Merkma

Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

In short

Merkma is a log for your care products. You need an account for it; products, ratings, notes, prices and photos live on your shelf and are visible only to you at first. There is no tracking, no advertising and no analytics. Fonts and code come from the same server.

Two features send data to third parties if you want them to: looking products up at Open Beauty Facts, and fetching an image from an address you paste in. Both stay off until you agree.

There is no automated decision-making and no profiling.

When you open the website

When you open the website, your browser sends the details needed to deliver it: IP address, date and time, the address requested, the previous page (referrer) and the browser identifier. The site is hosted by Netlify.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is delivering the site securely and reliably. How long Netlify keeps its logs is set by its own terms.

Netlify, Inc.

101 2nd Street, San Francisco, CA 94105, USA

Data may be transferred to the USA. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Account and sign-in

You need an account to sign in. It runs on Supabase. I store your email address, a display name, possibly a handle and a profile picture and, if you enter them, details on skin and hair type. The profile details are optional.

You can sign in with Google, with Apple in the iPhone app or, if your account already has a password, with email and password. I do not create new password accounts; the email link is currently switched off. If you choose Google, Merkma sends you to Google. Google then learns your IP address and that you are signing in here. I receive your email address and name, nothing more. With Apple, your iPhone asks Apple directly; I receive an identifier that is valid only for Merkma, an email address (the Apple relay address if you choose that) and, the first time and only if you share it, your name. Google and Apple are contacted only when you press the respective button.

The legal basis is Art. 6(1)(b) GDPR, and for Google or Apple additionally your choice of that route (Art. 6(1)(a)). The data stays until you delete your account. You can do that in the app menu under “Delete account”; entries, photos and profile picture are removed. This ends the link to Google or Apple; for Apple you can also end it in the iPhone settings.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Apple Distribution International Ltd.

Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Your shelf

Supabase stores products, ratings, notes, place and date of purchase, price, routines, links to sources and photos for you. Photos that show an effect on your body are kept separately and are never delivered, even if your shelf is public. I do not analyse images; there is no face recognition and no skin analysis.

New shelves and products are private. For each shelf and product you set whether only you, confirmed friends or anyone with the link can see it. Place and price are never shown publicly. You can block and report other users. I store whom you blocked and, for a report, who reported whom, the reason, your optional note and the time. If you delete your account, a report you made stays without any link to you for as long as I need it to handle the case.

The legal basis is Art. 6(1)(b) GDPR; for photos showing an effect on the body it is your consent (Art. 6(1)(a), Art. 9(2)(a)), which you withdraw by deleting the photo. Blocking and reporting rest on Art. 6(1)(f): my interest in protecting users from harassment and unlawful content. Everything stays until you delete it or your account. The menu lets you export all your data as a file.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Storage on your device

Merkma stores in your browser (localStorage) the language and theme you chose, your decision on the two consents below, whether the handle prompt was already shown, and your sign-in so that you do not have to sign in at every start. This is necessary for the function you asked for (§ 25(2) no. 2 TDDDG); processing the sign-in rests on Art. 6(1)(b) GDPR. There are no cookies for advertising or analytics. The values stay until you sign out or clear the site data.

Looking up products at Open Beauty Facts

If you allow it, Merkma looks up name, brand and, if available, an image at Open Beauty Facts for a scanned barcode or a product name you type. The barcode digits or your search term and, for technical reasons, your IP address go there. No other details, account or identifier go with it. Thumbnails in the result list are loaded by your browser directly from images.openbeautyfacts.org; that server also learns your IP address. A found image is put on your private shelf if the product has no photo yet; images are licensed CC BY-SA 3.0 and credited at the image.

The feature is off until you agree after your first sign-in. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the menu; without it you enter products by hand. There is no data processing agreement with the association.

Open Food Facts (Association Open Food Facts)

21 rue des Iles, 94100 Saint-Maur des Fossés, France

Provider’s privacy policy

Fetching an image from an address

For a product you can paste an address from which Merkma fetches the image instead of you taking a photo. Merkma then calls that address, without a cookie and without telling it which page the request comes from. The server behind it learns your IP address. Which provider that is depends on the address you paste; I have no contract with it and no influence on how it processes data. The image is copied to your private shelf and not linked.

This feature is also off until you agree once (Art. 6(1)(a) GDPR, for servers outside the EU additionally Art. 49(1)(a)). You withdraw in the menu. Merkma does not open links to sources by itself; the page opens only when you tap one.

Voluntary public product contributions

You can submit saved product details and selected photos of your own packaging for review. For that I store the details shown, the image selection, the version of your consent and the time, together with your internal account ID, at Supabase. Only authorised reviewers see a submission and may correct details against the packaging. Only after their approval does a Supabase function send the selected data to Open Beauty Facts (Association Open Food Facts, France). It receives product data, selected photos, the app identifier and a pseudonymous contributor ID, not your email address, not your account ID, no notes, ratings or purchases. Your IP address is not passed on in this transfer.

The legal basis is your explicit consent (Art. 6(1)(a) GDPR), separate from the consent for lookups. Before publication you can withdraw a submission on the saved product; a transfer already in progress cannot be stopped reliably.

The public database is licensed under ODbL, individual contents under DbCL, photos under CC BY-SA 3.0. Published contributions can be copied and reused. If you delete them in Merkma or delete your account, they remain at Open Beauty Facts. Ask for correction or deletion on the product page there or from the association. My record of the submission is deleted with the product or account.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Open Food Facts (Association Open Food Facts)

21 rue des Iles, 94100 Saint-Maur des Fossés, France

Provider’s privacy policy

The iPhone app

You get the app from the App Store; what Apple processes there is Apple’s own responsibility. Everything else in this text applies in the app too. The terms of use are inside the app; imprint and privacy open in the iPhone’s browser.

The app uses camera and photos only when you take or pick a picture. When scanning a barcode, the iPhone evaluates the camera image itself; it is not transmitted. Cutting out a product photo is also computed on the iPhone. A photo is uploaded only when you save the entry. The app remembers your sign-in on the device until you sign out. There is no advertising identifier and no third-party analytics or crash reporting.

Apple Distribution International Ltd.

Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

How long

Your data stays as long as your account exists. If you delete it in the app, I remove entries, photos and profile picture; what was published at Open Beauty Facts stays there. The providers delete their logs on their own schedules.

Links to other sites

Links to shops you add yourself and to Open Beauty Facts are ordinary links. Your browser connects to the target only when you tap one; the target’s own privacy policy applies there. Merkma currently uses no affiliate or partner links.

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live.