Privacy

Who handles your data

Filippo Marcolini, who makes Full Glow Up Project, is the “data controller”: the person who decides what is done with your data and is responsible for it. For any question: team@fullglowupproject.com.

What we collect, and why

The law requires a reason for every use of your data. We have four: we need it to give you the service you ask for (the contract); you have given us your consent; we need it to keep the service running without burdening you (our legitimate interest); or the law requires it of us (a legal obligation).

• The account. Your email, which we ask for from the second day, or the code of your Google account if you sign in with Google; the codes of your devices, stored as fingerprints from which the code cannot be worked out. They let you find everything again on any device. Reason: contract.
• Your memory in the app. Your age group, your answers to the questions, a few numbers on the shape of your face, your Mission page with the missions, the sentences in “What you've told me”, your suggestions sheet and the name you give the chat. They are used for the advice and the missions. Reason: contract; for the chat sentences and for what you write in the boxes where you tell us about yourself (they are listed below), your consent.
• The chat and the boxes where you tell us about yourself. What you write in your own words in the chat and in the boxes “What brought you here?”, “Have you already tried something that didn't work?”, “Is there anything you'd like to tell us?”, “In this area, what matters to you right now?”, “Or something of your own”, “What do you fear might happen?”, “What exactly did you do?”, “And right afterwards, what did you do?” and “What, exactly?” is used to reply to you, give you advice, choose your missions and understand whether you're in danger. Since it can be about your health, the first time you open the chat or reach one of those boxes we ask for your explicit consent. Reason: consent. Each time you say yes, we keep proof of your consent: the day and time of your yes, the version and the language of the text you read and, if you withdraw it, the day and time you withdrew it. Never anything you wrote. We need it to be able to prove that you had given us your consent. Reason: legal obligation.
• The haircut on your photo. A crop of your head, only if you ask for it and you confirm it. Reason: consent.
• The reminder. If you turn it on: the address at which your browser receives the notifications, the time you choose, the day you turned it on and the version of the text you read. Reason: consent.
• The alerts. Your phone's time zone, your language and the day you last opened the app (or the day your subscription ended, if that is later), so that we can send the reminder and the notice emails at the right time, in your language, just once, and know when an account is no longer used. If we write to tell you that your account is about to be deleted, we also keep the day we did it, so as not to write to you twice and to count the 30 days; when you come back, we remove it. Reason: contract.
• The subscription. Your email and your card are handled by Stripe, not by us. We keep the code by which Stripe knows you and the status of your subscription. Reason: contract. Each time you tap “Continue” to subscribe, before the payment form opens, we also write your phone's time zone at that moment on your customer record on Stripe: just the name, like “Europe/Rome”. It replaces the previous one; if the phone doesn't send one, we remove the previous one. It stays with the customer data in our Stripe account, not with the subscription: so it does not end up in the receipts, which remain even after “Delete account”. If you subscribe, it is used to count the 14 days to withdraw in the time zone you had when you subscribed, even if you travel later, and to write, in that time zone, the dates in the email that confirms the withdrawal. Reason: legal obligation. If you don't subscribe, we don't use it: it is there only because you asked to subscribe. Reason: contract. Either way, it stays until the next “Continue”, and we remove it before deleting your customer record on Stripe, with “Delete account” or when we delete the account ourselves. If you use “Withdraw from contract here”, the name you write goes only into the confirmation email: we don't keep it. Reason: legal obligation.
• The reason for cancelling. After you have cancelled, we ask whether you would like to tell us the reason, by choosing one of six answers: answering is optional. The answer does not stay linked to you: the server only counts how many times each one is chosen, in six counters that do not say who answered, or when, or in which language. Next to your account we keep only the end date of the subscription you have already answered for, so as not to count the same cancellation twice, and not what you answered. That date goes away with “Delete account” and when you reactivate the subscription. Reason: legitimate interest.
• The anti-abuse limits. How much model text you use in a day; and, when you ask for a sign-in, an image or a text written by a model without having left your email, the address of your connection turned into a code from which the address cannot be worked out. The code lasts one hour for sign-ins and images, and up to 24 hours for counting model text and suggestions. They are used to prevent abuse and to keep costs under control. Reason: legitimate interest.

What stays on your phone

The whole photo, the points on your face and the conversation in progress, which disappears when you close the window. Our server does not write what you write in its logs.

Who receives your data

We do not sell your data and we do not use it for advertising. It goes only to the services we use to make the app work:

• Railway (United States): our server and the database, in a European region (the Netherlands). Railway states, however, that its main processing still takes place in the United States, even with the European region, and for this it commits to the European Commission's standard contractual clauses.
• OpenRouter (United States) and Alibaba Cloud (Singapore, with data centres in Singapore and China): the chat messages and the crop of your head, so that the models can reply and draw. We do not send your email or your account code with the messages. Alibaba keeps the messages, as a rule, for up to 30 days, longer if the law or the security of the service requires it, and for up to 2 years those that its automatic checks flag; it may also keep the crop. OpenRouter and Alibaba state that they do not use them to train their models.
• Brevo (France): the emails with the sign-in link, the end-of-trial notice, the withdrawal confirmation and the notice before we delete an account that isn't used. Brevo keeps a log of the emails sent, with the address they went to, and a list of blocked addresses, which it no longer sends to (for example when an email bounces back); when the account is deleted, with “Delete account” or after 12 months without use, we ask Brevo to delete the log and to remove the address from the list.
• Cloudflare (United States): delivers the pages of the site and forwards the emails sent to team@.
• Google (United States): sign-in with Google, if you use it; the mailbox where the emails sent to team@ arrive; the reminder on Chrome.
• Stripe: the payment, from the moment you tap “Continue” to subscribe.
• Apple, Mozilla and Microsoft: the reminder on Safari, Firefox and Edge.

The reminder goes out empty: whoever delivers it only knows that it exists, not what it says.

Outside Europe

Some of these services process data in the United States, in Singapore or in China, where data laws are different from ours. Cloudflare adheres to the agreement between the European Union and the United States on data; OpenRouter and Railway commit to the contractual clauses approved by the European Commission. For Alibaba, which receives the data through OpenRouter, we are checking which safeguards apply, and we will write it here. For the other services, the safeguards are in their data processing agreements.

How long we keep your data

• The account and your memory: for as long as you use the account. If you don't use it for 12 months, we delete it as with “Delete account”; we email you 30 days before, and to keep it you just need to sign in. Using it means opening the app or signing in; if you don't open the app for about six months, you need to sign in again (with your email or Google), and until you do, opening it doesn't count. If you have a subscription, the 12 months count from when it ends. If you never leave your email, 30 days from when you started.
• The marker of anyone who chooses “under 16”: 30 days, only in the browser. After that, the first time you open the app, it deletes itself.
• An account left without an age group (we explain this under “Age”): if you don't use it for 30 days, we delete it as with “Delete account”. If you have a subscription, the 30 days count from when it ends.
• Sign-in links: one hour.
• The connection code: one hour, or up to 24 hours if it is used to count model text and suggestions.
• The reason for cancelling: the six counters stay, because they do not lead to anyone. The date next to your account goes away with “Delete account” or when you reactivate the subscription.
• Proof of your consent for the chat and the boxes: for as long as you have the account, even after you withdraw it. Withdrawing deletes the chat sentences and what you wrote in the boxes, not the proof. It goes away together with the account: with “Delete account” or when we delete the account ourselves, as described above.
• Chat messages and the crop of your head: we keep nothing. Alibaba: as written above.

“Delete account”, in Settings, immediately deletes everything we have, and the same happens when we delete an account that hasn't been used for 12 months. Along with the account we delete your customer record on Stripe, with the saved card, and we ask Brevo to delete the log of your emails and to remove your address from its list.

After that, only these things remain. If you have ever subscribed, your payments and receipts, with the email you paid with, stay in our Stripe account for as long as tax law requires: the law obliges us to keep proof of what we sell. Reason: legal obligation. Then, what Stripe keeps on its own account, for its own legal obligations and to prevent fraud, as it explains in its privacy policy. And, for as long as Railway decides, the backup copies of the database, which Railway makes automatically.

Your rights

You can ask us at any time to give you access to the data we hold about you, to correct it, to erase it, to give it to you in a file, to restrict its use, and to stop using it for the anti-abuse limits, for the reason for cancelling and to enforce the minimum age. You can withdraw a consent whenever you like; withdrawing it does not change what was done before.

You can do many things yourself: in Settings (“Delete account”, the reminder, the chat) and on the Mission page, with “Remove” next to the sentences. For anything else, write to team@fullglowupproject.com from your account's email address: we reply within a month.

If you think we are handling your data wrongly, you can lodge a complaint with the supervisory authority, the Garante per la protezione dei dati personali, the Italian data protection authority (garanteprivacy.it).

Age

The app is for people aged 16 or over. We ask for your age group, not your date of birth, and we keep only that. To enforce the minimum age we use your age group, the chat messages (only to see whether you write that you are under 16) and a marker in your browser, as explained below. Reason: legitimate interest, that is, protecting younger people and upholding the 16-or-over rule.

• If you choose “under 16”. You don't get in, and nothing reaches us. Only one marker stays in the browser: it says that “under 16” was chosen there and until when it applies, nothing else. For 30 days, in that browser, instead of the age question you get the same answer again; after that, the first time you open the app, the marker deletes itself. “Delete account” does not remove it. If there was already an account there, we ask you to confirm: if you do, we delete it as with “Delete account”, and only then does the marker stay. But if a conversation about something serious is open in the chat, we don't delete it, so as not to interrupt it: the account stays without an age group, and the 30-day rule described above applies.
• If you write in the chat that you are under 16. It only counts if you write it as a number of years or as your year of birth: the chat doesn't try to guess your age from anything else, such as school or the way you write. The chat replies, once, that the app is designed for people aged 16 or over; if you're talking about something serious, it deals with that first. Then the conversation carries on as usual. We remove the age group from your account, and the app will ask you your age again.
• If you think we got it wrong. Answer the age question again: with your age group, your account goes back to how it was. Or write to us at team@fullglowupproject.com. We can't see the marker in your browser, though: it stays only there, and it goes away by itself after 30 days.

Artificial intelligence

The chat, the safety check, the mission of the day and the haircut on your photo are made by artificial intelligence programmes: in the chat, a programme replies to you, not a person. These programmes do not recognise emotions from your face, do not infer your origin, your religion or your orientation from any data, and do not make decisions that have legal effects on you.

Artificial intelligence programmes can make mistakes: they can say things that are inaccurate or out of place. They do not replace a person or a professional.

The safety check reads your messages to understand whether you are in danger. If it thinks you are, the chat stops doing what it was doing and looks with you for help outside the app. Nobody is alerted, and no trace of it remains with us. When the check goes through a model provider, that provider may keep the messages flagged by its filters for up to 2 years.

The image of the haircut on your photo is a simulation made by a programme, not a photograph.

You can say no. For the chat and the boxes where you tell us about yourself, do not give your consent when we ask for it, or withdraw it whenever you like in Settings: the rest of the app works just the same. The haircut on your photo is made only if you ask for it and you confirm it.

Cookies

Our site does not use cookies, or statistics or advertising programmes. It saves in your browser only what the app needs to work, such as your memory and the conversation in progress. When you tap “Continue” to subscribe, Stripe's form loads, and it uses its own cookies to prevent fraud.

If this page changes

If we change something important, we tell you in the app before it takes effect. At the top you will find the date of the last change.