Last updated: August 11, 2026
This Privacy Policy explains how FORMA ("FORMA," "we," "us," or "our") collects, uses, stores, and protects your information when you use our website and mobile app (together, the "Service"). By using the Service, you agree to the collection and use of information as described here.
When you create an account, we collect your email address and password, along with profile details such as your display name and selected goals. As you use the Service, we also store your onboarding status, subscription tier, and gamification state (level, XP, streak, and raffle tickets earned through the app).
The core of FORMA is a scan: you capture three photos of your face (one frontal, two profile angles). These photos are uploaded to private, access-controlled cloud storage tied to your account — they are not publicly accessible and are not shared with other users.
From these photos, we compute detailed skin and facial metrics for your report, including:
This is the most sensitive category of data we handle — it can be considered biometric and health-adjacent information under some laws. We use it only to generate your personal reports and track your progress over time, never to identify you to third parties, for facial recognition unrelated to your own scans, or for advertising.
Your scan photos are sent to Anthropic (Claude) for AI-assisted analysis to generate these metrics. If you use the optional haircut try-on feature, your photo is separately sent to Google (Gemini) to generate that preview image. Both providers process this data only to return a result to us, under their own API terms, and do not use it to train their general-purpose models.
FORMA is not a medical device and does not provide medical diagnoses. Skin and facial analysis is provided for informational and cosmetic-improvement purposes only and is not a substitute for advice from a licensed dermatologist or physician.
Your scan photos and computed metrics are retained for as long as your account is active, so you can revisit past reports and track changes over time (including weekly rescans). When you delete your account (see Section 8), your photos and derived scan data are deleted from our active systems immediately, except where limited retention is required for legal, security, or fraud-prevention purposes.
As you follow your personalized protocol, we record which daily steps you complete or skip, along with timestamps, so we can track your progress and adjust your plan.
FORMA includes AI coaching specialists (LUMEN, AURA, EDGE, FORGE, and CHISEL) that you can chat with for personalized guidance. We store your full conversation history with each specialist, along with the advice, plans, and protocols generated for you, and your answers to onboarding questionnaires (such as hair type, style priority, and length).
To generate responses, your messages and relevant profile context are sent to Anthropic (maker of Claude) for AI processing. Relevant excerpts may also be converted into embeddings via Voyage AI to retrieve relevant reference material used to inform your coaching responses. These providers process this data on our behalf and are contractually restricted from using it for any purpose other than providing these services to us.
Subscription purchases are handled through Apple's App Store (In-App Purchase) and managed on our behalf by RevenueCat, which validates receipts and tracks your entitlement status. We do not receive or store your full payment card details — Apple and RevenueCat handle that directly and provide us only with the information needed to confirm your purchase and manage your subscription.
We use PostHog to track product analytics — events such as app opens, scan starts and completions, onboarding progress, paywall views, plan generation, and report views — tied to your account so we can understand how the Service is used and improve it. We use Sentry to capture crash reports and error context (for example, a failed photo upload) to help us find and fix bugs; a sample of activity traces is collected for this purpose.
You can delete your account and all associated data — including your scan photos, computed metrics, coaching conversations, and account information — at any time directly in the app, from Profile → Delete account. This immediately deletes your data across our systems, including your stored photos, and removes your account entirely.
If you're unable to use the in-app option or need help, email support@tryformaai.app with the subject line "Delete my data" and we'll complete deletion for you, except for limited records we're required to keep for legal, tax, or security purposes.
We rely on the following third-party providers to operate the Service. Each is only given the data it needs to perform its function and is contractually restricted from using your data for its own purposes:
Depending on where you live, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can exercise any of these rights by contacting us at support@tryformaai.app. We will respond within a reasonable timeframe and in accordance with applicable law.
The Service is not directed to children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please contact us and we will delete it.
We use industry-standard technical and organizational safeguards — including encryption in transit, private access-controlled storage, and restricted internal access — to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or through the Service before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
If you have any questions about this Privacy Policy or how we handle your data, contact us at support@tryformaai.app.