Last updated 14 October 2026
Timothy Birkl runs Skinspark under the name lunupa, Sterzingerstr. 44, 83024 Rosenheim, Germany. Questions about your data go to hola@lunupa.com.
Skinspark is for ages 18 and over. We ask for your birth month and year, nothing more, and keep them with your profile. If you are under 18, the app stops and deletes what is on your device; it will not ask again for 24 hours. If you have an account and change your age to under 18, you are asked for your password to delete the account and everything in it, or you can correct the date. You can also sign out without deleting: this device is then wiped and blocked for 24 hours, and the account stays until you write to hola@lunupa.com and we delete it. The same applies to an account whose saved birth date is under 18.
Your skin profile, swipes, saved products, shelf and routines are stored on your own device only (in your browser, or in the iPhone app). They never reach our server. Clearing your browser data, deleting the app, or "Clear everything on this device" under Profile, deletes them.
We store your email address, a check value made from your password (the password cannot be worked out from it), the time you agreed to this notice, and one file with your skin profile, swipes, saved products, shelf, routines and products you typed in or scanned. If you ask to change your email, we also keep the new address until you confirm it or the link expires.
Your skin type, skin concerns, skin conditions (such as rosacea or eczema) and whether you are pregnant are health data. Conditions and pregnancy are stored only if you tick them. We store them only because you ticked the box when you made the account (explicit consent, Article 9(2)(a) and Article 6(1)(a) GDPR), and use them only to score products for you. You can withdraw this at any time by deleting your account under Profile. We keep both until you delete the account; deleting removes the login and the file at once.
After you sign in, the server sets a cookie that keeps you signed in for 90 days. The account does not work without it, so we do not ask for consent to it. Signing out ends it.
Under Profile you can download everything we hold about you as one file, change your password, and delete the account.
A photo of an ingredient list is read on your phone. The photo never leaves it; only the text you choose to keep is saved.
When you scan a barcode that is not among our products, our server asks Open Beauty Facts for it. Open Beauty Facts sees our server and the barcode, not you. If it has a photo of the product, your browser loads that photo from images.openbeautyfacts.org, which then sees your IP address.
The camera is only used while the scan screen is open, and nothing from it is recorded.
If a product is missing, you can send it in. We store the barcode, name, brand, product type, ingredient list, the time, and a photo of the front if you add one. No name, email, account or IP address is stored with it. To stop one person sending hundreds, the server keeps your IP address in memory for up to a day; it is never written to disk.
We check each product by hand. If we add it, everyone using Skinspark can see the product, its ingredient list and your photo; you agreed to that when you ticked the box. Send only photos you took that show the product and nothing else. To have a product or photo removed, write to hola@lunupa.com.
The shop buttons (YesStyle, Shop Apotheke, Douglas, Lookfantastic, Ecco Verde, dm, Amazon) open that shop's site. Nothing is sent to them until you tap one. A plain search link earns us nothing.
Where a button shows a price, it is an ad link through Awin, an affiliate network: if you buy, the shop may pay us a commission. When you tap it, Awin and the shop set their own cookies to count the sale; their privacy notices apply. Prices and some product photos come from the shop's own product list; we store those photos on our server, so loading them sends nothing to the shop.
To pick shops that deliver to you, the app guesses your country from your device's time zone or language, on your device. You can change it under Profile. It is saved with your profile.
Anyone 18 or over with an account can make an invite link under Profile. We store the name you pick and the time you agreed to these terms. When someone makes an account through your link, we store that your link brought them. You see how many signed up and what you earned, never who they are. The person you invited sees your link name in their data download.
Paid plans are not live yet. Once they are, you get 30% of what Skinspark receives from each person you invited, for as long as they pay. What Skinspark receives is the price after VAT, app store fees and card fees, so it is less than the price shown. Each share is held for 14 days after the payment, then paid out. Refunds and chargebacks earn nothing; if one comes after we paid you, it comes off your next payout. Your own payments earn nothing either: a second account, an email alias or a card you have paid with yourself counts as you. To check the card, we keep a code from the payment service that tells cards apart without showing the number.
We pay out through a payout service, which needs your name and payout details; its own privacy notice applies. We may change the share or end the program for future payments with 30 days' notice by email. What you already earned stays yours. Deleting your account removes your link and any share not yet paid out. Payment records stay as long as tax law requires.
The web server logs every request: the page, the time, your browser, and your IP address, which is turned into a short code before it is stored. We use this to spot attacks and errors (legitimate interests, Article 6(1)(f) GDPR). The log is deleted after 90 days.
The server belongs to DigitalOcean and is in New York, USA. DigitalOcean has joined the EU-US Data Privacy Framework, which the European Commission recognises as adequate protection.
When you ask for a password reset or change your email, we email you a link through Resend, an email service in the USA. Resend gets the address and the email text, nothing else.
You can ask for a copy of your data, have it corrected, deleted or restricted, and get it in a format you can use elsewhere. Write to hola@lunupa.com. You can complain to a data protection authority; for lunupa that is the Bavarian Data Protection Authority (lda.bayern.de).
Scores come from a fixed set of rules applied to the ingredient list. They are a guide, not medical advice, and no decision about you is made with them. For a rash, acne that will not settle, or any other skin problem, ask a doctor or dermatologist.
Product names, ingredient lists and photos come from Open Beauty Facts. The database is available under the Open Database Licence and the photos under Creative Commons Attribution-ShareAlike. We cut the products out of the photos and resized them; our edited photos are shared under the same licence.
Ingredient lists for Korean and Japanese brands come from INKEEDecoder (formerly INCIDecoder). We do not use their photos; those products show a drawn picture.
Some products were sent in by people using Skinspark, with their own photo of the pack, and checked by us before they were added.