Privacy at a glance
Table of Contents
This Privacy Policy applies to the Hairmony mobile application ("App") developed and operated by:
PODSuite OÜ
Republic of Estonia, European Union
Email: hairmonyapp@gmail.com
PODSuite OÜ acts as the data controller within the meaning of the EU General Data Protection Regulation (GDPR) in respect of any personal data processed in connection with the App.
Capitalised terms used in this Privacy Policy have the following meanings:
Hair Data (including photos of your scalp, information about hair loss, dandruff, scalp health conditions, and chemical treatment history) is health-adjacent and potentially sensitive personal information. Depending on its content, it may fall within or near the categories of personal data that attract enhanced protection under Art. 9 GDPR (special categories) or equivalent provisions in other jurisdictions.
We handle Hair Data and Photos with care:
The App asks for Your explicit permission before any of it is sent for AI analysis (Section 6). By giving it and using the App's analysis features, You consent to the processing of this health-adjacent data for the purposes described in this Policy. You can withdraw that permission at any time in Settings → Privacy → AI Photo Analysis.
The table below describes all categories of data that may be processed in connection with your use of the App, where that data lives, and the legal basis under GDPR.
| Data Category | Examples | Where It Lives | Legal Basis (GDPR) |
|---|---|---|---|
| Hair profile answers | Birth year, gender, hair type, scalp condition, porosity, density, chemical treatment history, reported concerns, notes you add | Your Device; sent to Anthropic as part of a scan (Section 6); only hair type, porosity, thickness, and density to PostHog if usage analytics is on (Section 9) | Performance of contract (Art. 6(1)(b)) |
| Hair photos | Two photos taken for AI analysis: the top of your head, and your hairline from the front, which shows part of your face | Your Device; passed through our server to Anthropic during analysis only, never stored by us (see Section 6) | Performance of contract (Art. 6(1)(b)) |
| Product label photos | Photos of a product's ingredient list or front label, taken with the Product Scanner | Passed through our server to Anthropic while the scan runs, never stored by us (see Section 6) | Performance of contract (Art. 6(1)(b)) |
| Analysis results | Hair scores, metric breakdowns, ingredient match lists, suggested products, product label readings | Your Device; a copy of each AI result on our server, kept for 7 days (Section 7), except the brand, product name, and product type of a product we could not match and for which no usable barcode was read, which is kept as a Product Scanner contribution (below) | Performance of contract (Art. 6(1)(b)) |
| Routine and task data | Hair care routine steps, wash frequency, product lists, task history | Your Device only | Performance of contract (Art. 6(1)(b)) |
| Subscription status | Active/trial/expired state, transaction history, anonymous RevenueCat user ID, device platform/OS, App version, IP address (for fraud detection) | RevenueCat (USA) (see Section 7); Apple/Google handle the actual purchase | Performance of contract (Art. 6(1)(b)) |
| Anonymous ID and scan records | A random anonymous user ID per install (new on each reinstall); a record of each AI request (type, time, tier, token count, outcome); a copy of each AI result, kept for 7 days; your remaining scan allowance. No name, email, or Photos | Supabase (EU region) (see Section 7) | Performance of contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)): preventing abuse |
| Product Scanner contributions | Barcode-to-product pairings, barcodes that matched no product, the brand, product name, and product type read from a product that matched no product and had no barcode we could use, and product details you choose to submit (brand, product name, product type, ingredient list read from the label), each with the country your Device is in (Section 7) | Supabase (EU region) (see Section 7) | Legitimate interests (Art. 6(1)(f)): improving the product catalog |
| App journey steps | Which steps were reached (app opened, onboarding started, a question reached, paywall viewed, purchase completed, a product scan's outcome), never your answers | Supabase (EU region) (see Section 7) | Legitimate interests (Art. 6(1)(f)): finding where the App loses people |
| Anonymous technical telemetry | App version, device OS, framework errors; collected by Expo SDK; anonymous and non-personal | Expo's infrastructure (see Section 8) | Legitimate interests (Art. 6(1)(f)): app stability |
| Product analytics (optional) | Screen views, feature usage events, products recommended, viewed, or liked (with their match scores), crash reports, app/OS/device class, anonymous distinct ID, your anonymous Support ID, basic hair traits (hair type, porosity, thickness, density); collected via PostHog; no Photos, no hair scores or hair needs, no advertising ID, no session replay | PostHog EU Cloud (European Union) (see Section 9) | Outside the US: consent (Art. 6(1)(a)). US devices: on by default, with an opt-out |
| Ad measurement (optional) | Install, app-open, and session events; Meta's anonymous install ID and Google's app instance ID; device and app information, IP address (Google keeps only a coarse location); your device's advertising ID (IDFA on iOS, Android advertising ID on Android); iOS vendor ID (Google); trial, purchase, and renewal events sent by RevenueCat, with your Support ID. No Hair Data or Photos | Meta (EU/USA), Google (EU/USA); RevenueCat (USA) (see Section 10) | Outside the US: consent (Art. 6(1)(a) GDPR, and Art. 5(3) ePrivacy Directive as implemented nationally, e.g. § 25 TDDDG in Germany). US devices: on by default, with an opt-out. On iOS, also Apple's tracking permission |
We do not collect your name, email address, phone number, or any other directly identifying information. The App has no registration flow. Everything our server holds is tied only to a random anonymous ID for your install (see Section 7). It never includes your Photos, your name, or your email.
Your hair profile answers, scan history, Photos, and routine are stored on your Device using local on-device storage. PODSuite OÜ operates no servers that store your Photos, profile answers, or routine. What does leave your Device: Photos and hair profile answers sent to Anthropic while a scan runs, only after you allow it (Section 6); the service records our server keeps under your anonymous ID, including a copy of each AI result, kept for 7 days (Section 7); and, only if switched on, usage analytics (Section 9) and ad measurement (Section 10).
Practical implications:
The App's hair analysis and the Product Scanner's label reading are powered by Claude, an AI model developed by Anthropic, PBC (548 Market St, San Francisco, CA 94104, USA).
Your permission comes first: Nothing is sent to Anthropic until you allow it. Before the App sends anything for the first time, it shows you what is sent, who receives it, and how long it is kept, and asks whether to allow AI photo analysis. One permission covers both hair and product scans. If you tap "Not now", nothing is sent and the scan does not run; barcode scans, which never use AI, keep working. You can withdraw your permission at any time in Settings → Privacy → AI Photo Analysis: from then on nothing is sent, and the App asks again before your next photo scan. Withdrawing does not undo what was already sent; to ask for its earlier deletion, see Section 13.
What is transmitted: When you start a hair scan, the App sends your two hair Photos (one of the top of your head, and one from the front, which shows your hairline and part of your face) and your profile answers (your birth year and gender, what you told the App about your hair and scalp, chemical treatments, and any notes you add) over an encrypted HTTPS connection to our server function (on Supabase, see Section 7). On later scans, the request also carries the hair profile and scores from your earlier scans, so that results stay consistent. Our server checks your subscription and scan allowance and forwards the request to Anthropic's API. Before the analysis, the same Photos may also be sent on their own, for a quick check that they show your hair clearly enough. Our server does not store the Photos; it keeps a copy of the AI's result for 7 days, so that an interrupted scan can still finish (Section 7). No name, email, or anonymous ID is added to these requests.
Product Scanner: The barcode is read by your phone's camera, on your Device, and barcode scans never use AI. If the barcode matches a product we know, no photo is sent. Otherwise, once you have allowed AI photo analysis, the App sends a photo of the product's front label (to identify the product) or of its ingredient list (to read the ingredients) to Anthropic the same way. These photos show the product, not you, and are not stored by us.
Your photos are not used to train AI models. PODSuite OÜ does not train AI models. Anthropic's API terms prohibit the use of API inputs and outputs for model training absent opt-in consent, which we have not provided. Your photos are processed to generate your analysis result and are not retained by Anthropic beyond their standard safety review window (up to 30 days), unless they are flagged for misuse (see below).
How Anthropic handles your data:
International transfer notice: Anthropic processes this data in the United States, outside the EU/EEA. That transfer is protected by the European Commission's Standard Contractual Clauses (Art. 46 GDPR), which are part of Anthropic's Data Processing Addendum.
Subscriptions are sold and billed exclusively by Apple (App Store) or Google (Google Play). PODSuite OÜ does not receive your payment card details, billing address, or any financial information. Those remain with Apple and Google and are governed by their respective privacy policies.
RevenueCat as our subscription processor. To validate purchase receipts and track subscription state (active, trial, expired, cancelled) consistently across Apple App Store and Google Play, we use RevenueCat, Inc. (548 Market St, San Francisco, CA 94104, USA). RevenueCat acts as a data processor on our behalf and receives:
On our instruction, RevenueCat forwards subscription events (trial started, initial purchase, trial converted, renewal; with product, price, currency, time, and your anonymous app user ID) to Meta's Conversions API, and to Google Analytics, which passes selected events to Google Ads as conversions; Google also receives cancellation, expiration, and billing-issue events. RevenueCat sends events to each provider only for installs that carry that provider's ID above, which means only while Ad Measurement is on, and on iOS only once you have also allowed tracking (see Section 10).
RevenueCat does not receive your payment card details, billing address, real name, email, or any other Personal Data. Those never leave Apple or Google.
International transfer notice: RevenueCat is located in the United States. Transmitting the data above to RevenueCat constitutes a transfer of Personal Data to a third country outside the EU/EEA. This transfer is governed by the Data Processing Addendum incorporated into RevenueCat's Terms of Service, which includes the European Commission's Standard Contractual Clauses as the safeguard for personal data transfers (Art. 46 GDPR). The transfer is necessary to perform the subscription contract you enter into when you subscribe (Art. 6(1)(b) GDPR); the Meta and Google IDs are sent only with your consent, or on US devices until you opt out, and on iOS only once you have also allowed tracking (Section 10).
Retention: RevenueCat retains subscription and transaction data for as long as your subscription is active and for a reasonable period thereafter for accounting, tax, and dispute-resolution purposes, in line with RevenueCat's own retention policy.
RevenueCat's full handling of this data is governed by their Privacy Policy and described in their Security overview.
Our server (Supabase). We run the App's server side on Supabase (Supabase, Inc.). When you first open the App, it creates a random anonymous user ID for your install (a new one on each install, including every reinstall). Everything our server holds is tied to that ID:
Our server never holds your Photos, name, email, profile answers, or routine. We use Supabase's EU region, so this data is hosted within the European Union and is not transferred to a third country.
Supabase acts as a data processor on our behalf under its Data Processing Addendum, and its handling of data is governed by its Privacy Policy. The anonymous ID, the AI request records, and the copies of AI results are necessary to provide the scans and subscription you use (Art. 6(1)(b) GDPR) and to protect the service from abuse (Art. 6(1)(f) GDPR). Product Scanner contributions and app journey steps rest on our legitimate interests (Art. 6(1)(f) GDPR) in improving the product catalog and the App; they hold product facts and step names, not your answers, and you can object at any time (Section 17).
Hairmony is built using the Expo framework (by Expo, Inc.). Expo may collect limited, anonymous technical telemetry as part of its SDK operation, such as framework version, device platform, and anonymised crash or error reports.
This data, if collected, is:
To our knowledge, Expo telemetry does not include your Hair Photos, profile answers, scan results, or any other App-specific content.
To understand how the App is used in aggregate (which features people reach, which screens are visited, and where the App crashes), we use PostHog, an open-source product analytics platform operated by PostHog Inc. We use PostHog's EU Cloud instance, hosted on infrastructure located within the European Union.
When it is on: Usage analytics follows the same rule as ad measurement (Section 10), based on where your Device is:
Either way, you can change it at any time in Settings → Privacy → Share Usage Analytics. Switching it off stops collection immediately.
What is collected:
What is not collected: No Photos, no hair scan scores (overall or per trait, such as scalp, hair loss, dandruff, and frizz), no hair needs, no text of your scan results, no birth year or gender, no session replay or screen recording, no keystroke logging, and no identifier that points to you as a person (no name, email, phone number, or advertising ID), only the random anonymous IDs above. PostHog processes this data only on our behalf; it is never passed to advertisers, Meta, or Google.
Where it is processed: All PostHog event data is stored on PostHog's EU Cloud infrastructure within the European Union. No personal data is transferred outside the EU/EEA through this analytics integration.
Legal basis: Outside the US, your consent (Art. 6(1)(a) GDPR, and Art. 5(3) ePrivacy Directive as implemented nationally, e.g. § 25 TDDDG in Germany), which you can withdraw at any time with the switch. On US devices, analytics is on by default and the switch is your opt-out.
PostHog's full handling of this data is governed by their Privacy Policy. If you wish to have the events associated with your install deleted, see Section 13.
We advertise Hairmony on Facebook, Instagram, and Google. To see which of our ads lead to installs and subscriptions (so we can spend our ad budget on ads that work), the App contains two measurement tools: Meta's software development kit (SDK) and Google Analytics for Firebase. Both are used only for ad measurement. They are not used to show ads inside the App (there are none), the App logs no events of its own to either, and there is no Facebook or Google sign-in.
When it is on: one switch covers both.
The switch is in Settings → Privacy → Ad Measurement. Until it is on, and on iOS until you have also allowed tracking, neither tool collects or sends anything to Meta or Google.
Apple's tracking permission (iOS): Apple counts this kind of ad measurement as tracking, so on an iPhone or iPad it also needs your answer to Apple's App Tracking Transparency prompt, which offers "Allow" and "Ask App Not to Track". Apple's permission comes on top of the switch above; it does not replace it.
What Meta receives while it is on:
What Google receives while it is on:
analytics_storage, ad_storage, and ad_user_data). Ad personalisation stays denied at all times, so this data is not used for personalised ads or remarketing.On iOS, Apple's SKAdNetwork may also send Meta and Google an anonymous, delayed notice that an install came from one of their ads; it contains no information about you.
Never shared with Meta or Google: your Hair Data, Photos, scan results, hair profile answers, routine, or product scans, and no name or email, because we have none.
Switching it off stops all further sharing with both: the Meta SDK stops logging and stops reading the advertising ID; Google Analytics collection is switched off, its consent signals go back to denied, and the Analytics data and app instance ID on your Device are reset; neither tool is started on later launches; and both IDs are deleted from your RevenueCat record, so no further subscription events are sent. Events already sent stay with Meta and Google; withdrawing consent does not affect processing that took place before it.
Meta's role: For the collection of these events and their transmission to Meta, PODSuite OÜ and Meta Platforms Ireland Limited are joint controllers under Meta's Controller Addendum. What Meta does with the data after receiving it (for example matching events to ad views to report our campaign results), Meta decides as an independent controller, under the Meta Privacy Policy. You can exercise your GDPR rights for data Meta has received directly against Meta Platforms Ireland, through the Meta Privacy Center; you can also contact us and we will forward your request.
Google's role: For Google Analytics for Firebase, Google acts as our processor under the Google Ads Data Processing Terms: it processes this data on our behalf, and we have not allowed Google to use it for its own products and services. When our Analytics data is passed to Google Ads to measure our campaigns, Google acts as an independent controller for that processing under the Google Ads Controller-Controller Data Protection Terms. How Google handles it is described in the Google Privacy Policy and in How Google uses information from sites or apps that use our services. For data Google processes as a controller, you can exercise your rights directly against Google; you can also contact us and we will act on or forward your request.
International transfer notice: Meta and Google may transfer this data to Meta Platforms, Inc. and Google LLC in the United States. Both are certified under the EU-U.S. Data Privacy Framework (see the list at dataprivacyframework.gov, and Meta's and Google's own framework pages), which the European Commission has found to provide an adequate level of protection (Art. 45 GDPR). Where that framework does not apply, they rely on the European Commission's Standard Contractual Clauses (Art. 46 GDPR).
Legal basis: Outside the US, your consent (Art. 6(1)(a) GDPR, and Art. 5(3) ePrivacy Directive as implemented nationally, e.g. § 25 TDDDG in Germany), which you can withdraw at any time with the switch. On US devices, ad measurement is on by default and the switch is your opt-out (see Section 18). On iOS, Apple's tracking permission is needed as well, in every country; you can withdraw it at any time in your device's settings.
PODSuite OÜ does not:
The App's only source of revenue is a direct subscription fee. Your data is not the product.
Most processing stays within the European Union: our server (Supabase, on its EU region) and our product analytics provider (PostHog, on its EU Cloud instance) are both hosted in the EU, so the data they hold does not constitute a transfer to a third country. Four limited exceptions involve transfers to the United States:
No other Personal Data is transferred outside the EU/EEA by PODSuite OÜ.
Most App data is stored on your Device, so you are in direct control of deleting it. Here is exactly what to do for each data type:
The easiest path, in-app deletion: The App provides a built-in "Delete my data" button in its settings. Tapping it permanently and immediately erases all App data stored on your Device (hair profile, scan history, routine, saved products, and locally stored Photos) and resets your analytics identity: your anonymous PostHog distinct ID is replaced, and your usage-analytics choice returns to the default for your country (off outside the US, where the first run's privacy step asks you again, and on for US devices). If you continue to use the App with usage analytics on, PostHog starts a new analytics profile for you, and your prior events are not merged into it. Both profiles carry the same Support ID, so one deletion request covers both (see below). Deliberately kept, like your other settings: your subscription and the anonymous ID behind it (so you stay subscribed and your Support ID stays the same), your language and region, your Ad Measurement choice together with the Meta and Google install IDs that go with it, and any scan cooldown in progress. The button does not touch our server records (see below).
Your Support ID: When you email us about data held outside your Device, please include your Support ID, which you can copy in Settings → My Account → Support ID. It is your install's anonymous ID, and it lets us find everything held under it: your install's records on our server (Supabase); your RevenueCat record, including the Meta and Google install IDs stored there while Ad Measurement is on; and, if usage analytics was on, your PostHog analytics events.
There is no account to delete with us and no request form required. For everything stored on your Device, the in-app button or uninstalling the App is enough; for anything held elsewhere, one email to us is enough.
PODSuite OÜ keeps no Personal Data beyond the anonymous server records described in Section 7.
We take reasonable steps to protect the data processed in connection with the App:
While we strive to protect your data, no security measure is entirely infallible. We recommend keeping your Device's operating system and the App up to date.
The App is intended for adult users making informed decisions about their own hair care. It is not designed for, marketed to, or directed at children, and we do not knowingly or intentionally collect personal information from children.
For the purposes of this Section, the term "child" is interpreted on a case-by-case basis as prescribed by applicable data protection laws. As a general rule, we treat any person under the age of 16 as a child, unless local data protection law permits a lower age or we have received verifiable parental authorization. Holders of parental responsibility are responsible for preventing their children from providing personal information via the App without verifiable parental consent.
About the App Store content rating. Hairmony may carry a "4+" age rating on the Apple App Store. This is a content rating, confirming only that the App contains no objectionable material. It does not indicate that the App is built for or appropriate for young children.
The App has no registration flow and asks for no identifying information, so we have no technical means to verify a User's age and rely on parents, guardians, and Users themselves to ensure appropriate use.
If you reasonably believe that a child has provided personal information via the App, please contact us at hairmonyapp@gmail.com and we will erase the information as quickly as possible.
As a resident of the European Union or European Economic Area, you have the following rights under the GDPR:
Practical note: Because most App data is stored on your Device, many of these rights are exercisable directly by you: clearing the App's local storage or uninstalling the App erases it. For data held on our server or processed by Anthropic, RevenueCat, PostHog, Meta, or Google, we will act on your request or forward it to the relevant provider. You can also exercise your rights for data Meta or Google has received as a controller directly against them (Section 10). Contact us at hairmonyapp@gmail.com. We aim to respond within 30 days.
If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia, or Texas), this section applies in addition to the rest of this Policy.
If you believe that PODSuite OÜ has violated your rights under the GDPR, you have the right to lodge a complaint with a supervisory authority. As an Estonian company, our lead supervisory authority is:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
www.aki.ee ·
info@aki.ee
You may also contact the data protection authority in your own EU member state of residence.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated through the App or on this page. Your continued use of the App after any changes constitutes acceptance of the revised Policy.
For any privacy-related questions, requests, or concerns, please contact us:
PODSuite OÜ
Republic of Estonia, European Union
hairmonyapp@gmail.com
We aim to respond to all privacy inquiries within 30 days.