Privacy at a glance
Table of Contents
This Privacy Policy applies to the Hairmony mobile application ("App") developed and operated by:
PODSuite OÜ
Republic of Estonia, European Union
Email: hairmonyapp@gmail.com
PODSuite OÜ acts as the data controller within the meaning of the EU General Data Protection Regulation (GDPR) in respect of any personal data processed in connection with the App.
Capitalised terms used in this Privacy Policy have the following meanings:
Hair Data - including photos of your scalp, information about hair loss, dandruff, scalp health conditions, and chemical treatment history - is health-adjacent and potentially sensitive personal information. Depending on its content, it may fall within or near the categories of personal data that attract enhanced protection under Art. 9 GDPR (special categories) or equivalent provisions in other jurisdictions.
We handle Hair Data and Photos with care:
By choosing to use the App's analysis features, You consent to the processing of this health-adjacent data for the purposes described in this Policy.
The table below describes all categories of data that may be processed in connection with your use of the App, where that data lives, and the legal basis under GDPR.
| Data Category | Examples | Where It Lives | Legal Basis (GDPR) |
|---|---|---|---|
| Hair profile answers | Birth year, hair type, scalp condition, porosity, density, chemical treatment history, reported concerns | Your Device only | Performance of contract (Art. 6(1)(b)) |
| Hair photos | Photos of your hair and scalp taken for AI analysis | Your Device; transmitted to Anthropic during analysis only (see Section 6) | Performance of contract (Art. 6(1)(b)) |
| Analysis results | Hair scores, metric breakdowns, ingredient match lists, suggested products | Your Device only | Performance of contract (Art. 6(1)(b)) |
| Routine and task data | Hair care routine steps, wash frequency, product lists, task history | Your Device only | Performance of contract (Art. 6(1)(b)) |
| Subscription status | Active/trial/expired state, transaction history, anonymous RevenueCat user ID, device platform/OS, App version, IP address (for fraud detection) | RevenueCat (USA) - see Section 7; Apple/Google handle the actual purchase | Performance of contract (Art. 6(1)(b)) |
| Subscription entitlement link | An anonymous user ID generated per install (including each reinstall), linked to your anonymous RevenueCat ID - no name, email, or Hair Data | Supabase (EU region) - see Section 7 | Performance of contract (Art. 6(1)(b)) |
| Anonymous technical telemetry | App version, device OS, framework errors - collected by Expo SDK; anonymous and non-personal | Expo's infrastructure (see Section 8) | Legitimate interests (Art. 6(1)(f)) - app stability |
| Anonymous product analytics | Screen views, feature usage events, crash reports, app/OS/device class, anonymous distinct ID - collected via PostHog; no identifiers, no session replay | PostHog EU Cloud (European Union) (see Section 9) | Legitimate interests (Art. 6(1)(f)) - product quality |
We do not collect your name, email address, phone number, or any other directly identifying information. The App has no registration flow; the only server-side record tied to your install is an anonymous ID used to manage your subscription (see Section 7) - it holds no Hair Data, Photos, or directly identifying information.
With two limited exceptions - photos transmitted to Anthropic during an active scan, and an anonymous ID used to manage your subscription (see Section 7) - all data you enter into Hairmony is stored exclusively on your Device using local on-device storage. PODSuite OÜ operates no servers that receive, store, or process your Hair Data, analysis results, routine, or Photos.
Practical implications:
The hair analysis feature is powered by Claude, an AI model developed by Anthropic, PBC (548 Market St, San Francisco, CA 94104, USA).
What is transmitted: When you initiate a hair scan, your Photo - along with a structured prompt describing your hair profile - is sent over an encrypted HTTPS connection to Anthropic's API. No other Personal Data is included in this request.
Your photos are not used to train AI models. PODSuite OÜ does not train AI models. Anthropic's API terms prohibit the use of API inputs and outputs for model training absent opt-in consent, which we have not provided. Your photos are processed to generate your analysis result and are not retained by Anthropic beyond their standard safety review window (up to 30 days).
How Anthropic handles your data:
International transfer notice: Anthropic is located in the United States. Transmitting your Photo to Anthropic constitutes a transfer of Personal Data to a third country outside the EU/EEA. This transfer occurs at your explicit instruction (by initiating the scan) and is necessary to perform the service you requested (Art. 49(1)(b) GDPR). By using the AI analysis feature, you acknowledge this transfer.
If you do not wish your Photo to be transmitted to Anthropic, you should not use the AI hair analysis feature.
Subscriptions are sold and billed exclusively by Apple (App Store) or Google (Google Play). PODSuite OÜ does not receive your payment card details, billing address, or any financial information - those remain with Apple and Google and are governed by their respective privacy policies.
RevenueCat as our subscription processor. To validate purchase receipts and track subscription state (active, trial, expired, cancelled) consistently across Apple App Store and Google Play, we use RevenueCat, Inc. (548 Market St, San Francisco, CA 94104, USA). RevenueCat acts as a data processor on our behalf and receives:
$RCAnonymousID:…). We do not call logIn() or pass any identifier of our own - this ID is created by RevenueCat, stored on your Device, and not linked to your name, email, or any account identifier (we hold none).RevenueCat does not receive your payment card details, billing address, real name, email, or any other Personal Data - those never leave Apple or Google.
International transfer notice: RevenueCat is located in the United States. Transmitting the data above to RevenueCat constitutes a transfer of Personal Data to a third country outside the EU/EEA. This transfer is governed by the Data Processing Addendum incorporated into RevenueCat's Terms of Service, which includes the European Commission's Standard Contractual Clauses as the safeguard for personal data transfers (Art. 46 GDPR). The transfer is necessary to perform the subscription contract you enter into when you subscribe (Art. 6(1)(b) GDPR).
Retention: RevenueCat retains subscription and transaction data for as long as your subscription is active and for a reasonable period thereafter for accounting, tax, and dispute-resolution purposes, in line with RevenueCat's own retention policy.
RevenueCat's full handling of this data is governed by their Privacy Policy and described in their Security overview.
Anonymous subscription identifier (Supabase). To keep track of which install is entitled to a subscription, the App generates an anonymous user ID and stores it - linked to your anonymous RevenueCat ID - in a database we operate on Supabase (Supabase, Inc.). A fresh anonymous ID is generated on each install, including every reinstall. This record exists solely to resolve your subscription entitlement and contains:
Supabase holds no Hair Data, Photos, scan results, routine, or profile answers - only the anonymous identifier link described above. We use Supabase's EU region, so this data is hosted within the European Union and is not transferred to a third country.
Supabase acts as a data processor on our behalf under its Data Processing Addendum, and its handling of data is governed by its Privacy Policy. The transfer of this anonymous identifier to Supabase is necessary to perform the subscription contract you enter into when you subscribe (Art. 6(1)(b) GDPR).
Hairmony is built using the Expo framework (by Expo, Inc.). Expo may collect limited, anonymous technical telemetry as part of its SDK operation - such as framework version, device platform, and anonymised crash or error reports.
This data, if collected, is:
To our knowledge, Expo telemetry does not include your Hair Photos, profile answers, scan results, or any other App-specific content.
To understand how the App is used in aggregate - which features people reach, which screens are visited, and where the App crashes - we use PostHog, an open-source product analytics platform operated by PostHog Inc. We use PostHog's EU Cloud instance, hosted on infrastructure located within the European Union.
What is collected:
What is not collected: No Hair Data, no Photos, no scan results, no routine details, no session replay or screen recording, no keystroke logging, and no profile-level identifier (no name, email, account ID, advertising ID).
Where it is processed: All PostHog event data is stored on PostHog's EU Cloud infrastructure within the European Union. No personal data is transferred outside the EU/EEA through this analytics integration.
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) - improving App stability, usability, and feature quality. Because the data is limited to anonymous product-usage signals and is not linkable to an identifier we can resolve to a real person, the impact on your privacy is minimal.
PostHog's full handling of this data is governed by their Privacy Policy. If you wish to have the events associated with your install deleted, see Section 12.
PODSuite OÜ does not:
The App's only source of revenue is a direct subscription fee. Your data is not the product.
The App's device-only architecture means that, in normal use, your Personal Data does not leave your country. Two limited exceptions apply, both involving transfers to the United States:
Our product analytics provider (PostHog, on its EU Cloud instance) and our subscription-entitlement database (Supabase, on its EU region) are both hosted within the European Union, so the data they hold remains in the EU and does not constitute a transfer to a third country. No other Personal Data is transferred outside the EU/EEA by PODSuite OÜ.
Because all App data is stored on your Device, you are always in direct control of deletion. Here is exactly what to do for each data type:
The easiest path - in-app deletion: The App provides a built-in "Delete my data" button in its settings. Tapping it permanently and immediately erases all locally stored App data (Hair profile, scan history, routine, locally stored Photos, and your anonymous PostHog distinct ID) from your Device. If you continue to use the App after this, you will be treated as a brand new User: a fresh anonymous distinct ID will be generated, and no prior events or data will be linked to your future activity.
We do not hold any Personal Data on our own servers. There is no account to delete with us, and no request form required for the data we handle - uninstalling the App is sufficient for the data we control.
PODSuite OÜ retains no Personal Data on its own servers because it does not operate servers that receive Personal Data.
We take reasonable steps to protect the data processed in connection with the App:
While we strive to protect your data, no security measure is entirely infallible. We recommend keeping your Device's operating system and the App up to date.
The App is intended for adult users making informed decisions about their own hair care. It is not designed for, marketed to, or directed at children, and we do not knowingly or intentionally collect personal information from children.
For the purposes of this Section, the term "child" is interpreted on a case-by-case basis as prescribed by applicable data protection laws. As a general rule, we treat any person under the age of 16 as a child, unless local data protection law permits a lower age or we have received verifiable parental authorization. Holders of parental responsibility are responsible for preventing their children from providing personal information via the App without verifiable parental consent.
About the App Store content rating. Hairmony may carry a "4+" age rating on the Apple App Store. This is a content rating, confirming only that the App contains no objectionable material - it does not indicate that the App is built for or appropriate for young children.
The App has no registration flow and collects no identifying information, so we have no technical means to verify a User's age and rely on parents, guardians, and Users themselves to ensure appropriate use.
If you reasonably believe that a child has provided personal information via the App, please contact us at hairmonyapp@gmail.com and we will erase the information as quickly as possible.
As a resident of the European Union or European Economic Area, you have the following rights under the GDPR:
Practical note: Because we store no Personal Data on our servers, most of these rights are exercisable directly by you - clearing the App's local storage or uninstalling the App erases the data we control. For data processed by Anthropic, RevenueCat, or PostHog, we will forward your request to the relevant provider. Contact us at hairmonyapp@gmail.com - we aim to respond within 30 days.
If you believe that PODSuite OÜ has violated your rights under the GDPR, you have the right to lodge a complaint with a supervisory authority. As an Estonian company, our lead supervisory authority is:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
www.aki.ee ·
info@aki.ee
You may also contact the data protection authority in your own EU member state of residence.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated through the App or on this page. Your continued use of the App after any changes constitutes acceptance of the revised Policy.
For any privacy-related questions, requests, or concerns, please contact us:
PODSuite OÜ
Republic of Estonia, European Union
hairmonyapp@gmail.com
We aim to respond to all privacy inquiries within 30 days.