Privacy Policy

Last Updated: July 11, 2026

1. Introduction

Welcome to HairSync ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, website, and related services (collectively, the "Service").

We are committed to protecting your privacy and ensuring the security of your personal health information. This policy complies with applicable privacy laws including GDPR and CCPA where applicable.

2. Information We Collect

Personal Information

• Name and email address
• Account credentials (encrypted; including Sign in with Apple identifiers)
• Profile information (procedure type, surgery date, doctor/clinic details)

Health Information

• Recovery photos and progress images
• Symptom tracking data (pain levels, swelling, etc.)
• Medication schedules and adherence
• Recovery milestones and notes

Community Content

• Posts, comments, and reactions you publish under your pseudonym
• Progress photos you choose to share with the community

Technical Information

• Device information and operating system
• App usage analytics (anonymized)
• Crash reports and performance data

3. How We Use Your Information

We use your information to:

• Provide personalized recovery tracking and insights
• Generate AI-powered photo analysis and coach responses
• Send medication reminders and milestone notifications
• Operate the community and match you with members at your recovery stage
• Improve app functionality and user experience
• Provide customer support and respond to inquiries
• Ensure app security and prevent fraud
• Comply with legal obligations

AI Analysis: If you use AI features, your photos and questions are processed by our AI provider (OpenAI) solely to generate your response. Images and prompts sent through the API are not used to train OpenAI's models under OpenAI's API data policy.

4. Community, Journey Pages, and Clinic Sharing

• Private by default: your recovery photos and tracking data are visible only to your account unless you explicitly share them.
• Community posts are visible to other signed-in HairSync users under your pseudonym — never your real name or email.
• Public journey pages are opt-in. If you enable one, the progress posts you have shared to the community become visible on the web at your journey URL until you turn it off.
• Clinic sharing is opt-in. If you connect with your clinic, the clinic's staff can view your recovery timeline and shared photos until you disable sharing.

5. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information. Health-related data is never used for advertising. We may share information only in these limited circumstances:

Service Providers

• Firebase (Google) for secure data storage, authentication, and analytics
• OpenAI for AI-powered photo analysis and coach responses
• RevenueCat for subscription management
• Apple for app distribution, payments, and crash reporting

Legal Requirements

• When required by law or legal process
• To protect our rights or property
• In case of emergency to protect user safety

Business Transfers

• In connection with a merger, acquisition, or sale of assets (with prior notice)

All third-party providers are contractually required to protect your data and use it only for specified purposes.

6. Data Security

We implement industry-standard security measures:

• Encryption of data in transit and at rest
• Secure cloud storage with Firebase/Google Cloud
• Access rules that restrict your photos and health data to your account
• Regular security reviews and updates

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

• Account information: until account deletion
• Health data and photos: until you delete them or your account
• Community posts: until you delete them or your account
• Analytics data: anonymized after 2 years

You can delete your account and all associated data at any time in the app (Settings → Delete Account) or by contacting us.

8. Your Rights and Choices

Access and Control

• View and download your data
• Correct inaccurate information
• Delete specific data or your entire account

Privacy Settings

• Control notification preferences
• Choose whether to use AI features
• Manage community sharing, journey pages, and clinic sharing

Legal Rights (where applicable)

• Right to be forgotten (GDPR)
• Right to data portability
• Right to object to processing
• Right to restrict processing

9. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it promptly.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States where our servers are located. We ensure that such transfers comply with applicable data protection laws and implement appropriate safeguards. For users in the European Economic Area, we rely on adequacy decisions or Standard Contractual Clauses approved by the European Commission.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy here and in the app. Changes become effective when posted. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. California Residents

Under the California Consumer Privacy Act (CCPA), California residents have additional rights:

• Right to Know: request information about the categories and specific pieces of personal information we collect
• Right to Delete: request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out: opt out of the sale of personal information (note: we do not sell personal information)
• Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights

13. Consent and Lawful Basis

By using our Service, you consent to the collection and use of your information as described in this policy. Where GDPR applies, we process data on the basis of consent (AI analysis and sharing features), contract performance (providing the Service), legitimate interest (app improvement and security), and legal obligation. You may withdraw consent at any time where consent is the lawful basis.

14. Contact Us

Email: support@hairsync.app
Subject line: HairSync — Privacy Inquiry

For GDPR-related inquiries, use the same address with "DPO" in the subject line. We will respond within 30 days (or as required by applicable law).