Privacy Policy
This Privacy Notice for Dude Development LLC (doing business as Hairdaze) — “we,” “us,” or “our” — describes how and why we collect, store, use, and share (“process”) your personal information when you use our services (the “Services”), including when you:
- Download and use our mobile application (Hairdaze), or any other application of ours that links to this Privacy Notice;
- Visit our website at hairdaze.app; or
- Engage with us in other related ways, including support, sales, marketing, or events.
Questions or concerns? Reading this notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have questions, contact us at [email protected].
Summary of key points
What does Hairdaze do with your data? Hairdaze is a haircare tracking app. You log what you do to your hair and how it responds; we run statistical analysis over your own history to find patterns and show them back to you. The data you enter is the product.
Do we process health data? Yes. Information about your hair and scalp condition is health-related information, and with your permission we also read a limited set of data from Apple Health. Some of this is treated as “sensitive” or “special category” information in certain jurisdictions. See Health and wellness data.
Do we sell your data? No. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use health data for advertising or marketing of any kind.
What stays on your device? A great deal of it, by design. Where we read data from Apple Health, the raw measurements are converted into simple signals on your iPhone, and the raw values are never transmitted to us. See Health and wellness data.
Do we collect information from third parties? Yes — a small amount. We request local weather conditions, and we look up publicly listed cosmetic ingredient information for products you add. See When and with whom do we share.
Do we use AI? Yes, for one narrow purpose: turning statistical results our own system has already produced into readable sentences. See Automated analysis and AI.
How do you exercise your rights? You can export or delete your data from inside the app, or contact us at [email protected]. See Your privacy rights.
1. What information do we collect?
In short: We collect the information you enter into the app, a limited set of health signals you choose to share, your location if you enable weather features, and standard technical information from your device.
Information you provide to us
Account information. When you create an account we collect your email address and a password, which is stored in hashed form and is never visible to us. If you sign in with Apple, we receive the identifier Apple provides and the email address you choose to share, which may be a private relay address.
Hair profile. Information you give us about your hair so the app can be useful to you: hair type and texture, porosity, density, scalp characteristics, length, chemical treatment history, and the goals and concerns you select.
Daily logs. The core of the Services. For each day you may record: whether you washed, which routine steps you performed, which of your products you used and how you applied them, how you styled or protected your hair, what your hair was exposed to, an overall rating of the day, and optional observations about your hair condition — greasiness, breakage, frizz, dryness, tangling, and scalp itchiness. You may also add free-text notes.
Every condition observation is optional. A question you skip is not recorded as an answer of any kind. The app is built so that “I did not answer” and “I observed none of this” are stored differently and cannot be confused, and our database refuses to store any value meaning “declined” or “not applicable.”
Your product shelf. The haircare products you tell us you own, and the ingredient information associated with them.
Photographs. If you use the ingredient scanner, the app uses your camera to read the ingredient list printed on a product. We collect the images or text you choose to submit through that feature.
Support correspondence. If you contact us, we keep your message and our reply.
Payment data. If you purchase a subscription, the payment itself is handled by Apple, and subscription status is managed through RevenueCat. We never receive or store your card number. See Apple's privacy notice and RevenueCat's privacy notice.
Location information
Humidity, temperature, and dew point affect how hair behaves, so weather is one of the factors the app can account for. If you grant location permission, we use your device location to request local weather conditions from Apple WeatherKit.
What we store: we retain your most recent position on your profile so that weather can be refreshed without repeatedly waking your GPS, along with the resulting weather readings attached to your logs. That position is rounded to roughly one kilometre before it is stored — enough to look up local humidity, not enough to identify an address. We do not build or retain a location history, and we do not use your location for advertising.
Location is optional. You can decline it, or revoke it later in iOS Settings › Privacy & Security › Location Services. The app works without it; weather simply stops being one of the factors considered.
Information collected automatically
Device and log data. We collect technical information needed to operate and secure the Services: device model and operating system version, app version, language and region settings, IP address, and diagnostic information such as error reports and crash logs. This is used for security, troubleshooting, and understanding whether features work — not to build a marketing profile of you.
All personal information you provide must be true, complete, and accurate, and you must notify us of any changes.
2. Health and wellness data
In short: Hairdaze processes health-related information. Where we read from Apple Health, we convert measurements into simple signals on your device, and the raw values never reach our servers. We never use health data for advertising, and we never sell it.
This section describes the most sensitive information the Services handle. Please read it.
Health information you enter yourself
Your hair and scalp observations — breakage, dryness, itchiness, greasiness, frizz, tangling — describe the condition of your body. Several privacy laws treat this as health data or as “sensitive” personal information, and we treat it that way regardless of where you live.
Information from Apple Health
If you choose to connect Apple Health, Hairdaze requests read-only access. We never write anything to Apple Health.
What leaves your device. Hairdaze reads health data on your iPhone and converts it there into a small number of plain signals. Only those signals are transmitted to us:
poor_sleep— whether sleep was short (true or false)good_sleep— whether sleep was adequate (true or false)low_hydration— whether fluid intake was low (true or false)sweat_load— how physically demanding the day was, on a scale from 0 to 1
Raw health measurements are never transmitted to us. Values such as exact sleep hours, heart rate variability, basal body temperature, and menstrual cycle information remain on your device. This is enforced in our application code and verified by an automated test that fails our build if any such value appears in what the app sends.
Any signal you have not shared is simply absent. We do not record a default, and the absence of a signal is never interpreted as a negative reading.
Our commitments regarding health data
- We do not use health data for advertising or marketing, and we do not permit anyone else to.
- We do not sell health data, and we do not share it for cross-context behavioural advertising.
- We do not disclose health data to third parties except the service providers described in Section 6, who process it on our instructions and may not use it for their own purposes.
- We do not use health data to make decisions about your eligibility for employment, insurance, credit, or housing.
- Data obtained from Apple Health is used only to provide the haircare features you asked for.
Withdrawing access
You can revoke Hairdaze's access to Apple Health at any time in iOS Settings › Privacy & Security › Health › Hairdaze. Revoking access stops further reading immediately. Signals already transmitted remain in your log history until you delete the relevant logs or your account.
Hairdaze is not a medical service
Hairdaze describes patterns in what you have recorded. It does not diagnose, treat, or give medical advice, and it is not a substitute for a clinician, dermatologist, trichologist, or stylist. If the app notices that you have repeatedly logged significant breakage, it may suggest seeing someone in person — that is a prompt, not a finding about your health.
3. How do we process your information?
In short: To run the app, to analyse your own history for you, to keep the Services secure, to support you, and to comply with law.
- To create and manage your account and keep you signed in.
- To deliver the Services — storing your logs, products, plans, and profile, and making them available across your devices.
- To analyse your history and produce insights. This is the central purpose of the app. See Section 5.
- To provide safety-related prompts, such as pausing suggestions that would add heat or tension when you have repeatedly logged breakage.
- To respond to your enquiries and provide support.
- To send administrative information about changes to the Services, terms, or policies.
- To keep the Services secure, including preventing fraud and abuse.
- To diagnose faults and improve the Services, using aggregated and technical information.
- To comply with legal obligations and to establish, exercise, or defend legal claims.
We do not use your personal information for behavioural advertising, and we do not run third-party advertising in the app.
4. What legal bases do we rely on?
In short: We process personal information only where we have a valid legal reason. For health data in the UK and EU, that reason is your explicit consent.
If you are in the UK or European Economic Area
Under the UK GDPR and EU GDPR, we rely on the following bases:
- Performance of a contract. To provide the Services you have signed up for — your account, your logs, and the features you use.
- Explicit consent (Article 9(2)(a)). Health data — both the hair and scalp observations you enter and the signals derived from Apple Health — is special category data. We process it only on the basis of your explicit consent, given when you choose to record it or to connect Apple Health. You may withdraw this consent at any time, which stops further processing; see Section 11.
- Consent. For optional features such as location-based weather and any marketing communications.
- Legitimate interests. To keep the Services secure, prevent abuse, diagnose faults, and improve the app. We balance these against your rights and do not rely on this basis for health data.
- Legal obligation. Where we must retain or disclose information to comply with law.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
If you are in Canada
We process your information with your express consent, or with implied consent where permitted and the purpose would be obvious to a reasonable person. You may withdraw your consent at any time by contacting us.
In limited circumstances, Canadian law permits processing without consent — for example where collection is clearly in your interests and consent cannot be obtained in a timely way; for investigating a breach of an agreement or a contravention of law; where disclosure is required by subpoena, warrant, or court order; or where the information is publicly available and specified by regulation.
5. Automated analysis and AI
In short: The app analyses your own history statistically and describes what it finds. A language model writes the sentences; it does not decide the findings, and it is not given anything that identifies you.
How the analysis works
Hairdaze looks for relationships between what you do and how your hair responds — for example, whether a particular ingredient tends to precede a better or worse outcome for you. The analysis runs over your own logs, not a population model, and applies statistical corrections so that a result is only reported when it is unlikely to be chance. When there is not enough evidence, the app says so rather than guessing.
These are correlations, not causes. The app tells you what has tended to accompany what in your own history. It does not establish that one caused the other.
Where AI is used
Once our system has produced a statistical finding, we use a large language model — Google's Gemini, via Google Cloud Vertex AI — to turn that finding into a readable sentence.
What the model receives. Only the finding itself and the surrounding numerical context. Your user identifier, email address, name, and account details are not included. Every response is validated against the original finding before it is shown to you, and a response that overstates the evidence is rejected rather than displayed.
Under our agreement with Google Cloud, this data is not used to train Google's models.
Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by automated means. The insights the app produces are informational. If this changes, we will tell you, explain the logic involved, and provide a way to request human review.
6. When and with whom do we share your information?
In short: With a small number of service providers who process data on our instructions, and where the law requires. We do not sell your data.
Service providers
| Provider | What they do | What they receive |
|---|---|---|
| Supabase | Database, authentication, and file storage | Account details and all data you enter into the app |
| Google Cloud | Hosting for our analysis service (Cloud Run) and the language model used for wording (Vertex AI) | Your logs during processing; for the language model, findings only, with no identifier |
| Apple | App distribution, sign-in, payments, and WeatherKit | Account and purchase information; location coordinates when weather is requested |
| RevenueCat | Subscription management | A pseudonymous identifier and subscription status. No health data. |
| Open Beauty Facts | Public cosmetic ingredient database | Product names or barcodes you look up. No account or health data. |
Each provider acts on our instructions under a written agreement and may not use your information for their own purposes.
Other situations
- Legal requirements. Where we are required to do so by law, or where disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.
- Business transfers. In connection with a merger, financing, acquisition, or sale of assets. If your information would become subject to a different privacy notice, we will notify you before that happens and tell you what choices you have.
We have not sold or shared personal information for a business or commercial purpose in the preceding twelve months, and we do not intend to. We do not use or disclose sensitive personal information for purposes other than those permitted under applicable law.
7. International transfers of your information
In short: Our servers are in the United States. If you are outside the US, your information is transferred there.
We are based in the United States, and our service providers store and process data on servers located in the United States and other countries. If you access the Services from the UK, the EEA, Canada, or elsewhere, your information will be transferred to, stored in, and processed in the United States, which may not offer the same level of data protection as your own jurisdiction.
Where we transfer personal information out of the UK or EEA, we rely on the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum where applicable, together with supplementary measures as appropriate. You may request a copy of the relevant safeguards by contacting us.
8. How long do we keep your information?
In short: For as long as you have an account, and then only as long as the law requires.
We keep your personal information for as long as you maintain an account with us, because the value of the app depends on your history being available to it. We keep it no longer than necessary for the purposes set out in this notice, unless a longer period is required or permitted by law.
When you delete your account, we delete your personal information from our active systems. Some information may persist for a limited period in encrypted backups, from which it is deleted on the normal backup rotation, and we may retain a minimal record where necessary to comply with law, resolve disputes, or enforce our agreements.
9. How do we keep your information safe?
In short: Encryption in transit and at rest, database-level access rules, and least-privilege access. No system is perfectly secure.
- All traffic between the app and our servers is encrypted using TLS.
- Data at rest is encrypted by our infrastructure providers.
- Access to your records is enforced at the database level by row-level security rules, so one account cannot read another account's data.
- Passwords are stored hashed and are never visible to us or recoverable by us.
- Administrative access is limited to those who need it to operate the Services.
Despite these measures, no transmission over the internet and no storage system can be guaranteed to be completely secure. You should access the Services only within a secure environment.
10. Do we collect information from minors?
In short: Hairdaze is for adults. We do not knowingly collect data from anyone under 18.
The Services are intended for users who are at least 18 years old. We do not knowingly collect, solicit data from, or market to children under 18, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18.
If we learn that we have collected personal information from a person under 18, we will deactivate the account and take reasonable measures to delete that data promptly. If you believe we may have collected such data, contact us at [email protected].
11. What are your privacy rights?
In short: You can access, correct, export, and delete your information, and withdraw consent. Most of this you can do yourself inside the app.
Rights available to you
- Access — obtain confirmation of whether we process your information, and a copy of it.
- Correction — have inaccurate information corrected.
- Deletion — have your information erased.
- Portability — receive your data in a portable, machine-readable format.
- Restriction and objection — ask us to restrict processing, or object to processing carried out on the basis of our legitimate interests.
- Withdrawal of consent — withdraw consent at any time where we rely on it, including for health data and location.
- Complaint — lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office; in the EEA, your national data protection authority; in Canada, the Office of the Privacy Commissioner.
How to exercise them
In the app, open Profile › Privacy & Data to export your data or delete your account. You can also email [email protected]. We will respond within the period required by applicable law.
We may need to verify your identity before acting on a request. We will use the information you provide for that purpose only.
12. Controls for Do-Not-Track features
Most browsers and some mobile operating systems offer a Do-Not-Track (“DNT”) setting. No uniform standard for recognising DNT signals has been finalised, and we do not currently respond to them. California law requires us to disclose this. If a standard is adopted that we must follow, we will update this notice.
Hairdaze does not track you across other companies' apps or websites, and does not request the iOS App Tracking Transparency permission.
13. Do United States residents have specific privacy rights?
In short: Yes. If you live in a state with a comprehensive privacy law, you have rights of access, correction, deletion, portability, and opt-out.
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or another state with a comprehensive consumer privacy law, you may have the rights described below.
Categories of personal information we collect
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Email address, account name, unique identifiers, IP address | YES |
| B. Personal information under the California Customer Records statute | Name, contact information, financial information | NO |
| C. Protected classification characteristics | Gender, age, race and ethnicity, other demographic data | NO |
| D. Commercial information | Transaction and purchase history | YES |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other network activity | How you use the app, features accessed, diagnostic logs | YES |
| G. Geolocation data | Device location, used to retrieve local weather | YES |
| H. Audio, electronic, sensory, or similar information | Photographs of product ingredient labels you scan | YES |
| I. Professional or employment-related information | Job title, work history | NO |
| J. Education information | Student records | NO |
| K. Inferences drawn from personal information | Patterns identified in your logs, and the insights generated from them | YES |
| L. Sensitive personal information | Health data — hair and scalp condition, and signals derived from Apple Health; precise geolocation | YES |
We collect this information directly from you, automatically from your device, and — for weather and ingredient information — from the third-party sources named in Section 6. We retain it for as long as you have an account with us.
Sale, sharing, and sensitive information
We have not sold or shared personal information for a business or commercial purpose in the preceding twelve months, and we will not do so in future. We do not use or disclose sensitive personal information for any purpose other than providing the Services you requested, which under California law means no right to limit its use applies. You may nonetheless withdraw consent to our processing of health data at any time; see Section 11.
We do not process personal information for targeted advertising or for profiling in furtherance of decisions producing legal or similarly significant effects.
Your rights
- Right to know whether we are processing your personal data, and to access it
- Right to correct inaccuracies
- Right to request deletion
- Right to obtain a copy of the data you shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of targeted advertising, sale, or profiling — none of which we carry out
- Right to limit the use and disclosure of sensitive personal information, where applicable
To exercise these rights, email [email protected] or use the export and deletion tools in Profile › Privacy & Data. You may designate an authorised agent to make a request on your behalf, with proof of authorisation.
Appeals. If we decline to act on your request, you may appeal by emailing [email protected] with “Privacy Appeal” in the subject line. We will respond in writing with our reasoning. If your appeal is denied, you may complain to your state attorney general.
California “Shine the Light” law. California residents may request, once a year and free of charge, information about categories of personal information we disclosed to third parties for their direct marketing purposes. We do not disclose personal information for such purposes.
14. Consumer health data (Washington and Nevada)
Washington's My Health My Data Act and Nevada Revised Statutes Chapter 603A give residents of those states specific rights over consumer health data. Because Hairdaze processes health-related information, we maintain a separate notice covering those rights.
See our Consumer Health Data Privacy Policy.
15. Do we make updates to this notice?
Yes. We will update this notice as necessary to stay accurate and compliant. The updated version will be indicated by a revised “Last updated” date. If we make material changes, we will notify you prominently in the app or by email. Where a change affects processing that relies on your consent, we will ask for your consent again rather than assuming it.
16. How can you contact us about this notice?
Email us at [email protected], or write to:
Dude Development LLC (dba Hairdaze)
572 John Ross Parkway, Suite 107
Rock Hill, SC 29730
United States
17. How can you review, update, or delete your data?
You have the right to request access to the personal information we hold about you, details of how we have processed it, correction of inaccuracies, and deletion.
The fastest route is inside the app: open Profile › Privacy & Data, where you can export your complete history or delete your account and all associated data. You can also email [email protected].