Aunty Curl ("we", "us") provides a personalized hair-care guidance app. This policy explains what we collect, why, and your choices. By using the app you agree to this policy.
Aunty Curl offers educational and cosmetic guidance only. It is not medical advice and is not a substitute for a licensed dermatologist or trichologist.
Information we collect
Account — your email address and a securely hashed password (handled by our authentication provider, Supabase).
Hair profile & quiz answers — curl type, porosity, goals, struggles, budget and brand preferences, and the routines, check-ins, and notes you create.
Photos — if you choose to add hair photos, we process them to analyze your hair texture and condition and to track your progress. Photos may be captured with your camera or selected from your photo library, with your permission.
Approximate location — only if you allow it, we use coarse location to show humidity-aware tips. We do not store a location history.
Purchases — subscription status and transaction identifiers from Apple, via our payments provider (RevenueCat). We never receive your full card details.
Diagnostics — crash and error reports (via Sentry) to keep the app stable.
Push token — if you enable notifications, a device token used to deliver reminders.
How we use your information
To generate your personalized routine, product suggestions, and "council" guidance.
To analyze hair photos you submit and tailor recommendations.
To operate accounts, process subscriptions, send reminders you opt into, and fix bugs.
Photos & AI analysis
When you submit a photo or your quiz answers for analysis, they are sent to our AI provider, Anthropic, solely to generate your results. Per Anthropic's API terms, this data is not used to train their models. Photos you save are stored in our secure storage (Supabase) and are linked to your account. You can delete them at any time by deleting your account.
How we share information
We currently share data only with service providers that help us run the app, under contract and only as needed:
Supabase — authentication, database, and photo storage.
Anthropic — AI analysis of your answers/photos (not used for training).
RevenueCat & Apple — subscription processing and management.
Sentry — crash/error diagnostics.
A weather data provider — to convert coarse location into local humidity.
Railway — backend hosting.
We may in the future share or license aggregated, de-identified data (data that cannot reasonably identify you) with analytics partners, researchers, or other third parties for product improvement, research, or commercial purposes. We may also partner with advertising or data platforms, which may involve sharing certain personal information. If we begin doing so in a way that constitutes a "sale" or "sharing" of personal information under applicable law (such as CCPA), we will update this policy, provide notice in the app, and offer you an opt-out mechanism before such sharing begins.
Affiliate links
Some product links in the app may be affiliate links. If you buy through them, we may earn a small commission at no extra cost to you. This never changes which products we recommend to you.
Data retention
We keep your information for as long as your account is active. When you delete your account, we delete your profile, routines, check-ins, and photos. Backups and legally required records may persist for a limited time.
Your choices & rights (all users)
Delete your account & data directly in the app: Settings → Account → Delete Account.
Control camera, photo, location, and notification permissions in your device settings at any time.
Opt out of marketing emails via the unsubscribe link in any such email.
EU & UK users — GDPR rights
If you are in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases: contract performance (to provide the app), legitimate interests (security, fraud prevention, improving the service), and consent (location access, push notifications, optional analytics). You have the right to:
Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate or incomplete data.
Erasure ("right to be forgotten") — request deletion of your data, subject to legal obligations.
Restriction — ask us to restrict processing in certain circumstances.
Portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interests or for direct marketing.
Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
Lodge a complaint — with your local data protection authority (e.g. ICO in the UK, or your EU Member State's supervisory authority).
To exercise any of these rights, contact us at support@auntycurl.com. We will respond within 30 days.
California users — CCPA / CPRA rights
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:
Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you, and how it is used and shared.
Right to delete — request deletion of personal information we have collected, subject to certain exceptions.
Right to correct — request correction of inaccurate personal information.
Right to opt out of sale or sharing — we do not currently sell or share your personal information. If we begin doing so, we will provide a "Do Not Sell or Share My Personal Information" link before that practice starts.
Right to limit use of sensitive personal information — you may direct us to limit our use of sensitive personal information (such as biometric or health-related data) to what is necessary to perform the services.
Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights.
To submit a CCPA request, contact us at support@auntycurl.com. We will verify your identity before processing the request and respond within 45 days (extendable by a further 45 days with notice).
Other international users
Users in other jurisdictions (including Canada, Australia, Brazil, and others) may have rights under their local privacy laws. We are committed to honoring reasonable data requests regardless of jurisdiction. Contact us and we will do our best to assist.
Children
Aunty Curl is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect their data. If you believe a child has provided us personal information, contact us and we will delete it.
Security & international transfers
We use industry-standard security measures (encryption in transit and at rest, access controls) to protect your data. Our service providers are based in the United States. If you are located outside the US, your data will be transferred to and processed in the US. For transfers from the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent transfer mechanisms. By using the app, you acknowledge this transfer.
Changes
We may update this policy. Material changes will be reflected by the "Effective" date above and, where required by law, we will notify you via the app or email before changes take effect.
Contact & Data Controller
Aunty Council is the data controller for personal data collected through Aunty Curl. For questions, requests, or complaints: support@auntycurl.com.