What CurlCue knows about you, and what it does with it.

The short version

• —CurlCue scores hair products against your hair. To do that it needs a hair profile, and it needs the photos you choose to scan or share. That is what this policy is mostly about.
• —There is no advertising SDK and no analytics SDK in the app. Apart from the services that make features work, the only third-party code in it is a crash reporter, and that is configured to send no personal details.
• —Photos of product labels are read by AI services to extract the text. Messages and photos you send to CurlCue AI go to Anthropic, along with your hair profile, so the answer is about your hair. Your account identity does not go with them. The app asks before any of this is sent, and you can turn the AI features off again under Privacy in your profile.
• —A hair profile is not medical data, and CurlCue does not give medical advice.
• —We do not sell your data, and we do not share it for advertising.
• —You can export everything tied to your account, or delete the account and all of it, from the Profile tab. No email to us required.

What we collect, and why

Your account

Signing up asks for a username, an email address and a password. Sign-in is handled by Supabase Auth, which stores a hash of your password; CurlCue never stores or sees it in readable form. A forgotten password is reset with a six-digit code sent to your email. The confirmation and reset emails are sent through Resend, an email delivery service.

From version 1.0.1 you can sign in with Apple or with Google instead of a password. Apple gives CurlCue an email address, which is a private relay address if you choose to hide yours, and no name. Google gives the email address, the name and the address of the picture on your Google account. These are kept with your sign-in. CurlCue shows neither the name nor the picture and does nothing else with them.

You can add a bio, an avatar, a banner image, and links to your Instagram, TikTok or website. The app also records your phone’s time zone, which it uses to reset weekly allowances and count streaks on your local calendar rather than ours.

The hair quiz comes after you create your account. Your answers stay on your phone until you finish it, and are then saved to your account.

Your hair profile

The quiz asks about your curl pattern (family and type, 1a to 4c), length, strand thickness, density, porosity (or, if you are not sure, how your hair behaves on wash day, which the app uses as a stand-in), scalp condition, color, bleach or heat damage history, how often you use heat now, whether you are in a protective style, how often you wash, how you refresh between washes, the water hardness and climate where you live, the look you are steering toward (shine, volume, feel, frizz tolerance), care goals, and a budget preference.

This is what the score is built from. The one exception is the budget preference: it is stored, and the scoring engine does not read it.

If you use them, hair check-ins and wash-day logs are stored too. A check-in asks how your hair feels on four 1-to-5 scales — moisture, definition, frizz and scalp comfort — then whether you liked how your hair looked that day, and if you did not, which one of six things went wrong (frizzy, flat, greasy roots, crunchy, dry ends, or it did not hold). There is an optional note.

None of this is medical data in the sense of a health record or Apple’s HealthKit. CurlCue does not read or write HealthKit, does not diagnose anything, and does not give medical advice. If you have a scalp condition, ask a professional.

Photos

CurlCue asks for camera and photo-library access, and the permission prompts say why: the camera is used to scan ingredient labels and recognize products, and to take photos of your hair; the photo library is used for hair photos and product photos you choose to share. The app never reads your library on its own. It only receives the photos you pick.

• —Ingredient labels. The photos you take of an ingredients list are sent to Anthropic, which reads the text off them. While you are lining up the shot, the app also sends a small frame about every two seconds for framing tips (too dark, too far, not the label). Text detection for the live view itself runs on the phone.
• —The front of the bottle.When you add a product to the catalogue, the front photo goes to Google Cloud Vision to read the text on it, to Anthropic to sort that text into brand, name, category and size, and to Replicate to remove the background. Anthropic is also asked whether the photo shows a face, an ID card, a bank card, a screen of private messages or anything else that identifies a person. If it does, the app asks you to retake it, because an accepted front photo becomes that product’s picture for every CurlCue user.
• —Hair photos on your profile. You can pin up to three photos to your profile. Who can see them in the app (everyone, your connections, or nobody) is a setting you control, along with the visibility of every other profile field.
• —Photos in CurlCue AI and in posts. You can attach up to three photos to a CurlCue AI message; they are sent to Anthropic with the message. Photos in inspiration posts are shown to whoever can see the post.

Scans, submissions and the catalogue

Scanning a barcode records which product you scanned and when. If the barcode is not in CurlCue’s catalogue, the number, and only the number, is looked up at Open Beauty Facts, an open product database. Reading a label with the camera records that a read happened and which allowance paid for it: the weekly free allowance, credits you earned, or Pro. Products you save, verdicts you record and comparisons you run are stored against your account.

When you submit a product (brand, name, category, size, a price you saw, a link to buy it, photos), the submission is reviewed and, if approved, becomes part of the shared catalogue that every user scans against. A buy link is fetched once from our server to check that it leads to a product page, and any affiliate tags in it are removed. Approved submissions earn you scan credits.

Your routine

Your routine (the steps, the products in them, the order), saved routines, wash-day logs and check-ins, and the streaks, XP, badges and quests the app awards for keeping to it.

Notifications

News about your routine, your submissions and the community appears inside the app. From version 1.0.1 it can also reach you as push notifications, and only if you turn them on. The switch is under Privacy in your profile, and the app may offer it after you submit a product, apply to be verified or reach a two-day streak. It is off until you say yes.

Turning it on stores your phone’s push token with your account. The token is an identifier that Apple and Expo’s push service issue for this app on this phone, and it is how a notification finds it. When there is something to tell you (a product or verification result, a streak at risk, a quest or a badge, a new follower or a comment) our server hands the token and the text of the notification to Expo, which passes them to Apple to deliver. Wash-day reminders are scheduled on the phone itself and involve no server. Turning the switch off deletes the token, and so does deleting your account.

Community

If you use the community features, CurlCue stores what you post (routines, tips, and inspiration posts with a photo or a link and a caption), your comments, likes and bookmarks, who you follow and who follows you, follow and friend requests, invite links you create, the people you block, and the reports you file (a reason from a fixed list and an optional note). Reports are read by CurlCue so that we can act on them.

If you apply to be a verified creator, the application (the role you are applying for, a short bio, the hair types you work with, and your Instagram, TikTok or website links) is stored with your account.

Every profile field has its own visibility setting: public, connections only, or private. You can also make the whole account private.

CurlCue AI

CurlCue AI runs on Anthropic’s Claude models. When you send a message, the message, any photos you attached, your hair profile and your current routine are sent through CurlCue’s server to Anthropic, so that the answer is about your hair. Your account identity is not sent: Anthropic receives the content of the conversation, not who you are. The same path is used when the app asks the model to shape a routine, write a product verdict, or produce an insight.

None of this happens until you say so. The first time you use a feature that sends something to an AI service (CurlCue AI, reading a label, adding a product or its photo, checking a buy link, comparing routines, or building a routine with CurlCue AI) the app shows you what will be sent and who receives it, and waits for you to agree. Declining is a real choice: product scores, your saved routine, favourites and the community do not use the AI and keep working, and a product verdict written without CurlCue AI says so. Each AI feature asks again when you try it. You can change the answer at any time under Privacy in your profile, and turning it off stops any further sending.

Your conversation history is stored on your phone, not on our servers. What our server keeps is a usage log: when each request was made, which mode it was, which model answered, and how many tokens it used. That log exists to enforce daily allowances and to stop abuse.

Usage and allowance logs

For the same reason, the app keeps a log of label reads, AI requests and activity (check-ins, scans, wash-day steps) against your account. These logs power your allowances, streaks and badges, and let us answer “why did I run out”. They hold timestamps, counts and event types, not content.

How far you get through the app

From version 1.0.3 the app also records which steps of signing up, the hair quiz and your first days your account reaches: that a screen was shown, answered or left, how long it took, whether you saw your first product score and logged your first hair day, and the days you open the app. It never records your answers, your email address, your name or anything you type. It is kept with your account, is part of your data export and is deleted with your account. We use it only to find where people get stuck and make those parts easier. It is not shared with anyone and not used for advertising.

CurlCue Pro

If you subscribe to CurlCue Pro, Apple handles the payment. Paying shows CurlCue neither your card nor your Apple Account. RevenueCat, the service that manages the app’s subscriptions, receives the App Store transaction and your CurlCue user ID (a random identifier, not your email). It tells our server what happened (purchase, renewal, cancellation, expiry, billing issue, refund), and our server stores that status against your account so that Pro features unlock. Subscriptions are managed and cancelled in your App Store settings, not inside CurlCue.

Crash reports

CurlCue uses Sentry for crash reports, switched on only in builds that carry a reporting key. When it is on, a crash sends a stack trace, the device model, OS and app version, and your user ID. It is configured to send no IP address, no email or profile fields, no screenshots, no session recordings and no console logs, and web addresses in a report are cut at the question mark, so a signed photo link cannot end up in one.

App updates

When it starts, the app checks Expo’s update service for a newer version of its JavaScript. That request carries the app’s runtime version and platform so the service can decide which update applies. Nothing from your account goes with it.

This website

This site is hosted on Vercel. It sets no cookies, runs no analytics and stores nothing in your browser. Vercel, like any host, sees the technical details of a request (your IP address, browser and the page asked for) in order to serve it.

What we do not collect

• —No advertising SDK and no analytics SDK.The app does not measure what you tap or how long you stay. The one record it keeps of where you are in the app is the one described under “How far you get through the app”: which steps your account reached, kept with your account and never shared.
• —No location.The app asks where you live only in the sense of “is your water hard” and “is it humid”, and you answer from a list.
• —No contacts. Invites are links you share yourself.
• —No microphone.
• —No HealthKit, and no health data in that sense. A hair profile is not a medical record.
• —No advertising identifier, and no tracking of you across other apps or websites.
• —No selling of personal data, and no sharing of it for behavioural advertising.

Who else handles your data

These are the companies whose systems your data passes through so that the app works. Each receives what is listed and nothing else. None of them is allowed to use it for its own advertising.

Other CurlCue users see what you choose to show them: the profile fields you set to public or to connections, your posts and comments, and the products and photos you contributed to the catalogue.

Each of these services is held to the same standard this policy describes. Every one of them is used under commercial terms that require it to process your data only to provide the feature it is listed against, to keep it confidential and secured, and not to use it for its own purposes. CurlCue does not send your data to a service that will not commit to that, and adding a new one means updating the table above before it receives anything.

We will disclose data if the law requires us to.

How long we keep it

Everything tied to your account is kept for as long as the account exists and deleted when you delete it. The usage logs have no separate clock; they go with the account.

Two things outlive an account:

• —Products, ingredient lists and product photos that were accepted into the shared catalogue stay in the catalogue, because other people’s scores are built on them. The record that you submitted them is deleted with you.
• —Copies may persist for a limited time in our database provider’s routine backups before those expire.

Your CurlCue AI conversation history lives on your phone and goes when you delete the app. Data exports you saved are yours.

Export and delete, from inside the app

Both are in the app, neither needs an email to us, and neither is gated behind Pro.

Export

Open the Profile tab, scroll to the Privacy section and tap Export my data. The app builds a JSON file of everything tied to your account (profile, hair profile, privacy settings, scans, saved products, submissions, routine, check-ins, posts, comments, follows, badges, notifications, push tokens, allowance logs and the rest) and opens the share sheet so you can save it wherever you like. Nothing about any other user is included. One thing is held by the sign-in service and is not in the file: the name and picture address from a Google sign-in. Email us and we will send them to you.

Delete

In the same section, tap Delete account. The app asks you twice, then deletes your data, your uploaded files and your sign-in, and signs you out. It cannot be undone.

If you signed in with Apple, Apple asks you to confirm it is you first. Afterwards CurlCue may still be listed under Sign in with Apple in your Apple Account; when it is, the app says so and tells you where to remove it.

Everything else

Camera and photo-library permission can be withdrawn at any time in iOS Settings. Notifications are turned off with the same switch that turns them on, or in iOS Settings. Profile photos, posts and comments can be deleted one at a time in the app. Every profile field has its own visibility setting, and any user can be blocked.

Your rights

If you live in California

The CCPA, as amended by the CPRA, gives you the right to know what personal information we collect and how it is used, to delete it, to correct it, and to opt out of its sale or sharing. CurlCue does not sell personal information and does not share it for cross-context behavioural advertising, so there is nothing to opt out of. We will not treat you differently for exercising any of these rights. Access and deletion are in the app; for a correction the app cannot make, or anything else, email us.

If you are in the EU, EEA, UK or Switzerland

The GDPR and the UK GDPR give you rights of access, rectification, erasure, restriction, portability and objection. The export in the app is your right of access and portability; deletion in the app is your right of erasure. Our legal bases for processing are: performing our contract with you, since the app cannot score products without a hair profile; your consent for the camera, your photo library and every photo you choose to share, which you can withdraw by deleting the photo or the permission; your consent for push notifications, which you can withdraw with the switch; and our legitimate interest in keeping the service secure, enforcing allowances and preventing abuse, which is what the usage logs are for.

Your data is stored and processed in the United States. You can complain to the data-protection authority where you live.

Jeovany Gutierrez is the controller of this data. Requests that the app cannot fulfil itself go to support@curlcue.app; we may ask you to confirm you own the account first.

Children

CurlCue is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has an account, email us and we will delete it.

Security

Data travels over TLS. Every table in the database has row-level security, so a signed-in user can read and write only their own rows, and the keys for the AI and vision services live on the server, never in the app. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

Changes to this policy

We will post changes here and update the date at the top. If a change is significant, we will say so in the app before it takes effect.

Contact

Jeovany Gutierrez · support@curlcue.app