Privacy Policy — HairCare

This Privacy Policy explains how HairCare, an app built by Aporam, collects, uses, shares and protects your information. By using HairCare, you agree to the practices described here.

HairCare is operated by Aporam (company registration no. 46.232.750/0001-90; "we", "us", "our"). For any privacy matter, reach us at contact@aporam.com.

1.In short

• You can use the app without an account. In guest mode, everything you fill in stays on your device.
• We do not sell your data and there is no advertising in the app. We use no advertising identifiers and no cross-app tracking.
• Your progress photos never leave your device.
• You can delete your account, and everything tied to it, from inside the app.

2.Information we collect

2.1 Account and profile

• Email sign-up: your name, email and password. The password is handled by our authentication provider and is never stored in readable form by us.
• Sign in with Google or Apple: if you choose to sign in (or link your account) with Google or Apple, we receive the email and name attached to that identity from the provider. We never receive your password. If you use Apple's "Hide My Email", we only receive the relay address Apple generates.
• Profile picture: if you add an avatar, it is uploaded to our storage provider.

2.2 Your hair profile (quiz)

The diagnosis quiz asks about curl pattern, thickness, oiliness, chemical history, heat use, strand strength and elasticity, porosity, the goals you are after and the conditions you report — including dryness, frizz, tangling, dandruff and hair loss. We use this to build your routine and rank recommendations.

We treat these answers as hair and cosmetic characteristics, not as a medical diagnosis: HairCare is not a health app, it does not replace a dermatologist or trichologist, and it performs no clinical assessment. We do not ask for — and the app should not be used to enter — medical history, medication, health conditions, biometric data or any other sensitive data. The same applies to your conversations with Tina, to reviews and to community posts.

2.3 Your routine

The steps, schedules, check-ins, achievements, reminders you have already read and your notification preferences. If you have an account, this is synced so your routine survives a change of device.

2.4 Progress photos

The photos you attach to routine steps are copied into a private folder inside the app on your own device and are not uploaded to our servers. Only the file name travels with the synced routine. If you uninstall the app, those photos go with it.

2.5 Public content you create

• Product and recipe reviews: your rating, your per-characteristic ratings and the text you write. Reviews are public inside the app and show your name and your hair type.
• Community: posts, comments, likes and bookmarks. Posts and comments are public and show your name.
• Moderation: when you report content or block someone, we record the report (with its reason) and the block so we can act on it.

2.6 Conversations with Tina

The messages you send to the assistant, along with your hair profile, the routine step in question, the product or recipe the chat was opened from, and the app's language. We also count how many messages each account sends, to enforce usage limits and prevent abuse.

2.7 Catalog browsing

Your favourites and the products and recipes you opened recently, to build the "recently viewed" lists and refine recommendations.

2.8 Suggestions and problem reports

The text you send through "Send suggestions" and "Report a problem", along with any images you attach.

2.9 App usage (analytics)

We record which screens you open and a handful of product events (finished the intro, created an account, started and finished the quiz, created a routine, completed or skipped a step, opened the premium screen) to understand where people get stuck. These events are keyed to your account identifier — never your email or name — and stay anonymous in guest mode. We do not record your screen or what you type.

2.10 Diagnostics, errors and performance

When the app crashes or slows down, we send a report containing the error message, the stack trace, the trail of screens you visited, your device model, OS version, app version and the request's IP address. This is used solely to fix the problem.

2.11 What we do not collect

We do not collect precise location, contacts, calendar, banking or payment data (the app has no purchases at this time), or advertising identifiers. There is no tracking for advertising purposes: the app never shows iOS's tracking prompt because it does not track.

3.How we use your information

• Build and personalize your routine and your product and recipe recommendations.
• Maintain your account, authenticate you and sync your data across devices.
• Send the reminders and notifications you set up.
• Answer your questions through the Tina assistant.
• Display and moderate public community content and reviews.
• Keep the app working, secure and free from fraud, abuse and runaway cost (Tina's usage limits).
• Fix errors, measure performance and understand which features are used most.
• Respond to you and to your suggestions.
• Comply with legal obligations.

4.Legal bases (LGPD)

• Performance of a contract (art. 7, V): your account, hair profile, routine, sync, Tina and the community — that is, the app you asked for.
• Consent (art. 7, I): access to your camera and photo library, sending notifications, and publishing content to the community. You can withdraw consent at any time.
• Legitimate interest (art. 7, IX): security, fraud and abuse prevention, error fixing and product improvement (aggregate analytics).
• Compliance with a legal obligation (art. 7, II) and the regular exercise of rights (art. 7, VI), where applicable.

5.Who we share with

We do not sell your data. We share only with the providers that run the app:

• Supabase — database, authentication, file storage and server functions. Our project is hosted in the South America (São Paulo, Brazil) region.
• OpenAI — receives Tina's messages, your hair profile and the item in question in order to generate the reply. The call is made by our server, not by the app, and carries none of your name, email or account identifier.
• PostHog — product analytics, with data hosted in the European Union.
• Sentry — error and performance reports, hosted in the United States.
• Google and Apple — authentication (if you use social sign-in) and app distribution through their stores.
• Amazon — catalog product images are loaded from Amazon's CDN, and purchase links open in your device's browser.

We may also share data when required by law, by order of a competent authority, or to protect rights, safety and integrity. In a corporate reorganization, data may transfer as part of the business, with the obligations in this policy preserved.

When you tap an external link (to a store, for example), that site's privacy policy takes over — not ours.

6.International data transfers

Your account data is stored in Brazil. Some providers process data abroad: OpenAI and Sentry in the United States and PostHog in the European Union. Those transfers rely on the grounds set out in art. 33 of the LGPD and on data protection clauses agreed with each vendor.

7.Guest mode

You can use the app without an account. In that case there is no record of you on our server: the quiz, the routine and the photos live only on the device, and analytics records events without tying them to a person. You can read reviews and the community, but talking to Tina, posting, commenting, reviewing or favouriting requires an account. If you create an account later, your local data starts syncing.

8.Photos and camera

The app only accesses the camera and photo library with your permission, and only when you tap to add a photo. There are three uses, with different destinations:

• Progress photos — stay on your device only (see 2.4).
• Profile picture — uploaded to a public area of our storage: anyone with the file's direct address can open it. Do not put anything in it you would not want seen.
• Images attached to a problem report — uploaded to a private area, reachable only by your account and by our team.

You can delete any of them at any time.

9.Notifications

With your permission, the app schedules reminders for your routine. They are local: they live on your device and never pass through a push server. To schedule them at the right time, the app reads your device's time zone. You can turn notifications off whenever you like, in the app's settings or in your system settings.

10.Security

Traffic between the app and our servers is encrypted (HTTPS/TLS). Your session tokens are kept in the operating system's secure storage (Keychain on iOS, Keystore on Android). In the database, access is restricted by rules that ensure an account can only see its own rows. No system is 100% secure, but we work continuously to reduce risk.

11.How long we keep it

• Account and linked data — for as long as the account exists.
• Sign-ups that were never confirmed — deleted automatically after 7 days, freeing the address for a new sign-up.
• Tina's usage counter — entries are discarded after a few days; they exist only for the usage limit.
• Errors and analytics — kept for each provider's standard retention window, then discarded or aggregated.
• Public content — for as long as it is published; deleting your account removes it too.

We may retain the minimum required when the law demands it.

12.Deleting your account

From inside the app, at Profile → Edit profile → Delete account. Deletion removes the authentication account and, in cascade, your profile, quiz, routine, favourites, recent items, reviews, community posts and comments, submitted feedback and profile picture. Local device data is wiped as well. The action is final and cannot be undone. If you prefer, write to contact@aporam.com and we will do it for you.

13.Your rights (LGPD)

At any time, you can:

• confirm that processing exists and access your data;
• correct incomplete, inaccurate or out-of-date data;
• request anonymization, blocking or deletion of unnecessary or excessive data;
• request portability of your data;
• find out who we share data with;
• withdraw consent and be told what follows from that;
• object to processing carried out on the basis of legitimate interest.

To exercise your rights, write to contact@aporam.com. We reply within the legal deadline and may ask for information confirming your identity before acting on a request. You may also complain to Brazil's data protection authority (ANPD).

14.Children and teenagers

HairCare is not intended for children under 13. If you are between 13 and 18, use the app with the supervision and consent of a guardian. If we find we have collected a child's data without proper consent, we will delete it.

15.Changes to this policy

We may update this policy from time to time. We will tell you about relevant changes in the app or by other means. The "last updated" date at the top marks the version in force.

16.Contact us

Questions or privacy requests? Write to contact@aporam.com.