Last updated: October 10, 2026

This Privacy Policy explains how Trichometrics ("we", "us", or "our") collects, uses, shares, retains, and deletes information when you use the Trichometrics mobile application and related services (the "App"). For a privacy request, contact support@trichometrics.com.

1. Scope

This Policy applies when you create or use an account, capture or select photos, request an AI-powered hair or scalp analysis, use guided capture or transplant-related features, track treatments and progress, read or post in the community, make a purchase, receive reminders, or contact support.

2. Information We Collect and How We Collect It

We collect information you provide directly:

Account information: Email address and authentication information. Passwords are handled by our authentication provider; we do not store plaintext passwords. If you use Sign in with Apple or Google, we receive the name and email address that provider makes available, which may include an Apple private relay address.
Profile information: Optional first name, sex selection, birth year, primary concern area, and treatment or transplant-related information you choose to provide.
Photos and related content: Hair, scalp, frontal, top, temple, side, and back-of-head photos captured with the camera or selected from your photo library, plus dates, regions, notes, tags, and favorites. A frontal photo may include your face.
Treatment and recovery information: Treatment names, types, dosages, frequencies, supply information, adherence logs, surgery date, technique, graft count, and recovery check-ins.
Support communications: Messages and attachments you send to support.
Community content: If you use the community, your community name, posts, comments, likes, reports, blocks, and related moderation records, as described in Section 11.

We and our service providers also collect:

Analysis information: AI-generated and on-device hair, scalp, density, hairline, thinning, recovery, and candidacy measurements and results.
Device, app, and usage information: Device type, operating system, app version, language, IP or network information available to service providers, screen and feature events, scan mode, performance data, and error or crash diagnostics.
Purchase and subscription information: Product identifiers, entitlement and subscription status, trial status, transaction-related identifiers, and purchase events. Payment credentials are processed by Apple or Google and are not provided to us.
Notification information: Notification preferences and device tokens when needed to deliver enabled notifications.

3. Anthropic AI Analysis and Exact Data Sent

The App uses the AI API provided by Anthropic, PBC ("Anthropic") as a third-party service to generate hair and scalp analyses. Depending on the feature you choose, the request sent to Anthropic may contain:

compressed JPEG copies of selected or captured hair or scalp photos, including frontal, top/crown, temple, side, or back-of-head views; a frontal photo may contain your face;
your sex selection, used to select the appropriate analysis framework;
on-device derived hairline and density measurements, such as hairline coverage, temple drop, hairline height, hairline classification, and density labels;
for post-transplant recovery features: days since surgery, technique, graft count, and a limited history of prior check-in day, phase, density, thinning, and on-track status; and
for transplant-candidacy features: age derived from birth year, recipient-stage label, whether donor photos were provided, and donor-density measurements or labels.

We do not include your name, email address, password, or Trichometrics account identifier in the Anthropic AI request. Anthropic receives the request solely to generate the analysis you asked for. The resulting analysis is returned to our backend and may be stored in your account history.

Under Anthropic's standard commercial API practices, API inputs and outputs are not used to train its generative models by default. Anthropic may retain API inputs and outputs for up to 30 days under its standard API retention period. Limited exceptions may apply, including longer retention required for trust and safety enforcement, legal compliance, or a different retention arrangement or feature that applies to our account. See Anthropic's privacy policy and Anthropic's privacy center.

If you post in the community, your posts, comments, and edits are also sent to Anthropic for automated screening, as described in Section 11. That request contains the content you are posting, not your name, email address, or Trichometrics account identifier.

4. Face Data and On-Device Processing

For this Policy, "Face Data" includes a photo containing a face and temporary information derived from a face, such as face bounds, eye landmarks, and head pose.

The App may process temporary face bounds, eye landmarks, head yaw/pitch/roll, framing, sharpness, brightness, and derived hairline or density measurements on your device. This processing guides head positioning, verifies that a usable hair or scalp view is present, and calculates hairline or density measurements.

Face bounds, eye landmarks, and head-pose values are not stored in your account and are not sent to Anthropic, PostHog, or RevenueCat. They are held temporarily in memory and discarded after the capture or processing session. Derived hairline and density measurements may be sent to Anthropic as described in Section 3.

Photos containing a face may be transmitted to Supabase for backend processing or storage and to Anthropic for the requested AI analysis. If you choose to post a photo in the community, it is published at your direction, including any face it shows, as described in Section 11. We do not use Face Data for facial recognition, identity matching, authentication, advertising, marketing, biometric-profile creation, or identifying an anonymous person. We do not sell Face Data or share it with advertising platforms, data brokers, or information resellers.

5. Consent and Withdrawal

Before the App collects or uses Face Data for guided capture, and before it sends photos or related context to Anthropic, the App presents a disclosure identifying the data, recipient, and purpose and asks for your affirmative consent. If you decline, the App does not perform the AI analysis or send the disclosed data to Anthropic.

You can withdraw AI data-sharing consent at any time through Profile → App Settings → AI Data Sharing → Withdraw Consent. Withdrawal stops future Face Data processing for guided capture and future transfers to Anthropic unless you consent again. Community posts are screened separately, as described in Section 11. Withdrawal does not automatically delete photos, results, or other data already stored in your account or data already processed by a provider. Use the deletion controls described in Section 9 or contact support to request deletion.

6. How We Use Information

Provide authentication, photo capture, gallery, analysis, treatment, reminder, comparison, recovery, candidacy, and account features.
Perform on-device image processing and requested Anthropic AI analysis.
Store and sync account content and analysis history.
Process purchases, confirm entitlements, and prevent duplicate or unauthorized use.
Run the community, including showing the content you choose to post, screening it for safety, and handling reports, blocks, and moderation.
Operate support, security, fraud prevention, abuse prevention, debugging, and reliability functions.
Understand feature use and improve App performance and user experience.
Send support responses, service notices, and enabled reminders.

We do not repurpose personal information or Face Data for a materially different purpose without obtaining additional consent where required.

7. Third Parties and Data Sharing

We do not sell or rent personal information. We share information only as needed for these purposes:

Supabase: Authentication, database, backend functions, and cloud storage. Supabase may process account information, profile information, photos, treatment and recovery data, analysis requests and results, and related identifiers. See supabase.com/privacy.
Anthropic: AI processing of the photos and contextual data listed in Section 3 to generate the requested analysis, and automated screening of community posts and comments as described in Section 11. See anthropic.com/privacy.
Expo: Delivery of community push notifications. Expo, Inc. receives your device's Expo push token and each notification (another member's community name and a post title of up to 80 characters, never the text of a post or comment) and passes it to Apple Push Notification service or Firebase Cloud Messaging for delivery. See expo.dev/privacy.
PostHog: Product analytics and crash diagnostics. PostHog may receive a Trichometrics account identifier, email address, device and app information, usage events, error details, and event properties such as selected sex, scan mode, recovery phase or status, candidacy result category, and purchase-funnel events. We do not intentionally send photos or face landmarks to PostHog. See posthog.com/privacy.
RevenueCat: Subscription, entitlement, and in-app-purchase management. RevenueCat may receive a Trichometrics account identifier, product and entitlement information, trial or subscription status, and transaction-related records. We do not send photos or face landmarks to RevenueCat. See revenuecat.com/privacy.
Apple and Google: Sign-in, app distribution, purchases, and platform services you choose to use. See Apple's privacy policy and Google's privacy policy.
Legal and safety disclosures: When reasonably necessary to comply with law or valid legal process, protect rights and safety, prevent fraud or abuse, or address a security incident.
Business transfers: As part of a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy and applicable law.

We require every third party with whom we share user data, including Face Data, to provide the same or equal protection of that data as stated in this Policy and required by applicable platform rules; to process it only for the authorized, limited purpose; and to apply appropriate retention, deletion, confidentiality, and security safeguards. If a provider cannot meet those requirements, we will not share the data with that provider.

Community posts: Content you choose to post in the community is published at your direction, not shared with a service provider. It is shown to other users and, to anyone on trichometrics.com and to search engines, as described in Section 11. The provider requirements above do not apply to people who read or copy public posts.

8. Storage and Security

Account data, photos, and results may be stored using Supabase infrastructure. We use administrative and technical safeguards designed to protect information, including encrypted transmission, authentication, access controls, and restricted service credentials. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

Information may be processed in countries where our providers operate, including the United States and European Union, subject to contractual and legal safeguards.

9. Retention and Deletion

Temporary on-device Face Data: Face bounds, eye landmarks, and head-pose values are discarded after the capture or processing session and are not retained in your account.
Anthropic API data: Anthropic may retain API inputs and outputs for up to 30 days under its standard commercial API practices, subject to the limited exceptions described in Section 3.
Account content: We generally retain account information, photos, treatments, recovery records, and analysis results while your account is active and as needed to provide the App.
Usage, purchase, security, and support records: Retention depends on operational, accounting, fraud-prevention, dispute-resolution, security, and legal needs. After account deletion, we retain minimal purchase and subscription ledger records (store transaction identifiers, products, purchase dates, and grant history) without the account link in those ledgers to prevent duplicate claims and for accounting, fraud prevention, dispute resolution, and legal needs. These ledger records have no fixed deletion date. Related security and purchase audit records may still contain earlier account identifiers, so removing the ledger account link does not fully anonymize all purchase records. Deleting your account does not cancel a store subscription; cancel it in the App Store or Google Play before deleting your account.
Community content: Kept until you delete it, we remove it, or your account is deleted, as described in Section 11.

You may initiate deletion of individual photos from the App where that control is available. You may initiate account and associated-data deletion through Profile, or request assistance at support@trichometrics.com. Because deletion requires backend processing, contact us if an in-App deletion does not complete so we can verify and process the request. Completion may not be immediate. Limited records or copies may remain where reasonably necessary for legal compliance, security, fraud prevention, dispute resolution, technical recovery, or backup-retention cycles, and are deleted or de-identified when the applicable reason or retention cycle ends.

Deleting data from Trichometrics does not shorten data already within a provider's permitted retention window, but we require providers to delete or de-identify it according to their applicable obligations and retention terms.

10. Your Choices and Rights

Depending on your location, you may have rights to access, correct, receive, object to processing of, restrict processing of, or delete personal information. You can update profile fields, manage notifications, withdraw AI data-sharing consent, delete available content, or initiate account deletion in the App. You may also contact support@trichometrics.com.

11. Community

The App and trichometrics.com include a community where members can read, post, comment, and react. The Community Guidelines set the rules for taking part. This section explains the data involved.

What we collect: If you use the community, we collect your community name (a pseudonym that we generate for you and that you can change; names are screened like posts), the version of the Community Guidelines you accepted and when, the posts you create (title, text, tag, language, and any share-card image, scalp photo or photo comparison you attach, together with the scan date and the scan results shown on a card), your comments and replies, likes, reports you submit, members you block, and moderation records (the screening result and reason, and any action taken on your content or account). We also record when each item was created or edited. If you allow community notifications, we also store your device's Expo push token, its platform (iOS or Android), your app language, and your app version for your signed-in account, so we can notify you about replies to your posts and comments and about moderation decisions on your items. A notification shows the other member's community name and the post title (cut to 80 characters), never the text of a post or comment. Notifications are delivered through Expo's push service (Expo, Inc., https://expo.dev/privacy), then Apple Push Notification service or Firebase Cloud Messaging. We delete this data when you sign out on that device or delete your account, and you can turn community notifications off in Profile.
What is public: Community content is public. Your name, any Pro or Team badge, your posts, your comments, like counts, scan dates, and post languages can be seen by anyone who opens the community in the App, including guests who are not signed in. A Pro badge shows that your account has a Premium subscription. Posts can include health information, such as hair-loss stage, scan scores, progress over time, and treatment names; when you post, you choose to make that information public. Other users can share public posts and their links outside Trichometrics.
Website and search engines: Approved posts and their visible comments are published on trichometrics.com, where anyone can read them without an account and search engines may index them. Search engines, and people who already copied or shared a post, may keep their copies for a time; we do not control those copies. Public community website pages may be read and copied by search engines. Our robots.txt asks AI crawlers not to read community pages, but we cannot guarantee that every crawler follows it. Deleting a post removes it from the App and our website, but does not remove copies already held by others.
What is never shown: We do not show your name, email address, account identifier, scan or source-photo identifiers, or device or network information with community content. You can choose your own saved scalp photos from any angle, or share a side-by-side comparison of two saved photos. Your photos may show your face. Photos that may show other people or anything other than hair, scalp or a result card are held for review, and photos of children are rejected. Posted images are stored separately under an address that does not contain your account identifier.
Automated screening: Before a post, comment, or edit appears, we check it with a word and pattern filter and then send its text and any image, with its tag and language, to Anthropic for automated screening against the Community Guidelines. The request does not include your name, email address, or account identifier, and Anthropic's handling of it is described in Section 3. Based on the result, the item is published, held for review by our team, or rejected, and we tell you the reason when an item is held or rejected. You agree to this screening when you accept the Community Guidelines. It happens only when you post, comment, or edit, and withdrawing AI analysis consent (Section 5) does not stop it. If you think a screening or moderation decision is wrong, contact us and a person will review it.
Moderation: Our team reviews held and reported items and may hide or remove content or remove posting access, as described in the Community Guidelines and the Terms of Use. Reports you submit are not shown to the member you report.
Analytics: We do not send community page views, page titles, or URLs to Google Analytics. PostHog receives community usage events, such as that a post was created and its tag and language, but not the text or images of posts and comments.
Retention and deletion: Community content is kept until you delete it, we remove it, or your account is deleted. Deleting a post also deletes its image and the comments other users left on it. Deleting your account deletes your community profile, posts, comments, likes, reports, blocks, and the images of your posts. Moderation records are deleted with the item they belong to, except where we must keep a limited record of illegal content or abuse, as described in Section 9.
Age: The community is only for people aged 16 or older.
Contact: For questions, complaints about content, or requests about community data, contact support@trichometrics.com.

12. Children's Privacy

Trichometrics is not intended for children under 13, or the higher minimum age required in a user's jurisdiction. We do not knowingly collect personal information from children below the applicable minimum age. Contact us if you believe a child has provided information. The community has a higher minimum age of 16, as described in Section 11.

13. Changes to This Policy

We may update this Policy. If a change materially expands how previously collected information is used or shared, we will provide notice and request additional consent where required. The date above identifies the latest version.

14. Contact Us

For privacy questions or requests, email support@trichometrics.com.