Draft of 5 October 2026 — not yet in force
Today this site collects waitlist signups and nothing else. The app, when it exists, will handle photographs of your scalp — that is personal, and in several places it may count as health-related data, which carries extra obligations. This notice says what we collect now, and what we intend for later.
Scalp Map is run by an individual, not a company. There is no registered entity behind it, and we are not going to imply there is one. The operator is [full legal name], based in Bangladesh.
Note that the address we send from, [email protected], is not monitored — replies to our confirmation email go nowhere. Use one of the three addresses above instead.
You don't have to write to us to leave. Every email we send, starting with the confirmation, carries a link that unsubscribes you or deletes your entry outright. That route is live and depends on no mailbox of ours, so it works even if one of the addresses above is down.
Your waitlist details are used for exactly one thing: to email you once, when Scalp Map opens, and to work out where to launch. Where consent is the applicable legal basis, that consent is what you gave at signup, and you can withdraw it at any time by unsubscribing or asking us to delete your entry. [Confirm the legal basis that applies in each market the waitlist accepts, and name it here.]
If we later want to send you anything else — product updates, a newsletter, anything that is not the single launch email — we will ask you separately. We will not treat your waitlist signup as permission for it.
In the app, photographs and anything derived from them would be used to produce your own record and nothing else.
We may use aggregated, de-identified statistics to improve the measurement model. Aggregated means your individual images and records cannot be recovered or re-identified from it. If we ever want to use identifiable scans for research or model training, we will ask you first, separately, and a refusal will not reduce the app's functionality.
We do not sell your data. We do not share it with advertisers, insurers, employers or data brokers.
The waitlist is stored with Supabase, which hosts the database and the functions that receive the form. Email is sent by Resend, which processes it in Tokyo — so a second international transfer, separate from where the list itself is stored. The site is served by GitHub Pages (GitHub, Inc.), and the domain is managed by Cloudflare, which handles DNS and, where a record is proxied, also routes requests to the site. Each of them therefore sees your address or your IP in the course of doing its job, as any such provider does. Each must be under a contract to process data only on our instructions before this notice goes live. We will disclose data to authorities only where a valid legal order compels us, and we will tell you unless we are legally barred from doing so.
Waitlist entries are stored in Singapore (Supabase region ap-southeast-1). If you are outside Singapore, your details are transferred there when you join the list. If we later accept signups from the UK or EU, that transfer needs a lawful basis documented here before we do. Waitlist entries are kept until the app launches and you have either signed up or left the list, and are deleted whenever you ask, whichever comes first.
We are not going to quote a deletion-from-backups timeline we have not tested. A specific retention schedule — including how long backups hold a deleted entry — must be measured against the real setup and published here before this notice takes effect. [Retention schedule, per data type, once verified.]
The intent is that data is encrypted in transit and at rest, that staff access is limited to the fewest people needed and logged, and that the stored list is rate-limited and access-controlled. These are design intentions for a product that is still being built, not claims about a system we have audited — and we would rather say that than imply a guarantee.
What we can say today: this page loads no third-party scripts and sets no cookies of its own. The waitlist itself is stored where the browser cannot reach it — the database rejects every read and write that does not come from our own server-side function, so the list cannot be downloaded by anyone visiting the site. Submissions are validated and rate-limited on the server, not just in your browser. No system is perfectly secure and we will not claim ours is; if a breach affects your data we will notify you and the relevant regulator within the time limits the law sets.
Depending on where you live, you may have the right to access your data, correct it, export it, delete it, restrict or object to processing, and withdraw consent.
You do not have to ask us to leave. Every email we send, including the confirmation, carries a link that lets you unsubscribe or delete your entry outright — email, country and region, gone, with no explanation required and nobody to persuade. That link works whether or not our contact mailbox is live. And if you simply never click the confirmation link, nothing further is ever sent to you. For anything else, write to [email protected] and we will respond within 30 days. [Confirm which rights apply in each market the waitlist accepts.] If you're in the UK or EU you may also complain to your supervisory authority; if you're in California you have rights under the CCPA, including the right not to be discriminated against for using them.
Scalp Map is intended for people aged 13 and over. We do not invite anyone under 13 to join the waitlist or to upload data, and we do not knowingly collect their information. If you believe someone under 13 has signed up, tell us at [email protected] and we will remove the entry.
Being 13 is the minimum, not a universal permission. The age at which a young person can agree to their own data being processed varies:
The waitlist is open worldwide to anyone aged 13 or over. We do not operate a separate verified parental-consent step, and some countries require one below a certain age. So if you are under the age your country sets for agreeing to this on your own, please involve a parent or guardian before joining.
Either of you can ask us to delete the entry at any time and we will, promptly and without asking why. If you are a parent or guardian and your child has joined, the same applies — the unsubscribe link in the confirmation email deletes the entry outright, with nobody to persuade.
This whole site is readable without signing up, without a photograph, and without telling us anything about yourself. That is deliberate.
Anywhere. Joining the waitlist is not the same as the app launching in your country — which markets the app itself opens in is a separate decision, not yet made, and being on the list is not a promise that it will reach you.
This site sets no cookies of its own and runs no advertising or analytics trackers. It does load two typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which means your browser makes a request to Google to fetch them, and Google receives your IP address as part of that request. Self-hosting the fonts would remove that request, and is on the list.
If we add analytics later we will update this notice before switching anything on, not after.
When we start sending commercial email we will include a valid postal address and accurate sender details, honour opt-outs promptly, and keep the promise made at signup — one launch email unless you separately ask for more. FTC CAN-SPAM guidance
Scalp images, any measurements taken from them and routine records can be sensitive health-related information. The EU sets additional conditions for special-category health data, and some US health apps carry breach-notification duties. The actual data architecture has to be reviewed against both before the app collects anything. EU special categories · FTC Health Breach Notification Rule
If we change this notice in a way that materially affects you, we'll email you before it takes effect rather than quietly updating the date at the top.
For the shape of what belongs in a notice like this one — including that it applies to sole traders, and that it needs full contact details and clear retention information — we followed the UK regulator's small-organisation guidance. ICO: how to write a privacy notice
Draft of 5 October 2026 — not yet in force
These terms cover your use of this website and the Scalp Map waitlist. When the app launches, separate app terms will apply and you'll be asked to accept them then.
This site is run by an individual, not a company: [full legal name], based at West Palashi, Dhaka - 1205, Bangladesh ("we", "us"). By using this site or joining the waitlist, you accept these terms.
This is the clause that matters most, so it's near the top. Scalp Map is a personal record-keeping tool, and it is not offered to diagnose, treat, cure, prevent or predict any condition. Nothing on this site or in the app is medical advice.
We are not making a claim here about how the product is classified under any country's medical-device rules. That depends on its intended use and its actual features in each market, and it is a question for qualified review before launch — not something a disclaimer settles. FDA digital health policy navigator [Obtain market-specific regulatory review before stating any regulatory status.]
Anything the app derives from a photograph is an estimate and carries error. Do not use it to start, stop or change any medication or treatment. If you are worried about your hair or scalp, see a doctor, dermatologist or trichologist. If you have a medical emergency, contact emergency services.
Joining the waitlist means we may email you once, about the launch of Scalp Map. It is not a purchase, a reservation, or a promise of a place, a price, or a feature.
Joining is a two-step thing. Submitting the form asks to join; we email you a link, and you are on the list only once you click it. Until you do, your entry is unconfirmed and we send you nothing else. Every email we send carries a link that unsubscribes you or deletes your entry outright — that is the quickest route, and it works without writing to anyone. You can also email [email protected].
You must give an email address you control, and you must be at least 13 years old. If you are under 18, check with a parent or guardian first. Some countries set a higher age for agreeing to this on your own, and we do not operate a verified parental-consent step; if that applies to you, involve a parent or guardian before joining. Either of you can have the entry deleted at any time. See the privacy notice for detail.
Scalp Map is an app in development and is not available to use. Descriptions of it on this site describe what we intend to build. Features, timing, pricing and availability may change, and some things described here may not ship. Interface visuals on this site are labelled concepts, not screenshots. Nothing on this page is a contractual commitment to deliver a specific feature by a specific date.
Don't attempt to break into, overload, scrape at volume, or interfere with this site, and don't submit other people's email addresses without their permission. We may suspend access that does any of these things.
The Scalp Map name, logo, copy and design on this site belong to us. You may link to the site freely; please don't copy the content wholesale or present it as your own.
This site is provided "as is". To the fullest extent the law allows, we exclude liability for indirect or consequential loss arising from use of this site. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded. If you are a consumer, your statutory rights are unaffected.
How we handle your data is set out in the privacy notice, which forms part of these terms.
We may update these terms. The date at the top shows when they last changed; continuing to use the site after a change means you accept the updated terms.
These terms are governed by the laws of Bangladesh, and the courts of Bangladesh have exclusive jurisdiction, except where consumer-protection law in your country of residence gives you the right to bring a claim locally. Both follow from the operator being based in Bangladesh. [A lawyer should confirm this clause is enforceable in the markets the waitlist accepts — the waitlist is open worldwide, and a consumer in the UK, EU or California may retain the right to sue at home whatever this says.]
Questions about these terms: [email protected], or by post to West Palashi, Dhaka - 1205, Bangladesh. Privacy and deletion requests go to [email protected]; the full list is in the privacy notice. To leave the waitlist or delete your entry you need none of them: use the link in any email we have sent you.
Everything we publish about how this site treats you and your data
There are two documents and one how-to. Both documents are drafts and not yet in force — they say so at the top of each page, and each lists what is still outstanding. They describe real, live processing: the waitlist is open and accepting signups.
No cookie policy, because this site sets no cookies of its own — the detail is in the privacy notice under Cookies and third-party requests. No acceptable-use policy as a separate page, because it is Terms §5. No data-processing addendum, because there are no business customers whose data we process. If any of that changes, the document comes before the change, not after it.
How to leave the waitlist, and what happens when you do
You never have to ask us, explain yourself, or wait for a reply. The link is already in your inbox.
Every email we send carries a link that unsubscribes you or deletes your entry outright. That includes the very first one — the confirmation email you get the moment you join. Open the link and you are shown both choices.
The page asks you to confirm before either happens. That is deliberate: mail scanners and link previewers follow links on their own, and a link that unsubscribed the instant it was fetched would remove people who never clicked anything.
Email [email protected] from the address you signed up with, and we will delete the entry and confirm when it is done. Writing from a different address means we may have to ask you something to avoid deleting the wrong person’s row.
Less than you might expect. Joining the waitlist stores exactly this:
No name, no date of birth, no postal address, no precise location, no photographs, and no health information. There is no app yet, so there is nothing from an app to delete.
If you have ever asked for a sign-in link, a short-lived token is stored alongside your entry for 15 minutes and then stops working. It goes with the entry when the entry goes.
When you submit the form we store a salted one-way hash of your IP address for up to 24 hours, purely to stop one source flooding the list. The raw address is never stored, and the hash is kept apart from your signup so it cannot be used to work out where you signed up from. It is not joined to your entry, so deleting your entry does not need to touch it — it expires on its own within a day.
Then you were never on the list. We send nothing to an unconfirmed address beyond that single confirmation email, and an unconfirmed entry can be deleted by the same link in exactly the same way.
The live record goes immediately. We are not going to quote you a backup-deletion figure we have not measured — a specific retention schedule, including how long backups hold a deleted entry, is still outstanding and is marked as such in the privacy notice. When it has been tested against the real setup, it will be published there and here.
If you want to stay on the list but change your country or region, write to [email protected]. Signing up again with the same address also refreshes those details and your consent record, and does not create a second entry.