Last updated 6 October 2026 · Effective 6 October 2026
This policy explains what we collect when you join the Scalp Map waitlist, who processes it, where it is stored, how long it stays and what you can ask us to do with it. It covers this website and the waitlist. It is the whole of what we hold.
Scalp Map is run by two individuals, not a company: Ashfaque Ahmed Nur and Imtiaz Ahmed ("we", "us"), based in Bangladesh. There is no registered entity behind it, and we are not going to imply there is one. We are jointly responsible for the data described here.
The address we send from, [email protected], is not monitored. Use one of the three above.
You never have to write to us to leave. Every email we send carries a link that unsubscribes you or deletes your entry outright. That route depends on no mailbox of ours, so it works even if one of the addresses above is down.
Only what the waitlist needs:
waitlist-site.That is the list. No name, no date of birth, no postal address, no precise location, no photographs, no health information, no tracking pixel.
Two checks run while you submit and keep nothing: our server asks a public DNS resolver whether the domain after the @ accepts email at all — just the domain, never your full address — and the form notes how long it was on screen and includes one field people never see, which together tell a person apart from a script.
Why country and region. To work out where to launch first and which local information applies to you. They are not used to profile you, and we never ask your device for its location.
Your waitlist details are used for exactly one thing: to email you once, when Scalp Map opens, and to work out where to launch.
Where the GDPR, UK GDPR or a comparable law applies, our basis is your consent, given when you submitted the form and verified your address. The wording you agreed to is stored with your entry as the record of it. You can withdraw it at any time by unsubscribing or deleting your entry, and withdrawing costs you nothing.
The 24-hour IP hash rests on our legitimate interest in keeping the list from being flooded. It is the least identifying thing that does the job.
If we ever want to send you anything beyond that single launch email, we will ask you separately. Your signup is not permission for a newsletter.
Four providers handle your data in the course of running the service, each only to provide that service to us:
If we change this list, we will update this policy before the change takes effect, not after. If Scalp Map is ever sold, or stops operating and its assets transfer, the waitlist would move with it — and we would email you first, so you can leave before it does.
We disclose data to authorities only where a valid legal order compels us, and we will tell you unless we are legally barred from doing so.
Waitlist entries are stored in Singapore (Supabase region ap-southeast-1). Email is processed in Tokyo. We are in Bangladesh. So if you are anywhere else, your details cross a border when you join — that is inherent to the service, not incidental.
Where a transfer out of the UK or EEA needs a safeguard, we rely on the Standard Contractual Clauses (with the UK Addendum where relevant) that our providers make available for exactly this purpose.
Deleting your entry removes it from the live database immediately. Our database provider also keeps rolling encrypted backups for disaster recovery; a deleted entry can persist in those until they rotate out. Those backups are used for nothing else, and we will not quote you a figure we have not measured ourselves.
Your data is encrypted in transit and at rest. The waitlist is stored where your browser cannot reach it — the database refuses every read and write that does not come from our own server-side function, so the list cannot be downloaded by anyone visiting this site. Submissions are validated and rate-limited on the server, not just in your browser. Verification codes are bounded by a short expiry and a five-attempt ceiling enforced in the database itself. This page loads no third-party scripts.
No system is perfectly secure and we will not claim ours is. If a breach affects your data we will notify you and the relevant regulator within the time limits the law sets.
You can ask us to give you a copy of your data, correct it, export it, delete it, restrict or object to how we use it, and withdraw your consent. We apply all of these to everyone who asks, wherever you live, rather than first checking whether your country obliges us to.
The fastest route needs no reply from us: the link in any email we have sent you unsubscribes you or deletes your entry outright — email, country and region, gone, with no explanation required and nobody to persuade. For anything else, write to [email protected] and we will answer within 30 days.
If you are in the UK or EU you may also complain to your supervisory authority. If you are in California you have rights under the CCPA, including the right not to be treated differently for using them.
Scalp Map is intended for people aged 13 and over, and the waitlist is open worldwide on that basis. We do not invite anyone under 13 to join and we do not knowingly hold their data. If you believe someone under 13 has signed up, tell us at [email protected] and we will remove the entry.
Thirteen is a floor, not a universal permission. The age at which a young person can agree to this on their own varies — in the EU each member state sets it somewhere between 13 and 16, and several countries set it higher still. We do not operate a verified parental-consent step. So if you are below the age your country sets, involve a parent or guardian before joining.
Either of you can have the entry deleted at any time, promptly and without being asked why. The link in the verification email does it outright.
This site sets no cookies of its own. It does store one thing on your device and make one external request, both covered in the Cookies and Browser Storage Notice.
The waitlist holds no health information. Because Scalp Map is a hair- and scalp-health product, some laws treat a signup to it as consumer health data anyway — that is covered in the Consumer Health Data Privacy Policy.
You get one verification email, and one email the day Scalp Map opens. No newsletter, no drip sequence. Every email carries a working unsubscribe link and our postal address, and replies reach a person at [email protected].
Scalp Map is an app in development. It collects nothing today, because it does not exist yet. When it does, it will handle photographs of your scalp and records you keep yourself, which is a different kind of data from an email address — so this policy will be rewritten and you will be told before it takes effect, not quietly amended. Nothing described here extends to data the app might one day hold.
If we change this policy in a way that materially affects you, we will email you before it takes effect rather than quietly updating the date at the top.
Questions or requests: [email protected], or by post to West Palashi, Dhaka - 1205, Bangladesh.
Last updated 6 October 2026 · Effective 6 October 2026
These terms cover your use of this website and the Scalp Map waitlist. When the app launches it will have its own terms and you will be asked to accept them then.
This site is run by two individuals, not a company: Ashfaque Ahmed Nur and Imtiaz Ahmed, at West Palashi, Dhaka - 1205, Bangladesh ("we", "us"). By using this site or joining the waitlist you accept these terms, the Privacy Policy and the Acceptable Use Policy.
This is the clause that matters most, so it is near the top. Scalp Map is a personal record-keeping tool. It is not offered to diagnose, treat, cure, prevent or predict any condition, and nothing on this site or in the app is medical advice.
We make no claim here about how the product is classified under any country's medical-device rules. That depends on its intended use and its actual features in each market, and a disclaimer does not settle it. FDA digital health policy navigator
Anything the app derives from a photograph is an estimate and carries error. Do not use it to start, stop or change any medication or treatment. If you are worried about your hair or scalp, see a doctor, dermatologist or trichologist. In an emergency, contact emergency services.
Scalp Map is an app in development and is not available to use. Descriptions of it here describe what we intend to build. Features, timing, pricing and availability may change, and some things described may not ship. Nothing on this site is a contractual commitment to deliver a specific feature by a specific date.
Joining means we may email you once, about the launch. It is not a purchase, a reservation, or a promise of a place, a price or a feature.
Joining takes two steps. Submitting the form asks to join; we email you a six-digit code, and you are on the list only once you type it back. Until then your entry is unverified and we send you nothing else.
You must give an email address you control, and you must be at least 13 years old. If you are under 18, check with a parent or guardian first. Some countries set a higher age for agreeing to this on your own and we do not operate a verified parental-consent step; if that applies to you, involve a parent or guardian before joining. Either of you can have the entry deleted at any time.
Leaving. Every email we send carries a link that unsubscribes you or deletes your entry outright. You need no reply from us and no reason. You can also email [email protected].
Set out in full in the Acceptable Use Policy, which forms part of these terms. In short: do not attack, overload or scrape this site, and do not submit other people's email addresses.
The Scalp Map name, logo, copy and design belong to us. You may link to the site freely; please do not copy the content wholesale or present it as your own.
This site is provided "as is" and "as available", without warranties of any kind, to the fullest extent the law allows. We do not warrant that it will be uninterrupted or error-free.
To the fullest extent the law allows, we exclude liability for indirect, incidental or consequential loss arising from use of this site or the waitlist. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded. If you are a consumer, your statutory rights are unaffected.
We may suspend or remove access, or delete an entry, where it breaches the Acceptable Use Policy. Where we delete an entry for that reason we will say so to the address on it, unless doing so would itself be abusive.
How we handle your data is set out in the Privacy Policy, which forms part of these terms.
We may update these terms. The date at the top shows when they last changed, and continuing to use the site after a change means you accept the updated terms. If a change materially affects people on the waitlist, we will email them.
These terms are governed by the laws of Bangladesh, and the courts of Bangladesh have exclusive jurisdiction — except where consumer-protection law where you live gives you the right to bring a claim locally, which this clause does not take away.
Questions about these terms: [email protected], or by post to West Palashi, Dhaka - 1205, Bangladesh. Privacy and deletion requests go to [email protected]. To leave the waitlist you need neither: use the link in any email we have sent you.
Everything we publish about how this site treats you and your data
All five documents are in force as of 6 October 2026. They describe live processing: the waitlist is open and accepting signups.
Scalp Map is run by Ashfaque Ahmed Nur and Imtiaz Ahmed, two individuals rather than a company.
No data-processing addendum, because there are no business customers whose data we process. No AI disclosure, because nothing on this site or in the waitlist uses it. If either changes, the document comes before the change, not after it.
How to leave the waitlist, and what happens when you do
You never have to ask us, explain yourself, or wait for a reply. The link is already in your inbox.
Every email we send carries a link that unsubscribes you or deletes your entry outright. That includes the very first one — the verification email you get the moment you join. Open the link and you are shown both choices.
The page asks you to confirm before either happens. That is deliberate: mail scanners and link previewers follow links on their own, and a link that unsubscribed the instant it was fetched would remove people who never clicked anything.
Email [email protected] from the address you signed up with, and we will delete the entry and confirm when it is done. Writing from a different address means we may have to ask you something to avoid deleting the wrong person’s row.
Less than you might expect. Joining the waitlist stores exactly this:
waitlist-siteNo name, no date of birth, no postal address, no precise location, no photographs, and no health information. There is no app yet, so there is nothing from an app to delete.
If you have ever asked to open your entry, a second six-digit code is stored alongside it for 15 minutes and then stops working. It goes with the entry when the entry goes.
When you submit the form we store a salted one-way hash of your IP address for up to 24 hours, purely to stop one source flooding the list. The raw address is never stored, and the hash is kept apart from your signup so it cannot be used to work out where you signed up from. It is not joined to your entry, so deleting your entry does not need to touch it — it expires on its own within a day.
Then you were never on the list. We send nothing to an unverified address beyond that single verification email, and an unverified entry can be deleted by the same link in exactly the same way.
The live record goes immediately. Our database provider also keeps rolling encrypted backups for disaster recovery, and a deleted entry can persist in those until they rotate out; they are used for nothing else. We will not quote you a backup-deletion figure we have not measured ourselves — the same wording is in the Privacy Policy under How long we keep it.
If you want to stay on the list but change your country or region, write to [email protected]. Signing up again with the same address also refreshes those details and your consent record, and does not create a second entry.
Last updated 6 October 2026 · Effective 6 October 2026
This policy forms part of the Terms of Service. It applies to this website and the waitlist.
Do not attempt to gain access to any part of this site, its database or its server-side functions that is not open to you. Do not probe for or exploit weaknesses, interfere with other people's use, or try to overload the site or the systems behind it.
Submit only an email address you control. Adding someone else's address is the one abuse here with a direct victim — they get mail they never asked for, and the verification step exists so that nothing further ever reaches them.
Do not submit the form by script, scrape the site at volume, or try to work around the rate limits. Reading the site as a person, at a person's pace, is always fine.
Do not use the signup, sign-in or verification forms to test whether a particular person has joined. These endpoints are built to answer identically either way; trying to defeat that is a breach of this policy.
If you find a security weakness, please tell us at [email protected] rather than demonstrating it against real data. We would rather hear from you than find out later, and we will not pursue anyone who reports in good faith, acts only against their own entry, and gives us a reasonable chance to fix it before telling anyone else.
We may suspend or remove access, and delete an entry. Where we delete an entry for this reason we will say so to the address on it, unless doing so would itself be abusive.
Questions: [email protected].
Last updated 6 October 2026 · Effective 6 October 2026
This site sets no cookies of its own, and runs no advertising or analytics trackers. There is no consent banner because there is nothing to consent to. Two things are worth naming anyway, because the law covers any storage on your device and any request your browser is made to send — not just cookies.
If you switch between light and dark mode, we save that choice in your browser's localStorage under the key scalpmap-theme. The value is the word light or dark and nothing else.
It stays on your device, is never sent to us or to anyone else, and cannot identify you. It exists so the site does not forget your choice between visits. Clearing your site data removes it, and the site works normally without it — it simply follows your system setting again.
The page loads two typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser makes that request directly to Google, which means Google receives your IP address as part of serving the files. We receive nothing from it and set nothing as a result.
Self-hosting the fonts would remove the request entirely. We intend to do that.
This site is served by GitHub Pages, and its domain is managed by Cloudflare. Where a Cloudflare record is proxied, Cloudflare may set its own bot-management cookie on requests it routes. That is theirs, not ours — we cannot read it and we do not use it.
If we ever add analytics, we will update this notice and the Privacy Policy before switching anything on, and ask for consent where consent is required.
Questions: [email protected].
Last updated 6 October 2026 · Effective 6 October 2026
This is a separate policy because some laws require it to be separate — among them the Washington My Health My Data Act and Nevada SB 370, which apply regardless of how small the operator is and cover data that merely relates to someone's health.
Scalp Map is a hair- and scalp-health product. Joining a waitlist for one can itself count as consumer health data under those laws, even though all we hold is an email address and a region. So rather than argue about whether it applies, we have written it down.
Only this: the fact that you joined a waitlist for a hair- and scalp-health app, your email address, and the country and region you selected. That is the entire set, and it is the same set described in the Privacy Policy — there is no separate health profile.
We collect no photographs, no measurements, no diagnoses, no conditions, no treatments, no medications, no symptoms, no bodily functions, no precise location, and nothing inferred about your health from any of the above.
To email you once when the app opens, and to work out which markets to launch in. Nothing else.
Nobody, beyond the four service providers named in the Privacy Policy — Supabase, Resend, GitHub and Cloudflare — each only to provide that service to us. We share it with no advertiser, insurer, employer, data broker or other third party.
We have never sold consumer health data and we do not sell it. A sale would require your separate written authorisation under these laws, and we have neither sought nor obtained one, because we do not do it.
You have the right to know what we hold, to get a copy of it, to withdraw your consent to its collection and sharing, and to have it deleted — including from our backups as they rotate, and we will pass a deletion request on to our providers.
The fastest route needs no reply from us: the link in any email we have sent you deletes your entry outright. Otherwise write to [email protected]. We answer within 30 days, and we will not treat you differently for asking.
If we refuse a request we will tell you why, and you may appeal by replying to that refusal. If the appeal is refused you may complain to your state Attorney General.
The two of us, named in the Privacy Policy. The database refuses any read that does not come from our own server-side functions, so the list is not reachable from this website at all.
The app will handle scalp photographs and records you keep yourself, which is consumer health data in a much fuller sense than an email address. This policy will be rewritten before the app collects anything, and we will ask for the separate consent those laws require rather than relying on anything you agreed to here.
Ashfaque Ahmed Nur and Imtiaz Ahmed · [email protected] · West Palashi, Dhaka - 1205, Bangladesh.