Waitlist sign-in is temporarily unavailable. Please try again shortly. There is no
password field because this site uses email codes or Google to verify an address.
The free waitlist has no charge. The Early Adopter reservation is optional and can be purchased only when checkout is open.
If you make a $4.99 USD Early Adopter payment, you may request a full refund before the app launches, or within the first 14 days of your first month of Pro, which begins when the app becomes available. You are also entitled to a full refund if the app has not launched within 180 days of payment.
Request a refund from your signed-in profile or email [email protected]. We will review the request and arrange eligible refunds through Paddle, the seller and payment processor. Your mandatory consumer and statutory withdrawal rights also apply. See the Terms of Service for the offer terms.
Last updated 11 October 2026 · Effective 11 October 2026
This policy covers scalpmap.app, its waitlist, member area and optional Google sign-in. The Scalp Map app is in development and does not collect information through this website.
1. Who is responsible
Ashfaque Ahmed Nur and Imtiaz Ahmed jointly operate Scalp Map from West Palashi, Dhaka - 1205, Bangladesh. Contact us about privacy at [email protected].
2. Information we collect
Waitlist: your email address, approximate country, signup source, age confirmation, consent record, and signup and verification dates. The country is estimated from your connection; we do not request precise location.
Access and security: verification and access codes, an unsubscribe token, sign-in session details, and a salted hash of your IP address used for rate limiting. Our database stores a hash of the browser session token; your browser stores the token and expiry date.
Google sign-in: if you choose Google, Supabase Auth receives your Google account identifier, email and basic profile information. We link its user ID and email to your waitlist entry. Using Google to join creates an entry for a new address.
Onboarding: your progress and any answers you save to questions about hair or scalp concerns and how long they have lasted, current care and what interrupts it, confidence and what you want your hair to look like in six months. Answers may include short text you write and may reveal health information. You can keep your waitlist entry without finishing the introduction.
Early Adopter reservation: if you accept the offer, we record the terms version and acceptance time, Paddle customer and transaction IDs, payment and refund status, dates, amount, currency, and your first Pro month and price entitlement. Paddle handles your payment details; we do not receive card numbers.
Email signup checks whether the address domain accepts mail and uses a hidden field and submission timing to limit automated signups. We do not collect scalp photographs through this site.
3. Purposes and legal bases
We use your waitlist details to verify and manage your entry, check geographic eligibility, plan launch markets, and send one launch email. We use onboarding answers to plan the app, with your separate choice to save them. We use access and security details to sign you in and protect the service.
Where a legal basis is required, we rely on your consent for the launch email and saved onboarding answers, our legitimate interests for security and service operation, and steps you request to provide waitlist access. You may withdraw consent at any time. We do not sell personal information, use it for targeted advertising, or make automated decisions about your eligibility or price.
4. Who receives information
Supabase hosts our database, authentication and server functions; Resend delivers email; GitHub Pages hosts the site; Cloudflare provides domain and connection services; and Google handles optional sign-in and serves the site fonts. Opening the pricing page may connect your browser to Paddle to show a local price. If you reserve Early Adopter, Paddle receives your email and payment details to process the purchase, receipt and any refund. Each provider receives information needed for its role, including ordinary connection data where your browser contacts it. We may disclose information when legally required. We do not share onboarding answers with Paddle, advertisers, insurers, employers or data brokers.
5. Where information is processed
Our Supabase project is hosted in Singapore. We operate from Bangladesh, and service providers may process information in other countries. Applicable law may give you information and rights concerning international transfers; contact us for details of the safeguards relevant to your information.
6. Retention and security
We keep waitlist entries and saved answers while we operate the waitlist, unless you delete them sooner. An email signup creates an unverified database entry; it is not eligible for the launch email until verified and has no automatic deletion date. Verification codes work for 30 minutes, entry access codes for 15 minutes, and browser sessions for up to 30 days. An hourly cleanup removes IP hashes older than 24 hours. Expired codes may remain in a record until cleared by a later action or deletion.
Deleting your entry removes its live waitlist, onboarding and linked session records and requests removal of its linked Google Auth identity. If you stop during Google sign-in before joining, contact us to remove any Auth record. Provider backups may retain deleted information until they rotate out. We use encrypted connections, server access controls, expiring codes and rate limits to protect information.
7. Your choices and rights
Use the link in a Scalp Map email or your entry view to unsubscribe or request deletion. You can also ask to access, correct, receive a copy of, or delete your information; withdraw consent; or exercise other rights available where you live. Email [email protected]. We may need to verify your identity. You may complain to a relevant privacy authority.
8. Age and related notices
The waitlist is for people aged 16 or older. If the law where you live requires parental or guardian permission, you must have it before joining. Contact us if you believe someone below that age has provided information and we will delete the entry.
We will update this policy before collecting new categories of information or using information for new purposes. If a material change affects waitlist members, we will notify them before it takes effect.
Last updated 11 October 2026 · Effective 11 October 2026
These terms govern scalpmap.app, the free waitlist and its member area. The Scalp Map app is in development and will have its own terms before use.
1. Operator and acceptance
Ashfaque Ahmed Nur and Imtiaz Ahmed jointly operate Scalp Map from West Palashi, Dhaka - 1205, Bangladesh. By using this site or joining the waitlist, you agree to these terms and the Acceptable Use Policy. See our Privacy Policy for data practices.
2. Free waitlist
Joining is free. You must use an email address you control, be at least 16, and have parental or guardian permission if local law requires it. We verify your address and plan to send one email when the app opens. A waitlist entry does not guarantee a launch date, place or feature.
Scalp Map is planned to have a free version. If you do not subscribe after a trial or your Early Adopter month, you move to the free version and keep your photos; you are never charged for it. You can export or delete your photos at any time.
When the app opens, waitlist members can try Pro free for 7 days without a payment card; nothing is charged automatically. Waitlist members who subscribe within 30 days of launch get the Early Adopter Pro prices in section 3, protected for 12 months from subscription activation.
You can unsubscribe or request deletion through a link in our email or your member area, or contact [email protected]. A signed-in browser may retain access for up to 30 days; log out on shared devices.
3. Early Adopter offer
When checkout is open, the optional Early Adopter reservation has a base price of $4.99 USD, with the local price and any applicable tax shown before payment. It provides priority access when the app becomes available, and it pays for your first month of Pro, which begins when the app becomes available to you. You may cancel within the first 14 days of that month for a full refund. No Pro subscription or subscription charge starts automatically: when the month ends, you choose whether to subscribe.
Eligible Early Adopters can choose a Pro price of $14.99 per month, $34.99 every three months or $119.99 per year, protected for 24 months from subscription activation. Final app features and launch timing may change. The price commitment applies to an eligible subscription, subject to the terms accepted at purchase.
Our Refund Policy gives the full refund conditions. Paddle sells and processes any reservation, issues the receipt and handles refunds. We do not receive card numbers. Applicable Paddle buyer terms and mandatory consumer rights also apply.
4. Health information
Site content is general information, not a diagnosis or medical advice. Do not use it to start, stop or change treatment. Consult a qualified health professional about medical concerns.
5. Use and ownership
Do not misuse, attack, overload, scrape or interfere with the site, evade its security controls, or submit an address you do not control. We may suspend access or remove an entry to protect the service, comply with law or address a breach. The Scalp Map name, logo, text and design belong to us or their licensors. You may link to the site but may not republish its content as your own.
6. Availability and liability
We may change, pause or discontinue the site or waitlist. To the extent law permits, we do not guarantee uninterrupted or error-free service and are not liable for indirect or consequential loss arising from this site. Nothing here limits liability that cannot legally be limited or your mandatory consumer rights.
7. Changes, law and contact
We may update these terms. We will notify waitlist members before a material change affecting them takes effect. Bangladesh law governs these terms, subject to mandatory rights under the law where you live. Courts in Bangladesh have jurisdiction unless applicable consumer law provides otherwise.
Everything we publish about how this site treats you and your data
These documents are current as of 9 October 2026 and describe the live website and waitlist.
Policies
Privacy PolicyWhat the waitlist collects, how we use and protect it, who processes it, how long it is kept and the choices available to you.
Terms of ServiceThe waitlist rules, the planned purpose of Scalp Map, age requirements, medical limitations, liability and governing law.
Refund PolicyWhen the optional Early Adopter payment is refunded and how to request it.
Acceptable Use PolicyWhat you must not do to this site, how to report a security problem, and what happens if you breach it.
Cookies and Browser Storage NoticeNo cookies of our own or trackers. Theme and sign-in storage, and optional Google sign-in and Paddle pricing or checkout.
Use the link in a Scalp Map email or your member area to unsubscribe or request deletion. You can also email [email protected] from the address you used to join. We may verify your identity before acting.
Unsubscribe or delete
Unsubscribing stops the launch email but keeps your entry. Deletion removes your live waitlist entry, onboarding answers and linked sessions, and requests removal of a linked Google Auth identity. If a payment obligation is open, the automated deletion route pauses; contact us so we can resolve it and complete your request.
An unverified email signup also creates a database entry. Its deletion link works the same way. If Google sign-in created an Auth record without a completed join, email us to remove it.
Other records
An hourly cleanup removes IP address hashes older than 24 hours. Provider backups may retain deleted information until they rotate out. Paddle may retain payment records it must keep under its own legal obligations if you make a reservation.
Last updated 8 October 2026 · Effective 8 October 2026
This policy forms part of the Terms of Service. It applies to this website and the waitlist.
1. Do not attack the service
Do not attempt to gain access to any part of this site, its database or its server-side functions that is not open to you. Do not probe for or exploit weaknesses, interfere with other people's use, or try to overload the site or the systems behind it.
2. Do not sign other people up
Submit only an email address you control. Adding someone else's address is the one abuse here with a direct victim — they get mail they never asked for, and the verification step exists so that nothing further ever reaches them.
3. Do not automate against the form
Do not submit the form by script, scrape the site at volume, or try to work around the rate limits. Reading the site as a person, at a person's pace, is always fine.
4. Do not use the service to work out who is on the list
Do not use the signup, sign-in or verification forms to test whether a particular person has joined. These endpoints are built to answer identically either way; trying to defeat that is a breach of this policy.
5. Reporting a security problem
If you find a security weakness, please tell us at [email protected] rather than demonstrating it against real data. We would rather hear from you than find out later, and we will not pursue anyone who reports in good faith, acts only against their own entry, and gives us a reasonable chance to fix it before telling anyone else.
6. What happens if you breach this
We may suspend or remove access, and delete an entry. Where we delete an entry for this reason we will say so to the address on it, unless doing so would itself be abusive.
Last updated 11 October 2026 · Effective 11 October 2026
This site sets no cookies of its own, and runs no advertising or analytics trackers. Optional Google sign-in and Paddle pricing or checkout may use provider storage. The storage and requests are described below.
1. Browser storage
If you switch between light and dark mode, we save that choice in your browser's localStorage under the key scalpmap-theme. The value is the word light or dark and nothing else.
It stays on your device, is never sent to us or to anyone else, and cannot identify you. It exists so the site does not forget your choice between visits. Clearing your site data removes it, and the site works normally without it — it simply follows your system setting again.
After you sign in, we save a random token and expiry date in localStorage under scalpmap-session. The token is sent only to our Supabase functions to open your profile or log out. It expires after 30 days. Logging out from your profile removes it from the browser and revokes the corresponding hashed session on our server.
When you close the What happens next steps with Got it, we save the word how in localStorage under scalpmap-viewed, so the card stays marked Viewed on later visits. It holds nothing else, is never sent to us, and logging out removes it.
If you choose Google sign-in, Supabase Auth temporarily keeps its session and PKCE verifier in browser storage under keys beginning scalpmap-google-session. The page also keeps scalpmap-google-intent in session storage to remember whether you were joining or opening an entry through the redirect. The site signs out and clears the intent after the action; a browser closed mid-flow may keep the Auth data until you clear site data or complete a later sign-in.
2. External requests
The two typefaces are served from this site, not from Google Fonts or any other font host. Nothing about loading the type reaches a third party, and your IP address is not disclosed to one.
If you choose Continue with Google, your browser goes to Google and Supabase Auth to verify your account. Google may use its own cookies there; see Google's own privacy information for that step. The Supabase client code is served from this site, not a third-party script host.
Opening the pricing page may load Paddle’s script to show a local price. Opening checkout lets Paddle process the reservation and may allow it to use its own storage for payment processing.
3. What our providers may set
This site is served by GitHub Pages, and its domain is managed by Cloudflare. Where a Cloudflare record is proxied, Cloudflare may set its own bot-management cookie on requests it routes. That is theirs, not ours — we cannot read it and we do not use it.
4. If this changes
If we ever add analytics, we will update this notice and the Privacy Policybefore switching anything on, and ask for consent where consent is required.
Last updated 9 October 2026 · Effective 9 October 2026
This notice covers information about hair and scalp concerns collected through the Scalp Map website and waitlist. Ashfaque Ahmed Nur and Imtiaz Ahmed jointly operate the service from West Palashi, Dhaka - 1205, Bangladesh.
What we collect and why
Joining a hair and scalp waitlist may reveal an interest in health-related services. We collect your email and approximate country directly through signup and connection data to manage the list and plan launch markets. If you choose to save onboarding answers, we collect your selections and short write-ins about hair or scalp concerns and how long they have lasted, current care and what interrupts it, confidence and what you want your hair to look like in six months. We use those answers to plan the app, not to diagnose you or determine price or access.
This website does not collect scalp photographs. Please leave diagnoses, medication and other medical details out of write-ins. If you include them, they remain in your answer until you ask us to remove it or delete your entry.
Sharing and retention
Supabase stores waitlist and answer data. Resend receives the email address needed to deliver verification and launch messages. Google receives account information if you choose its sign-in; Cloudflare and GitHub Pages receive ordinary connection data when you visit. We do not send onboarding answers to Paddle, advertisers, insurers, employers or data brokers, and we do not sell consumer health data.
We keep saved answers with your waitlist entry while we operate the waitlist, unless you delete the answers or entry sooner. Provider backups may retain deleted information until they rotate out. See the Privacy Policy for other retention details.
Your rights
You may ask what consumer health data we hold, receive a copy, correct or delete it, or withdraw consent. Use your entry’s deletion link or email [email protected] to remove answers while keeping your waitlist place. If we deny a request, you may appeal by replying to our decision. You may also contact the authority responsible for consumer health data rights where you live.
We will update this notice and obtain any required consent before collecting additional categories of consumer health data or using it for new purposes.
