Waitlist sign-in is temporarily unavailable. Please try again shortly. There is no password field because this site uses email codes or Google to verify an address.
Last updated 8 October 2026 · Effective 8 October 2026
This policy covers scalpmap.app, the Scalp Map waitlist and optional Google sign-in. It does not cover the future Scalp Map app.
Scalp Map is operated jointly by Ashfaque Ahmed Nur and Imtiaz Ahmed, based in Bangladesh ("we", "us"). We are the people responsible for the personal data described in this policy.
Privacy and deletion requests can be sent to [email protected]. Waitlist support is available at [email protected]. Our postal address is West Palashi, Dhaka - 1205, Bangladesh.
For email signup, our server checks whether the email domain can receive mail. Only the domain after the @ is sent to the DNS resolver. The form also uses timing and a hidden field to detect automated submissions.
We do not ask for your date of birth, postal address, precise location, scalp photographs, medical records or other health information on the waitlist.
We use waitlist information to verify your address, manage your entry, plan where to launch, prevent abuse and send one launch email. Joining the waitlist does not subscribe you to a newsletter. We will ask separately before sending other marketing email.
Where consent is the required legal basis, you give it when you complete verification by code or Google sign-in. You can withdraw it at any time by using a deletion or unsubscribe link. We process the short-lived IP hash on the basis of our legitimate interest in protecting the waitlist from abuse.
We do not sell personal information, use it for advertising, make automated decisions about you, or share it with advertisers, insurers, employers or data brokers.
We use the following providers to operate the site and waitlist:
These providers may process data only as needed to provide their services. We may also disclose information when required by a valid legal process, or as part of a transfer of the Scalp Map project. If a project transfer would affect the waitlist, we will give you notice and an opportunity to delete your entry first.
Waitlist entries are stored in Singapore in Supabase region ap-southeast-1. Email is processed in Tokyo, and we operate from Bangladesh. Your information may therefore be processed outside your country.
Where UK or EEA law requires a transfer safeguard, we rely on the Standard Contractual Clauses and the UK Addendum made available by our providers.
Deletion removes the live entry immediately. A deleted entry may remain temporarily in encrypted disaster-recovery backups until those backups rotate out.
We use encryption in transit and at rest, server-side access controls, input validation, rate limits, expiring verification codes and hashed session tokens. The waitlist database does not permit direct public reads or writes. No online service is completely secure.
You may ask to access, correct, export or delete your information, restrict or object to its use, or withdraw your consent. We make these choices available regardless of where you live.
Use the link in a Scalp Map email or the entry view to unsubscribe or delete your entry without contacting us. Deletion also removes a linked Supabase Auth identity. For other requests, email [email protected]. We aim to respond within 30 days. You may also have the right to complain to your local data protection authority.
The waitlist is for people aged 13 or older. If the law where you live requires parental or guardian permission at your age, you must have that permission before joining. We do not knowingly collect data from anyone under 13. Contact [email protected] if you believe a child under 13 has joined.
Our use of local browser storage and provider technologies is described in the Cookies and Browser Storage Notice.
The waitlist does not collect scalp photographs or medical information. Some laws may still treat interest in a hair and scalp product as consumer health data. Our Consumer Health Data Privacy Policy explains how we handle that information.
Scalp Map is intended to help people keep a personal visual record of their hair and scalp over time, including photographs and notes they choose to add. The app is still in development and does not collect that information through this website.
Before the app collects photographs or personal records, we will publish an updated privacy notice that explains the exact data, purposes, access controls, retention periods and deletion options. We will request consent where required. This waitlist policy does not authorize future app data collection.
We may update this policy as the site changes. If a change materially affects people already on the waitlist, we will notify them before it takes effect.
Questions or requests can be sent to [email protected], or by post to West Palashi, Dhaka - 1205, Bangladesh.
Last updated 8 October 2026 · Effective 8 October 2026
These terms apply to scalpmap.app and the Scalp Map waitlist. They do not govern the future Scalp Map app.
Scalp Map is operated jointly by Ashfaque Ahmed Nur and Imtiaz Ahmed, based at West Palashi, Dhaka - 1205, Bangladesh ("we", "us"). By using this site or joining the waitlist, you agree to these terms and the Acceptable Use Policy. Our handling of personal data is described in the Privacy Policy.
Joining the waitlist allows us to verify your email address, keep your entry and email you once when Scalp Map opens. It is not a purchase, reservation, guarantee of access, or promise of a particular launch date, price or feature.
You must provide an email address you control and be at least 13 years old. If the law where you live requires parental or guardian permission at your age, you must have that permission before joining.
You may leave at any time by using the unsubscribe or deletion link in a Scalp Map email or entry view. You may also contact [email protected].
After you verify your address, this browser may remain signed in for up to 30 days. Use Log out in your profile when using a shared device. You are responsible for access to a browser session left signed in on your device.
Scalp Map is being developed to help people keep a personal visual record of their hair and scalp over time, including photographs and notes they choose to add. The app is not currently available, and its features, timing, pricing and availability may change.
Scalp Map is not intended to diagnose, treat, cure, prevent or predict a medical condition. Content on this site is general information and is not medical advice. Do not use Scalp Map to start, stop or change medication or treatment. Consult a qualified health professional about medical concerns.
The app will have updated terms and privacy information before launch. You will be asked to accept the terms that apply when you begin using it.
You must not misuse, attack, overload, scrape or interfere with the site, bypass its security controls, or submit an email address you do not control. The Acceptable Use Policy provides more detail and forms part of these terms.
The Scalp Map name, logo, site copy and design belong to us or are used with permission. You may link to the site, but you may not copy or republish its content as your own.
The site relies on third-party services including Supabase, Resend, GitHub Pages, Cloudflare and optional Google sign-in. Their own terms and privacy practices may also apply when you use their services.
The site and waitlist are provided "as is" and "as available". To the fullest extent permitted by law, we make no warranties that they will always be available, secure or error-free. We may change, pause or stop the site or waitlist.
To the fullest extent permitted by law, we are not liable for indirect, incidental, special or consequential loss arising from the site or waitlist. Nothing in these terms excludes liability that cannot legally be excluded, including liability for fraud or for death or personal injury caused by negligence. Your mandatory consumer rights remain unaffected.
We may block access or remove an entry when reasonably necessary to protect the site, comply with law, or address a breach of these terms or the Acceptable Use Policy.
We may update these terms as the site changes. The date above shows the current version. If a change materially affects people already on the waitlist, we will notify them before it takes effect.
These terms are governed by the laws of Bangladesh. Courts in Bangladesh have jurisdiction, subject to any mandatory consumer rights that allow you to bring a claim where you live.
Questions about these terms can be sent to [email protected], or by post to West Palashi, Dhaka - 1205, Bangladesh. Privacy and deletion requests can be sent to [email protected].
Opening your Scalp Map access…
Everything we publish about how this site treats you and your data
These documents are current as of 8 October 2026 and describe the live website and waitlist.
Scalp Map is run by Ashfaque Ahmed Nur and Imtiaz Ahmed, two individuals rather than a company.
How to leave the waitlist, and what happens when you do
You never have to explain why you want to leave. The link is in any email we sent, or in your Google join result and entry view.
Every email we send carries a link that unsubscribes you or deletes your entry outright. If you joined with Google, the join result and your entry view provide the same leave link without waiting for an email.
The page asks you to confirm before either happens. That is deliberate: mail scanners and link previewers follow links on their own, and a link that unsubscribed the instant it was fetched would remove people who never clicked anything.
Email [email protected] from the address you signed up with, and we will delete the entry and confirm when it is done. This is also how to remove a Google Auth identity if you started sign-in but did not finish joining. Writing from a different address means we may have to ask you something to avoid deleting the wrong person’s row.
Less than you might expect. Joining the waitlist stores exactly this:
waitlist-siteWe do not ask for a name, date of birth, postal address, precise location, photographs or health information. Google may supply a name and profile image if you choose its sign-in. There is no app yet, so there is nothing from an app to delete.
If you have ever asked to open your entry, a second six-digit code is stored alongside it for 15 minutes and then stops working. It goes with the entry when the entry goes.
When you submit the form we store a salted one-way hash of your IP address for up to 24 hours, purely to stop one source flooding the list. The raw address is not stored in our waitlist table. The hash is kept apart from your signup; the estimated country is stored with the signup. It is not joined to your entry, so deleting your entry does not need to touch it — it expires on its own within a day.
Then you were never on the list. We send nothing to an unverified address beyond that single verification email, and an unverified entry can be deleted by the same link in exactly the same way.
The live record goes immediately. Our database provider also keeps rolling encrypted backups for disaster recovery, and a deleted entry can persist in those until they rotate out; they are used for nothing else. We will not quote you a backup-deletion figure we have not measured ourselves — the same wording is in the Privacy Policy under How long we keep it.
If you want to stay on the list but correct your estimated country or a region stored from an earlier signup, write to [email protected]. Signing up again with the same address updates the estimated country and your consent record if the earlier entry is unconfirmed or unsubscribed; it does not create a second entry.
Last updated 8 October 2026 · Effective 8 October 2026
This policy forms part of the Terms of Service. It applies to this website and the waitlist.
Do not attempt to gain access to any part of this site, its database or its server-side functions that is not open to you. Do not probe for or exploit weaknesses, interfere with other people's use, or try to overload the site or the systems behind it.
Submit only an email address you control. Adding someone else's address is the one abuse here with a direct victim — they get mail they never asked for, and the verification step exists so that nothing further ever reaches them.
Do not submit the form by script, scrape the site at volume, or try to work around the rate limits. Reading the site as a person, at a person's pace, is always fine.
Do not use the signup, sign-in or verification forms to test whether a particular person has joined. These endpoints are built to answer identically either way; trying to defeat that is a breach of this policy.
If you find a security weakness, please tell us at [email protected] rather than demonstrating it against real data. We would rather hear from you than find out later, and we will not pursue anyone who reports in good faith, acts only against their own entry, and gives us a reasonable chance to fix it before telling anyone else.
We may suspend or remove access, and delete an entry. Where we delete an entry for this reason we will say so to the address on it, unless doing so would itself be abusive.
Questions: [email protected].
Last updated 8 October 2026 · Effective 8 October 2026
This site sets no cookies of its own, and runs no advertising or analytics trackers. Optional Google sign-in uses browser storage and Google may use its own cookies during authentication. The storage and requests are described below.
If you switch between light and dark mode, we save that choice in your browser's localStorage under the key scalpmap-theme. The value is the word light or dark and nothing else.
It stays on your device, is never sent to us or to anyone else, and cannot identify you. It exists so the site does not forget your choice between visits. Clearing your site data removes it, and the site works normally without it — it simply follows your system setting again.
After you sign in, we save a random token and expiry date in localStorage under scalpmap-session. The token is sent only to our Supabase functions to open your profile or log out. It expires after 30 days. Logging out from your profile removes it from the browser and revokes the corresponding hashed session on our server.
If you choose Google sign-in, Supabase Auth temporarily keeps its session and PKCE verifier in browser storage under keys beginning scalpmap-google-session. The page also keeps scalpmap-google-intent in session storage to remember whether you were joining or opening an entry through the redirect. The site signs out and clears the intent after the action; a browser closed mid-flow may keep the Auth data until you clear site data or complete a later sign-in.
The page loads two typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser makes that request directly to Google, which means Google receives your IP address as part of serving the files. We receive nothing from it and set nothing as a result.
Self-hosting the fonts would remove the request entirely. We intend to do that.
If you choose Continue with Google, your browser goes to Google and Supabase Auth to verify your account. Google may use its own cookies there; see Google's own privacy information for that step. The Supabase client code is served from this site, not a third-party script host.
This site is served by GitHub Pages, and its domain is managed by Cloudflare. Where a Cloudflare record is proxied, Cloudflare may set its own bot-management cookie on requests it routes. That is theirs, not ours — we cannot read it and we do not use it.
If we ever add analytics, we will update this notice and the Privacy Policy before switching anything on, and ask for consent where consent is required.
Questions: [email protected].
Last updated 7 October 2026 · Effective 7 October 2026
This is a separate policy because some laws require it to be separate — among them the Washington My Health My Data Act and Nevada SB 370, which apply regardless of how small the operator is and cover data that merely relates to someone's health.
Scalp Map is a hair- and scalp-health product. Joining a waitlist for one can itself count as consumer health data under those laws, even though the current signup asks only for an email address and estimates a country from the connection. So rather than argue about whether it applies, we have written it down.
Only this: the fact that you joined a waitlist for a hair- and scalp-health app, your email address, and the country estimated from your IP address. Earlier entries may also contain the region selected at the time. That is the entire set, and it is the same set described in the Privacy Policy — there is no separate health profile.
We collect no photographs, no measurements, no diagnoses, no conditions, no treatments, no medications, no symptoms, no bodily functions, no precise location, and nothing inferred about your health from any of the above.
To email you once when the app opens, and to work out which markets to launch in. Nothing else.
Nobody, beyond the providers named in the Privacy Policy — Supabase, Resend, GitHub, Cloudflare and, only when you choose its sign-in, Google — each only to provide that service to us. We share it with no advertiser, insurer, employer, data broker or other third party.
We have never sold consumer health data and we do not sell it. A sale would require your separate written authorisation under these laws, and we have neither sought nor obtained one, because we do not do it.
You have the right to know what we hold, to get a copy of it, to withdraw your consent to its collection and sharing, and to have it deleted — including from our backups as they rotate, and we will pass a deletion request on to our providers.
The fastest route needs no reply from us: the link in any email we have sent you deletes your entry outright. Otherwise write to [email protected]. We answer within 30 days, and we will not treat you differently for asking.
If we refuse a request we will tell you why, and you may appeal by replying to that refusal. If the appeal is refused you may complain to your state Attorney General.
The two of us, named in the Privacy Policy. The database refuses any read that does not come from our own server-side functions, so the list is not reachable from this website at all.
The app will handle scalp photographs and records you keep yourself, which is consumer health data in a much fuller sense than an email address. This policy will be rewritten before the app collects anything, and we will ask for the separate consent those laws require rather than relying on anything you agreed to here.
Ashfaque Ahmed Nur and Imtiaz Ahmed · [email protected] · West Palashi, Dhaka - 1205, Bangladesh.