Draft of 5 October 2026 — not yet in force
Today this site collects waitlist signups and nothing else. The app, when it exists, will handle photographs of your scalp — that is personal, and in several places it may count as health-related data, which carries extra obligations. This notice says what we collect now, and what we intend for later.
Scalp Map is run by an individual, not a company. There is no registered entity behind it, and we are not going to imply there is one. The operator is [full legal name], based in [country of operation].
Contact details are not published yet, deliberately. A correspondence address and a contact mailbox will appear here before this notice takes effect and before the waitlist accepts a single signup. Contact email — withheld until a mailbox is live and tested. Postal address — withheld until there is one we can publish.
We own the domain scalpmap.app, but owning a domain is not the same as having a working inbox, and an address that bounces is worse than no address at all. In the meantime the signup form on this site does not accept submissions, so there is nothing here collecting your data while you have no way to reach us about it.
Your waitlist details are used for exactly one thing: to email you once, when Scalp Map opens, and to work out where to launch. Where consent is the applicable legal basis, that consent is what you gave at signup, and you can withdraw it at any time by unsubscribing or asking us to delete your entry. [Confirm the legal basis that applies in each market the waitlist accepts, and name it here.]
If we later want to send you anything else — product updates, a newsletter, anything that is not the single launch email — we will ask you separately. We will not treat your waitlist signup as permission for it.
In the app, photographs and anything derived from them would be used to produce your own record and nothing else.
We may use aggregated, de-identified statistics to improve the measurement model. Aggregated means your individual images and records cannot be recovered or re-identified from it. If we ever want to use identifiable scans for research or model training, we will ask you first, separately, and a refusal will not reduce the app's functionality.
We do not sell your data. We do not share it with advertisers, insurers, employers or data brokers.
The waitlist is stored with Supabase, which hosts the database and the functions that receive the form. Email is sent by Resend, which processes it in Tokyo — so a second international transfer, separate from where the list itself is stored. The site is served by GitHub Pages (GitHub, Inc.), and the domain is managed by Cloudflare, which handles DNS and, where a record is proxied, also routes requests to the site. Each of them therefore sees your address or your IP in the course of doing its job, as any such provider does. Each must be under a contract to process data only on our instructions before this notice goes live. We will disclose data to authorities only where a valid legal order compels us, and we will tell you unless we are legally barred from doing so.
Waitlist entries are stored in Singapore (Supabase region ap-southeast-1). If you are outside Singapore, your details are transferred there when you join the list. If we later accept signups from the UK or EU, that transfer needs a lawful basis documented here before we do. Waitlist entries are kept until the app launches and you have either signed up or left the list, and are deleted whenever you ask, whichever comes first.
We are not going to quote a deletion-from-backups timeline we have not tested. A specific retention schedule — including how long backups hold a deleted entry — must be measured against the real setup and published here before this notice takes effect. [Retention schedule, per data type, once verified.]
The intent is that data is encrypted in transit and at rest, that staff access is limited to the fewest people needed and logged, and that the stored list is rate-limited and access-controlled. These are design intentions for a product that is still being built, not claims about a system we have audited — and we would rather say that than imply a guarantee.
What we can say today: this page loads no third-party scripts and sets no cookies of its own. The waitlist itself is stored where the browser cannot reach it — the database rejects every read and write that does not come from our own server-side function, so the list cannot be downloaded by anyone visiting the site. Submissions are validated and rate-limited on the server, not just in your browser. No system is perfectly secure and we will not claim ours is; if a breach affects your data we will notify you and the relevant regulator within the time limits the law sets.
Depending on where you live, you may have the right to access your data, correct it, export it, delete it, restrict or object to processing, and withdraw consent.
You do not have to ask us to leave. Every email we send, including the confirmation, carries a link that lets you unsubscribe or delete your entry outright — email, country and region, gone, with no explanation required and nobody to persuade. That link works whether or not our contact mailbox is live. And if you simply never click the confirmation link, nothing further is ever sent to you. For anything else, write to us once that address is published and we will respond within 30 days. [Confirm which rights apply in each market the waitlist accepts.] If you're in the UK or EU you may also complain to your supervisory authority; if you're in California you have rights under the CCPA, including the right not to be discriminated against for using them.
Scalp Map is intended for people aged 13 and over. We do not invite anyone under 13 to join the waitlist or to upload data, and we do not knowingly collect their information. If you believe someone under 13 has signed up, contact us and we will remove the entry.
Being 13 is the minimum, not a universal permission. The age at which a young person can agree to their own data being processed varies:
The waitlist is open worldwide to anyone aged 13 or over. We do not operate a separate verified parental-consent step, and some countries require one below a certain age. So if you are under the age your country sets for agreeing to this on your own, please involve a parent or guardian before joining.
Either of you can ask us to delete the entry at any time and we will, promptly and without asking why. If you are a parent or guardian and your child has joined, the same applies — tell us and it goes.
The hair science section of this site is readable without signing up, without a photograph, and without telling us anything about yourself. That is deliberate.
Anywhere. Joining the waitlist is not the same as the app launching in your country — which markets the app itself opens in is a separate decision, not yet made, and being on the list is not a promise that it will reach you.
This site sets no cookies of its own and runs no advertising or analytics trackers. It does load two typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which means your browser makes a request to Google to fetch them, and Google receives your IP address as part of that request. Self-hosting the fonts would remove that request, and is on the list.
If we add analytics later we will update this notice before switching anything on, not after.
When we start sending commercial email we will include a valid postal address and accurate sender details, honour opt-outs promptly, and keep the promise made at signup — one launch email unless you separately ask for more. FTC CAN-SPAM guidance
Scalp images, any measurements taken from them and routine records can be sensitive health-related information. The EU sets additional conditions for special-category health data, and some US health apps carry breach-notification duties. The actual data architecture has to be reviewed against both before the app collects anything. EU special categories · FTC Health Breach Notification Rule
If we change this notice in a way that materially affects you, we'll email you before it takes effect rather than quietly updating the date at the top.
For the shape of what belongs in a notice like this one — including that it applies to sole traders, and that it needs full contact details and clear retention information — we followed the UK regulator's small-organisation guidance. ICO: how to write a privacy notice
Draft of 5 October 2026 — not yet in force
These terms cover your use of this website and the Scalp Map waitlist. When the app launches, separate app terms will apply and you'll be asked to accept them then.
This site is run by an individual, not a company: [full legal name], based in [country of operation] ("we", "us"). By using this site or joining the waitlist, you accept these terms.
This is the clause that matters most, so it's near the top. Scalp Map is a personal record-keeping tool, and it is not offered to diagnose, treat, cure, prevent or predict any condition. Nothing on this site or in the app is medical advice.
We are not making a claim here about how the product is classified under any country's medical-device rules. That depends on its intended use and its actual features in each market, and it is a question for qualified review before launch — not something a disclaimer settles. FDA digital health policy navigator [Obtain market-specific regulatory review before stating any regulatory status.]
Anything the app derives from a photograph is an estimate and carries error. Do not use it to start, stop or change any medication or treatment. If you are worried about your hair or scalp, see a doctor, dermatologist or trichologist. If you have a medical emergency, contact emergency services.
Joining the waitlist means we may email you once, about the launch of Scalp Map. It is not a purchase, a reservation, or a promise of a place, a price, or a feature. You can unsubscribe from any email we send, or ask us to delete your entry, by writing to the contact address published in the privacy notice. That address is withheld until a mailbox is live and tested — which is also why the waitlist is currently closed.
You must give an email address you control, and you must be at least 13 years old. If you are under 18, check with a parent or guardian first. Some countries set a higher age for agreeing to this on your own, and we do not operate a verified parental-consent step; if that applies to you, involve a parent or guardian before joining. Either of you can have the entry deleted at any time. See the privacy notice for detail.
Scalp Map is an app in development and is not available to use. Descriptions of it on this site describe what we intend to build. Features, timing, pricing and availability may change, and some things described here may not ship. Interface visuals on this site are labelled concepts, not screenshots. Nothing on this page is a contractual commitment to deliver a specific feature by a specific date.
The general information about hair and scalp health on this site is educational, sourced to published clinical guidance, and dated. It is not personalised advice, it is not a substitute for an assessment, and it is not evidence about what Scalp Map itself can do. See Sources for the references and their review date.
Don't attempt to break into, overload, scrape at volume, or interfere with this site, and don't submit other people's email addresses without their permission. We may suspend access that does any of these things.
The Scalp Map name, logo, copy and design on this site belong to us. You may link to the site freely; please don't copy the content wholesale or present it as your own.
This site is provided "as is". To the fullest extent the law allows, we exclude liability for indirect or consequential loss arising from use of this site. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded. If you are a consumer, your statutory rights are unaffected.
How we handle your data is set out in the privacy notice, which forms part of these terms.
We may update these terms. The date at the top shows when they last changed; continuing to use the site after a change means you accept the updated terms.
These terms are governed by the laws of [governing law], and the courts of [jurisdiction] have exclusive jurisdiction, except where consumer-protection law in your country of residence gives you the right to bring a claim locally. Both follow from the operator's country of operation and the markets the waitlist accepts, so neither can be filled in before those are settled.
Questions about these terms: the contact address published in the privacy notice. Email and postal address are withheld until both are real, live and tested — which must happen before this page is published as final or the waitlist accepts a single signup.