Waitlist sign-in is temporarily unavailable. Please try again shortly. There is no password field because this site uses email codes or Google to verify an address.
Last updated 8 October 2026 · Effective 8 October 2026
This policy covers scalpmap.app, the Scalp Map waitlist and optional Google sign-in. It does not cover the future Scalp Map app.
Scalp Map is operated jointly by Ashfaque Ahmed Nur and Imtiaz Ahmed, based in Bangladesh ("we", "us"). We are the people responsible for the personal data described in this policy.
Privacy and deletion requests can be sent to privacy@scalpmap.app. Waitlist support is available at support@scalpmap.app. Our postal address is West Palashi, Dhaka - 1205, Bangladesh.
For email signup, our server checks whether the email domain can receive mail. Only the domain after the @ is sent to the DNS resolver. The form also uses timing and a hidden field to detect automated submissions.
We do not ask for your date of birth, postal address, precise location, scalp photographs, diagnoses, medication, pregnancy or detailed medical history. Write-in answers can contain words you choose to provide about your hair or scalp; please do not include medical details. These answers may be consumer health data.
We use waitlist information to verify your address, manage your entry, plan where to launch, prevent abuse and send one launch email. Onboarding answers help us plan the future app. Founder Pass records let us manage priority access, the future credit and price entitlement, receipts and refunds. Joining the waitlist does not subscribe you to a newsletter. We will ask separately before sending other marketing email.
Where consent is the required legal basis, you give it when you complete verification by code or Google sign-in. You can withdraw it at any time by using a deletion or unsubscribe link. We process the short-lived IP hash on the basis of our legitimate interest in protecting the waitlist from abuse.
We do not sell personal information, use it for advertising, make automated decisions about you, or share it with advertisers, insurers, employers or data brokers.
We use the following providers to operate the site and waitlist:
These providers may process data only as needed to provide their services. We may also disclose information when required by a valid legal process, or as part of a transfer of the Scalp Map project. If a project transfer would affect the waitlist, we will give you notice and an opportunity to delete your entry first.
Waitlist entries are stored in Singapore in Supabase region ap-southeast-1. Email is processed in Tokyo, and we operate from Bangladesh. Your information may therefore be processed outside your country.
Where UK or EEA law requires a transfer safeguard, we rely on the Standard Contractual Clauses and the UK Addendum made available by our providers.
Deletion removes the live entry immediately. A deleted entry may remain temporarily in encrypted disaster-recovery backups until those backups rotate out.
We use encryption in transit and at rest, server-side access controls, input validation, rate limits, expiring verification codes and hashed session tokens. The waitlist database does not permit direct public reads or writes. No online service is completely secure.
You may ask to access, correct, export or delete your information, restrict or object to its use, or withdraw your consent. We make these choices available regardless of where you live.
Use the link in a Scalp Map email or the entry view to unsubscribe or delete your entry without contacting us. Deletion also removes a linked Supabase Auth identity. For other requests, email privacy@scalpmap.app. We aim to respond within 30 days. You may also have the right to complain to your local data protection authority.
The waitlist is for people aged 13 or older. If the law where you live requires parental or guardian permission at your age, you must have that permission before joining. We do not knowingly collect data from anyone under 13. Contact privacy@scalpmap.app if you believe a child under 13 has joined.
Our use of local browser storage and provider technologies is described in the Cookies and Browser Storage Notice.
The waitlist does not collect scalp photographs. Onboarding answers can describe a hair or scalp concern and may be consumer health data. Our Consumer Health Data Privacy Policy explains how we handle that information.
Scalp Map is intended to help people keep a personal visual record of their hair and scalp over time, including photographs and notes they choose to add. The app is still in development and does not collect that information through this website.
Before the app collects photographs or personal records, we will publish an updated privacy notice that explains the exact data, purposes, access controls, retention periods and deletion options. We will request consent where required. This waitlist policy does not authorize future app data collection.
We may update this policy as the site changes. If a change materially affects people already on the waitlist, we will notify them before it takes effect.
Questions or requests can be sent to privacy@scalpmap.app, or by post to West Palashi, Dhaka - 1205, Bangladesh.
Last updated 8 October 2026 · Effective 8 October 2026
These terms apply to scalpmap.app and the Scalp Map waitlist. They do not govern the future Scalp Map app.
Scalp Map is operated jointly by Ashfaque Ahmed Nur and Imtiaz Ahmed, based at West Palashi, Dhaka - 1205, Bangladesh ("we", "us"). By using this site or joining the waitlist, you agree to these terms and the Acceptable Use Policy. Our handling of personal data is described in the Privacy Policy.
Joining the free waitlist allows us to verify your email address, keep your entry and email you once when Scalp Map opens. The free waitlist entry is not a purchase or reservation. An optional, separate Founder Pass is a paid priority-access reservation under section 3. Neither path guarantees a particular launch date or feature.
You must provide an email address you control and be at least 13 years old. If the law where you live requires parental or guardian permission at your age, you must have that permission before joining.
You may leave at any time by using the unsubscribe or deletion link in a Scalp Map email or entry view. You may also contact support@scalpmap.app.
After you verify your address, this browser may remain signed in for up to 30 days. Use Log out in your profile when using a shared device. You are responsible for access to a browser session left signed in on your device.
Founder Pass costs $4.99 USD and gives priority access when the app becomes available. The payment will be credited toward your first Pro payment if you subscribe after a 14-day trial that begins only when the app becomes available. No Pro subscription or subscription charge starts before that trial. The founding Pro price is $14.99/month or $119.99/year, protected for 24 months after subscription activation. The $4.99 payment is optional; you may continue to the dashboard without it.
Cancel before launch for a full refund. We also refund the $4.99 if you do not subscribe after the trial, or if the app has not launched within 180 days of your Founder Pass payment. Refunds are handled manually for this MVP; request one from your signed-in profile or by writing to support@scalpmap.app. We will review and submit eligible refunds through Paddle. A request is not itself confirmation that a refund has been paid. Paddle provides the payment receipt, linked from your profile after confirmation.
The payment is processed by Paddle. We do not store card information. Payment status appears as pending until a verified Paddle notice confirms it. These reservation terms carry consent version 2026-10-08-founder-pass-v1.
Scalp Map is being developed to help people keep a personal visual record of their hair and scalp over time, including photographs and notes they choose to add. The app is not currently available, and its features, timing and availability may change. The Founder Pass founding price in section 3 is a specific commitment for eligible subscribers.
Scalp Map is not intended to diagnose, treat, cure, prevent or predict a medical condition. Content on this site is general information and is not medical advice. Do not use Scalp Map to start, stop or change medication or treatment. Consult a qualified health professional about medical concerns.
The app will have updated terms and privacy information before launch. You will be asked to accept the terms that apply when you begin using it.
You must not misuse, attack, overload, scrape or interfere with the site, bypass its security controls, or submit an email address you do not control. The Acceptable Use Policy provides more detail and forms part of these terms.
The Scalp Map name, logo, site copy and design belong to us or are used with permission. You may link to the site, but you may not copy or republish its content as your own.
The site relies on third-party services including Supabase, Resend, GitHub Pages, Cloudflare, optional Google sign-in and optional Paddle payments. Their own terms and privacy practices may also apply when you use their services.
The site and waitlist are provided "as is" and "as available". To the fullest extent permitted by law, we make no warranties that they will always be available, secure or error-free. We may change, pause or stop the site or waitlist.
To the fullest extent permitted by law, we are not liable for indirect, incidental, special or consequential loss arising from the site or waitlist. Nothing in these terms excludes liability that cannot legally be excluded, including liability for fraud or for death or personal injury caused by negligence. Your mandatory consumer rights remain unaffected.
We may block access or remove an entry when reasonably necessary to protect the site, comply with law, or address a breach of these terms or the Acceptable Use Policy.
We may update these terms as the site changes. The date above shows the current version. If a change materially affects people already on the waitlist, we will notify them before it takes effect.
These terms are governed by the laws of Bangladesh. Courts in Bangladesh have jurisdiction, subject to any mandatory consumer rights that allow you to bring a claim where you live.
Questions about these terms can be sent to admin@scalpmap.app, or by post to West Palashi, Dhaka - 1205, Bangladesh. Privacy and deletion requests can be sent to privacy@scalpmap.app.
Everything we publish about how this site treats you and your data
These documents are current as of 8 October 2026 and describe the live website and waitlist.
Scalp Map is run by Ashfaque Ahmed Nur and Imtiaz Ahmed, two individuals rather than a company.
How to leave the waitlist, and what happens when you do
You never have to explain why you want to leave. The link is in any email we sent, or in your Google join result and entry view.
Every email we send carries a link that unsubscribes you or deletes your entry outright. If you joined with Google, the join result and your entry view provide the same leave link without waiting for an email.
The page asks you to confirm before either happens. That is deliberate: mail scanners and link previewers follow links on their own, and a link that unsubscribed the instant it was fetched would remove people who never clicked anything.
Email privacy@scalpmap.app from the address you signed up with, and we will delete the entry and confirm when it is done. This is also how to remove a Google Auth identity if you started sign-in but did not finish joining. Writing from a different address means we may have to ask you something to avoid deleting the wrong person’s row.
Joining the waitlist stores the following:
waitlist-siteWe do not ask for a name, date of birth, postal address, precise location, photographs, diagnoses or detailed medical history. Write-in answers may contain information you choose to type about a hair or scalp concern. Google may supply a name and profile image if you choose its sign-in. There is no app yet, so there is nothing from an app to delete.
Deleting the entry removes its local onboarding and Founder Pass records. If a Founder Pass payment is pending or paid, the automatic deletion link pauses deletion so we can settle the payment and refund obligation first. Contact privacy@scalpmap.app to complete both. Paddle may keep transaction records it must retain by law.
If you have ever asked to open your entry, a second six-digit code is stored alongside it for 15 minutes and then stops working. It goes with the entry when the entry goes.
When you submit the form we store a salted one-way hash of your IP address for up to 24 hours, purely to stop one source flooding the list. The raw address is not stored in our waitlist table. The hash is kept apart from your signup; the estimated country is stored with the signup. It is not joined to your entry, so deleting your entry does not need to touch it — it expires on its own within a day.
Then you were never on the list. We send nothing to an unverified address beyond that single verification email, and an unverified entry can be deleted by the same link in exactly the same way.
The live record goes immediately. Our database provider also keeps rolling encrypted backups for disaster recovery, and a deleted entry can persist in those until they rotate out; they are used for nothing else. We will not quote you a backup-deletion figure we have not measured ourselves — the same wording is in the Privacy Policy under How long we keep it.
If you want to stay on the list but correct your estimated country or a region stored from an earlier signup, write to privacy@scalpmap.app. Signing up again with the same address updates the estimated country and your consent record if the earlier entry is unconfirmed or unsubscribed; it does not create a second entry.
Last updated 8 October 2026 · Effective 8 October 2026
This policy forms part of the Terms of Service. It applies to this website and the waitlist.
Do not attempt to gain access to any part of this site, its database or its server-side functions that is not open to you. Do not probe for or exploit weaknesses, interfere with other people's use, or try to overload the site or the systems behind it.
Submit only an email address you control. Adding someone else's address is the one abuse here with a direct victim — they get mail they never asked for, and the verification step exists so that nothing further ever reaches them.
Do not submit the form by script, scrape the site at volume, or try to work around the rate limits. Reading the site as a person, at a person's pace, is always fine.
Do not use the signup, sign-in or verification forms to test whether a particular person has joined. These endpoints are built to answer identically either way; trying to defeat that is a breach of this policy.
If you find a security weakness, please tell us at admin@scalpmap.app rather than demonstrating it against real data. We would rather hear from you than find out later, and we will not pursue anyone who reports in good faith, acts only against their own entry, and gives us a reasonable chance to fix it before telling anyone else.
We may suspend or remove access, and delete an entry. Where we delete an entry for this reason we will say so to the address on it, unless doing so would itself be abusive.
Questions: admin@scalpmap.app.
Last updated 8 October 2026 · Effective 8 October 2026
This site sets no cookies of its own, and runs no advertising or analytics trackers. Optional Google sign-in uses browser storage and Google may use its own cookies during authentication. The storage and requests are described below.
If you switch between light and dark mode, we save that choice in your browser's localStorage under the key scalpmap-theme. The value is the word light or dark and nothing else.
It stays on your device, is never sent to us or to anyone else, and cannot identify you. It exists so the site does not forget your choice between visits. Clearing your site data removes it, and the site works normally without it — it simply follows your system setting again.
After you sign in, we save a random token and expiry date in localStorage under scalpmap-session. The token is sent only to our Supabase functions to open your profile or log out. It expires after 30 days. Logging out from your profile removes it from the browser and revokes the corresponding hashed session on our server.
If you choose Google sign-in, Supabase Auth temporarily keeps its session and PKCE verifier in browser storage under keys beginning scalpmap-google-session. The page also keeps scalpmap-google-intent in session storage to remember whether you were joining or opening an entry through the redirect. The site signs out and clears the intent after the action; a browser closed mid-flow may keep the Auth data until you clear site data or complete a later sign-in.
The page loads two typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser makes that request directly to Google, which means Google receives your IP address as part of serving the files. We receive nothing from it and set nothing as a result.
Self-hosting the fonts would remove the request entirely. We intend to do that.
If you choose Continue with Google, your browser goes to Google and Supabase Auth to verify your account. Google may use its own cookies there; see Google's own privacy information for that step. The Supabase client code is served from this site, not a third-party script host.
If you choose Reserve for $4.99, the page loads Paddle's checkout script from cdn.paddle.com and opens Paddle Billing sandbox checkout. Paddle receives ordinary request data and may use its own storage for payment processing. The script is not loaded if you do not open checkout.
This site is served by GitHub Pages, and its domain is managed by Cloudflare. Where a Cloudflare record is proxied, Cloudflare may set its own bot-management cookie on requests it routes. That is theirs, not ours — we cannot read it and we do not use it.
If we ever add analytics, we will update this notice and the Privacy Policy before switching anything on, and ask for consent where consent is required.
Questions: privacy@scalpmap.app.
Last updated 8 October 2026 · Effective 8 October 2026
This is a separate policy because some laws require it to be separate — among them the Washington My Health My Data Act and Nevada SB 370, which apply regardless of how small the operator is and cover data that merely relates to someone's health.
Scalp Map is a hair- and scalp-health product. Joining its waitlist can itself count as consumer health data under those laws. New members can answer questions about a hair or scalp concern during the introduction.
The fact that you joined a hair- and scalp-health waitlist, your email and estimated country, and any older region are held with your entry. If you answer onboarding questions, we also hold selections or short write-in answers about hair concerns, frustration, duration, current care, consistency, confidence, hopes and desired app help. These may reveal feelings about your appearance. Answering is required to finish the introduction, but you can leave it unfinished and keep your waitlist entry. Answers are not used to infer a diagnosis. Current consent version: 2026-10-08-onboarding-v3; earlier answers may carry 2026-10-08-onboarding-v2 or 2026-10-08-founder-pass-v1.
We do not request photographs, measurements, diagnoses, medication, pregnancy details, precise location or detailed medical history through this website. Please keep write-in answers brief and leave out medical details. If you enter them anyway, they remain with the answer until removed under this policy.
To manage the waitlist and launch email, plan launch markets and understand which future app features prospective users want. We do not use these answers to diagnose, advertise to you or decide your access or price.
We retain answers with your waitlist entry until you delete them or the entry. The Privacy Policy explains backup retention and payment-record retention separately.
Our server-side database provider Supabase holds the answers. Other providers named in the Privacy Policy help run the site and payment flow; Paddle handles payment identifiers and billing details if you buy Founder Pass, but we do not send it your onboarding answers. We share answers with no advertiser, insurer, employer or data broker.
We have never sold consumer health data and we do not sell it. A sale would require your separate written authorisation under these laws, and we have neither sought nor obtained one, because we do not do it.
You have the right to know what we hold, to get a copy of it, to withdraw your consent to its collection and sharing, and to have it deleted — including from our backups as they rotate, and we will pass a deletion request on to our providers.
The link in any email we have sent you can delete your entry and linked onboarding answers. You may also write to privacy@scalpmap.app to remove or correct answers without leaving the waitlist. We answer within 30 days, and we will not treat you differently for asking. Payment records may be retained by Paddle as required by law.
If we refuse a request we will tell you why, and you may appeal by replying to that refusal. If the appeal is refused you may complain to your state Attorney General.
Reviewed 8 October 2026: AAD on shedding and hair loss, AAD healthy hair tips, AAD dandruff care, and AAD diagnosis and treatment. Tips are general information, not an assessment of your hair.
The two of us, named in the Privacy Policy. The database refuses direct browser reads; authenticated server-side functions use the waitlist session token to access your records.
The app will handle scalp photographs and records you keep yourself, which is consumer health data in a much fuller sense than an email address. This policy will be rewritten before the app collects anything, and we will ask for the separate consent those laws require rather than relying on anything you agreed to here.
Ashfaque Ahmed Nur and Imtiaz Ahmed · privacy@scalpmap.app · West Palashi, Dhaka - 1205, Bangladesh.