Privacy policy.

Your hair journey is personal, and so is the information you share with us. This policy explains what CurlyGirl collects, why, who helps us run the app, how long we keep things, and the choices you have. It applies wherever you use CurlyGirl, including the United Kingdom, the European Union, Nigeria, Ghana, Kenya, and South Africa.

1. Who we are

CurlyGirl is made by Cubyard LLC, a company based in the United States. Cubyard LLC is responsible for your personal information in CurlyGirl (the "controller" under data protection laws such as the GDPR, the UK GDPR, Nigeria's Data Protection Act, Ghana's Data Protection Act, Kenya's Data Protection Act, and South Africa's POPIA). You can reach us about anything privacy related at [email protected].

2. Information we collect

What you give us:

• Account information: your name, email address, and profile picture link (if your account has one) when you sign in with Google or Apple. We never see your password.
• Hair profiles: the profile names you create and the hair details you choose to add, such as curl pattern, porosity, strand thickness, chemical history (for example color or relaxer), whether you have hard water, and ingredients you avoid.
• Your routine: wash days, the products on your shelf and in each wash, techniques, notes, and check-ins about how your hair feels.
• Shared routines: if you choose to share a wash day, we make a private link for that one wash. Anyone with the link can see the products you used (brand, name, size, and our catalog picture) and the names of the techniques you picked. It never shows your photos, notes, check-ins, name, or hair details. You can turn a link off any time from that wash in the app, and deleting the wash, its profile, or your account removes it. We count how many times a link is opened and keep nothing about the people who open it.
• Photos: pictures of products you snap so we can identify them, and hair photos you add to check-ins.
• Hair Talk: the questions you ask and the answers you get. If you use voice, your speech is streamed to run the call and turned into a written transcript; we keep the transcript, not the recording.
• Messages to us: anything you send when you contact support.

What we collect as you use the app:

• Usage data: which screens you open and which features you use (for example adding a product or logging a wash), with the app version and a random ID for your install. We never record what you type in these events.
• Device and diagnostic data: crash reports and error details, device type and operating system, your IP address as it reaches our servers, and a push notification token if you allow notifications.
• Before you sign in: if you answer the first few hair questions before creating an account, we record that you started and finished them, and which answers you picked, against your install's random ID and nothing else that identifies you. Your answers are only added to a hair profile once you sign in. If you do sign in, we link that install ID to your account so we can see whether the first questions helped you get started.

About your hair details. Curl pattern, porosity, and the rest describe your hair, not who you are. We do not ask for or try to work out your race or ethnicity. Because hair texture can be connected to someone's background, we treat your hair profile with extra care: adding it is your choice, we use it only to personalize your routine, we never sell it or use it for advertising, and you can change or clear it at any time.

3. How we use your information, and why we are allowed to

• To run CurlyGirl for you: your account, profiles, shelf, washes, check-ins, photo journal, wash mix insights, product picks, and Hair Talk. We need this information to provide the app you signed up for under our terms of service (performance of a contract).
• To identify products: reading a barcode or a product photo and finding the product's details and ingredients. This is part of providing the app (contract).
• To remind you and send tips: wash reminders and check-in nudges by push notification (only if you allow notifications on your phone) and wash reminders by email (on unless you switch off "Email reminders" on the Me tab). These are part of the routine tracking you signed up for (contract). Hair care tips come only if you switch "Hair care tips" on (consent). We also email you when you create your account and when you delete it.
• To keep the app working and safe: fixing crashes, preventing abuse, securing accounts, and limiting how often requests can be made (our legitimate interest in a reliable, secure service).
• To improve CurlyGirl: understanding which features help, and checking the quality of Hair Talk answers. A small sample of Hair Talk answers is checked automatically for accuracy, and our team may read a conversation to fix a wrong answer (legitimate interest in giving you accurate, helpful guidance).
• To help you when you ask: a small number of authorized team members can view your account as you see it to answer a support request or fix a problem (legitimate interest, and to provide the app).
• To meet legal duties: keeping records the law requires and responding to valid legal requests (legal obligation).

Wash mix insights, product picks, and Hair Talk answers are created automatically from your information, but they are suggestions only. We never make decisions about you that have legal or similarly significant effects.

We do not sell your personal information, share it for advertising, or show ads in the app. Your email and name are required to create an account, and the usage, device, and diagnostic information described above is collected automatically while you use the app. What you add yourself, such as hair profiles, washes, check-ins, photos, and Hair Talk chats, is up to you.

4. Who helps us run the app

We use trusted service providers who process information on our behalf and only under our instructions:

• Microsoft Azure: hosting, database, photo storage, and email delivery, in the United States.
• OpenAI: identifying products from photos, reading ingredient lists, describing check-in photos for Hair Talk, and powering Hair Talk itself. OpenAI does not use our requests to train its models and keeps them for up to 30 days for abuse monitoring.
• Meta: outlining the products in a photo you snap so you can pick which ones to add, on a tier where your photos are not used for training.
• Brave Search and barcode lookup services: finding product details and images. We send product names and barcodes, never information about you.
• Sentry: crash and error reports, which include your user ID, name, email, and device details so we can fix problems you hit.
• Google and Apple: sign-in, push notification delivery, and app distribution.
• Cloudflare: network security and delivery for our website and servers.
• Anthropic (Claude): when our team reviews a Hair Talk conversation or app usage, they may use an AI assistant that then sees that conversation, your account email, and your usage, only on our instructions.

We may also share information if the law requires it, to protect the safety or rights of our users or others, or as part of a merger or sale of our business, in which case this policy will continue to protect your information.

5. Where your information is stored

Cubyard LLC is based in the United States, and your information is stored and processed in the United States, mainly in Microsoft Azure's Central US region. If you use CurlyGirl from the UK, the EU, or another country, your information is sent to us in the US because that is needed to provide the service you asked for. Data protection laws in the US may differ from those where you live. We protect your information the same way wherever you are, and where our service providers handle it we use safeguards such as their data processing terms, the Standard Contractual Clauses approved by the European Commission and their UK equivalent, or the provider's participation in the EU-US Data Privacy Framework. Write to us if you would like more detail on these safeguards.

6. How we keep it secure

• All traffic between the app and our servers is encrypted (HTTPS).
• Your data sits in access-controlled databases and storage, and photos are shared only through short-lived signed links.
• Sign-in happens through Google or Apple, so we never hold a password for you.
• Only a small number of authorized team members can reach personal data, and only to run or support the app.

If a breach ever puts your information at risk, we will tell you and the relevant regulators as the law requires.

7. How long we keep it

• Your account and hair data: for as long as your account is open. You can delete single washes, check-ins, shelf products, profiles, and Hair Talk chats yourself at any time.
• When you delete your account: we delete your profiles, washes, check-ins, shelf, Hair Talk chats, and settings from our database right away, and our database backups roll over within 14 days. We keep a record that an account was deleted (an ID and the date) and technical records of our own AI usage (timings and costs) that no longer point to a name or email.
• Photos: when you delete a check-in photo, a check-in, a wash, or your account, we also delete those photos from our private file storage, along with any product photos you snapped for that wash or account. Deleting a profile does the same for its product photos and for any washes you delete with it; washes you move to another profile keep their photos. A few photos from deletions before October 2026 may still be in storage while we clean them up. Email [email protected] and we will remove yours within 30 days.
• Shared routine links: until you turn the link off or delete the wash, its profile, or your account. A turned-off link is deleted, not kept.
• Usage events: 180 days, signed in or not.
• Server logs (IP address, request details, and sometimes your email): 30 days.
• Crash and error reports: up to 90 days with Sentry.
• Requests to OpenAI: up to 30 days on OpenAI's side.

We keep something longer only when the law requires it, for example records of a privacy request.

8. Your rights

Wherever you live, you can ask us to:

• Show you the personal data we hold about you and how we use it¹
• Correct anything that is wrong or incomplete (most of it you can edit yourself in the app)¹
• Delete your account and data (available right in the app, on the Me tab under "Delete account")
• Give you a copy of your hair care data in a portable format¹
• Limit how we use your data, or object to uses based on our legitimate interests, including usage analytics¹
• Stop notifications: turn off push in your phone's settings, and use the "Wash reminders", "Email reminders", and "Hair care tips" switches on the Me tab. You can withdraw any other consent you gave, without affecting what happened before

We answer within 30 days, or sooner if your local law requires it, and we will never treat you differently for using these rights. We may need to confirm it is really you before acting.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to your data protection regulator, for example:

• United Kingdom: the Information Commissioner's Office (ico.org.uk)
• Ireland: the Data Protection Commission (dataprotection.ie), or the regulator in your EU country
• Nigeria: the Nigeria Data Protection Commission (ndpc.gov.ng)
• Ghana: the Data Protection Commission (dataprotection.org.gh)
• Kenya: the Office of the Data Protection Commissioner (odpc.go.ke)
• South Africa: the Information Regulator (inforegulator.org.za)

9. Young people

CurlyGirl is not meant for children under 13, and we do not knowingly collect information from them. In some places the law requires a parent's or guardian's permission at an older age: for example under 16 in Ireland, and under 18 in Nigeria, Kenya, and South Africa. If that applies to you, please use CurlyGirl only with your parent or guardian's permission. If you believe a child has given us information without the permission the law requires, contact us and we will delete it.

You can also add a profile for someone you look after, such as your child. If you do, you are telling us you are their parent or legal guardian and that you may share their hair details and photos with us. We use that information only to personalize your routine, and you can delete the profile at any time.

10. Our website

This website sets no cookies and runs no analytics. Its fonts load from Google Fonts, so Google receives your IP address when a page loads.

11. Changes to this policy

We may update this policy as CurlyGirl grows. We will post the new version here and update the date at the top. If a change materially affects how we use your information, we will also let you know before it takes effect, for example in the app or by email.

12. Contact us

Questions about this policy or your data, or a request to use your rights:

Cubyard LLC, United States
Email: [email protected]
Or visit our contact page