StrandScout

Privacy policy

Last updated 2026-10-04

Effective date: October 4, 2026

This policy explains what the StrandScout app and the StrandScout website collect, why, who else handles it, and the choices you have. StrandScout is made by Viral Tandel, who publishes apps as Viral Labs ("we", "us", "our"). If you have a question, email viral.b.tandel@gmail.com.

The short version

1. What the app collects and why

Photos and check-in details

When you run a check-in, the app sends your photos (front, left temple, right temple and, if you took it, crown), the scale you chose (Norwood or Ludwig), and the optional details you entered (age range, family history, when you first noticed a change, the generic names of anything you already use, and your answers about shedding) to our server over an encrypted (HTTPS) connection. Our server passes them to the Google Gemini API, gets the read, and sends it back to your phone. The app asks for your consent, and names Google Gemini, before the first photo leaves your phone.

Our server handles the photos in memory only. We do not save them, log them, or keep a copy after the read comes back, and we do not use your photos to train any AI model. Photos of your head necessarily show your face. They are handled the same way as everything else: read, returned, and not stored by us.

Google Gemini

Google provides the AI read as our service provider. We send Google the photos and the check-in details above, and nothing that identifies you: no name, no email, no Apple ID, no device identifier. Google's handling of data sent to the Gemini API is described in the Gemini API Additional Terms of Service and the Google Privacy Policy.

Your timeline, photos and notes

Everything you save in StrandScout (your check-ins, photos, reads, notes, routine and trends) is stored on your phone in the app's own storage. There is no account, no cloud sync and no copy on our servers. Like any app's data, it may be included in your own iPhone backups (iCloud or a computer), which Apple handles under its terms.

The dermatologist report PDF is created on your phone. It leaves your phone only if you choose to share it, and only with the people or apps you pick.

Anonymous device id

On first launch the app creates a random id and stores it on your phone. It is sent with each check-in so we can count check-ins, apply the free limit, fair-use and rate limits, and stop automated abuse. The only records our server keeps are a daily request counter and a Pro flag, both keyed to this id. It is not your Apple ID, your advertising identifier or your device's serial number, and it is not linked to your name or contact details.

Purchases

StrandScout Pro is sold through Apple In-App Purchase. Apple processes the payment; we never see your card or bank details. We use RevenueCat, Inc. to manage subscriptions. RevenueCat receives your Apple purchase receipt and the anonymous app user id so it can confirm Pro, keep it working after you reinstall, and support Restore purchases. From RevenueCat we see purchase status and history (which product, dates, country and currency), not your name or email. See the RevenueCat privacy policy.

Technical data

Our server runs on Cloudflare. As with any internet request, your IP address and basic request details pass through Cloudflare so the check-in can be delivered and the service protected from attacks. We do not store IP addresses with your check-ins or use them to identify you.

If you have turned on Share With App Developers in your iPhone settings, Apple may share anonymous crash reports with us. You can change this in Settings, Privacy & Security, Analytics & Improvements.

Camera, photo library and notifications

Camera access is used only to take check-in photos. Photo library access is used only for the photos you pick, one at a time through the system picker. The optional four-week reminder is a local notification scheduled on your phone; nothing is sent to us. You can turn any of these off at any time in iPhone Settings. The guide and the timeline work without them.

2. What we do not do

If any of this changes, we will update this policy and the App Store privacy label before the change ships.

3. Who handles data for us

Each handles data under its own terms and privacy policy. We may also disclose information if the law requires it, but because we hold almost nothing about you, there is very little we could disclose.

4. How long we keep data

5. Deleting your data

In the app, open Settings and tap Delete my data. This erases your check-ins, photos, reads, notes and trends from your phone and replaces the anonymous device id with a new one. Deleting the app does the same. There are no photos or timelines on our servers to delete.

To have your purchase record removed from RevenueCat, email us and we will delete it. You can still restore a purchase later through Apple.

You can withdraw your consent to photo reading at any time by not running check-ins. The guide and your timeline keep working without sending anything.

6. Your rights

Depending on where you live (for example the EU, the UK, or California and other US states), you may have the right to ask what personal data we hold about you, to correct or delete it, to object to or restrict how it is used, to receive a copy, and to complain to your local data protection authority. Because we hold almost no data that can identify you, most requests can be answered quickly. Email us and we will reply. We do not sell or share personal information as those terms are defined in California law.

If you are in the EU or UK, we rely on your explicit consent to send photos for reading (photos of your head and the optional health details you enter are sensitive data), on performing our contract with you to provide StrandScout Pro, and on our legitimate interest in keeping the service secure and free from abuse (the anonymous id and rate limits). Our service providers may process data in the United States and other countries, using legal safeguards such as the EU Standard Contractual Clauses where required.

7. Children

StrandScout is made for adults watching their own hair and is not directed to children under 13 (or the minimum age in your country). The app does not ask for personal information. We do not knowingly collect personal information from children. If you believe a child has sent us personal information, for example by email, contact us and we will delete it.

8. Security

Check-ins travel over encrypted connections, and the data on your phone is protected by iOS. No system is perfectly secure, so we keep as little data as we can.

9. This website

The StrandScout website is a static website served by Cloudflare, which processes your IP address to deliver the pages. The launch-email form stores the email address you enter, the page you were on and your country, in a Cloudflare KV store, so we can send one message when the app is released; email us to be removed. If analytics are turned on (Google Analytics 4 and Microsoft Clarity), they load only after you interact with a page and collect anonymous usage data under those companies' policies. The free tools run entirely in your browser and send nothing.

10. Changes to this policy

If this policy changes, the effective date at the top changes with it. If a change is significant, we will also mention it in the app.

11. Contact

Viral Tandel (Viral Labs). Email: viral.b.tandel@gmail.com