Curlvolve Privacy Policy
Last updated 9 September 2026.
Who we are. Curlvolve is published by Reihaneh Hesani, Dubai, United Arab Emirates. Contact: hello@curlvolve.app.
The short version
- Your hair photo is analysed on your iPhone. It is never uploaded for analysis.
- Your profile, routine and shelf are saved in your own iCloud, in a private database that we cannot read.
- If you turn on progress photos, those photos are saved in that same private iCloud database. You can delete any of them, or all of them, in Settings.
- If you use Ask and allow it, your question and a minimal hair profile are sent to Anthropic (the company behind the Claude AI model) to write the answer. Nothing else, and never without your explicit permission.
- We use no advertising, no tracking, and no third-party analytics.
What data the app handles, and where it goes
| Data | Where it is processed or stored | Why | Who can access it |
|---|---|---|---|
| Your hair photo for the scan | On your device only | To read curl range, visible bulk, strand width and ends | Nobody but you. It never leaves the phone. |
| Quiz answers, scan results, cuticle answers, routine state, check-ins, shelf, challenge progress | On your device, and in your own iCloud private database (Apple CloudKit) when you have an account | To build and keep your routine across your devices | You, through your Apple ID. We cannot read your private database. |
| Progress photos (optional) | On your device, and in your own iCloud private database only if you switch "Save my progress photos to iCloud" on | Your Day 1 / Day 21 comparison | You. Delete individually or all at once in Settings. |
| Ask questions (optional) | Sent to our Cloudflare Worker, then to Anthropic's API | To write a plain-language answer | Anthropic processes the request under its own privacy policy and retention rules. We send: your question, curl range, strand width, colour history, the names of products you scanned, and today's dew-point band. We never send your name, email, city, photos or any identifier. |
| An anonymous device token for Ask | Our Cloudflare Worker (a counter that expires daily) | To enforce the five-questions-a-day limit | Us. It is a random string, not linked to you. |
| Your city or country (typed by you) | On your device; sent to Apple WeatherKit as coordinates to get the forecast | The daily hair-weather reading | Apple, under Apple's privacy policy. We do not use device location. |
| Product barcodes or label text | Label text is read on your device. Barcode lookups, when used, go to Open Beauty Facts | The ingredient check | Open Beauty Facts receives the barcode only. |
| Sign in with Apple identity | Apple. We store a refresh token in your device Keychain so we can revoke your sign-in when you delete your account | Your account | Apple. If you chose "Hide my email", we never see your real address. |
| Subscription | Apple App Store | Curlvolve Pro | Apple handles payment; we see only whether Pro is active. |
What we do not do
- We do not sell, rent or share your data with advertisers or data brokers.
- We do not track you across apps or websites.
- We do not use your curl type, or anything else, as a proxy for ethnicity, in analytics, matching or targeting.
- We do not make medical claims. Curlvolve is general information about hair care, not medical advice.
Ask and artificial intelligence
Ask is an AI assistant. Before your first question the app asks for your explicit permission and names Anthropic as the provider. You can withdraw that permission at any time in Settings (AI assistant). With it off, nothing is ever sent. Anthropic's handling of API requests is described at anthropic.com/legal/privacy.
Retention and deletion
- Data on your device and in your iCloud private database stays until you delete it.
- Delete my account in Settings deletes your profile, routine, shelf and every photo from your device and your iCloud private database, and revokes your Sign in with Apple. It cannot be undone.
- Ask requests are not stored by us. The daily counter expires at midnight UTC.
Children
Curlvolve is intended for people aged 13 and over (16 and over where local law requires). We do not knowingly collect data from children below that age.
Your rights
Depending on where you live (for example the EU or UK GDPR, or the UAE Personal Data Protection Law), you may have the right to access, correct, export or delete your data, or to object to processing. Because your data lives on your device and in your own iCloud, you can exercise most of these rights directly in the app. For anything else, email hello@curlvolve.app.
Changes
We will update this page when the app's data practices change and note the date at the top.