Privacy Policy

KESHAH Inc. ("KESHAH", "we", "us", or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the KESHAH mobile application, keshah.com, and related services (the "Service").

By using the Service, you agree to the collection and use of information as described in this Policy. If you don't agree, please don't use the Service.

1. Information We Collect

Information you provide directly:

• Account info: name, email, phone number, password
• Authentication provider (Apple ID, Google account) if you sign in through them
• Quiz answers (hair loss location, goals, medication use, stress level, family history, hormonal changes, etc.)
• Progress data: daily exercise completions, streaks, feel-check answers, scalp check-in answers
• Photos (optional): starter photos, progress photos you upload
• Chat messages you send through in-app support
• Purchase / shipping information for physical products (if applicable)
• Any information you send us at contact@keshah.com

Information collected automatically:

• Device info: model, operating system, app version, language, timezone
• Usage data: features used, time spent, buttons tapped, screens viewed
• Approximate location (from IP address; not precise GPS)
• Crash logs and diagnostic data
• Marketing attribution (which ad or channel brought you to the app)

Information from third parties:

• Subscription status from RevenueCat
• Payment status from Apple / Google / Stripe (we do NOT receive or store your credit card number)
• Attribution data from Appstack
• Anonymous analytics from Amplitude

2. How We Use Your Information

We use your information to:

• Create and manage your account
• Provide the Service, including personalizing your daily routine based on quiz answers, gender, and progress
• Send transactional communications (e.g., password resets, subscription receipts, trial reminders)
• Send optional educational, promotional, or nurture communications (you can opt out)
• Process purchases and manage subscriptions
• Improve, debug, and secure the Service
• Analyze usage patterns to build better features
• Prevent fraud and enforce our Terms
• Comply with legal obligations

We do not sell your personal information.

3. How We Share Your Information

Service providers who help us operate the Service:

• Firebase / Google Cloud — authentication, database, notifications, crash reporting, storage
• RevenueCat — subscription management
• Apple / Google — payment processing for in-app subscriptions
• Stripe — payment processing for physical products
• Amplitude — product analytics
• Appstack — attribution
• AWS End User Messaging, Twilio — SMS delivery
• Nodemailer / SES — transactional email delivery
• Calendly — appointment scheduling

Each of these providers has its own privacy practices. We share only what's necessary for them to perform their function.

Business transfers. If KESHAH is acquired, merges, or transfers substantially all of its assets, your information may be transferred to the acquiring entity.

Legal compliance. We may disclose information if required by law, subpoena, or governmental request, or to protect our rights, users, or the public.

With your consent. In any other case, we ask you first.

4. Data Retention

We retain your information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce agreements.

If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where we're required to retain it (e.g., for tax, accounting, or fraud-prevention purposes).

5. Your Rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access — request a copy of the information we hold about you
• Correction — ask us to correct inaccurate information
• Deletion — ask us to delete your account and associated data
• Objection / Restriction — object to or restrict certain uses of your information
• Data Portability — receive your information in a portable format
• Withdrawal of consent — withdraw consent for processing (where applicable)
• Opt out of marketing — unsubscribe from promotional emails or SMS at any time

To exercise these rights, contact us at contact@keshah.com. We will respond within a reasonable timeframe as required by law.

6. Children's Privacy

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information to us, please contact contact@keshah.com and we will delete it.

If you are between 13 and 18, please review this Policy and our Terms of Service with a parent or legal guardian.

7. International Users

KESHAH is based in the United States. If you use the Service from outside the U.S., your information will be transferred to, processed, and stored in the U.S. and other countries where our service providers operate. By using the Service, you consent to this transfer.

If you are in the European Economic Area, United Kingdom, or Switzerland: you may have additional rights under GDPR, including the right to lodge a complaint with your local supervisory authority. The lawful basis for our processing is (a) performance of our contract with you, (b) our legitimate interests in operating and improving the Service, (c) your consent where applicable, and (d) compliance with legal obligations.

If you are a California resident: you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale of personal information (we do not sell personal information).

8. Security

We use reasonable technical and organizational measures to protect your information from unauthorized access, alteration, disclosure, or destruction. Payment information is handled by PCI-DSS-compliant third-party processors (Apple, Google, Stripe). We do not store credit card numbers on our systems.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk.

9. Cookies and Similar Technologies

The keshah.com website may use cookies and similar tracking technologies to remember your preferences, understand how you use the site, and support advertising. You can control cookies through your browser settings. The mobile app does not use cookies but uses device identifiers for similar purposes.

10. Third-Party Links

The Service may contain links to third-party websites, apps, or services (e.g., research studies, YouTube videos). We are not responsible for the privacy practices of those third parties. Please review their policies separately.

11. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes by posting the updated Policy in the Service, updating the "Last Updated" date, and, where practical, sending a notification. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact

Questions or requests? Contact us at:

KESHAH Inc.
Email: contact@keshah.com