Your data belongs to you.

1. Who we are

Shea is operated by Partnox LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA. You can reach us anytime at hello@partnox.com.

2. The short version

• We do not sell or rent your data, ever.
• We do not use your data for advertising, and we do not track you across other apps or websites. Because the app does not track you, Shea does not show the iOS App Tracking Transparency prompt.
• We do not send your photos to any AI service. Face blurring happens entirely on your own device.
• You can delete your account and every piece of data tied to it from inside the app, instantly.

3. What we collect

We collect only what is necessary to provide the Shea experience:

• Account information: your email and display name when you sign up. Signing in with Apple or Google sends us a verified email from that provider.
• Your hair profile: your curl pattern, porosity, density, scalp type, hair status, goals, and length. You enter these, and you can edit or clear them at any time.
• Hair photos: the progress, wash-day, and style photos you choose to add. Faces are blurred on your device before a photo is ever saved or uploaded. You can choose to keep your face visible on a given photo, and your profile avatar is the only photo that is never auto-blurred. Photos are stored in your account's private bucket on Supabase Storage and belong to you. We keep them until you delete them or your account, at which point they are permanently removed.
• Your hair content: wash-day logs and routines, logged styles, your product shelf and ratings, habits and streaks, length measurements, and any notes you write.
• Product ingredient scans: when you scan a product's ingredient list, the text is read on your device using Google ML Kit, and the recognized ingredients can be saved with that product. The photo is not sent to a server to be scanned.
• Usage data: how you interact with the app: features used, screens viewed, and actions taken, so we can understand what is working and fix what is not.
• Device & diagnostics: device model, OS version, app version, language, and timezone, plus crash and performance reports when something goes wrong, so we can fix bugs.
• Push notification token: if you turn on reminders, your device's Firebase Cloud Messaging (FCM) token, used only to deliver your wash-day and journey reminders. You can turn reminders off anytime in settings.
• Purchase status: your subscription plan and status, managed through the Apple App Store or Google Play and RevenueCat. We never see or store your card details.

We do not collect advertising identifiers (no IDFA, no Google Advertising ID), and the app contains no advertising or attribution SDKs.

4. On-device privacy

Shea's two most sensitive features run entirely on your device, with nothing sent to us or any third party:

• Face blur: your face is detected and irreversibly blurred on your device before any hair photo is saved or uploaded. The unblurred version never leaves your phone.
• Ingredient scanning: reading a product's ingredient list from a photo happens locally on your device. The image is not uploaded to be scanned.

5. Analytics & crash reporting

We use PostHog and Google Analytics for Firebase for product analytics (which features are used, which screens are viewed, where people get stuck) and Firebase Crashlytics for crash and stability reports. These are first-party tools that identify you only by an internal account ID and an app-instance ID. They are not used for advertising, we do not collect any advertising identifier (no IDFA, no Google Advertising ID), and your data is not shared with them for cross-app tracking. Google Analytics infers only an approximate, city-level location from your IP address for regional reporting; we never request precise GPS location.

6. Age requirement

You must be at least 13 years old to use Shea. If you are between 13 and 17, you should have a parent or guardian's permission. We do not knowingly collect data from anyone under 13. If you believe a child under 13 has provided us with personal data, email hello@partnox.com and we will delete it.

7. Companies that help us run Shea

We share data only to the extent necessary to operate the app. Here is the complete list of our data sub-processors:

Google ML Kit powers the on-device face blur and ingredient scanning. It runs locally on your device and does not send your photos to Google.

We do not use Google Gemini or any other AI service to analyze your photos, and we do not share any data with advertising networks (no Pinterest, no Meta, no ad partners).

8. Your rights

You have the right to:

• Access: see what data we hold about you. Email hello@partnox.com and we will provide an export.
• Correct: fix any inaccurate data. You can edit most of it directly in the app (your hair profile, goals, looks, products, and notes).
• Delete: remove your account and every byte of data tied to it from inside the app: Profile → Settings → Delete account. All data is permanently purged immediately, across the database and our storage, in a single server-side operation. There is no recovery window.
• Portability: request a machine-readable export of your hair-care data.
• Withdraw consent: turn off reminders or analytics at any time from your in-app and device settings.

9. Security

All data is encrypted in transit using TLS 1.2 or higher, and is encrypted at rest in Supabase. Every record is isolated per user with row-level security, so you can only ever access your own data. Authentication tokens are excluded from device cloud backups so they cannot be restored onto someone else's device. We follow industry-standard practices and review them regularly.

10. California residents (CCPA / CPRA)

Under California law, you have the right to know what personal information we collect, request its deletion or correction, and opt out of any "sale" or "sharing" of personal information. We do not sell or share your personal information for cross-context behavioral advertising. California residents may exercise these rights by emailing hello@partnox.com.

11. Our website

This policy also covers shea.one. Our marketing website uses Google Analytics and the Pinterest tag to measure visits and how well our ads work. These run on the website only and are completely separate from the Shea app, which uses neither. You can opt out with standard browser privacy controls or an ad blocker.

12. International users

Our infrastructure is operated in the United States. If you use Shea from the European Economic Area or the United Kingdom, your data is transferred to the US under the European Commission's Standard Contractual Clauses or an equivalent mechanism. You may access, correct, erase, restrict, port, or object to the processing of your personal data, and lodge a complaint with your local supervisory authority, by emailing hello@partnox.com.

13. Changes to this policy

If we update this Privacy Promise, we will change the "Last updated" date above and notify you inside the app for material changes. Continued use of Shea after a change means you accept the updated policy. If you do not accept it, you can delete your account at any time.

14. Contact

Partnox LLC
30 N Gould St Ste N, Sheridan, WY 82801, USA
hello@partnox.com