Privacy Policy

Information Plume handles

When you create an account or record, Plume may handle your name, email address or Apple private relay address, selected tracking areas, hair concerns and history, treatments and routines you enter, completion history, symptoms, side effects, notes, consent choices, account settings, and product feedback with any reply from the Plume team.

Plume also creates account and app identifiers needed for authentication, synchronization, request safety, and service operation. Technical records may include request status, timing, error information, and basic network or device information used to secure and troubleshoot the service.

Original progress photos

Original progress photo files stay in protected storage inside the Plume app on your device. Plume does not upload those original full-resolution files to Supabase or OpenAI. Structured photo information, such as date, selected area, angle, completion state, and technical capture quality results, may sync with your account. A separately requested cloud assessment or appearance illustration uses a resized, metadata-stripped copy as described below.

Deleting photos or derived records also removes app-managed generated exports and reports that may contain them. Scan usage is retained when photos or derived records are deleted and is included in exports; account deletion removes server scan usage. Deleting the app removes its local photo files. You can also delete local photos and related records from Plume's Privacy & Data controls. Because original files are not backed up to the cloud by Plume, they cannot be restored on another device or after reinstalling the app.

Account sync and storage

You can sign in with Apple or Google. Plume uses the selected provider to authenticate your account and receives the account identifier and profile information needed for sign-in, such as your name and email address. Plume uses Supabase for account authentication, protected structured record synchronization, storage of records tied to your account, and server functions. Synchronized records remain while your account exists unless you delete them or delete your account.

When you request account deletion, Plume blocks access and removes the account and active data tied to it through its deletion process. Limited security, access log, or backup copies may remain temporarily where required for service integrity, fraud prevention, legal obligations, or routine backup expiration.

Ask Plume and OpenAI

Ask Plume is an optional OpenAI assisted educational feature. Before the first remote Ask Plume request, the app asks for explicit permission and explains that your question, recent Ask Plume conversation, and relevant recorded health or tracking facts are sent to OpenAI through Plume's Supabase service. Original progress photos are not included.

You can choose Not Now and continue using features that do not use OpenAI. You can later withdraw Ask Plume permission in Profile → Privacy & Data; pending remote requests are removed when permission is withdrawn. Ask Plume is for education and does not diagnose, prescribe, or determine whether a treatment is appropriate.

Optional cloud photo assessment

Cloud photo assessment is off by default and requires separate permission for the signed-in account. When you explicitly request an assessment, Plume creates a resized JPEG copy of the selected photo, removes file metadata, and sends that copy through Plume's Supabase service to OpenAI. The original full-resolution file, local asset path, and full device record are not sent.

The assessment can describe supported visible hair and scalp patterns, numbered regional observations, visible-severity labels, and an eligible photo-based hair-pattern estimate. The structured result and model provenance are saved in the protected local record and are not part of the structured account sync payload. Plume's assessment endpoint is designed not to persist submitted image bytes or model results.

You can disable cloud assessment in Privacy & Data to block future requests and separately delete saved derived results. Assessments are for tracking and education, not diagnosis or treatment decisions. The current build has no research or model-training upload pipeline.

Optional appearance illustration

With your separate permission for appearance illustrations, you can ask Plume to send a resized, metadata-free copy of your selected hair or beard photo through Supabase to OpenAI for an imagined six-month appearance illustration. The selected area and illustration horizon are included. The original full-resolution photo stays on your device.

The all-area cosmetic scenario also includes the selected region, an area-specific comparison reference and cosmetic intensity, and a digest binding that context to the photo. Scalp illustrations use the dutasteride + minoxidil comparison; beard illustrations use the minoxidil-only option with a more moderate appearance. These are creative references, not validated treatment forecasts, and the scalp comparison does not establish beard growth. If you choose the study-based crown scenario, the request also includes your selected study, treatment-start and study-population confirmations, the selected patch and its user-measured dimensions, apparent fine and thick strand estimates, and a digest binding that context to the photo. The rest of your health record is not included. For previews in the updated app, you review the photo and context before giving separate permission; ordinary capture and local analysis do not start these requests. Earlier app builds can instead request permission before capture and send a candidate photo during capture review, before Save. A consented retake can use another attempt even if you later discard the photo.

The illustration is optional and is not a treatment forecast or promised result. Plume does not save the input copy, illustration context or generated image on its server. The app holds the illustration in memory for the preview flow and discards it when you leave that flow. OpenAI processes these inputs under its service data controls; Plume does not promise zero provider retention. Skipping another request cannot recall data already received by the provider.

Plume keeps a versioned consent receipt containing your account, request identifier, time and attempt number. A shared two-attempt limit includes requests that fail after processing begins. Receipts are included in signed-in account export and removed by account deletion. Deleting local photos or derived results does not reset that limit.

Private product feedback

If you send an idea, bug report, or question from the app, Plume stores its category, message, timestamps, and any Plume team reply with your signed-in account. Feedback is private to you and the Plume team; it is used to improve the app and respond to your message. It is not a channel for medical advice.

An unsent draft stays on the feedback screen until sent or the account changes and is not added to your health record. Your signed-in account export includes submitted feedback and replies. Deleting your account deletes its feedback and replies.

Optional reminders and saved setup

Device-only reminders remain local. If you separately enable photo check-in notifications while signed in, Plume stores minimized delivery information: your device notification token, Apple delivery environment, app build, time zone, and generic recovery schedule. Apple Push Notification service receives the token and a generic alert; notification payloads do not include photo, treatment, symptom, or account details. Turning reminders off or signing out disables the device registration, and deleting your account removes it.

Saving unfinished setup is optional and off by default. With separate permission, Plume saves only the selected goal, guidance preference, photo area, and setup step in protected storage on this device, bound to its local workspace. Product answers, photos, and processing-consent choices are excluded, as are backup, sync, model context, and exports. A draft expires seven days after its last saved change and is removed when next accessed. Turning saving off, choosing Start over, completing setup, or deleting the workspace also removes it.

Optional app usage analytics

Usage analytics is optional and off by default. If Share basic usage analytics is enabled during setup or in Privacy & Data, Plume sends app-open, setup-completion, and subscription-page-view events to PostHog in the United States to understand feature use. Each event includes the platform, build environment, and a temporary session identifier held only in memory.

Analytics does not include names, emails, account identifiers, persistent device identifiers, photos, health records, answers, or other text entered into the app. Plume does not record the screen or automatically capture taps. The connection exposes the network IP address to the provider. PostHog is configured to discard IP addresses from stored events, and Plume disables location enrichment. The analytics choice stays in the current protected local workspace and does not sync to other devices.

Turning usage analytics off stops new events and cancels pending requests; a request already received by PostHog cannot be recalled. Plume keeps no offline event queue. The temporary session identifier is cleared when analytics is disabled or the account workspace changes, and is not saved between app launches.

Local record export includes the analytics choice, not PostHog's event history. Because events are not associated with a Plume account, signing out or deleting the local record or account does not locate or delete events already received by PostHog. Those events remain subject to the project's retention settings.

Purchases

Apple processes Plume Pro purchases, renewals, refunds, and subscription management through the App Store and StoreKit under Apple's privacy terms. Plume receives verified entitlement status needed to unlock app features, but does not receive your full payment card details.

How Plume uses information

Authenticate your account and keep each person's record separated
Synchronize the structured record you choose to create
Track routines, streaks, symptoms, notes, and dated check ins
Provide source photo comparison and technical capture guidance
Answer optional Ask Plume educational requests after permission
Process separately requested cloud photo assessments and appearance illustrations after permission
Respond to private product feedback and send optional generic reminders
Understand basic app feature use when you enable optional usage analytics
Operate, secure, debug, prevent abuse of, and improve reliability of the service
Provide export and deletion controls and comply with legal obligations

Your choices and controls

Choose which routines, symptoms, treatment details, photos, and notes to record
Decline or withdraw optional Ask Plume or cloud photo assessment permission
Skip optional appearance illustrations or decline a new processing request
Choose whether to save unfinished setup or enable photo check-in notifications
Enable or disable optional app usage analytics during setup or in Privacy & Data
Export your structured record, saved assessments, and signed-in product feedback and replies from the app
Delete photos, derived records, or all local app data
Delete your Plume account and its data from Profile → Account
Manage or cancel Plume Pro through Apple's subscription settings

Security and children

Plume uses platform protections, owner scoped access controls, protected local storage, and encrypted network connections. No storage or transmission system can be guaranteed completely secure.

Plume is not directed to children under 13. If you believe a child has provided personal information, contact us so we can investigate and remove it where appropriate.

This website

The public website does not offer access to your Plume health record. Its hosting and security providers may process basic request information needed to deliver and protect the site, such as IP address, browser type, requested page, and timestamps. The site does not currently use advertising trackers or accept health record submissions.

Changes and contact

Plume may update this policy when its services or legal obligations change. The updated date above identifies the current version. Material changes will be reflected here and, when appropriate, disclosed in the app before new processing begins.

For privacy questions, access or deletion requests, or concerns about this policy, contact the Plume privacy team.

Email the privacy team

← Back to Plume

Your record is personal. Plume treats it that way.