Privacy Policy

• Account information: your email and authentication identifiers let you sign in, save favorites, and view account history. If you choose Google sign-in, Google and our authentication provider handle that sign-in and may receive basic Google account information. We do not ask for your Google password.
• Search: the city or neighborhood you enter is sent through our server to Google Places for suggestions. Avoid entering a home address. We do not request device location. Client quiz coordinates are rounded to about a kilometer and we do not save its street-address or place-ID fields. Search URLs may still appear in browser history and hosting logs.
• Quiz: we store your hair and style preferences, budget, search area, optional answers, and results to provide matching and result history. Optional fields can be left blank. Keep result links private: anyone with the link can see a shortlist and match explanations. Original answers and historical photos require the submitting account to be signed in. New quiz photo uploads are not accepted. Old submissions and any previously uploaded photos may remain until removed through our data-request process.
• Optional AI matching: only if you check the separate AI option, written preferences and quiz answers are sent to OpenAI for ranking and short match explanations. Standard matching works without it. The matching request does not include account email, location coordinates, or uploaded photos, but information you put in free text may be included. Do not enter health information, contact details, or other sensitive information. Suggestions can be wrong and do not guarantee a result.
• Barber listings: profile details, business location, specialties, license information, booking links, and portfolio images come from barbers or permission-based imports. Published profile information is public. Profile text may be used for AI-assisted matching. Account email is not a public profile field. New portfolio uploads are checked in private storage before publication. Files with embedded camera, location, caption, rights, or provenance information need a suitable public copy or review; we do not silently strip required credits. We attempt to remove temporary copies after the publication attempt; interrupted uploads may remain privately until cleanup.
• Availability requests: your email and chosen barber are stored when you request availability email. This does not authorize unrelated advertising. Ask us to remove your waitlist entry at any time.
• Choices and agreements: we record the notice version, time, and the choices submitted with a new quiz, waitlist entry, profile, portfolio image acknowledgment, or signed-in account agreement. We do not retroactively assume consent for older records.
• Support and security: we receive messages you send, and our providers process technical information needed to deliver the site and prevent abuse, including IP addresses, request information, and bot-check signals. We retain limited server error reports with personal content removed. We do not record browser sessions or send visitor analytics events in this version.

• Supabase: accounts, authentication, database, and image storage.
• Resend: sign-in email delivery through our authentication provider.
• Vercel: website hosting and delivery, including operational request logs. Optional Web Analytics and Speed Insights are disabled in the application.
• Google Places: search text and selected locations; Google sign-in is optional.
• OpenAI: barber profile text and, only with the separate quiz choice, client answers for matching.
• Cloudflare Turnstile: bot checks on forms, including device and network signals.
• Upstash: temporary rate-limit records using network/account identifiers to prevent repeated abuse.
• Sentry: limited server error metadata and source-code positions. We remove request details, user information, breadcrumbs, and error text before sending events; browser telemetry and performance tracing are disabled.

Providers may process data in the United States or other countries. Their contracts, retention settings, and privacy practices also matter. Public barber profiles are visible to visitors and search engines. We may disclose information where required by law or reasonably necessary to address abuse or protect rights.

External booking, social, and license-check links take you to separate services. Their own policies and fees apply. We do not embed social feeds, advertising pixels, or third-party video players. The bot-check widget is a third-party security integration.

We use authentication and security technology needed for requested features. Optional analytics, advertising pixels, and session replay are disabled. We do not sell personal information or share it for cross-context behavioral advertising. We do not track you across other sites.

Our restricted tracking behavior is the same with or without a Do Not Track or Global Privacy Control signal; neither signal turns on optional processing. Essential security and sign-in processing still occur. Our integrations are not intended to let third parties collect cross-site advertising activity through this site. See the Cookie Policy for details.

Account data, saved results, listings, and waitlist entries are retained to provide those features. We do not currently run an automatic expiry job for quiz or waitlist records. Request deletion when they are no longer needed; backups and provider logs can remain for their configured retention periods, and legal or security obligations may require limited retention. We do not promise immediate deletion from every backup.

Email support@findmybarber.app to request access, correction, deletion, account closure, or withdrawal of an availability request. Include only the email or profile/result link needed to locate your information. We may verify control of the relevant account. Do not send passwords or identity documents unless a proportionate verification process is specifically arranged.

California rights under the CCPA/CPRA apply when the law covers a business and request. These can include access, correction, deletion, opting out of sale/sharing, limiting certain sensitive-data uses, authorized-agent requests, and equal treatment. You can contact us about your data whether or not a statutory threshold applies. We will handle covered requests within the applicable deadlines and explain lawful exceptions.

Accounts, quiz submissions, profile submissions, and waitlist requests are for adults 18 and over. The service is not directed to children under 13. Contact us if a child has supplied information. We use access controls and restricted storage, but no service can promise perfect security.

Material changes will be accompanied by an updated policy date and an appropriate notice. A new use that needs consent requires a new choice. Effective date: September 28, 2026.