Privacy policy

The short version

• No sign-up, no ads, no tracking, and your data is never sold.
• Your answers, plan, routine, check-ins, photos, lab results and chats stay on your phone. A photo only leaves it if you send it for an AI hair analysis, or post your progress to the community yourself.
• Health information leaves your phone only with your explicit consent, for the one AI answer you asked for, and is not stored on Roo's server.
• You can delete everything, on your phone and on Roo's server, from Settings in the app.

Who is responsible

In this policy, "Roo" means the Roo: Hair Loss Coach app, this website and the person who provides them. The controller responsible for your data is:

Ricardo Gruber
Schlossstr. 50
9497 Triesenberg
Liechtenstein
Email: contact@roohairloss.coach

Liechtenstein is part of the European Economic Area (EEA). The General Data Protection Regulation (GDPR) applies there through the Agreement on the European Economic Area, together with Liechtenstein's Data Protection Act (Datenschutzgesetz, DSG), so you have the same rights as anywhere in the EU. More details are in the legal notice (Impressum). Roo has not appointed a data protection officer, because the law doesn't require one for a provider of this size; write to the address above with any privacy question.

This policy covers the app, including its widgets, Lock Screen routine and Apple Watch app, and this website. When you follow a link to a shop, an online doctor, a clinic or another service, that service's own privacy policy applies.

What stays on your phone

Everything you enter in Roo is kept in the app's own storage on your device: your questionnaire answers (including your ethnic background, if you choose to share it), your results and plan, your routine ticks and reminders, check-ins and side-effect logs, lab results, chats with Roo and your progress photos. Roo has no access to any of it. Photos are kept in the app, not in your Photos library. Like the rest of the app's data, they are part of your iPhone's own backup if you use one (iCloud Backup or a backup to your computer), so a new or restored iPhone keeps your journal. That backup is between you and Apple: it never reaches Roo. The only thing the app can save to your Photos library is a progress card you choose to share (scores, never photos), when you tap Save Image. The Home Screen and Lock Screen widgets read your routine from the same device. If you use Roo on an Apple Watch, your routine (step names and ticks) goes from your iPhone to your watch directly, and your ticks come back the same way, never through Roo's server.

The results, the plan and the routine are worked out on your phone by fixed rules. Routine changes made by talking to Roo, the week summary, the "Is it working?" comparison, reading a shampoo label, the reviews Roo helps you write and the bald mirror all run on your phone too.

What reaches Roo's server

Roo's server runs on Supabase, in the EU (Ireland). It keeps:

None of this includes your health answers, your photos or your name.

The routine on your Lock Screen. If "Routine on the Lock Screen" is on (it is unless you turn it off, in Settings), Roo's server also keeps what it needs to put your morning and evening routine on your Lock Screen at the right times: this iPhone's push token for it, its push environment, your time zone, your morning time and evening start, and how many steps each routine has on each of the next two weeks. Never the names of your treatments or anything else about your health. It's kept against your anonymous ID until you turn the setting off or delete all your data, and the token is dropped when Apple says it no longer works. Apple delivers the push.

Public content. The app also downloads public content from Roo's server: research news, new treatments for the library between app updates, the shop's partner links and product photos, the partner clinics for See a dermatologist, community win counts, and seasonal backgrounds for the Today screen. These downloads carry nothing about your health or your plan. To get the seasonal backgrounds for where you live, the app sends the country you chose in the questionnaire, as a two-letter code, with no ID or anything else about you; Roo's server doesn't keep it, though Supabase's request logs may hold it for a few days.

"How did you hear about Roo?" If you answer this at the end of the questionnaire, the app sends just that answer, once (App Store, TikTok, a friend and so on), with no ID or anything else about you. Roo's server adds it to a count for the day, which can't be linked back to you. Skip the question and nothing is sent.

If you join the community

The community and reviews are optional. If you set up a community profile, Roo's server keeps:

Your stack, your plan week and what you write about your hair can say something about your health. You choose to share them, and you can switch the stack and week off, post anonymously or delete what you posted at any time.

Safety check. Before anything appears, the text, your name and your picture are checked by Anthropic's Claude model for spam and safety, after automatic checks on the phone's text for crisis words, contact details, links and the sourcing of research chemicals. Nothing else about you is sent with them. A post you report is hidden for you and goes to Roo's moderation queue; a post reported by three members who can post is removed for everyone, and an author whose posts are removed three times can no longer post. Removed posts stay hidden on the server, so repeated breaches can be recognised, until their author deletes them, the profile or all their data.

Anonymous posts. You can post anonymously. Other members then see "Anonymous member" and your plan week instead of your name, picture and stack. Roo's server still records which account wrote the post, so moderation, reports and the rules work the same.

Sharing your progress. At some monthly milestones the app may ask whether you'd like to share your progress. Nothing is shared unless you choose to: the app puts your first and latest photo of one view side by side on your phone, cropped to your hair unless you turn that off, and shows you exactly how the post will look. The picture and your words leave your phone only when you tap Post. Anthropic's Claude model checks the picture and the text for safety first, then the post appears in the community's Wins room, anonymously unless you turn that off. The picture is stored under a random name that isn't linked to your profile for other members, and it carries no camera details such as place or time. You can delete the post, with its picture, from its menu at any time, and deleting your community profile or all your data deletes it too. Members can see and save what's posted, so only share what you're happy for others to see.

From the community. The app may show how many members on the same treatment shared a win around the same week ("3 members on minoxidil in weeks 9 to 12 shared a win"). These are counts only, from posts members already made public in the Wins room under their own name, never anonymous ones, and only where two or more members are counted. To show them, the app downloads all the counts and picks yours on your phone, so nothing about your treatments or your week is sent.

Reviews with Roo. Roo may ask in the chat whether you'd review a product you've used for a while. His questions and the draft are worked out on your phone, with no AI; the review is sent only when you tap Post, like any review.

Links in posts open in a browser inside the app. The website you open sees what any website sees.

If you invite a friend

Inviting friends is optional. When you open the invite screen, Roo's server gives your anonymous ID an invite code. When a friend uses it, the server records that your two anonymous IDs are linked, and which free-month code each of you was given. A friend's free month is once per iPhone: when your friend enters your code, their app sends a one-time token from Apple's DeviceCheck service, which Roo's server passes to Apple only to check and mark that this iPhone has had its free month. Apple keeps that mark; the token isn't stored and can't tell anyone who your friend is. When your friend's Premium starts, the app sends Apple's signed record of their subscription (including its original transaction ID), so the server can check it's real and count it once. Free months are Apple offer codes: you redeem them on Apple's own page, and Apple handles the subscription. Nothing about your hair or health is part of an invite. If you delete all your data, the record of an invite stays with a random placeholder in place of your ID, so your friend keeps their month.

If you pair with a buddy

A buddy is optional, and both of you have to choose it: one of you turns buddies on, and the other enters that person's code (the same code as for a friend's free month) and chooses to pair up. Once you're paired, Roo's server keeps the name you gave your buddy, your current streak, whether today's routine is done and which day that's for, and any nudge you send (a fixed "keep going" message, at most one in 20 hours; there's no free text). Your buddy sees only those, and you see only theirs: never your treatments, answers, photos or anything about your health. A nudge waits on the server until your buddy's app next opens, then appears in their chat with Roo. Either of you can end it at any time, which removes the pairing and any nudges between you, and deleting all your data in the app deletes everything about you there.

When you use an AI feature

Roo's AI features are Ask Roo (the AI coach) and the AI hair analysis. They use Claude, an AI model made by Anthropic. Before your first use of each, the app shows you what is sent and asks for your explicit consent. Nothing is sent until you agree, and you can withdraw your consent at any time in Settings (Allow Roo's AI). Withdrawing doesn't affect what was sent before.

Ask Roo. Your question, a short summary of you (age, sex, the pattern your hair loss looks most like, your plan week, your goal and any warning signs), the treatments in your plan with the reasons for them, your treatment check-ins (side effects and notes), the last 12 messages of the chat, your phone's region and language, and the partner dermatologists and clinics the app recommends for you (so Roo only names those) are sent to Roo's server and passed to Anthropic, whose Claude model writes the answer. Roo's server doesn't store the question or the answer, only how many tokens the request used (see above), and no ID is passed to Anthropic. The partners sent are the ones in your country who see people online, and, if you've typed a city on See a dermatologist, the ones in that city. The city itself isn't sent, but a clinic listed there shows where you searched. Partners pay to be listed, and Roo always names one with "(Partner)".

AI hair analysis. The photos you choose, the pattern your hair loss looks most like, your previous result (if any) and your language are sent encrypted, analysed by Anthropic's Claude model, and deleted from Roo's server straight away. The result is saved on your phone only.

The free first analysis. Your first AI hair analysis is free, once per iPhone. To count that without an account, the app sends a one-time token from Apple's DeviceCheck service with that analysis, which Roo's server passes to Apple only to check and mark that this iPhone has had its free analysis. Apple keeps that mark, so it stays after the app is deleted; the token isn't stored and can't tell anyone who you are. It never goes to Anthropic. With Roo Premium no token is sent.

At Anthropic. Anthropic processes these requests under its commercial terms, which don't allow using them to train its models. Like most AI providers, Anthropic may keep requests for a limited time to check for misuse, then deletes them.

Other services

Clinics applying to be listed

Dermatologists and clinics can ask to be listed as partners in the app. The application, sent from the clinics page, holds the clinic's name, a contact email, its country and city, what it's known for, its website and whether it would like an invoice or to pay online (online payments are made on [the payment provider]'s own page, under its privacy policy). It goes to Roo's server, where only Roo's admins can read it, and is used only to review the application and reply. It's deleted 12 months after it's reviewed (or 12 months after it arrives, if it never is), or sooner if you ask. Once a clinic is a partner, its listing (name, city, what it's known for, booking link and logo) is public in the app; the contact email never is. Invoices and payment records are kept for as long as tax and commercial law requires. To limit spam, the server counts applications per connection with a one-way hash of the IP address, never the address itself.

The bald mirror

"See yourself bald" runs entirely on your phone using the front camera's face tracking. Nothing is recorded, saved or sent anywhere, and face data is never used to identify you, or for advertising, marketing or analytics.

Notifications

Reminders are scheduled on your phone at the times you choose. The only push Roo's server sends is the one that puts your morning or evening routine on your Lock Screen, without a sound, while "Routine on the Lock Screen" is on. It carries the time of day and how many steps there are, never the names of your treatments. Turn the setting off in Settings to stop it.

This website

This website sets no cookies, has no analytics or advertising, and loads nothing from other companies: its fonts and pictures are served from the site itself. It runs on a server Roo rents from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in Hetzner's data centre in Germany. When you open a page, the server uses your IP address, the page asked for and your browser's details to send you the page, and keeps no log of who opened which page. Only a request that fails with a server error leaves a technical note, which can include the IP address, in the server's error log; that log keeps its latest entries and overwrites older ones, so a note is gone within a few months at most. On an invite or buddy page, the code comes after a # in the address, so it never reaches the web server. The clinic application form sends what you type to Roo's server, as described above.

Legal bases

Roo processes personal data only on one of these legal bases:

You don't have to give Roo any data to use the app's core: the plan, routine, reminders, photos and Learn all work on your phone without sending anything about you. Without consent, the AI features and the community can't work.

Recipients and transfers

Roo uses these service providers. Where they act on Roo's behalf (processors), they're bound by a data processing agreement under Art. 28 GDPR and may use the data only to provide their service.

Data that stays in the EU or Liechtenstein stays inside the EEA, where the GDPR protects it everywhere. Some providers are based in the United States, and data may reach them there or be accessed from there. Where a provider is certified under the EU–US Data Privacy Framework, the transfer rests on the European Commission's adequacy decision for it (Art. 45 GDPR), which also covers transfers from Liechtenstein; otherwise it rests on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can ask for a copy of the safeguards at the address above. Roo shares data with authorities only where the law requires it, and never sells or rents personal data.

How long data is kept

Roo keeps personal data only as long as it needs it for the purpose it was collected for, as set out in each section above. In short: what's on your phone stays until you delete it or the app. On Roo's server, your account, community content, buddy pairing, Lock Screen routine details and AI cost log stay until you delete them or all your data; rate-limit counters stay two days at most; AI hair analysis times 31 days; the questions, answers and photos of AI requests aren't stored at all; clinic applications 12 months; invoices as long as tax law requires. Where the law requires Roo to keep something longer, it's kept only for that and blocked for anything else.

Your rights

Under the GDPR you have the right to:

• access the personal data Roo holds about you and get a copy (Art. 15);
• have it corrected (Art. 16) or deleted (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (data portability, Art. 20);
• object at any time, on grounds relating to your situation, to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, with effect for the future (Art. 7(3)), for example by turning off Allow Roo's AI in Settings;
• complain to a data protection supervisory authority (Art. 77), in particular in the EEA country where you live or work, or to the authority responsible for Roo: the Datenschutzstelle Fürstentum Liechtenstein, Städtle 38, Postfach 684, 9490 Vaduz, Liechtenstein, www.datenschutzstelle.li.

Most of this you can do yourself in the app: everything on your phone is yours to view and change, and Settings › Delete all my data deletes everything on your phone and everything Roo's server keeps against your anonymous ID: your community profile, posts, pictures and reviews, a buddy pairing, your invite code, your allowance record, the AI cost log, the Lock Screen routine's push token and times, the recovery key's hash and your anonymous sign-ins on every device. If your phone is offline, the app finishes this the next time it can reach the server, and your phone gets a new anonymous ID. For anything else, email contact@roohairloss.coach with the support code shown in Settings: it lets Roo find your records without being your ID. Roo answers within one month.

No automated decisions with legal effect. The plan, the "looks most like" read and the AI hair analysis are suggestions to help you understand your hair and talk to a doctor. None of them is a decision that has legal effects on you or similarly significantly affects you (Art. 22 GDPR), and nothing is done with them unless you choose to.

Children

Roo is for people aged 13 and over, and most hair loss treatments are only for adults: the plan never suggests medicines to anyone under 18. Where the law of your country sets an age below which a parent or guardian has to agree to the use of online services (in many countries 16), you may use the AI features, the community and a buddy only with their consent until you reach it.

Security

Everything between the app, the website and Roo's server travels encrypted (HTTPS). Your health information stays in the app's own storage on your phone, protected by iOS. On the server, IDs are kept as one-way hashes wherever that's enough, and only Roo's admins can reach the database. No system is perfectly secure; if a breach puts your rights at risk, Roo will tell you and the supervisory authority as the law requires.

Changes and contact

If this policy changes, the date at the top changes too, and the app tells you when it matters to you. Where a change needs your consent, Roo asks for it first. Questions or requests: contact@roohairloss.coach. See also the terms of use and the legal notice.