Privacy Policy

Last Updated: October 26, 2026. Effective: October 26, 2026 for accounts created on or after that date. For accounts created before it: November 24, 2026. Until then, an account created before October 26, 2026 stays under an earlier version: an account created before October 14, 2026 under the version last updated September 28, 2026 until November 12, 2026, and then under the version last updated October 20, 2026; an account created from October 14 to October 22, 2026 under the version last updated October 20, 2026; an account created from October 23 to October 25, 2026 under the version last updated October 23, 2026. A version takes effect on its Effective date, or, if it states none, on its Last Updated date, and material changes take effect only after the notice described in Section 16.

1. Introduction, Scope, and Who We Are

This Privacy Policy describes how Fadehaus LLC (“Fadehaus,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information when you use the Fadehaus mobile application (the “App”), our website at fadehaus.com, including its booking, sign-in, and billing pages, and any related services, features, or communications (collectively, the “Services”).

Fadehaus is a two-sided marketplace that connects clients with independent barbers and barbershops. Clients use the Services to discover nearby barbershops and barbers, view services, prices, and reviews, book appointments, pay in-app, tip, and leave reviews. Providers (independent barbers and barbershop owners) use the Services to list their shops, manage services, prices, schedules, and rosters, receive bookings and payments, view analytics, and send opt-in loyalty and promotional messages. Providers are independent contractors, not employees or agents of Fadehaus; Fadehaus is a booking platform and does not itself provide barbering services.

The Services are offered only in the United States and are intended only for users located in the United States. We do not target or offer the Services to residents of other countries, and this Policy is written to United States law.

This Policy applies to both clients and providers. Where a practice applies only to one group, we say so.

This Policy is a notice describing our practices, not a contract. Where a specific practice requires your consent (for example, precise location or promotional texts), we ask for that consent separately, and you can withdraw it as described in this Policy.

Your use of the Services is also governed by our Terms of Service, available at fadehaus.com/terms, which include additional terms required by the Apple App Store and Google Play, our refund and cancellation terms, our independent-contractor and marketplace disclaimers, subscription and auto-renewal terms, and our dispute-resolution (arbitration) provisions. The Terms of Service acknowledge that any app-store license is between you and Fadehaus (not Apple or Google), that Fadehaus alone is responsible for the App and its support, and that Apple and its subsidiaries are third-party beneficiaries of that agreement, as the App Store requires.

Contact for all privacy matters: team@fadehaus.com. Email is our sole published contact channel for privacy requests. Our Terms of Service list a business mailing address for legal notices.

2. Personal Information We Collect

We collect personal information from three sources: (a) information you provide to us directly, (b) information collected automatically when you use the App, and (c) information we receive from third parties. The categories below describe the personal information we collect. If we begin collecting materially new categories, we will update this Policy first.

2.1 Information You Provide Directly

2.2 Information Collected Automatically

Photos you upload (review photos, provider portfolio photos, and Passport reference photos) may contain embedded metadata, including location coordinates recorded by your camera. Since version 1.2.0 of the App (October 6, 2026), the App removes embedded location and camera metadata (EXIF) from a photo before it uploads it, and refuses a photo it cannot clean; our website does the same for Passport photos. Photos uploaded with an earlier version of the App may still contain that metadata. We do not use photo metadata to determine your location. If you turn on the option to include a screenshot in a bug report and allow photo access, the App finds the most recent screenshot on your device and attaches it; it does not upload any other photos from your library.

The App contains two analytics software development kits. PostHog (Section 5.2A) measures how the App is used and is never used for advertising. Firebase Analytics, from Google and linked to our Google Ads account (Section 5.2B), measures which of our ads lead to installs and sign-ups and lets Google Ads build audiences and personalize ads; on iPhone it reads the advertising identifier only if you allow tracking. The App shows no ads and contains no other advertising software. Our website uses PostHog, Google Analytics, and Google Ads tags, each only if you choose Accept in our cookie banner (Sections 5.3, 5.3A, and 5.3B).

2.3 Information from Third Parties

Paid plans for providers are billed by Stripe on our billing website, not through the Apple App Store or Google Play. To subscribe, change your plan or seats, or update your card, the App opens that page in your browser, and Stripe collects your card details directly under its own privacy policy. We receive subscription-status and invoice metadata but never your full payment card details. Subscription auto-renewal, cancellation, and refund terms are set out in our Terms of Service, and you can manage or cancel your plan in the App under Settings, then Subscription. Packs of texts and Fadehaus AI requests are bought the same way, and their terms are in Section 9B of our Terms of Service.

2.4 What We Do NOT Collect

• Card numbers. Payment card details are collected and stored by Stripe, our payment processor. Card data goes directly from your device to Stripe; Fadehaus never receives or stores full card numbers, CVCs, or bank account numbers.
• Biometric identifiers. Neither we nor service providers acting on our behalf use photos to identify individuals, perform facial recognition, or create or retain biometric identifiers or templates, including from Passport and portfolio photos. Automated photo screening (Section 4.1) evaluates whether an image complies with our content guidelines; it does not identify who appears in the image.
• Advertising identifiers, beyond Firebase. Only Firebase Analytics reads your device’s advertising identifier, as described in Section 5.2B: on iPhone only if you allow tracking, and on Android unless you opted out or deleted the ID. It goes from your device to Google; our own servers never receive or store it. We do not work with data brokers.
• Health information. We are not a healthcare provider and do not intentionally collect health information. Please do not enter medical or health details in free-text fields such as Passport notes. See Section 12A for how we handle any health-related information you nonetheless provide.
• Face ID and Touch ID data. If you turn on Face ID or Touch ID, your device checks your face or fingerprint itself and tells the App only whether the check passed. Neither we nor our service providers receive your face or fingerprint data.
• Your contacts and calendar. The App does not read your address book. If you tap Save contact, your phone’s own add-contact screen opens with our contact card. If you pick a person from your contacts to share your Passport with, your phone’s own contact picker opens and the App receives only the name, phone number, and email address of the one contact you pick. It does not read your calendar either: when you add an appointment to your calendar, your device shows its own add-event screen, and the App does not see your other events.
• Your photo library. The App uploads only the photos you choose, or your most recent screenshot when you ask it to attach one to a bug report.
• Your search history. The list of your recent searches is kept only on your device. A place search itself is sent to our servers and to Mapbox to find the place (Section 5.1).

3. How We Use Personal Information

We use each category of personal information for the purposes listed below.

We advertise Fadehaus on Google, and for that we share limited personal information with Google for targeted advertising, as described in Sections 5.2B, 5.3, 5.3B, and 6.3, where you can also read how to opt out. We never use or send sensitive personal information (your precise location, any health information, or your date of birth) for advertising, and we do not sell personal information for money (Section 6.3). We may also use de-identified or aggregated data, which no longer identifies you, for any lawful purpose, consistent with our de-identification commitment in Section 9.

4. Automated Processing and Artificial Intelligence

We use artificial intelligence (“AI”) in the limited, disclosed ways described in this Section. Except for the text screening in Section 4.1A, each involves sending limited content to Anthropic, our main AI vendor, which processes it on our behalf and under contract terms that prohibit use of your content to train its models.

4.1 Automated photo screening. Photos submitted for public display (review photos and provider portfolio photos) are screened by an automated AI vision system before they appear publicly. The system checks photos against our content guidelines (for example, no explicit content, no unrelated or deceptive imagery), which are available in the App under Settings, then About, then Content Guidelines. Screening processes only the uploaded image and the minimum context needed to evaluate it. It does not identify who appears in the image.

4.1A Automated text screening. Review comments and other text you write that other people will see (for example, profile names and bios, booking notes, service and membership descriptions, and messages and offers providers send to clients) are checked before they are saved, first against a list of prohibited words and then by OpenAI’s moderation service, which scores the text for abusive or harmful content. Only the text is sent to OpenAI, not your name or account details, and OpenAI does not use it to train its models.

4.2 AI review summaries. We use AI to generate a short summary of the published reviews for a shop or barber (called “Vibe”), which we show only to that shop or barber. Summaries are derived from review text that is already public in the App. Summaries are generated from all published reviews for the listing, including negative reviews, and are not edited or weighted to favor the provider.

4.2A Review-reply drafts. Providers can ask Fade to draft a reply to a review. The review’s text and rating are sent to Anthropic to write the draft; nothing is posted until the provider sends it.

4.3 Fade, our in-app assistant. Fade is an AI assistant in the App that answers questions about booking, your appointments, and, for providers, your business data. Your messages to Fade are sent to Anthropic to generate a reply, under the same contract terms described above. Before Fade answers you for the first time, the App tells you that Fade is the Fadehaus AI, explains what is sent to Anthropic, and asks your permission; Fade for your business asks separately, because it also sends your clients’ names, visits, and tips. Nothing is sent until you agree. You can withdraw that permission in the App under Settings, then Security and data, then Use Fade; Fade then stops answering. Withdrawing it does not delete conversations you sent us with your feedback (see below). Fade tells you that it is an AI assistant, not a person, whenever you ask.

If you have allowed location access, the App sends your device’s location with your messages so that Fade can find shops and barbers near you, and that location may be included in what is sent to Anthropic. If you agree when Fade asks, Fade can also remember short notes about your preferences (for example, how you like your cut) so that it does not have to ask again. Fade tells you each time it saves a note, and you can tell it to forget any note. Saved notes stay with your account until they are deleted, replaced by newer notes, or your account is deleted, and they are sent to Anthropic with your messages so that Fade’s replies can use them.

We do not store what you type to Fade, or Fade’s replies, as you chat. (If you report a Fade answer, we keep that one answer with your report, as described in Section 4.4.) When you give a Fade answer a thumbs up or down, a Feedback sheet opens where you can add a note if you want. It tells you: “Sending this shares this whole conversation with Fadehaus to improve Fade.” Only if you tap send do we store that whole conversation as text (your messages and Fade’s replies), your rating, and your note. If you close the sheet, nothing is sent. We use conversations you send to see what Fade answered, to find and fix wrong answers, to improve Fade’s instructions and tools, and to keep Fade safe. We do not sell them and we do not use them for advertising. Fadehaus does not use them to train or fine-tune any AI model, and Anthropic may not use them to train its models (see the contract terms described at the start of this Section 4).

If you are a provider, Fade answers questions about your business, so a conversation you send with your feedback can include details about your clients, such as their names, their visits, and their tips. You choose whether to send it, and those details are kept with it in the same way.

We keep a conversation you send for 180 days and then delete it. We also delete it when you delete your account, or sooner if you ask us to (Section 11.1). Only Fadehaus staff whose role specifically allows it can read conversations you send, and we keep a log each time one of them opens one.

When you rate a Fade answer, we also keep a record of that feedback so we can measure and improve how well Fade works. What we keep is your account identifier, which assistant surface and mode you were using, the rating you gave, and technical measurements of that exchange: an internal turn identifier, the model and prompt version used, which internal tools ran and whether any returned an error, how long the reply took, the number of tokens processed, whether a chart was shown, and whether the assistant declined to answer. The feedback record itself does not hold the text of your conversation.

Keeping feedback records is on by default, and you can turn it off at any time in the App under Settings, then Security and data, then Help improve Fade. Turning it off stops feedback records going forward. It does not delete conversations you chose to send with your feedback, and it does not change how Fade works for you. We keep a record of your choice, and of when you changed it, so that we can honor it.

Separately from feedback, each time Fade or another Fadehaus AI feature runs, we keep a short usage record: your account identifier, the business it counts against, if any, the feature, the AI model, the number of tokens processed, and our estimated cost. It never holds the text of your conversation. We use it to count a business’s monthly Fadehaus AI and the requests it bought, to show the business its Usage (Section 6.2A), and to measure what AI costs us. When you use Fade as a client, the record counts against no one. Help improve Fade does not turn this record off, because it is how use is counted.

4.3A Support requests. When you send us a help request or bug report, an AI model from Anthropic reads it to label it by topic and urgency and route it to the right person. For some common questions, an AI assistant may reply using only our published help articles; those replies appear under Fade’s name, the support chat opens by saying that Fade is the Fadehaus AI, the assistant tells you it is an AI whenever you ask, and you can ask for a person at any time. Refunds, account changes, and other decisions about your account are made by a person. Your conversations with the support assistant in the App are treated the same way as other Fade conversations (Section 4.3): they are not stored as you chat, and we keep one only if you send it with your feedback on an answer. This is separate from the help request or bug report itself, which we keep as a communication with us (Section 9).

4.4 Human review and appeals. No fully automated decision that produces a legal or similarly significant effect on you is made without a path to human review. If an automated system rejects or removes your photo, or if content moderation otherwise affects your account or listing, you may appeal by emailing team@fadehaus.com and a human will review the decision. Review moderation follows the Federal Trade Commission’s Rule on Consumer Reviews and Testimonials (16 CFR Part 465): we do not suppress reviews because they are negative, and removals happen only for violations of our content guidelines, with the reason logged. You can report any review, photo, profile, or Fade answer directly in the App. Clients can block a barber or shop, which hides it from their Discover and stops them booking it, and a provider can block a client from booking with them; you can also hide a review or photo you do not want to see. Reporting a Fade answer sends us that answer, the reason you picked, and any note you add, but not your own messages, and we keep it as a report (Section 9, communications with us). We review reports of objectionable content promptly (generally within 24 hours) and remove violating content and, where warranted, the responsible account.

4.5 Profiling. We do not use your personal information for profiling in furtherance of decisions that produce legal or similarly significant effects (such as decisions about lending, housing, insurance, education, or employment). If we ever introduce such profiling, we will update this Policy first and honor applicable opt-out rights.

4.6 Operations agents. We run a small set of AI agents that help us operate Fadehaus. They are built on Anthropic’s models, under the same contract terms described at the start of this Section 4, and they only propose: every refund, every submission to a bank or card network, every block on an account and every public message is decided by a person at Fadehaus, never by the agent. Three of them read limited personal information:

• Fraud and disputes. When a cardholder disputes a charge, or Stripe flags a payment for review, the agent reads the Stripe charge, dispute or review (its identifiers, amount, currency, status, reason, deadline and date; not the cardholder’s name, email, phone, address, IP address or device) and the one appointment that payment paid for (appointment, shop and barber identifiers, time, status and amount; not your name or contact details), and drafts the evidence a person may submit. Each day it also reads refund and charge counts grouped by card fingerprint and shop to spot patterns. It never lists your bookings by name or email.
• Bookkeeping. The agent reads our bank and Stripe payout records and our own payment records by identifier (amounts, dates, status; not the payer’s name or contact details) to match deposits to payouts and categorize transactions.
• Incident response. When our monitoring raises an alert, the agent reads the error report and summary counts from our logs to work out what broke and how many people are affected, by role or shop, never by name, email, account identifier or IP address, and it does not copy log lines into a ticket.

What an agent sends to Anthropic is the content just described, and nothing it is not listed as reading. Each run leaves a record with us (what the agent was woken by, limited to identifiers, amounts, reasons and timestamps; its receipt; and the identifiers of the Stripe objects, tickets and pages it cited), kept as described in Section 9. An agent’s tickets and notes are stored in Atlassian (Section 5.1) and carry identifiers, never names or contact details.

5. Service Providers and Independent Third Parties

We work with two kinds of outside companies: service providers that process personal information on our behalf under contract, and independent third parties that handle some data under their own privacy policies.

5.1 Service Providers (process personal information on our behalf under contract)

These companies process personal information on our behalf under contracts that limit their use of the data to providing services to us and require them to keep it secure, so that it gets the same or equal protection as this Policy describes. We do not authorize them to use your personal information for their own marketing. Google is the one exception to how this table works: Google measures for us as a service provider, but when it uses data to build ad audiences and personalize ads, it acts as an independent third party under its own terms and privacy policy. The Google rows below say which is which, and Section 6.3 explains this sharing and how to opt out.

5.2 Independent Parties You Interact With Through the App

These companies handle some data as independent controllers under their own privacy policies, which govern their use. We do not control their independent practices.

We use one advertising network, Google Ads, and no data brokers. The Fadehaus mobile app uses two analytics services: PostHog, which is never used for advertising (Section 5.2A), and Firebase Analytics, which is linked to Google Ads (Section 5.2B). Our website at fadehaus.com uses Google Analytics, PostHog, and Google Ads tags, each only if you choose Accept in our cookie banner; see 5.3 Website analytics (Google Analytics), Section 5.3A, and Section 5.3B below. Section 5.4 describes the cookies and hosting behind the website itself.

We update this table when we change or add service providers, as part of updating this Policy (Section 16).

5.2A Product Analytics in the App (PostHog)

The Fadehaus mobile app’s product analytics service is PostHog, which processes this data on our behalf as one of the service providers in Section 5.1. It records which screens you open (by the screen’s name only) and key steps such as opening a shop, choosing a service or a time, starting checkout, confirming a booking, joining a membership, and the steps of barber sign-up, with the identifiers of the shop, barber, service, appointment, or plan involved and, when we test two versions of a screen, which version you saw. Once you sign in, these are linked to your account identifier and to which side of the App you are using (client, barber, or shop); before you sign in, they carry only a random identifier the PostHog software creates on your device. PostHog also receives device and app details (device model and maker, operating-system version, app version, language, time zone, and screen size) and your IP address, from which it estimates an approximate location (city and country) before it discards the IP address, which it does not keep. We never send PostHog your name, phone number, email address, street address, payment details, or anything you type.

It also records session replays of how you move through the App: what the screen showed and where you tapped and scrolled. Replays hide everything you type, and hide private details such as the names of clients and family members, phone numbers, email and street addresses, messages and chats and the photos in them, profile photos, and your Passport and its photos. What a shop or barber shows publicly, such as its name and portfolio photos, can appear in a replay as it appears in the App. Screens that are almost entirely private, such as support conversations, inbox messages, your Passport, the people you share it with, and payout details, are hidden whole. Replays do not record the App’s logs or its network traffic.

We use this only to understand and improve the App, for example to see where people get stuck while booking. We never use it for advertising, we do not sell it or share it for advertising, we never send it to Google Ads, and it is not cross-app tracking: PostHog does not follow you across other companies’ apps or websites and never receives your device’s advertising identifier. (Firebase Analytics, which is used for advertising, is described separately in Section 5.2B.) PostHog stores this data in the United States. How long it is kept is in Section 9. Our website uses the same PostHog service, only with your consent, as described in Section 5.3A.

5.2B Install and Sign-up Measurement in the App (Firebase Analytics and Google Ads)

The Fadehaus mobile app on iPhone and Android includes Firebase Analytics, a Google service linked to our Google Ads account. We use it to learn which of our Google ads lead people to install the App and sign up, and it lets Google Ads build audiences (for example, people who installed the App but have not signed up) and personalize the ads Google shows.

• Turned on by us. We switch Firebase collection on from our servers, so we can also switch it off for everyone without an update to the App.
• What it records. The events Firebase records on its own: the first time you open the App after installing it, sessions, how long the App is in use, screen views, and app and operating-system updates. And one event we add: that you signed up, with your account type (client, barber, or shop). With them, Firebase receives a random identifier it creates for each install, device and app details (such as device model, operating-system version, app version, and language), and your IP address, from which Google estimates an approximate location (Google Analytics does not store the IP address itself).
• What it never receives. Your name, phone number, email address, Fadehaus account identifier, precise location, health information, date of birth, or anything you type.
• Advertising identifier on iPhone. On iPhone, Firebase also reads Apple’s identifier for vendor. It reads the advertising identifier (IDFA) only if you choose to allow tracking when Apple’s App Tracking Transparency prompt asks. If you choose Ask App Not to Track, or later turn tracking off in Settings, then Privacy & Security, then Tracking, it is not read.
• Advertising ID on Android. On Android, Firebase collects your device’s advertising ID unless you opted out in the App (below) or deleted the advertising ID in your Android settings (Settings, then Security & data, then Ads, on most phones).
• How Google uses it. Google measures installs and sign-ups for us as our service provider. Because Firebase is linked to Google Ads, Google can also use this data to add you to ad audiences and personalize ads, and for that it acts as an independent third party under the Google Privacy Policy. This is “sharing” for cross-context behavioral advertising, and “targeted advertising,” under state privacy laws (Section 6.3).
• Opting out. In the App, go to Settings, then Security & data, and turn on “Do not sell or share my personal information.” The choice is stored on your account, so it also applies on fadehaus.com while you are signed in. It turns off ad personalization and advertising-ID collection: Firebase can still count installs and sign-ups, but marked so that Google does not use them to build ad audiences or personalize ads. You can also opt out by emailing team@fadehaus.com. Before you have signed in or made a choice, Firebase can already record that you opened the App for the first time; your choice applies from the moment you make it.
• Storage and retention. Google stores this data on its own systems, which may be in the United States or other countries. How long it is kept is in Section 9.

Our website at fadehaus.com uses Google Analytics 4, a web-analytics service provided by Google LLC, to understand how visitors find and use the site so we can improve it. Google acts as our service provider for measuring the site, under the Google Ads Data Processing Terms. We have turned on Google Signals and linked Google Analytics to our Google Ads account. Google Signals lets Google connect visits with the Google account of a visitor who is signed in to Google and has turned on ad personalization in their Google settings. Together, these let Google use the site’s analytics data to build ad audiences and personalize ads, and for that Google acts as an independent third party under the Google Privacy Policy. This is “sharing” for targeted advertising (Section 6.3). In the App, Google’s measurement runs through Firebase Analytics (Section 5.2B). The website’s other services are PostHog (Section 5.3A), which is never used for advertising, and Google Ads tags (Section 5.3B).

• Only with your consent. Google Analytics does not load and sets no cookies until you choose “Accept” in our cookie banner. If you decline, or if your browser sends a Global Privacy Control signal, no analytics cookies are set and nothing is sent to Google. Accepting does not backfill: pages you viewed before you accepted are not sent afterwards. If you are signed in and have turned on “Do not sell or share my personal information” (Section 6.3), the site turns off ad personalization for your visits.
• Cookies used. When you accept, Google Analytics sets first-party cookies beginning with _ga. They store a randomly generated identifier used to measure visits and distinguish devices. If you later decline, we expire those cookies.
• What is collected. Standard measurement data: pages viewed, page titles and addresses, device and browser type, approximate location derived from your IP address (Google Analytics 4 does not retain the IP address itself), and referral source.
• AI-assistant referrals. If you arrive from an AI assistant, we record a traffic-source value of “AI Assistant” and the hostname of that assistant, for example chatgpt.com. We never record the full referring address, the conversation, or anything you typed into it. Your browser sends the referring address to every website you visit; we read it, and we send nothing and store nothing from it unless and until you accept analytics.
• Data transfer. Google may process this data in the United States. Google LLC self-certifies under the EU-US, Swiss-US, and UK Data Privacy Framework; standard contractual clauses apply as a fallback.
• Retention. Visitor- and event-level analytics data is retained for 14 months, and Google Signals data follows the same limit; aggregated reports may be kept longer.
• Changing your mind. Use the Cookie settings link in our website footer at any time to accept or decline analytics, or the “Your Privacy Choices” link in the footer to opt out of sharing for advertising (Section 6.3). You can also turn off ad personalization for your Google account at myadcenter.google.com. You can also install Google’s Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.
• More information. See “How Google uses information from sites or apps that use our services” at google.com/policies/privacy/partners/.

5.3A Product Analytics on the Website (PostHog)

Our website at fadehaus.com also uses PostHog, the product analytics service described for the App in Section 5.2A. PostHog processes this data on our behalf as one of the service providers in Section 5.1, in the same PostHog project as the App.

• Only with your consent. PostHog loads only after you choose “Accept” in our cookie banner, the same choice that turns on Google Analytics (Section 5.3). It never loads when your browser sends a Global Privacy Control signal. If you choose “Decline”, or later turn analytics off in Cookie settings, PostHog stops, and we delete its cookie and the data it stored in your browser.
• Cookie and identifiers. Before you sign in, PostHog uses a random identifier stored in two first-party cookies, ph_<project key>_posthog and ph_<project key>_posthog_cpm, on.fadehaus.com (shared with book.fadehaus.com and kept for 1 year), with related ph_ entries in your browser’s local storage. Choosing “Decline” or turning analytics off deletes all of them. Once you sign in on the website, that identifier is linked to your Fadehaus account identifier, the same one the App uses. When you sign out, the identifier is reset.
• What is recorded. The pages you view, by the page’s path only: we drop the query string, except campaign tags that begin with utm_, and we do not record the part of the address after #. And the clicks the site already measures: a link’s visible label, its destination path, and the section of the page it is in. Automatic capture of everything else is off.
• Session replays. On fadehaus.com’s public pages, PostHog records session replays of how you move through the page, with everything you type masked. Addresses inside a replay are cut to the page path and campaign tags, the same way as page views. Replays do not record the browser console or the contents of network requests. There are no replays on our legal pages (Privacy Policy, Terms of Service, Affiliate Terms, Health Data Notice and SMS Terms record page views only) or on book.fadehaus.com.
• Pages that record nothing. Pages reached from a private or signed-in link send nothing to PostHog: the member area (/app), sign-in and account confirmation pages (/sign-in, /auth, /oauth), account deletion (/delete-account), your inbox (/inbox), team invitations (/manager-invite), review requests (/review-ask) and payment pages (/stripe).
• IP address and location. PostHog estimates an approximate location (city and country) from your IP address and then discards the IP address, as described for the App in Section 5.2A.
• Storage and retention. PostHog stores this data in the United States. As for the App, session replays are kept for 30 days and analytics records for up to 12 months (Section 9).
• Never for advertising. We never use this data for advertising, we never send it to Google Ads, and we do not sell it or share it.

5.3B Google Ads on the Website

Our website at fadehaus.com uses Google Ads conversion tracking and remarketing tags, so we can see which of our ads bring people to the site and lead to a conversion, show our ads again to people who visited, and let Google personalize the ads it shows.

• Only with your consent. The Google Ads tags load only after you choose “Accept” in our cookie banner, the same choice that turns on Google Analytics and PostHog (Sections 5.3 and 5.3A). They never load when your browser sends a Global Privacy Control signal. If you choose “Decline”, or later turn analytics off in Cookie settings, they stop.
• What Google receives. The pages you visit on fadehaus.com, whether you completed a conversion, a random identifier in cookies, your IP address, and your browser type. Google may use the IP address to estimate an approximate location. We never send Google Ads your name, email address, phone number, Fadehaus account identifier, precise location, health information, or date of birth.
• Cookies used. First-party cookies beginning with _gcl, which Google keeps for 90 days, and cookies Google sets on its own domains (such as google.com and doubleclick.net) under its own policies.
• How Google uses it. Google measures our ads for us, and when it builds ad audiences and personalizes ads it acts as an independent third party under the Google Privacy Policy. This is “sharing” for targeted advertising (Section 6.3).
• Opting out. Use the “Your Privacy Choices” link in our website footer, choose “Decline” in Cookie settings, send a Global Privacy Control signal, turn on “Do not sell or share my personal information” in the App under Settings, then Security & data (it applies on the website while you are signed in), or email team@fadehaus.com. You can also turn off ad personalization for your Google account at myadcenter.google.com.
• Retention. Section 9.

5.4 Cookies and Website Hosting

fadehaus.com sets three always-on cookies: a sign-in cookie that keeps you signed in on the website, a small record of your cookie choice (fh_consent_v1), and fh_hero, which holds only “a” or “b” for 60 days so you see the same version of our home page, and of our pages for barbers and for barbershops, while we test two designs of each. None of them tracks you. While those tests run, your browser also stores small “already counted” flags (named fh_hx, one per test, value “1”) so a visit is counted once; they hold no identifier. Cloudflare hosts the site and, on the sign-in page, checks that you are a person and not a bot (Turnstile); Cloudflare sees your IP address and browser type and keeps short request logs. Errors on the website are reported to Sentry without your name. Google Analytics, PostHog, and the Google Ads tags run only if you accept them in the banner, and never when your browser sends a Global Privacy Control signal (Sections 5.3, 5.3A, and 5.3B); only then does PostHog set its ph_ cookie and do Google’s _ga and _gcl cookies get set. The Google Ads cookies are advertising cookies: they are used to measure our ads, show them again to people who visited, and personalize ads.

6. How We Share Personal Information

6.1 With Providers You Book

When you book an appointment, the provider (the barber and, where applicable, the shop) receives the information they need to perform the service: your name as it appears on your profile, the services and add-ons you selected, the appointment time, your relevant Passport preferences (hair type, styles, notes) if you have saved them, your appointment history with that provider, and your tip and payment status (amounts and status only, never card details). Staff at a shop you have booked with, and an independent barber you have booked with, can also see the phone number and email address on your account when they look you up in the App, for example to book your next visit for you. If a provider enters your contact details themselves, for example for a walk-in visit, that information is handled as described in Section 6.5. Providers also see the reviews you publish, which appear with your name as shown on your profile. If a provider you booked with uses Fade for their business, the name they see for you, with your visits and tips at their business, can be sent to Anthropic so that Fade can answer the provider’s questions, and can be stored in that provider’s Fade conversations as described in Section 4.3. Providers are independent businesses and are responsible for their own handling of information they receive; we require them, through our terms, to use client information only to provide and manage their services and, for clients who have separately opted in under Section 7.2, to send loyalty and promotional messages through the Services (never by exporting your contact information for their own off-platform marketing).

6.2 Public Information and Photos of People

Content you choose to publish is visible to other users of the Services: your reviews, ratings, and review photos (with your display name); provider profiles, shop pages, services, prices, portfolio photos, and aggregate ratings. Do not include information in public content that you do not want to be public. Public pages on fadehaus.com can be indexed by search engines, and a search engine or another site may keep a copy after you edit or delete the content; we cannot remove those copies, but you can ask the search engine to update them.

Providers must obtain permission from any identifiable person before uploading a photo of them (for example, a client whose haircut appears in a portfolio photo). If you appear in a photo in the App and want it removed, email team@fadehaus.com with the subject “Photo Removal.” You do not need an account to make this request (see Section 11.2 for how we verify non-account requests).

6.2A Within Shops (Between Providers)

When a barber applies to, is invited to, or joins a shop, the shop owner sees the barber’s profile, services, schedule, and the appointment and earnings data attributable to that shop, and the barber sees corresponding shop information. Shop owners with multiple shops see this information for each of their shops. If a barber leaves a shop, the shop retains the business records of appointments performed there. Everyone who works under a business can see its Usage page, including the name of each campaign and how many texts it used, and how much of the business’s Fadehaus AI each person on the account used, by name. Providers are independent businesses responsible for their own use of this information.

6.2B When a Shop Changes Owner

A shop owner can transfer their business to another Fadehaus account in the App. When the new owner accepts, they take over every location of that business, and the shop’s records go with it: its appointments and booking history (including the clients who booked there, and walk-in and guest details), services, reviews, and membership plans and their members. The previous owner loses owner access, and the shop’s managers are suspended. If you are on a waitlist for one of the shop’s memberships, we tell you in the App that your place was reset.

6.2C Fadehaus Staff Access

Fadehaus staff whose role specifically allows it can see a provider’s account and take the actions the provider’s owner could take, for example to issue a refund, set up a card reader, fix a problem the provider reports, review reported content, answer a support request, or enforce our terms.

6.3 Sharing for Targeted Advertising, and How to Opt Out

What we share. We advertise Fadehaus on Google. To do that, we let Google collect the data described in Sections 5.2B (Firebase Analytics in the App), 5.3 (Google Analytics on the website), and 5.3B (Google Ads on the website): identifiers (a random install or cookie identifier and, where allowed, your device’s advertising identifier), the app and website activity described there, device and browser details, and your IP address, from which Google may estimate an approximate location. Google uses it to measure our ads, to build audiences so it can show our ads again to people who used the App or visited our website, and to personalize ads. This is “sharing” for cross-context behavioral advertising under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CPRA”), and “targeted advertising” under other state privacy laws. We share these categories with one third party, Google, for this purpose. We did not share personal information for advertising before this version of the Policy.

What we do not do. We do not sell personal information for money, and we have not in the preceding 12 months. Some state laws define “sale” broadly enough to include advertising sharing like the above, so we treat your opt-out as covering both. We never use or share sensitive personal information for advertising: your precise location, any health information, and your date of birth are never sent to Google Ads or Firebase, and Google receives no location from us beyond what it estimates from your IP address. We do not sell sensitive personal information, so the Florida notice “This website may sell your sensitive personal data” does not apply to us. PostHog (Sections 5.2A and 5.3A) is never used for advertising. We do not knowingly share the personal information of anyone under 16 for advertising; you must be 18 to hold an account (Section 12).

How to opt out. You can opt out of sharing for targeted advertising, and of any sale, in any of these ways:

• In the App: Settings, then Security & data, then turn on “Do not sell or share my personal information.” The choice is stored on your account, so it covers the App and, while you are signed in, fadehaus.com. It turns off ad personalization and the collection of your advertising identifier.
• On the website: the “Your Privacy Choices” link in our website footer, or “Decline” in Cookie settings, which keeps the Google Ads tags and Google Analytics from loading.
• With a Global Privacy Control signal: if your browser sends one, our website never loads the Google Ads tags or Google Analytics (Section 14).
• By email: write to team@fadehaus.com with the subject “Do Not Sell or Share”. You do not need to verify your identity to opt out, but we need enough to find your account, such as the email address or phone number on it.
• On your device: on iPhone, choose Ask App Not to Track in Apple’s prompt, or turn tracking off in Settings, then Privacy & Security, then Tracking; on Android, delete your advertising ID in your device settings. You can also turn off ad personalization for your Google account at myadcenter.google.com.

We honor an opt-out as soon as you make it, and within 15 business days of an email request. After you opt out, Google may still count installs, sign-ups, and visits for us as our service provider, but not to build ad audiences or personalize ads. Opting out does not change the ads you see from other companies, and you may still see ads for Fadehaus that are not personalized. We will not ask you to opt back in for at least 12 months, and opting out never changes your price or the Services you get (Section 11.1).

California “Shine the Light.” We do not disclose personal information to third parties for their own direct marketing purposes (what we share with Google, above, is used to show ads for Fadehaus), so California Civil Code Section 1798.83 gives us nothing to report. You can still ask us about it at team@fadehaus.com.

Nevada. We do not sell covered information as Nevada law defines it. Nevada residents may still send us a request not to sell at team@fadehaus.com with the subject “Nevada Opt-Out”, and we will record it.

6.4 Other Disclosures

We may disclose personal information:

• For legal compliance and safety: to comply with law, regulation, legal process, or a lawful government request; to enforce our terms; or to protect the rights, property, or safety of Fadehaus, our users, providers, or the public, including fraud prevention.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business. Any successor’s use of personal information remains subject to this Policy; if the successor makes material changes, it must follow Section 16, including advance notice and, where required by law, your consent before applying changes to previously collected information.
• With your direction or consent: when you ask us to share information or otherwise consent.

We do not disclose personal information to third parties for their own independent marketing. Our advertising with Google is described in Section 6.3.

6.5 Information About Non-Users

Providers may enter limited information about walk-in, phone, and guest clients (a name and, if the client shares it, a phone number) to manage their in-shop queue, day board, and bookings. We process it only to provide those features to the provider, we do not text, email, or market to those clients, and we delete it on the provider’s schedule. If a shop owner or manager invites a barber by phone number or email address, we send that person the invitation by text or email (the owner can resend it), and we keep their contact information with the invitation. We also keep a record of each invitation text, as described in Section 9. If an owner invites a manager, we store the phone number or email address so that the person gets access when they sign in with it; we do not send them anything, and the App offers the owner a link to send them from the owner’s own phone. If an owner offers a shop’s ownership to someone, the person must already have a Fadehaus account, and we send one email with a code to that account’s address for each offer.

For this information, we act on the provider’s behalf: the provider decides what to enter and how to use it within our rules, and the provider is responsible for having the right to give it to us (see our Terms of Service, Section 15.10A). If you are a non-user, or a client, whose information a provider entered in the App and you want to see, correct, or delete it, you can ask the provider or contact team@fadehaus.com, and we will help or pass your request to the provider.

6.6 When You Share Your Passport

You can share your own Passport with another person, in the App or on fadehaus.com. Passports of family members you added cannot be shared.

• Who you share with. Anyone you choose. You type their phone number or email address, or pick them with your phone’s contact picker (Section 2.4).
• What they see. Your first name and the haircut details in your Passport: your hair type and your cut details (such as the guard on the sides, top length and style, fade, sideburns, neckline, part, and styling). Your notes for the barber are never shared. You choose one of two ways:
• Share live. They see your Passport as it is each time they open it, including your reference photo and when you last updated it, until the share ends.
• Send a copy. They get your Passport as it is when you send it, or the cut from one past visit with its month and year, without any photo. Changes you make later stay with you.
• How it reaches them. We never text or email the person you share with. If they have a Fadehaus account with that phone number or email address, verified, the share appears in their in-app Inbox and we send them a push notification. If they do not, we hold the share and deliver it only if they create an account and verify that same phone number or email address within 7 days; otherwise it expires. When the person was not on Fadehaus, or was found by phone number, you are asked to confirm before they can see your Passport. The App also offers to open your phone’s share sheet so that you can text them yourself; that message is sent by you, from your own phone, and contains only a link to download the App.
• Ending it. You can stop sharing at any time: a live share ends at once, and a copy is removed from their App too. They can decline, decline and stop you from sending again, or remove your Passport after accepting. A share is paused while either of you has asked to delete your account and ends when the account is deleted. When a share ends, we delete the copy we were holding for them. We cannot take back what they already saw, and the App does not stop screenshots.
• What we keep. We keep the phone number or email address you entered with the share until we delete it. We delete a share that was never accepted 37 days after you sent it, and a share that was accepted 30 days after it ended. If someone declines and stops you from sending again, we keep a record of that, without contact details, for one year.

6.7 AI Assistants You Connect

You can add Fadehaus to an AI assistant you use, such as Claude, ChatGPT, Gemini, or Perplexity, and ask it to find barbers or book for you. The assistant is made by another company (the “assistant company”), not by Fadehaus.

• Finding needs no account. The assistant sends us what to look for, such as a city or ZIP code, a service, and a day, and we send back public listing information (below). ChatGPT also sends an approximate location, about city level, which we use only to run that search. We do not ask the assistant who you are, a search is never linked to your Fadehaus account, even after you connect it, and we do not record what you asked for or that location.
• Usage records. For each request we write one usage line in our server logs: the name the assistant gives for itself and its version, which tool ran, whether it worked, how many results it returned, and how long it took. It never includes what you asked for, the place, the service, your location, your account, or anything else from your conversation. These lines are kept with our other server logs (Section 9). To limit abuse, we also count requests against a one-way hash of the network address they come from (usually the assistant company’s server, not your device), and booking requests against a one-way hash of your account identifier.
• Connecting your account. To price, hold, or book a time, the assistant asks you to connect your Fadehaus account. You sign in on our consent page at fadehaus.com with your usual sign-in method and choose whether to allow it. That page lists the details of your account the assistant receives when you allow it, such as your account identifier and email address.
• What a connected assistant can do. Only these things, and only as you: price a time, hold a time for 10 minutes, book a time it held, let a hold go, and list your own appointments (up to 10). We tell the assistant to show you the barber, service, day, time, and price and to ask you before it books. It books only for you; bookings for family members and guests are made in the App. It cannot cancel or change a booking, and it cannot pay: nothing is charged in the chat, and a booking that needs a card payment is finished in the App or on fadehaus.com through a link the assistant gives you. Apart from public listing information and the sign-in record of your account (such as your account identifier, email address, and phone number), our servers refuse every other request an assistant makes with your connection, such as for your Passport, messages, family members, favorites, reviews, or payments.
• What we send to the assistant. The results of what it asked for. For a search: public listing information anyone can see on Fadehaus without an account, such as shop and barber names, city and state, distance, ratings, services and prices, hours, open times, and a fadehaus.com link, never a phone number, email address, or street address. With your account connected, also: your price for a time (including any membership credit and the membership’s name), whether a card payment is due, what is paid at the shop, and the free-cancellation window; the hold and when it ends; the booking’s status and confirmation code; and your appointments, with the barber, shop, service, day, time, and status of each, and how many you have coming up and have attended.
• The assistant company’s privacy policy applies. What you type to the assistant, and what we send back to it, are handled by the assistant company under its own privacy policy and terms, not this Policy. We do not control whether it keeps your conversations or uses them to improve its models; check its settings. This is true when the assistant is Claude too: Anthropic then handles your conversation under its own terms, not as our service provider (Section 5.1).
• Removing a connection. You can see every assistant you connected, and remove any of them, in the App under Settings, then Security and data, then Connected apps (the row appears once you have connected one). Removing one ends the connection, and the Fadehaus connector refuses that assistant’s requests for your account right away. You can connect it again later. When we delete your account (Section 10), every connection ends.
• What we keep. Supabase Auth, which runs our sign-in (Section 5.1), keeps a record of each connection: which assistant, the details it was given, and when you allowed it. Removing a connection marks that record as removed.
• No sale, no advertising. We do not sell anything we receive through an assistant, and we do not use it for advertising (Section 6.3).

7. SMS, Push Notifications, and Communications

7.1 Transactional messages. We send transactional SMS and push notifications, such as one-time passcodes, booking confirmations, appointment reminders, and account or security notices. When you enter your phone number to sign in, we tell you that you are agreeing to one verification text per request, that message and data rates may apply, and that you can reply STOP to opt out or HELP for help. Booking confirmation and reminder texts are off until you turn on “Text me notifications” in Settings, then Notifications; that screen shows the same disclosure, and we keep a record of when you turned it on or off. Message frequency varies with your activity.

Review-request texts are sent uniformly after completed appointments, are never conditioned on predicted sentiment, and contain no marketing or promotional content. You can turn off review-request messages in Settings, then Notifications, without affecting booking messages.

7.2 Offers and promotional messages. Offers are off until you say yes, and each yes is for one business only: a yes to one barber is not a yes to another barber, a shop, or Fadehaus. The first time you book with a barber, checkout may ask, in a “Keep in touch” step before you pay, whether that barber may send you offers by email and by text. Each is its own unticked box showing the address or number the offers would go to, with the words: “By tapping Yes, you agree to get the offers you ticked from [the business]: recurring automated marketing texts sent through Fadehaus to [your number], and marketing emails to [your email]. Saying yes is not needed to book or buy anything. Msg frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help. Not all carriers are covered. Every offer email has a link to stop.” A yes given there is saved only if your booking goes through. If you tap “Not now”, we keep a note of it (the barber, when, and the version of the words you were shown) so that checkout does not ask about that barber again for 90 days, and then asks at most once more. You can also say yes by email or text at any time in the App under Settings, then Notifications, then Offers, which lists the barbers and shops you have booked with; a text yes there shows: “Recurring automated marketing texts from [the business] sent through Fadehaus to [your number]. Not needed to book. Msg frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help.” Promotions from Fadehaus itself are a separate switch, “Fadehaus news”, on the Text messages and Email pages under Settings, then Notifications. A barber or shop can send you offers by text, email, push notification, or in the App inbox only while you have a yes on file for that business. We keep a record of each choice: the account, the business, the channel, the time, and the version of the words you were shown. You can withdraw any of them at any time on the same pages (including “Stop all offers”), by replying STOP to a text, or with the link at the bottom of an offer email. When you ask to delete your account, we withdraw all of them at once (Section 10).

If a loyalty or promotional program offers you a price or service difference (such as a discount or reward) in exchange for your personal information, that program can be a financial incentive under the CPRA. If the CPRA applies to us and we offer such a program, we will present its material terms when you join: what data is involved, the benefit, how to join, and how to withdraw at any time. Participation is always voluntary, and withdrawing does not affect your ability to book. The visit-based loyalty rewards Providers can offer today (Terms of Service, Section 13.8) are earned by completing visits and do not ask you for any personal information beyond your bookings.

7.3 Opting out of texts. Reply STOP to any Fadehaus text and we will stop sending all texts to that number, including transactional texts such as booking confirmations and reminders, and we withdraw every yes to offers on any account that uses that number. We send one message confirming your opt-out. We also accept other common ways of saying stop, such as UNSUBSCRIBE, CANCEL, END, QUIT, or REVOKE sent on their own. Reply START to let that number receive texts from us again: your booking texts (such as confirmations and reminders) come back on as they were before the STOP, unless you changed them in the App since, and offers stay off until you say yes again. If you stop all texts, we will deliver essential notices by push notification or email instead, and phone one-time-passcode sign-in will be unavailable until you opt back in (you can still receive a one-time passcode only if you individually request one to sign in after opting back in). Reply HELP for help. You may also opt out by any other reasonable method, including emailing team@fadehaus.com or changing your notification settings in the App, and we will honor revocations within ten business days. You can disable push notifications at any time in your device settings.

7.4 No sharing of SMS consent data. SMS opt-in data and phone numbers collected for the purpose of SMS consent will not be shared with or sold to third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except with our SMS delivery provider solely to enable delivery of the messages you have consented to receive.

To state this in the terms carriers require: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

7.5 Messaging program summary. Our messaging program is called Fadehaus. Through it, Fadehaus and the barbershops you use send transactional texts (appointment confirmations, reminders, waitlist alerts, and verification codes) and, only if you separately opt in, promotional and loyalty texts (loyalty rewards, win-back offers, and promotions). Consent to booking texts is collected in the App under Settings, then Notifications, then Text messages; consent to offers by text is given separately for each barber or shop under Settings, then Notifications, then Offers, and for Fadehaus’s own promotions with the “Fadehaus news” switch on the Text messages page. Offer texts require explicit opt-in and are off by default. Message frequency varies. Message and data rates may apply. Reply STOP to any Fadehaus text to opt out, or HELP for help; you can also opt out by toggling text messages off in the App. See our Terms of Service at fadehaus.com/terms for the full messaging program terms.

7.6 Setup help and tips for barbers and shops. If you run a chair or a shop on Fadehaus, we may send you a short message about the next step in setting up or using your business on Fadehaus, such as adding your services, setting your hours, sharing your booking link, or connecting payouts. Whether and when a message goes out is decided by your own account activity in the Services: which setup steps are done, when you last signed in or opened the App, and whether clients have booked you. We send it on one channel at a time (the App inbox if you use the App, otherwise email, and a text only if you turned on texts and the step affects whether clients can book you), at most one such message a week, between 9 a.m. and 6 p.m. in your time zone, never while you have an open support request or time off booked, and never naming your clients. These messages never contain plan offers or prices. Some providers, chosen at random, do not receive them, so that we can measure whether they help. The wording is written ahead of time, may be drafted or checked with AI tools, and is filled in with your first name on our own servers; we do not send your personal information to an AI provider to write these messages. To stop them, use the “Stop these tips” link in any such email, email team@fadehaus.com, or reply STOP to a text (which stops all texts, Section 7.3). Stopping them does not stop booking, payment, or account messages.

8. Location Information

We use your precise location for four things: to show barbershops and barbers near you on the map and in the discovery list; to let Fade, our in-app assistant, find shops and barbers near you when you ask it to (your coordinates go to Anthropic with your message so Fade can answer, Section 4.3); to rank nearby address suggestions first while a provider types a shop address; and, on a provider’s own phone, to let Stripe confirm where a Tap to Pay on iPhone or Tap to Pay on Android payment was taken. Each one runs only while you are using the App; we never collect location in the background. Location is collected only after you grant the operating-system location permission, which the App requests with a just-in-time explanation. Your coordinates are sent to our servers to run the nearby-search query and may appear transiently in short-lived technical logs, which are deleted on our diagnostics schedule (Section 9). We do not build or retain a history of your locations, do not use location to track you over time, do not use it for advertising, never send it to Google Ads or Firebase, and never sell it. When you view the map, our map provider (Mapbox) receives your device’s IP address and the displayed map area in order to serve map tiles, and when you search for a place it receives your search and the center of the map you are viewing (Section 5). The App removes embedded location metadata from a photo before it uploads it (Section 2.2, which explains the exception for photos uploaded with earlier versions), so uploading a photo does not reveal your location to us. You can revoke location permission at any time in your device settings and continue using the App without location features. Precise geolocation is sensitive personal information under state privacy laws; we process it only for the purposes described here, which you enable by granting the permission, and you may withdraw that consent at any time by revoking the permission. For Maryland residents: we collect your precise location only when it is strictly necessary for the thing you asked for, such as finding shops near you, and we never sell it.

9. Data Retention

We keep personal information only as long as needed for the purposes in Section 3, and then delete or de-identify it. Retention by category:

Where we retain de-identified data, we maintain and use it only in de-identified form, we do not attempt to re-identify it (except as permitted by law solely to test our de-identification), and we contractually require any recipient to do the same.

10. Account Deletion

You can delete your account at any time in the App (Settings, then Account, then Delete Account) or by contacting team@fadehaus.com. If your account has an email address, we verify you by confirming control of that email; if your account has no email address (for example, a phone-only account), we verify you by sending a one-time code to the phone number on your account. You can also request account deletion at fadehaus.com/delete-account without the App.

When you ask us to delete your account, we schedule the deletion for 30 days later and, if your account has a confirmed email address, email you the date. Two things happen right away, when you ask: we withdraw every yes you gave to offers (Section 7.2), and we cancel your upcoming bookings. Your own bookings are cancelled as if you had cancelled them yourself, so the cancellation terms shown when you booked apply (see our Terms of Service, Section 7.2). If you are a barber or shop owner, your clients’ upcoming bookings with you are cancelled too; we tell each client, and a client who paid in advance is refunded (Terms of Service, Section 7.5). Nothing else is deleted before the 30 days are up, and if you sign in during those 30 days, the deletion is cancelled, but cancelled bookings stay cancelled and offers stay off until you turn them on again. After 30 days, we delete your account as described below, and we end any paid plan or membership you have, so it does not renew and you are not charged again (Terms of Service, Sections 9.3 and 9A.5).

Deletion removes your profile, contact information, sign-in identifiers, Passport data, Passport photos, your review photos, push tokens, Fade’s saved notes about you, your Fade feedback records, and Fade conversations you sent with your feedback. Your review text and star ratings stay published without your name or any link to your account, so shop and barber ratings stay accurate (Section 9). Where providers hold appointment histories, your name and contact details are removed and replaced with a generic label (for example, “Deleted user”). We retain only what Section 9 says we must retain (chiefly payment and financial records, opt-out and consent records, records of texts we sent you, and of texts you sent us, without your phone number or the messages, Fadehaus AI usage records that no longer name you, the free trial and plan payment fingerprints that stop a second free trial, the record that your account was deleted, and records needed for legal compliance or dispute resolution), and we delete those when the retention period ends. Providers deleting an account should first resolve outstanding appointments and payouts; Stripe retains connected-account records under its own policy.

If you delete your account while a paid plan or membership still has paid time left, we keep a one-way hash of your phone number, email address, or Apple sign-in identifier, together with the details of that plan or membership (which plan, the shop or barber, the price, the paid period, your former account identifier, and the subscription and customer references Stripe gave it), so that you can get that paid time back if you sign up again. We delete them after the paid period ends.

11. Your Privacy Rights

These rights come from the privacy laws of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and other states with similar laws in effect. Whether or not your state’s law applies to a company our size, we give every United States user the same rights, as a matter of policy. Where we extend rights voluntarily beyond what your state’s law requires, we honor them as a matter of policy; statutory deadlines and appeal procedures apply as required by the law of your state.

11.1 Your Rights

• Right to know / access. You may request confirmation that we process your personal information and a copy of it, including (for California residents) the categories collected, the sources, the purposes, and the categories of third parties to whom it was disclosed.
• Right to delete. You may request deletion of your personal information, including Fade conversations you sent with your feedback, subject to the legal-retention exceptions in Section 9. In-app account deletion (Section 10) is the fastest way to exercise this right.
• Right to correct. You may correct inaccurate personal information. Most profile, Passport, and provider business data can be corrected directly in the App; for anything else, email us.
• Right to portability. You may request your personal information in a portable, readily usable format.
• Right to a list of specific third parties (Oregon). Oregon residents may additionally request a list of the specific third parties to which we have disclosed personal data (see the Section 5 tables).
• Right to opt out of sale, sharing, and targeted advertising. We share personal information with Google for cross-context behavioral advertising and targeted advertising (Section 6.3). You can opt out at any time: in the App under Settings, then Security & data (“Do not sell or share my personal information”), through the “Your Privacy Choices” link on fadehaus.com, with a Global Privacy Control signal on the website, or by emailing team@fadehaus.com. We do not sell personal information for money, and your opt-out covers any sale under a state law that defines it more broadly.
• Right to opt out of significant profiling. We do not profile you for decisions with legal or similarly significant effects (Section 4.5), so there is nothing to opt out of. If that changes, we will provide the required opt-out mechanism first.
• Right to limit use of sensitive personal information (California). We use sensitive personal information (precise geolocation) only for the purposes permitted by the CPRA regulations (providing the service you request), and never for advertising, so no separate “Limit the Use of My Sensitive Personal Information” mechanism is required. You can stop the collection of precise geolocation entirely by revoking the location permission.
• Right to non-discrimination. We will not deny you the Services, charge you different prices, or provide a different level of quality because you exercised a privacy right. Voluntary loyalty programs that offer benefits in exchange for personal information are described in Section 7.2 and are always optional.

11.2 How to Exercise Your Rights

Submit requests by either method:

1. Email: team@fadehaus.com with the subject “Privacy Request”, from the email address on your account where possible; or
2. In-app: use in-app account deletion for deletion requests, in-app editing for corrections, and Settings, then Security & data, to opt out of sharing for targeted advertising.

Opt-outs of sale, sharing, and targeted advertising can also be made on the website and with a Global Privacy Control signal, need no verification, and are handled as described in Section 6.3.

Verification. We verify requests by matching the information you provide against our records, typically by confirming control of the email address or phone number on the account. For phone-only accounts, we verify by sending a one-time code to the phone number on file. If you are not an account holder (for example, you are asking us to remove a photo of you), we verify your request by asking you to describe the content and its location in the App and to demonstrate your identity by reasonable means. We may ask for additional information where reasonably necessary, and we use it only for verification.

Authorized agents. You may use an authorized agent to submit a request. We will require proof of the agent’s authority (such as a signed permission) and may still verify your identity directly.

Timing. We will confirm receipt within 10 business days where required and respond within 45 days. If we need more time, we may extend once by up to 45 additional days and will tell you why.

11.3 Appeals

If we decline all or part of your request, we will explain why. You may appeal by replying to our decision or emailing team@fadehaus.com with the subject “Privacy Appeal” within 60 days of our decision. We will respond to appeals within the period required by your state’s law (generally 45 to 60 days) and explain our decision. If your appeal is denied, you may contact your state Attorney General; residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other appeal-rights states can find complaint mechanisms through their Attorney General’s office, and California residents may contact the California Privacy Protection Agency or the California Attorney General.

11.4 California Notice at Collection

For California residents, Sections 2 (categories and sources, including sensitive personal information), 3 (purposes), 5 and 6 (categories of recipients), 6.3 (sharing for cross-context behavioral advertising, no sale for money, and how to opt out), and 9 (retention periods) together constitute our notice at collection. A link to this Policy, including this notice at collection, is presented when you create an account, and the Policy is always available in the App under Settings, then About. The “Do not sell or share my personal information” choice is in the App under Settings, then Security & data, and on fadehaus.com through the “Your Privacy Choices” link in the footer. The location permission request shows the operating system’s prompt with our short explanation of why we ask; it does not link to this Policy. This Policy’s Last Updated date is the date it was last revised.

12. Children’s Privacy

The Services are intended for adults and are not directed to children. You must be at least 18 to create an account, whether as a client or as a provider. We ask for your date of birth at sign-up and do not allow account creation for anyone under 18 (we also use it as described in Section 3: to time a birthday offer from a provider you said yes to, and as an age group in a shop’s analytics), and we ask providers to confirm that they are at least 18 when they set up a barber or shop profile. If an account made before we asked has no date of birth on file, we ask for it the next time the App opens. A parent or guardian may book an appointment for their child from the parent’s own account; the child does not get an account.

Family members you add. You can add people to your own account so you can book for them and keep a haircut Passport for them. A person you add does not get an account, a login, or any way for us to reach them: everything about them lives inside your account, and we only ever talk to you. For each person you may give us a first name, your relationship to them, their haircut preferences, and, only if you turn the photo switch on, a reference photo of the haircut they want. All of it except the first name is optional. We do not ask for or keep a date of birth for the people you add. We use this information only to book their appointments and show their Passport and photo to the barber you booked. We do not contact the people you add, do not use this information for marketing or advertising, do not sell or share it, and do not use the photo to identify anyone or to train anything. In analytics we only count how many visits were booked for more than one person; we never use a family member’s relationship. You can edit or remove a person at any time. Removing them takes them off your account and right away deletes their Passport, their reference photo, and your relationship to them, and empties the haircut details saved on their past visits; only their first name stays, on past appointments, as part of your booking history, until you delete your account. Deleting your account deletes all of it. By adding someone you confirm that you are their parent or legal guardian, or that they are an adult who asked you to add them, and that you are allowed to give us this information about them. You must not let a person under 18 use your account. If we learn that an account belongs to someone under 18, we will close it. We do not knowingly collect personal information from children under 13. If we obtain actual knowledge that we have collected personal information from a child under 13, we will delete it and terminate the account. If you believe a child under 13 has provided us personal information, contact team@fadehaus.com and we will investigate and delete it.

12A. Consumer Health Data

We do not ask for health information, and you should not enter it. If you nonetheless provide information that reveals a health condition (for example, in a free-text Passport note), we treat it as sensitive consumer health data: we use it only to provide the service you requested, we do not sell it, we do not disclose it except to the provider you book with, and we delete it on request. Washington and Nevada residents can review our Consumer Health Data Privacy Notice at fadehaus.com/health-data-notice.

13. Data Security and Breach Notification

We use administrative, technical, and organizational measures designed to protect personal information, including: encryption of data in transit; access controls designed to restrict each user’s access to their own records; storage of card data exclusively with our PCI-DSS certified payment processor; restriction of service credentials to our servers; access limited to those who need it; and logging and monitoring of our backend systems. No system is perfectly secure, and we cannot guarantee absolute security. If a breach of security affecting your personal information occurs, we will notify you and the appropriate regulators as required by applicable state breach-notification laws, without unreasonable delay.

13A. Where Your Information Is Stored

Our database and file storage are hosted by Supabase on Amazon Web Services in the United States. Crash and error reports are stored by Sentry in the United States. Product analytics and session replays from the App and from our website are stored by PostHog in the United States. Google stores Google Analytics, Firebase Analytics, and Google Ads data on its own systems, which may be in the United States or in other countries. The other service providers in Section 5 process information on their own systems, which may be in the United States or in other countries.

14. Do Not Track and Opt-Out Preference Signals

Our website at fadehaus.com uses Google Analytics, PostHog, and Google Ads tags only with your consent (see 5.3 Website analytics (Google Analytics), Section 5.3A, and Section 5.3B), and Google Analytics and the Google Ads tags are used for targeted advertising (Section 6.3). On the website we honor a Global Privacy Control (“GPC”) signal as a valid request to opt out of sale and sharing for targeted advertising: when your browser sends GPC, we do not load the Google Ads tags, Google Analytics, or PostHog, we set no analytics or advertising cookies, and the cookie banner reflects that you are opted out. A GPC signal overrides an earlier acceptance stored on your device. You can change your cookie choice at any time through the Cookie settings link in the footer, and opt out of sharing through the Your Privacy Choices link.

Browser “Do Not Track” signals have no common standard, and our website does not act on them separately; GPC is the signal we honor. The mobile app cannot receive a browser’s GPC signal. In the App, use Settings, then Security & data, then “Do not sell or share my personal information” (Section 6.3), and, on iPhone, Apple’s App Tracking Transparency setting. The App’s product analytics (PostHog, Section 5.2A) is not tracking and is never used for advertising; Firebase Analytics (Section 5.2B) is used for advertising, and your choice in Settings, then Security & data, turns off ad personalization and the collection of your advertising identifier.

15. Third-Party Services and Links

The Services integrate the third-party providers listed in Section 5. When you interact directly with a third party (for example, entering card details into Stripe’s payment interface, or authenticating with Apple or Google), that third party’s privacy policy governs its own handling of your data. The Services may contain links to provider websites or social profiles; we are not responsible for the privacy practices of external sites.

16. Changes to This Policy

We may update this Policy from time to time. The Last Updated date at the top shows when it was last revised, and each version takes effect on its Last Updated date unless we state a later effective date in the change notice. For material changes, we will give you advance notice in the App and by email (if we have your address) before the changes take effect, and material changes take effect no sooner than 30 days after that notice.

We will not apply material changes to this Policy retroactively to personal information collected before the change without obtaining your affirmative consent where required by law, and we will not apply a material change in a way that is materially less protective of previously collected information without first obtaining your affirmative consent. Your continued use of the Services after the effective date of a prospective, non-material change means that change applies to you. We keep prior versions available on request.

17. Contact Us

Fadehaus LLC, a Florida limited liability company. Mailing address: 7901 4th St N STE 300, St. Petersburg, FL 33702, USA.

Email (sole privacy contact channel): team@fadehaus.com

If you have a disability and need this Policy in another format, email team@fadehaus.com and we will provide it. Our accessibility statement is at fadehaus.com/accessibility.

For privacy requests, use the subject line “Privacy Request”. For appeals of privacy decisions, use “Privacy Appeal”. For content-moderation appeals (including AI photo-moderation decisions), use “Moderation Appeal”. To request removal of a photo of you, use “Photo Removal”.