Privacy Policy

01Who we are

Norwood is developed by EitanX Labs, the independent sole-trader studio of Eitan Michaelevich, based in Israel - a country the European Commission recognizes as providing adequate data protection. For the little personal data this policy describes us handling (support emails, and the records our service providers process for us), EitanX Labs is the data controller. This policy covers the Norwood app for iOS and Android, and this website. Questions about it reach the developer directly at founder@eitanx.com.

02What Norwood stores, and where

Norwood keeps its data in the app's private, sandboxed storage on your device:

• Photos you capture or import, plus their thumbnails, stored as files in the app's documents directory.
• A local database holding photo metadata (region, capture date, optional notes), the schedules and reminders you enter, logs, and appointments.
• Preferences such as your reminder settings, chosen capture source, and whether the app lock is enabled.

None of this ever reaches us. We have no way to see, access, or recover any of it.

03What never happens

• Your photos, health information, logs, and settings are never transmitted off your device by the app - not to us, not to Google, not to anyone.
• No accounts, sign-ins, or registration of any kind.
• No analytics, crash-reporting, or tracking SDKs. The only SDKs that send anything off the device are Google's ad SDK (to show ads in the free version) and the purchase service behind the Remove Ads option - both described in section 05.
• No push notification tokens - reminders are scheduled locally on your device.
• No location permission, and no access to contacts, browsing history, financial information, or health records held elsewhere on your device.
• Biometric unlock (Face ID on iPhone, fingerprint on Android) for the optional app lock is performed entirely by the operating system. The app receives only a yes-or-no result and never sees biometric data.

04Health-related information

Photos of your scalp and records of your treatments are sensitive, health-related information, and Norwood treats them that way: they are stored only on your device, are never transmitted or shared, and are never used for advertising, marketing, or any purpose other than showing you your own progress. Ad requests are built with no access to this data - no photos, no region names, no treatment or schedule information, and no keywords derived from any of it. Norwood is not a medical device and does not diagnose, treat, cure, or prevent any condition.

Some US states, including Washington and Nevada, give consumer health data special legal protection. Norwood is built so that we never collect, receive, share, or sell consumer health data: your photos, treatments, logs, and notes stay on your device, all processing happens there, and ad requests are built with no access to any of it. Questions or requests under these laws reach us at the contact below.

05Ads in the free app

Starting with the app update released in August 2026, the free version of Norwood shows ads: a banner on the home screen and an occasional full-screen ad after exporting share images - never during capture, comparison, or anywhere in your photo library. Ads are served by Google AdMob. Earlier app versions contain no ads and no ad SDK, and ad serving may reach devices gradually - until it reaches yours, none of the data flows described below happen.

What Google receives.To request, deliver, and measure ads, Google's SDK processes data from your device: device identifiers (including the advertising identifier, where you allow it), IP address (which Google may use to infer an approximate, city-level location), basic device and app information (model, OS version, app identifier), ad interaction events (which ads were shown, viewed, or tapped), and diagnostic data. This happens between your device and Google; none of it flows through us. What Google never receives is anything about how you use Norwood: ad requests carry no photos and no health information, ever. Google's handling of this data is described in the Google Privacy Policy and in How Google uses information from sites or apps that use its services. The ad technology providers Google may work with are listed here.

Consent in the EEA, UK, and Switzerland.Before any ad is requested, a consent form (Google's certified consent framework) asks your permission. If you decline, Norwood simply shows no ads and requests none. You can review or change your choices at any time in the app under Settings, via "Ad privacy options" - withdrawing consent is as easy as giving it, takes effect immediately (ad requests simply stop), and does not affect ad serving that already happened while your consent was in place.

US state privacy laws.Ad serving honors applicable US state privacy requirements through Google's consent and restricted-data-processing tools, and the same in-app "Ad privacy options" screen is available where it applies.

Tracking signals.Where you allow personalized ads, Google may collect information about your device's activity over time and across other apps and websites that use Google advertising services, to build interest-based ad profiles. Decline the iPhone tracking prompt, or reset or delete your Android advertising ID, and that cross-app collection stops for this app. Norwood itself does not track you across other companies' apps or sites, and like most services it does not respond to browser "Do Not Track" signals - the controls that actually work here are the consent form, the tracking prompt, and the ad-ID settings above.

On iPhone.Apple's App Tracking Transparency prompt separately asks whether the advertising identifier may be used. If you decline - or are never asked - ads still work but are non-personalized (contextual). iOS ad measurement uses Apple's SKAdNetwork, which reports campaign performance in aggregate without identifying you.

On Android. You can reset or delete your advertising ID at any time in your system settings; ads then continue non-personalized.

Ad content.Norwood caps ad content at Google's "Teen" maximum ad content rating.

Removing ads.A one-time "Remove Ads" purchase in the app's Settings permanently disables ads (rolling out from the August 2026 update; on each platform it becomes available with that platform's ad-supported release). Payment is handled entirely by the store you installed the app from - Apple's App Store or Google Play - through your store account; we never see or store payment details. To validate the purchase and restore it after a reinstall or on a new device, the app uses RevenueCat, a purchase-management service: it receives the purchase record (the product bought, timestamp, and the store's signed receipt) tied to an anonymous identifier - never your name, email, or store account. This appears as "Purchase History" on the App Store privacy label and under Financial info in Google Play's Data safety section. Once ads are removed, ad serving - and every ad-related data flow described above - stops entirely.

06Where this data is processed, and for how long

The providers named in this policy - Google, RevenueCat, and Vercel - are US companies, so the limited data described in sections 05 and 12 is processed in the United States. Google and Vercel are certified under the EU-US Data Privacy Framework (including its UK and Swiss extensions), which the European Commission recognizes as adequate protection for such transfers. RevenueCat processes purchase records for us under the EU Standard Contractual Clauses with the UK addendum, the approved safeguard for transfers outside those frameworks. Your photos and health data are not part of any of this - they never leave your device.

How long data is kept: everything on your device stays until you delete it or the app - we hold no copy. Purchase records processed by RevenueCat are kept for as long as your Remove Ads purchase needs to stay restorable - the lifetime of the product. Data Google processes to serve ads is retained under Google's retention rules, described in the Google Privacy Policy linked above. The website's server logs are short-lived and deleted automatically by our host, and support emails are kept only as long as needed to help you.

07Other features that reach beyond the app

Two optional features involve movement of data, both fully under your control, and neither sends anything to us or to advertisers:

• WiFi microscope (optional). If you connect a WiFi scalp microscope, video streams from the microscope into your phone over your local network. Nothing is sent out; the connection never leaves your network.
• Backup export. When you tap Export backup, the app builds a zip of your data and hands it to the system share sheet. You choose the destination. If you send it to a cloud storage or messaging service, that service's own privacy policy applies to the copy you placed there.

08Permissions the app asks for

Every permission is optional in practice: decline any of them and the rest of the app keeps working, and you can revoke any of them later in your system settings - the related feature simply stops working (declining the tracking prompt only makes ads non-personalized).

09Device backups

If you use your device's own backup features (such as iCloud Backup or Google's device backup), your device may include Norwood's data in those backups. Those backups are created and managed by your device and governed by Apple's or Google's privacy policies and your backup settings - not by Norwood.

10Deleting your data

You can delete individual photos inside the app at any time. Deleting the app removes everything it stored on your device - we never had a copy, so there is nothing for us to delete. Copies you control may still exist elsewhere: a backup zip you exported, or your own device backup if it includes app data. Those are yours to keep or delete. Restoring a backup replaces the app's current data with the backup's contents. For data Google processes to serve ads, use the in-app "Ad privacy options" screen (shown where consent rules apply) and the controls in your Google settings.

11Children

Norwood is not directed at children under 13 and is intended for adults tracking their own progress. The app stores your data only on your device, and its ads are configured for general audiences with a "Teen" maximum content rating and no child-directed treatment.

12This website

This site is static, sets no cookies, and shows no ads. Fonts and images are served from this site itself, and there are no advertising or cross-site tracking scripts. The one measurement in use is Vercel Web Analytics: cookieless, aggregate page-view counts served from this same domain, with no personal identifiers and no way to follow you across sites. Our hosting provider (Vercel) serves the site, processes those aggregate counts, and may keep standard, short-lived server logs (such as IP addresses in access logs) to operate the service; we do not use any of it to identify visitors.

13Your rights (EEA, UK, and Switzerland)

Where data protection law asks us to name a legal basis for the little processing we are responsible for, ours are: consent, for personalized ads and the data flows to Google described in section 05 (the consent form is how you give it, and withdrawing it works as described there); contract, for validating your Remove Ads purchase and restoring it on a new device; and legitimate interests, for the website's cookieless page counts and short-lived server logs (keeping the site running and secure) and for answering emails you send us.

The law also gives you rights over personal data we are responsible for: access, correction, deletion, restriction, portability, and objection. In practice almost everything Norwood handles lives on your device under your direct control - deleting it is described above, and we hold no copy to hand over or correct. The purchase records RevenueCat processes for us are tied to an anonymous identifier we cannot link to you, so under Article 11 GDPR those rights do not attach to them unless you provide extra information that identifies your record. To exercise any right or ask how this applies to you, email founder@eitanx.com.

You also have the right to complain to a data protection supervisory authority - in the EEA, the authority of the country where you live or work; in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the FDPIC. We would appreciate the chance to answer you directly first, but you never need our permission to go to them.

14Changes to this policy

When Norwood changes what it does with data, this policy is updated first, the "effective" date above changes, and the change is explained in plain language before it takes effect. The August 2026 update is an example: it added section 05 when ads were introduced. Any future change - for example an optional sync feature - will follow the same rule and be opt-in.

15Contact

Questions about privacy or this policy:

Norwood is not a medical device. It does not diagnose, treat, cure, or prevent any disease or condition, and does not provide medical advice. Consult a qualified healthcare professional for medical advice, diagnosis, or treatment.