Privacy Policy

Overview

Tho ("the app") helps customers discover and book salons and barbers, and helps salon owners manage bookings, staff and services. This policy explains what we collect, why, and the choices you have.

Information we collect

• Account information — your email address, name and, optionally, a phone number you give at sign-up or add to your profile.
• Content you create — bookings, reviews, messages to salons, and photos you upload (profile picture, salon gallery, service images, review photos, and instruction photos attached to a booking).
• Approximate location, as a customer — with your permission, your device’s location is used on your device to show salons near you and sort them by distance. As a customer, your location is never sent to us and never stored.
• Your salon’s location, if you run one — when a salon owner pins their shop on the map, the precise coordinates are stored with the salon and shown publicly, alongside the address, so customers can find it. This applies to the salon’s own location only.
• Camera — used only to scan a salon’s walk-in-queue QR code. The image is decoded on your device and is never uploaded or stored.
• Notification token — if you allow notifications in the mobile app, your device’s push token is stored so we can send booking reminders and queue updates through Google Firebase Cloud Messaging. It is tied to your account and removed when another account signs in on that device. The website does not send push notifications.
• Delivery details — if you order a product for delivery, the address, phone number and any note you enter are stored with that order and shared with the salon delivering it. Choosing collection in the shop stores none of it.
• Service activity — the bookings, orders, queue entries, prepaid packs and loyalty points needed to operate the service.
• Crash and diagnostic reports — when the mobile app crashes or misbehaves, a report is sent to Google Firebase Crashlytics so we can fix it. We do not attach your name, email or account to those reports.

We do not knowingly collect data from children, sell your data, or use third-party advertising SDKs. There is no advertising identifier and no cross-app tracking.

How we use it

• To create and secure your account and sign you in.
• To provide the service: discovery, booking, rescheduling and cancellation, walk-in queues, messaging, reviews, loyalty, prepaid packs, product orders and their delivery, and — for salon staff — calendar, client and business management.
• To show salons near you (your location stays on your device).
• To notify you about your bookings, your place in a queue, your orders, and rewards.
• To find and fix crashes, so the app keeps working.

How it is stored and shared

• Data is stored with our backend provider, Supabase, and transmitted over encrypted connections (HTTPS).
• Two service providers process data on our behalf and for no purpose of their own: Supabase (the database, sign-in and file storage) and Google Firebase (delivering notifications, and crash reporting).
• Access is enforced by row-level security in the database: you see your own data; a salon’s owner and staff see the data for that salon’s bookings, orders and queue.
• Salon and stylist gallery photos are public — they are marketing material shown to anyone browsing the app.
• Instruction photos you attach to a booking are held in a private store and are readable only through short-lived signed links, by you and the salon you booked.
• A salon you book with, join the queue at, buy a pack from, or order from can see your name, profile photo and contact details, and the history of your visits with that salon. If you order for delivery, that salon also sees the delivery address and phone number you gave.
• We share data only as needed to operate the service or where the law requires it. We do not sell personal data.

Your rights and choices

• Access and update — edit your profile in the app.
• Location — deny or withdraw the permission in your device settings at any time; the map falls back to a default city view.
• Notifications — turn them off for the whole app in your device settings. Each booking also has its own “Remind me” switch, which only appears at salons that send reminders.
• Account and data deletion — delete your account yourself — in the app under Settings, or on this site from your profile — or email chemsbhai@gmail.com if you can no longer sign in, and we will do it within 30 days. See /delete-account for exactly what is removed and what a salon keeps without your name on it.

Data retention

We keep your data while your account is active and for as long as needed to provide the service or meet a legal obligation, then delete or anonymise it.

Changes

We may update this policy. Material changes will be posted here with a new "Last updated" date.