Last updated 17 October 2026
What Tress keeps on your phone, what it backs up, and what it sends to be read — and what it does not.
What you record in Tress: your name as you typed it, the answers you gave at the start — including anything about treatments, your scalp or your family — your scans and what they read, your routine and the days you ticked it, your check-ins, your journal notes and your products, and a profile picture if you set one, which stays on this phone. All of it is written on this phone first. Some of it can also go elsewhere, and each case has a section below. Once you say yes to reading with AI — the app asks before anything is sent for the first time, and Settings changes the answer — a few frames of each scan, the answers and readings your hair guide is worded from, one scan photograph for the illustration on the Premium screen, and your messages to Tress AI go through a server of ours to Google to be read. Where backup is part of your version of Tress — Settings shows “Back up my record” when it is — and only once you say yes to keeping a backup, a copy of your record is kept in your Tress backup under an account made for this phone, and your photographs join it only if you say yes to that too. If you save your progress, the sign-in you use is kept with that account. A subscription check runs once you reach the paywall or buy something. If you tap Report under something the AI wrote and pick a reason, that report comes to us. There is no advertising in Tress and nothing counts what you tap.
Much of what you record is about your health: the answers about treatments, your scalp and your family, your scan photographs and what they read. On this phone it is used only to run Tress for you. It leaves the phone only with your explicit consent, and each purpose has its own question: yes to reading with AI sends what the sections below describe to be read, and yes to keeping a backup keeps a copy of your record in your Tress backup. You can take either yes back at any time in Settings; that stops what it allowed from then on and does not undo what was done before. Signing in to save your progress, and the subscription check, are there to provide the service you ask for, which is the basis we rely on for them. The records our hosts keep of requests, including internet addresses, are kept in our legitimate interest in keeping the service secure and working, and a report you choose to send about something the AI wrote is kept in our legitimate interest in finding and correcting what a model gets wrong. Nothing you record is required by law or by any contract: Tress works without your answers, without reading with AI and without a backup, and only the scan itself needs the camera. Tress makes no decision about you by automated means that has a legal or similarly significant effect on you: a reading describes photographs, and nothing is decided about you from it.
Your photographs are written to the app’s private storage on this device, where no other app can read them. Your journey, sessions, routine, journal, answers and settings sit beside them in the app’s own record. Nothing in the app keeps the photograph files out of a device backup, so an iCloud or computer backup you have turned on can carry them; on iPhone the record itself is kept out of that backup, so restoring a phone from it brings the images across without the journey that describes them. Where you have a Tress backup, that is the way to bring a journey to a new phone: save your progress on the old one and sign in on the new one. Deleting the app removes the photographs and the record from the phone; it does not delete a Tress backup.
Where backup is part of your version of Tress, the app asks you once whether to keep a private backup, and tells you that your record includes health details. Nothing is backed up and no account is made until you say yes. If you say not now, everything stays on this phone; you can change the answer in Settings under “Back up my record”, and saving your progress asks the same question first. Once you say yes, the app makes an account for this phone. You are not asked to sign up, and the account has no name, email or password on it: it is a random identifier that tells the backup which record is yours. From then on a copy of your record is kept in step with the phone: your name as you typed it, your age range and sex if you gave them, your answers, your routine and its ticks, your check-ins, your journal notes, your products, your hair guide, and your scans and photo sets — their dates, titles and notes, what each scan read, and for each photograph its angle, when it was taken, the quality and hair coverage the app measured and the outline of the hair it traced. Photograph files are different: they are copied to the backup only after you say yes to “Back up my photos”, and turning that off in Settings removes the copies the next time the app can reach the backup. Turning “Back up my record” off stops the backup; what is already in it stays until you use “Delete my account and data” or ask us to delete it. The backup is held for us by Supabase, on servers in London. Rules on the database let an account reach its own rows and files and no other account’s. It is not end-to-end encrypted: we run the service, so we are able to reach what is stored there, and we do that only to keep it working or to answer a request from you. If you choose “Save my progress”, you sign in with Apple or Google — or, where your version offers it, with a code sent to your email — and that sign-in is attached to the same account so your record can come back on another phone. We then hold the email address the sign-in gives us — with Apple it can be a private relay address — and use it only to sign you in. With Google, the sign-in service may also record the name and picture on your Google account; Tress does not use them. With Apple, we also keep a token Apple issues for the sign-in, which only our server can reach, so that deleting your account can tell Apple to end the sign-in too.
Photos you take in the app go straight to that private storage, and that copy is the one your journey keeps. On the phone they are read: after a scan, the app measures light, focus and how much of each frame the hair covers, with a model built into the app, and no photograph leaves the phone for that. A photograph can leave in these ways, each with its own section: the hair analysis, a question to Tress AI about how something looks, and the preview on the Premium screen, all three only once you have said yes to reading with AI; your Tress backup, only if you switch photo backup on; the share sheet, when you hand an image to it yourself; and your device backup, if you have one turned on. Photos are not added to your camera roll unless you save one yourself.
Tress uses face data only while the camera is open for a hair scan, so that it can follow your head as you turn. On an iPhone or iPad with a TrueDepth camera it uses Apple’s ARKit face tracking, which is how the app uses the TrueDepth API; on other devices it uses Google’s ML Kit face detection, which is built into the app. From ARKit the app reads the position and rotation of your head, the positions of your eyes, and a fixed set of points from the face mesh ARKit tracks — its rim and a ring inside it — turned into flat positions on the screen. From ML Kit it reads the box around your face, the outline of your face and its features, and the angle of your head. The app does not read the depth images the TrueDepth camera produces, does not read your facial expressions, and does not store a face mesh, a face template or any other model of your face. Face data is not used to recognise or identify you and plays no part in signing in. The app lock can use Face ID, but that is your phone’s own system, which gives the app no face data.
Face data is used inside the app, for these things: to draw the guide over your head and tell you when each angle of the scan has been reached; to judge the quality of a scan by how much of it your face could be followed; to decide where the close-ups in your report are cut from each photograph; to measure the height of your hairline above your brows, relative to the size of your face, as part of the scan’s measurement on the phone; and to save the angle of your head with each photograph so that the next scan can be lined up with it. It is not used for advertising, marketing, profiling or analytics, and it is not used to train any model, ours or anyone else’s.
Most face data exists only in the phone’s memory while the camera is open, and is discarded once the scan and its processing finish. Four results are saved: for each photograph, the angle of your head and where its close-ups sit; for each scan, how much of it the camera could follow your face, and the hairline height described above. They are saved in the app’s private storage on your device, where no other app can read them, and on iPhone they are kept out of iCloud and computer backups with the rest of the app’s record. Face data is not sent to our server, to Google’s Gemini API, to your Tress backup, to RevenueCat or to any other third party, and it is not sold or shared. ML Kit runs on the device and returns its results to the app there; Google states that ML Kit sends it a small amount of diagnostic information — the device, the app, how the model performed — with an identifier for the installation, and no photograph. Your scan photographs show your face as well as your hair, and where they can go is set out in “Your photographs”, “The hair analysis” and “Your account and backup”.
Face data held in memory is discarded once the scan and its processing finish. The saved results are kept on your device until you delete them; nothing is deleted on a timer. Deleting a scan in the app deletes its face data with its photographs. “Delete all my data” — “Delete my account and data” where you have a Tress backup — in Settings deletes the face data with your scans, and deleting the app deletes it from the phone. Face data is never sent to us, so there is no copy on our side to keep or to delete. Questions about it can go to support@tresshaircare.com.
After a scan, and only once you have said yes to reading with AI, the app takes a few of the frames it already kept — the best one of each angle, a second of the top of the head, and a second of the front if there is room, six at most — makes a smaller copy of each, and sends those copies over an encrypted connection to a server of ours at tresshaircare.com. Nothing travels with them but the name of the angle each one shows: no name, no email, no account identifier, no journal entry and no routine. The front and side frames show your face as well as your hair. That server exists to hold the key Google requires, so that the key is not inside the app where anybody with a copy of it could find it. It passes your images to Google’s Gemini API — a hosted model that reads pictures — and asks it to describe what it can see. Google receives your images. What comes back is a fixed set of fields rather than a piece of writing: a note on the hairline, on each temple, on how closely the two sides match, on how covered the front, the mid-scalp and the crown look, a visual pattern, and a confidence for each, with anything the photographs did not support marked as not enough data. Tress builds what you read out of those fields. If you say not now, the scan is still saved and measured on the phone, and the report shows what that measurement supports.
It is not advertising, and your images are no part of any; the one picture drawn from a scan photograph for the Premium screen is described in its own section below. They are not sold, not shared with an advertiser, not used to target anything at you and not used to build a profile of you. There is no ad network in the app, no advertising identifier is read, and the images go to the one place the section above names. It is also not a diagnosis. Tress is not a medical device, and a reading of photographs is a description of photographs rather than a medical opinion: the request Tress sends states that the model may not diagnose anything, name a condition, count follicles, put a number on density, forecast regrowth or recommend any treatment, and the app checks the answer again when it arrives and discards any part of it that does one of those anyway. Neither of those is a promise about the future. Both are how the code is written today, and if either stops being true this page changes with it and the date at the top moves.
On this phone, the reading. The smaller copies made for sending are deleted as soon as they are ready, and what comes back is a set of fields rather than an image; those fields are saved with the scan, and where you have a Tress backup they are kept in it with the rest of your record. Your own frames stay where they were, and “Delete all my data” removes them. On our side, nothing: the server that holds the key keeps no log of its own and writes nothing about an analysis anywhere — it passes the images on, hands the answer back, and keeps neither. The one thing it does keep is a report you choose to send, and the section on reporting says what that holds. Two things we cannot answer for, and will not pretend to. The company that hosts that server keeps its own operational records of requests made to it; we do not control those and we have not audited them. And what Google keeps, for how long, and what it may do with it is set out in the terms Google publishes for that API — read those rather than our summary of them, because we have not independently verified them and a reassurance we cannot check is not one we should give on somebody else’s behalf.
The cards of your hair guide are put together on this phone, from your answers and your latest scan. Every value on them, the pattern and its range, and how much weight each subject is given are worked out here, by fixed rules, and no model has a say in them. One part can be written elsewhere, once you have said yes to reading with AI: the wording of the explanations. Putting the guide together then sends a server of ours the answers you picked at the start, as the labels you chose — which can include treatments, scalp symptoms and family history; which of the two example sets you chose, male or female; what your latest scan read, as words and confidences rather than pictures; the names of your routine items; and the lines the guide would otherwise say. No name, no age, no photograph, no journal entry, no date and none of the app’s own identifiers travel with them. The server passes them to Google’s Gemini API, which hands back reworded lines, and the app checks each one against your own record before it is shown: a line that names a place, a number or a treatment your record does not hold is dropped, and the guide says its own line there. The lines that pass are kept with the rest of your record, and “Delete all my data” removes them. Our server keeps nothing of the request.
Once you have said yes to reading with AI, and while you do not have Premium, the app can make an illustration for the top of the Premium screen: one of your scan photographs, redrawn by an image model. It is asked for when your report opens, so that it is ready. To make it, one smaller copy of that photograph, the name of the angle it shows, and your sex if you gave it, are sent over an encrypted connection to a server of ours, which passes them to Google’s Gemini API and hands the picture it draws straight back. Nothing else travels with it, and our server keeps nothing. The picture is kept on this phone and not in your Tress backup, is shown on the Premium screen only, and is replaced when you take a new scan; “Delete all my data” removes it. It is an illustration made by a model, labelled as one, and not a prediction of what your hair will do. Because it is shown on the screen that offers Premium, our App Store privacy label lists photographs as used for the developer’s own marketing: this illustration, shown to you alone inside the app, is the only such use, and your photographs are never used in advertising outside the app.
On iPhone and on Android, memberships are kept track of for us by RevenueCat (revenuecat.com), which publishes its own privacy policy there. The app connects to it at the moments that need a store: while the paywall is on your screen, so it can show what your storefront actually charges; when you buy; when you tap Restore; and, on a phone that has already bought something, at start-up about once a day, so that a refund or a lapse is noticed. Almost everyone meets the paywall, because after your first scan and its report the app asks you to choose a plan there. If you never open it and never buy, the app does not contact RevenueCat at all, and that service has no record of your install. When it does connect, RevenueCat makes a random identifier for the install and receives it along with the store’s answer about purchases: the App Store’s on iPhone, and on Android Google Play’s, where purchases are made through Google Play billing. That identifier carries no name, no email, no photograph and nothing you record, and we attach none of those to it. It does stay the same for as long as the app is installed, and Apple’s privacy label counts a lasting identifier like that as linked to you, so that is what we declare rather than argue the other way. Separately, Premium can be switched on for seven days on one phone with a review code, which we give only to the people who review Tress for the App Store and Google Play. A code typed in is sent over an encrypted connection to a server of ours at tresshaircare.com to be checked, with nothing about you alongside it; the server does not keep it, RevenueCat is not contacted for it, nothing is bought, and “Delete all my data” ends it.
You type them in. Earlier versions of Tress had a barcode scanner that sent the digits to an online cosmetics database and showed what it listed; that screen and that request are gone. A product is now a name and, if you want, a brand, written on the add-a-task form and kept in the app’s own record. Nothing is looked up and nothing is checked against anything. The names in your routine are among the words sent when your guide is worded or Tress AI answers, once you have said yes to reading with AI, and where you have a Tress backup your products are kept in it. The one leftover to name: if you scanned a bottle on an older version, that record kept the web address of the photo the database had, and the screens that draw your products still load that picture from there. Nothing can write a record like that any more, and “Delete all my data” in Settings clears it along with the rest of the record.
Some of the reading happens on this phone and some does not. On the phone: Apple’s ARKit face tracking or Google’s ML Kit face detection, so the camera can follow your head through a scan, and a model built into the app that separates hair from background, so the app can measure how much of a frame the hair covers. None of those sends a photograph anywhere — a frame goes in on this device and a few numbers come back. Google states that ML Kit sends it a small amount of diagnostic information — the device, the app, how the model performed — with an identifier for the installation, and no photograph. Elsewhere: Google’s Gemini API, reached through a server of ours, and only once you have said yes to reading with AI. It reads the scan frames described above, words your hair guide, draws the preview on the Premium screen, and answers Tress AI, the assistant. A message you send Tress AI travels with up to six earlier exchanges from that conversation and a slice of your record picked for the question — for example your goal, treatments you named, the names of your routine items and how often you have ticked them, check-in and scan counts and dates, and your latest scan’s reading — and, only when you ask how something looks, up to four small frames from your two latest scans. Your name, your age, your journal notes and the app’s own identifiers are never sent, and the conversation is not stored on our server. We do not train any model on what you record; what Google does with what it receives is Google’s to set out in its own terms. If you say not now, or turn it off in Settings, nothing goes to Gemini: the scan is measured on the phone, the guide keeps its own words, and Tress AI answers from your record. Whichever model is doing the reading, Tress does not diagnose anything and does not recommend a treatment, a product or a dose — it describes what a photograph shows and what it could not make out.
Where something on your screen was written or drawn by the AI — an answer from Tress AI, a scan report read with AI, a card of your hair guide the AI helped word, and the illustration on the Premium screen — there is a small Report button beside it, so you can tell us it was offensive, harmful, wrong or misleading without leaving the app. Nothing is sent until you tap it and pick a reason. Then the app sends a server of ours at tresshaircare.com, over an encrypted connection: the text the AI wrote that you are reporting, up to 4,000 characters of it; the reason you picked; the name of the model that wrote it, where the app kept one; whether your phone runs iOS or Android; and the app’s version. For the illustration no picture is sent, only a note that it was the illustration. No photograph, none of your messages or questions, no name, no account identifier and no other part of your record travels with a report. The server is hosted by Netlify and keeps each report in a store of ours so that we can review it; a report is not sent to Google.
We added no analytics SDK, no crash reporting, no ad network and no third-party tracker. Nothing in the app counts what you tap or reports how you use it. Two things report something of their own, and we name them rather than hide them behind that sentence: the subscription check described above, which counts purchases for us, so the App Store label and Google Play’s data safety form declare it for analytics as well as for making Premium work; and Google’s ML Kit, which sends Google diagnostic information about how its face detection performed. We read no advertising identifier, and Tress asks for no permission to track you across other apps. The hair analysis is not part of any of this: your images are sent to be read and are not counted, measured for engagement, or used to work out anything about how you use the app.
The camera, to scan your hair. That one is not optional where it is used: the hair scan asks for it the first time you open it and shows you why instead of a viewfinder if you say no. Your photo library is opened only through the phone’s own picker, which hands over just the picture you choose, so no access to the library is asked for. Face ID or your passcode, only if you turn on the app lock — the passcode is kept in your phone’s keychain. Notifications, only if you turn on reminders, and those are scheduled by your phone rather than sent from anywhere; if you start a free trial with notifications allowed, your phone also schedules one reminder two days before the trial ends. Each is asked for at the moment you first use the feature that needs it, and saying no costs you that feature rather than the app. On Android, the libraries the app is built from add a few permissions to its list that Tress never requests and never reads.
It happens when you ask for it. Saving or sharing an image from Tress — your card, a milestone, a tip, or an update with its photographs in it — renders that image, writes it into the app’s cache so the share sheet can read it, and hands it over; where it goes from there is your choice. Those files stay in the cache until the system clears it or the app is deleted. Two buttons take you out of the app: “Manage subscription” opens your store account’s subscription settings, and signing in with Google opens Google’s own sign-in page.
Settings has “Delete all my data” — “Delete my account and data” where you have a Tress backup. It deletes the photographs and thumbnails, cancels your reminders, and clears your journey, sessions, routine, products, journal, answers, and your answers about reading with AI and keeping a backup. Where you have a Tress backup, the same button removes your record and your photographs from it and deletes the account the backup was kept under, with any sign-in attached to it; if the backup cannot be reached at that moment, the app says so and tries again before it sends anything new. Deleting one note or one scan in the app removes what it held from the backup, photographs included, the next time the app reaches it; only an empty marker that something was deleted stays, until you use this button. It does not reach everything the app has put on the phone, and these are the leavings worth knowing about: your settings, meaning appearance, reminder hour and the capture options; the app lock, including the passcode in your keychain, so turn the lock off first if you want that gone too; the last membership answer the app had cached; any product pictures the image cache kept from a version that still scanned barcodes; the images you handed to the share sheet, still in the app’s cache; and, on a phone that has opened the paywall or bought something, the identifier RevenueCat made for the install. A Tress Premium subscription is billed by the store and is not cancelled by this button. A hair analysis leaves nothing on our server for this button to clear.
Deleting the app takes the app’s own storage with it: the photographs, the record, the settings and the cached files above. It does not delete a Tress backup: use “Delete my account and data” first, or write to us. Two things are held in your phone’s keychain rather than in the app: the passcode, and — where you have a Tress backup — the sign-in that opens it. What the keychain does after an app is removed is the phone’s behaviour, not something this app can show you. If you want the passcode gone, turn the app lock off before you delete; to end the sign-in for good, use “Delete my account and data”. A device backup made before you deleted anything still holds the photograph files until that backup is replaced or deleted, and that is in your phone’s backup settings rather than ours.
Three. Once the app has connected to RevenueCat, on iPhone or on Android — because you opened the paywall, bought, or restored — that service holds a customer record against the install’s random identifier; write to support@tresshaircare.com and we will help you have it deleted, and tell us roughly when you installed and the store account you used if you subscribed, because it carries no name for us to search on. Where you have a Tress backup, we can reach what is in it, as the section on your account and backup says; “Delete my account and data” removes it, or you can write to us. And we keep the reports people send about something the AI wrote; a report carries no identifier, so we cannot tell which one is yours, but if you tell us what it said and roughly when you sent it, we will look for it and delete it.
What is on your phone you already hold: read it in the app, change it, and delete it in Settings. Where you have a Tress backup, we hold a copy of your record, and you have the right to ask us for a copy of it, including in a common machine-readable format you can take elsewhere; to have it corrected; to have it deleted; to have its use restricted while a question about it is settled; and to object to how it is used. You can take back a consent at any time, in Settings or by writing to us. For any of these, write to support@tresshaircare.com from the email you saved your progress with, or tell us roughly when you installed the app if you never saved it; a person answers, and we reply within one month. What passes through our server on its way to Google — scan frames, answers, messages — is not kept by us, so there is nothing of it on our side to produce or erase. You can also ask a question about anything on this page, or tell us you object to something here, at the same address. Nothing is deleted on a timer: the backup is kept until you delete it or ask us to, and we set no expiry on the purchase record or on reports. Some of the services named here — Google, Netlify and RevenueCat among them — run servers outside the UK and the EU, so what is sent to them can leave your country. Those services offer safeguards for such transfers, such as the standard contractual clauses approved for the UK and the EU, in the data processing terms they publish; write to us and we will point you to them. If you are unhappy with how we have handled your data, you can complain to the data protection authority where you live or work — in the UK, the Information Commissioner’s Office (ico.org.uk).
Supabase keeps the backup and the sign-in, where your version has them, on servers in London; like any host it keeps its own logs of requests and sign-ins, including the internet address they came from. Netlify hosts the server that passes scans, answers and messages on to Google and keeps the reports you send about something the AI wrote, and hosts our website; like any host it keeps its own records of requests, including the internet address they came from. Google receives what is sent to be read or worded, through its Gemini API, provides the ML Kit face detection built into the app, and handles Sign in with Google and, on Android, Google Play billing. Apple provides the face tracking on iPhones with a TrueDepth camera, which runs on the phone, and handles Sign in with Apple and, on iPhone, App Store billing. RevenueCat keeps track of memberships on iPhone and on Android. An email service sends sign-in codes when you choose email. Each publishes terms of its own.
Tress is made for adults: you need to be 18 or over to use it, and it is not directed at children. It records treatments that are prescribed to adults. The app does not ask your age and does not check it. Earlier versions asked for an age range, optionally; where one was given it stays in your record, and in your Tress backup if you have one. If you believe someone under 18 has given us their details, write to us and we will delete them.
tresshaircare.com sets no cookies, runs no analytics and loads nothing from anybody else: its typefaces and images are served from the site itself. It is hosted by Netlify, which keeps its own records of requests, including the internet address they came from.
Tress is made and published by Arslan Ahmad, an individual developer, who is the seller named on its store listing and the person responsible for what the app does with what you record. Under UK and EU data protection law he is the data controller. Post reaches him at 128 City Road, London EC1V 2NX, United Kingdom; support@tresshaircare.com reaches him faster, and a person reads it. If you are in the UK or the EU and think this app has mishandled something of yours, you can complain to your data protection authority — in the UK that is the Information Commissioner’s Office. When any of this changes, this page changes with it and the date at the top moves.
Tress is a tracking and documentation tool. It is not a medical device and does not provide medical advice.