Privacy Policy
How hTrim collects, uses and protects your personal information. Covers the hTrim Android and iOS apps and this website.
Effective date: 2 October 2026
This Privacy Policy explains what the hTrim mobile application and website collect, why, who else sees it, how we keep it safe, how long we keep it, and what you can ask us to do about it. It applies to the hTrim Android app, the hTrim iOS app, and the website at htrim.app.
Developer details
- App namehTrim
- Developer nameKernel Coders Lab
- Support email[email protected]
- Contact addressHouse no# 139, Sector# 3, Uposhhor Housing Society, Boalia, Sopura-6203, Rajshahi, Bangladesh
1. Types of data we collect
Personal information you give us
| Data | When | Why |
|---|---|---|
| Name | Sign-up | To identify you to the salon serving you. |
| Email address | Sign-up | Sign-in, verification codes, service messages. |
| Mobile number | Sign-up (required for salon owners; optional for customers) | So a salon can reach you about a booking. An owner's number is verified by SMS. |
| Password | Sign-up, if you use one | Stored only as a PBKDF2 hash. We never store the password itself and cannot recover it. |
| Gender, date of birth | Optional, in your profile | Age-appropriate booking rules and, where a salon serves one gender, whether it can serve you. |
| Dependants | If you book for a child or family member | Their name, gender, date of birth and relationship to you — so the salon knows who is being served and can apply the rules appropriate to their age. |
| Booking details | When you book | Services, expert, branch, time, and any note you add. |
| Reviews and ratings | When you leave one | Shown publicly against the salon. |
| Home-visit address | When you book a visit to your own address | The street line and area you enter, the administrative area you select, and the map pin you drop. Kept with that booking, so the salon can find you and so we can check the address falls inside the branch's home-service range. |
| Payment records | When a branch requires an advance; and after a visit, for the balance | The amount, any tip, the method the salon marks it against (cash, bKash, Nagad, card), and whether it was refunded. This is the salon's record of the visit. We do not take the payment and never see card numbers. |
Media and photos
You may optionally set a profile photo, and a salon owner may upload a company logo. When you pick an image it is chosen through your device's own file/photo picker, and it is cropped and resized to a 512 px JPEG on your device before upload; files larger than 10 MB are rejected. We do not request access to your whole photo library, and the app has no camera and no microphone permission.
Location
With your permission, we read your approximate or precise location in exactly two places: to rank nearby salons by distance when you ask to find one, and to place the pin for a home-visit booking. We do not track you in the background. You can refuse the permission and still use the app by choosing your area manually.
Device and diagnostic information
- A device notification token, if you allow notifications, so we can tell you when your turn is approaching or a booking changes.
- Crash and error diagnostics — a crash report containing the error, the app version, and basic device and operating-system information, sent to our crash-reporting provider when the app fails. Used only to find and fix faults.
- Ordinary server logs — request paths, timestamps, error diagnostics — kept for security and debugging.
Permissions the app requests
The Android app declares exactly the following permissions in its manifest. Nothing else is requested:
| Permission | Why it is requested |
|---|---|
android.permission.INTERNET | To reach the hTrim service. |
android.permission.ACCESS_NETWORK_STATE | To detect whether the device is online, so the app behaves sensibly offline. |
android.permission.ACCESS_COARSE_LOCATION | To find salons near you using approximate location. |
android.permission.ACCESS_FINE_LOCATION | To find salons near you and place a home-visit pin, using precise location. |
android.permission.POST_NOTIFICATIONS | To tell you when your turn is approaching or a booking changes (Android 13+; requested at runtime). |
The app does not request the camera, microphone, contacts, calendar, SMS, or storage/photo-library permissions. On iOS the app requests location when in use (NSLocationWhenInUseUsageDescription), enables the remote-notification background mode for push, and registers the htrim:// URL scheme to return from an external sign-in.
If you sign in with Google or Facebook
hTrim lets you sign in with an existing account instead of a password. Where that is offered, we receive from the provider an identifier for your account there, your name, and your email address. We store the identifier so that signing in again reaches the same hTrim account.
We never receive or store your password at that provider, and we ask for no access to anything else of yours — not Drive, not Contacts, not Gmail, not your posts or friends. From Google the only permissions requested are openid, profile and email; from Facebook, your public profile and email address. We do not keep the provider's access or refresh tokens.
We never hold your money. hTrim does not take payments, store card details, or keep a customer wallet. Payments happen between you and the salon.
2. How we use your data
- Core functionality. To place you in a queue, show the salon who is waiting and for what, show your estimated start time, and deliver the notifications you asked for (a turn approaching, a change, a cancellation).
- Account management. To create and secure your account, verify your email address and mobile number with one-time codes, sign you in, and let you manage your profile, dependants and bookings.
- Salon operations. To let a salon you own or work at operate its business — rosters, attendance, payroll and reports.
- Safety and reliability. To diagnose crashes and faults, prevent abuse, and keep the service working.
- Analytics. We do not run a third-party analytics SDK, and we do not build behavioural or marketing profiles about you.
- Advertising. hTrim shows paid placements bought by salons on hTrim, labelled Sponsored or Featured partner in search results. They are chosen only by where you are searching — the device location or map pin you give the app, or the area you filter by — and by distance from that point; never by who you are, your bookings or anything else about you. hTrim contains no third-party advertising and no ad SDKs (no AdMob or similar). We do not share your data with advertisers, and we do not sell your personal information.
3. Third-party services
These are the services and SDKs built into the app, or used to run it. Each processes data only for the purpose shown.
| Service / SDK | What it handles |
|---|---|
| Google — Firebase Cloud Messaging | Delivering push notifications to your device (a device token). |
| Sentry | Crash and error reporting — the error, app version, and basic device and operating-system information, so we can fix faults. |
| Google — Sign in with Google | Authenticating you, if you choose that sign-in method. |
| Meta — Facebook Login | Authenticating you, if you choose that sign-in method. |
| Brevo | Sending transactional email, including verification codes. |
| BulkSMSBD | Sending SMS verification codes to Bangladeshi mobile numbers. |
| Cloudflare R2 | Storing uploaded images (profile photo, salon logo). The storage is private; images are served back through our own service, not from a public bucket. |
Payment processing. hTrim does not currently take payments, so no payment processor is integrated into the app or the website. When online payment for salon subscriptions launches, it will go through a licensed payment gateway, and we will name that provider here once it is live. We do not store your card details.
Some of these providers operate outside Bangladesh, so your information may be processed abroad. We choose providers that commit to protecting it. Otherwise we disclose data only when the law requires it — a valid legal request, or to protect someone's safety or our rights.
4. Data security and retention
Security. All traffic between your device and hTrim is encrypted in transit over HTTPS/TLS; unencrypted connections are not accepted. Passwords are stored only as PBKDF2 hashes and refresh tokens only as SHA-256 hashes. Uploaded images are held in private storage and served through our own service rather than from a publicly readable bucket. Access to a salon's records is restricted by role and checked on the server for every request. No service can promise perfect security, and we do not.
Retention. We keep personal data only as long as we need it:
- Account information — while your account exists, then deleted within 30 days of a deletion request (see below).
- Verification codes — minutes; they expire and are swept away automatically.
- Sign-in and refresh tokens — until they expire or you sign out.
- Crash and diagnostic reports — up to 90 days.
- Server logs — up to 90 days.
- Bookings, reviews and salon business records — kept as the salon's operating and accounting history, and where the law requires it (for example tax records), after which they are deleted.
5. Your rights and data deletion
You may request access to, correction of, or deletion of your personal data, and you may withdraw consent for optional processing (such as location or notifications) at any time in your device settings.
How to request account and data deletion. You can delete your account and the personal data linked to it by email, at no cost:
- By email: write to [email protected] from your registered address with the subject "Account deletion request".
- Deletion URL: https://htrim.app/account-deletion
Deletion is scheduled immediately and completed within 30 days. Some records must be kept — a salon's legal and accounting records, and reviews, which remain but are no longer linked to your name. We will always tell you what we cannot remove and why. See Delete your accountfor the full detail.
6. Children's privacy
hTrim is not directed at children. The minimum age to create an hTrim account is 13 (or the minimum age of digital consent in your country, if higher), and we do not knowingly collect personal information from children under that age. If we learn that a child under 13 has created an account, we will delete it. This is consistent with the principles of the US Children's Online Privacy Protection Act (COPPA) and comparable laws.
A parent or guardian may book on behalf of a child as a dependant, in which case we hold the child's name, gender, date of birth and their relationship to the adult, together with the bookings made for them. We hold that because a salon needs it to serve a child appropriately, and we hold nothing else about them — no contact details of their own and no login.
7. Effective date and policy updates
This policy is effective from 2 October 2026. We may update it from time to time; when we do, we will change the effective date at the top of this page, and the current version will always be published here at https://htrim.app/privacy. If a change materially affects how we handle your information, we will make that clear in the app rather than relying on you to re-read this page. Continuing to use hTrim after an update means you accept it.
8. Contact us
Kernel Coders Lab — [email protected]
House no# 139, Sector# 3, Uposhhor Housing Society, Boalia, Sopura-6203, Rajshahi, Bangladesh
If you are unhappy with how we have handled your information, tell us first and we will try to put it right.
hTrim is operated by Kernel Coders Lab. This policy is governed by the laws of Bangladesh. See also our Terms of Service.