Harumo

Operated by Wavefound (Byeongchul Oh) · contact@wavefound.net

Privacy Policy

Effective 2026-10-21

Harumo ("the app") stores your records and photos only on your device. The developer runs no servers and never receives your dose log, scalp photos, or notes. This policy explains what information can leave your device while you use the app, and how you choose.

1. Who we are

Harumo is made by Wavefound, a sole proprietorship in South Korea run by Byeongchul Oh (business registration no. 604-30-10608). Contact: contact@wavefound.net.

2. Information that stays on your device

Your medications (ingredient name, dose, start and stop dates), dose check-ins, dose changes, prescription dates, how-you-feel scores and notes, scalp photos with their brightness and face-landmark values, and app settings.
This information lives only in the app's private storage and does not appear in your photo gallery. It is not sent to the developer or anyone else, and it is excluded from your phone's cloud backups (Google backup and iCloud Backup).
Face landmarks (such as eye positions) and whether a face is in view are calculated on your device only, to help you take photos at the same angle and to time auto capture. They are not used to identify anyone.
For auto capture, the app reads your phone's tilt and movement (accelerometer) on the device, only while the camera screen is open. This is not stored or sent.
When you take a crown photo, the app finds where your head is in the frame with a model built into the app, on your device only. No photo leaves your device for this.
Photos that show your face are saved with a black bar over both eyes (on by default; turn it off in Settings > Cover eyes in face photos). The bar can't be removed later, and it stays in comparisons, cards, time-lapse, reports, and exports.
If you use Export, a file with this information is saved where you choose. You control that file.

3. Information that can leave your device

What	When	Information	Recipient (country)	Purpose
Ads	When you don't have Plus	Advertising ID and app set ID (Android), IP address, app usage (app launches, taps, ad views), diagnostics (app and SDK performance; on iOS, crash data), device and app information	Google LLC — AdMob (U.S.)	Showing ads, preventing fraud, measuring ads. Only non-personalized ads are requested, and no health information is passed to ads
Usage statistics	Only if you choose "Send"	An anonymous ID (the same random ID as error reports), which features were used (app opened, setup finished, photo set saved (number of photos), check-in (method), rewarded ad finished (placement)), device model, OS and app versions, language, region and time zone settings	PostHog Inc. (U.S. company, servers in Germany)	Seeing which features are used so we can improve the app. IP addresses are not stored
Error reports	Only if you choose "Send"	Error details (technical), an anonymous ID (a random ID the app creates when you agree), device model, OS and app versions	PostHog Inc. (U.S. company, servers in Germany)	Fixing crashes. Photos, notes, and medication names are not included
Face-detection diagnostics	When using the camera screen on iPhone (blocked on Android)	Device and app information, a per-installation identifier, performance values such as processing time, feature settings	Google LLC — ML Kit (U.S.)	Diagnostics for face detection. Photos are not sent
Update check	When you open the app (this website and the App Store at most once a day)	The IP address and time that come with any internet request. No records or device identifiers are added	GitHub, Inc. (hosts this website), Apple Inc. (App Store, iPhone), Google LLC (Google Play, Android) (U.S.)	Telling you about new versions, and asking you to update when a version fixes a problem that could damage your records
Purchases	When you buy Plus	Payments are handled by Google Play or the App Store; the developer never receives your payment details. The app only checks whether Plus was purchased	Google LLC, Apple Inc. (U.S.)	Buying and restoring Plus

We ask about usage statistics and error reports once on the home screen. Nothing is sent before you choose, or if you choose "Don't send". You can change this anytime in Settings > Send usage stats and error reports.
Each recipient handles information under its own policy: Google, PostHog, Apple, GitHub.
We do not sell this information or share it with anyone not listed above, and we do not use it for targeted advertising.

4. International transfers

The recipients above are in the United States and Germany, so information may be processed outside your country, including outside Canada. You can refuse usage statistics and error reports and still use every feature. Ad-related transfers do not happen with Plus.

5. Retention and deletion

On your device: until you delete it. Settings > Delete all removes your records, photos, and settings from the device right away, and uninstalling the app removes them too. Deleted information cannot be recovered.
Information that left your device: kept under each recipient's retention period.
Switching phones: your records are not in the cloud, so they don't move to a new phone by themselves. On the old phone, use Settings > Export to save a file, then open Harumo on the new phone and choose that file with Settings > Import.

6. Your choices and rights

You can view, edit, and delete the information on your device in the app.
You can turn off usage statistics and error reports anytime. To delete what was sent, email contact@wavefound.net with the Anonymous ID shown in Settings > About. We use that ID to find and delete both your usage statistics and error reports.
You can reset or delete your advertising ID in your phone's settings.

7. Permissions

Camera (optional: scalp photos), notifications (optional: reminders), saving to photos (optional: only when you save a comparison card), internet (ads, usage statistics and error reports if you agree, update checks, source links, purchase checks), and vibration (auto-capture cues). The app does not ask for location, contacts, or microphone.

8. Children

The app is for adults. We do not knowingly receive information from children under 13.

9. Security

We keep no copy of your records or photos. Information that leaves your device is sent over encrypted (HTTPS) connections.

10. Changes

If this policy changes, we will update this page and mention it in the app's update notes.

Guide card sources

The app's weekly guide cards are based on the public sources below. This is general information, not diagnosis or treatment. Talk to a doctor or pharmacist before changing how you take your medication.