Privacy policy
Last updated 29 October 2026.
In short
- We collect what we need to match your oil, send your order and run your account.
- Your health answers are used to match you, then forgotten. We never store them.
- Photos stay on your phone. Scan photos are read, then deleted; we keep only the readings.
- No ad trackers, no tracking cookies, and we never sell your details.
- Our database is in Canada. A few services we use handle data outside Canada, and they’re listed below.
Who we are
Yed Idem Inc. sells Yed Idem oils and is responsible for your personal information. It’s an Ontario company, owned by Woro Group Inc.
Our Privacy Officer is responsible for it. Write to hello@yedidem.ca with “Privacy” in the subject, or by post to the address above.
Woro Group Inc. publishes the Yed Idem app on the App Store and Google Play, under licence from us. Our Stripe account sits in Woro’s Stripe organization. Woro’s Expo account builds the app and passes on our order notifications, and its Sentry and Umami accounts hold error reports and visit counts that don’t name you. Woro uses these only to run Yed Idem’s shop and app for us. Apple and Google also give it statistics about the app, such as downloads and crashes, that don’t name you.
What we collect, why, and for how long
| What | Why | How long |
|---|---|---|
| Your email, language and first name if you give it, when you join the waitlist or the newsletter, and the oils you were matched to | To email you what you asked for | Until you unsubscribe |
| Your quiz answers, apart from health answers | To match your oil. Kept only if you tick “Save my answers” or have an account | Until you delete them |
| Your health answers: pregnancy, trying to conceive or breastfeeding, the signs that need a doctor, a new medication, and heavy shedding after childbirth, an illness or surgery | To match your oil, there and then | Never stored |
| A nut allergy, if you tell us | So no order ever includes a nut oil | In your profile, until you remove it |
| Your orders: your name, email and address, what you bought, its top and dose, the first name and hair details printed on its insert card, your gift message, and a gift recipient’s name and address | To send your order, answer questions about it, and keep tax records | 6 years after the end of the tax year of the order |
| Your other answers with an order, if you didn’t save them | So the app can offer to bring them in | 30 days, then deleted. Orders placed before the app opens: until 9 January 2027 |
| A gift recipient’s email, for a gift we email | To send the gift on its date | Until it’s sent |
| Your account: your sign-in email or Apple or Google sign-in, that you’re 18 or over, your hair profiles, check-ins, settings and the app’s notification tokens | To run your account | Until you delete it |
| Scan photos, in the app | To read your hair type | Deleted once read. We keep the readings until you delete them or your account |
| Progress photos, in the app | For your own album | On your phone only, unless you turn on backup |
| Reviews, and the three questions after delivery | Reviews show on our site. We read the answers to learn how each oil suits people | Until you delete them |
| Your email and a product, for a back-in-stock alert | To email you once, when it’s back | Until we’ve sent it |
| Your choices: what each box said, and when you ticked it | To show what you agreed to | While the choice lasts, and 3 years after. Once an account is deleted, only a scrambled copy of its email stays with them |
| What you write to us | To answer you | 2 years |
| Technical details when you use the site or the app, such as your IP address | To run them and stop abuse | A few days, in our services’ logs |
Copies in our nightly backups expire within 30 days. Stripe takes your card details on its own checkout page, or its payment sheet in the app, and we never see your full card number.
Your health answers
Some quiz questions are about your health: pregnancy, trying to conceive or breastfeeding, the signs that need a doctor, a new medication, and heavy shedding after childbirth, an illness or surgery. We ask each one only where it can change your match. We use the answers to choose your oil and never store them, on the website or in the app. That’s why we ask them again before every subscription order.
Photos
The website never asks for photos. In the app, with your consent, the scan sends 4 photos of your hair to Google’s Gemini model, run for us in Montreal, Quebec. It reads your hair type, then the photos are deleted. If Google’s automated checks flag a request as possible abuse, Google may keep a copy for up to 90 days, in Montreal, and its staff may review it. Google doesn’t use the photos to train its models. We keep only the readings. The photos must be of you, and you must be 18 or over.
Progress photos stay on your phone, and out of iCloud and Google backups. You can save them to your phone’s gallery at any time. From January, you can also turn on a backup to Backblaze, in Toronto: it’s a separate choice, off until you turn it on.
We don’t use your photos to train AI. If we ever ask, it will be a separate choice, off unless you turn it on.
Children
Our shop and app are for adults. A parent can take the quiz for a child and keep a child’s profile in their account. We never take or keep photos of anyone under 18, and never use a child’s profile for marketing. We don’t knowingly collect information from anyone under 14 without a parent’s consent.
Cookies and tracking
- One cookie keeps your bag between pages, for 30 days. It holds what’s in your bag, and for a quiz match, the first name it was for and the four answers its card prints (curl pattern, scalp, density and hairstyle), never your other answers.
- Visit counts come from Umami, which uses no cookies and counts pages and quiz steps without knowing who you are.
- Cloudflare Turnstile checks that a form, or a code in your bag, is sent by a person. It reads signals from your browser for that check only, never what you type.
- Error reports go to Sentry with no names, emails or IP addresses.
- No ad pixels and no tracking cookies, so there’s no cookie banner. Stripe’s checkout page sets its own cookies to guard against fraud.
Who helps us run the shop
Most of these may use your data only to provide their service to us. Stripe, Apple and Google also keep some of it under their own privacy policies, such as Stripe’s records of your payments.
| Service | What it does for us | Where |
|---|---|---|
| Supabase | Our database and sign-in | Canada (Montreal) |
| Amazon Web Services | Sends our emails | Canada (Montreal) |
| Backblaze | Photo backups, if you turn them on (from January) | Canada (Toronto) |
| Cakemail | Newsletters, if you sign up | Canada (Montreal) |
| Stallion Express and Canada Post | Shipping labels and delivery: your name and address | Canada |
| Google Cloud | Reads scan photos, and keeps our encrypted nightly backup | Canada (Montreal) |
| Stripe | Payments | Canada and the US |
| Cloudflare | Runs our website and forms, and forwards email sent to us | Worldwide |
| Our inbox, and Sign in with Google | US | |
| Apple | Sign in with Apple, and app notifications | US |
| Expo | Passes our order notifications to Apple and Google | US |
| Umami | Visit counts, with no personal data | EU |
| Sentry | Error reports, with no personal data | EU (Germany) |
Several of these companies are based in the US, including some whose servers are in Canada. Information held or handled outside Canada is subject to the laws there, and courts, police and national security agencies there may be able to get it. We checked each service before choosing it. If you live in Quebec, this means your data may also be stored or handled outside Quebec, such as photo backups in Toronto, if you turn them on.
We never sell or rent your details, or share them for advertising. Beyond the services above, we share them only when the law requires it, such as for a court order. If Yed Idem is ever sold or merged, your information would pass to the new owner, who may use it only as this policy says.
How the quiz decides
The quiz matches you by fixed rules, with no person involved. How matching works explains how your answers lead to your match. If you’d like a person to look at your match, write to us. The quiz runs only when you take it, and saving your answers is off until you tick the box.
Your rights
- See what we hold about you, and get a copy in a common file format.
- Correct it.
- Delete it, or your whole account: see Delete your account.
- Withdraw a consent, such as for emails, the scan or backups: in the app, through the link in an email, or by writing to us.
- Ask a person to review your match.
Write to our Privacy Officer, who looks into every request and complaint and answers within 30 days. If you’re not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
Keeping it secure
Only our Privacy Officer sees customers’ details, to run the shop. Your data travels encrypted. Database rules let each customer see only their own data, our backups are encrypted, and codes are stored scrambled. If a breach could seriously harm you, we’ll tell you and the privacy regulators.
Changes
We’ll post any change here with its date. If a change affects how we use what you’ve already given us, we’ll email you first, and ask for your consent again where it’s needed.