GLINTManage reservation

GLINT Website Privacy Policy

Effective date: October 7, 2026 · Version 2026-10-07.1

Who we are and what this covers

TimeToLockIn, Inc. operates GLINT. This policy describes information handled through glint.hair, our camera reservation service, and related customer support.

The reservation website does not upload or analyze your scalp photographs. The hair images and app screens shown on the website demonstrate the product experience. Camera-app scanning, AI analysis, and coaching will have privacy information specific to those services before you use them.

Information we collect

Reservations and payments. When you reserve a camera, we and our payment provider collect information needed for checkout, such as your email address, name, billing and shipping details, and payment information. Our reservation database stores your email address, reservation and payment references, payment/refund status, timestamps, the terms version presented at checkout, and evidence of acceptance reported by our payment provider. Stripe processes card details through its hosted checkout; our application does not receive or store your full card number or security code.

Customer support. We receive the information you include in emails and other support communications. Please do not send medical records, scalp photographs, card numbers, passwords, or private reservation links for routine reservation support.

Optional website analytics. If you accept optional tracking, Vercel Web Analytics receives public-page visits and limited reservation funnel events. We classify traffic into broad channels (such as search, social, email, referral, or direct) and use only approved campaign labels; other campaign values are grouped as "other." We do not add click identifiers, raw referring URLs, email addresses, scalp information, or private reservation URLs to custom event properties. Vercel may receive the browser-provided referring URL as part of its ordinary page analytics, which can include parameters supplied by the referring site. A paid deposit or refund is reported only after our server verifies its status with Stripe. These measurements are approximate and subject to your consent choice and browser settings.

Website operation and security. We process technical information needed to serve the site and prevent abuse, including request information, IP addresses, browser information, and reservation-access identifiers. Hosting and payment providers may also maintain security and service logs. Our application uses hashed identifiers for its database-backed rate limits.

Email delivery. We record message references and delivery-related information, including bounce and complaint events. We use this information to troubleshoot delivery and avoid sending additional messages to suppressed addresses.

How we use information

We use information to process and manage reservations, confirm payments, issue refunds, provide private access links, communicate about your order, answer support requests, prevent fraud and abuse, maintain reliable services, and meet legal and accounting obligations.

A reservation does not enroll you in paid Premium or authorize recurring payments. Transactional reservation messages are separate from promotional email enrollment.

Service providers and other disclosures

Our reservation service uses:

These providers process information needed to perform their services. Provider terms and privacy notices may also apply to their own activities. We may disclose information when required by law or when reasonably necessary to investigate fraud, protect people or services, or exercise legal rights. If our business is transferred, information may be included subject to applicable protections and notice requirements.

Cookies and browser storage

The reservation service uses a necessary cookie, `glint_reservation`, to recognize an authorized browser. It lasts up to 30 days. It is marked HttpOnly and SameSite=Lax and is transmitted securely on our HTTPS site. Clearing it may require you to request a new reservation access link.

We also use browser session storage for checkout-attempt and reservation references. This supports checkout recovery and is generally cleared when the browser tab or session closes. Private email access links expire after 30 days.

With your permission, our site uses Vercel Web Analytics to measure visits, broad traffic sources, and reservation steps. We store a validated channel and campaign label in browser session storage and on the reservation to connect a verified deposit or refund to its source. We do not store raw referral URLs or click identifiers for this reporting. Vercel may process ordinary technical request information as our hosting and analytics provider. You can decline or withdraw optional tracking using Cookie choices, and Global Privacy Control keeps it disabled. We also load the TikTok Pixel on the landing page with your permission to measure visits and advertising performance. TikTok may receive information including your IP address, browser and device information, the page URL, advertising click identifiers and the time of your visit, and may use cookies to associate visits with advertising activity. This information may be used for advertising measurement and personalization under TikTok’s privacy practices. TikTok’s privacy policy is available at https://www.tiktok.com/legal/page/us/privacy-policy/en. Advertising disclosures of this kind may constitute sharing for cross-context behavioral advertising under applicable state law.

Optional Vercel analytics and the TikTok pixel do not load before you accept optional cookies. Choose Reject optional to keep it off, or reopen Cookie choices in the landing-page footer to change your preference. We honor Global Privacy Control by keeping the pixel and purchase reporting disabled. Withdrawing permission stops new analytics events, clears the stored attribution for reservations associated with the same browser, and reloads the page without the pixel; it does not recall information already received by Vercel or TikTok. You may also clear existing cookies through your browser settings. Browser Do Not Track is not otherwise used to change site operation.

We store your cookie choice in local browser storage under glint-marketing-consent-v2 until you change it or clear that storage. Earlier cookie choices do not authorize this expanded measurement. With this permission, the landing-page pixel measures page views, product views and reservation checkout starts. After Stripe confirms a paid reservation, our server sends TikTok a purchase event with the deposit value, currency, product identifier, event time, an event identifier and a SHA-256 hash of the checkout email for matching. Hashing does not make this information anonymous. We do not send raw email addresses, names, shipping addresses, card data, private reservation URLs, scalp images or health information through this server integration. The pixel is not installed on checkout or reservation-management pages. Purchase reporting uses the choice provided at checkout; changing Cookie choices also requests cancellation of unsent events associated with the same browser’s reservation cookie. Contact support for choices relating to another browser or a cleared reservation cookie. Information already transmitted cannot be recalled by changing this setting. Stripe and other providers may use their own technologies for security and payment functions; their practices are described in their privacy notices.

Server-side advertising events are retried for up to 20 hours. Their payloads, including the email hash, are cleared after successful delivery or when retries end. Minimal event identifiers remain to prevent duplicate reporting. Server-side marketing choice records are scheduled for removal after 30 days.

How long information is kept

We keep reservation and transaction information as needed to manage your reservation, process refunds, maintain required financial records, resolve disputes, and comply with legal obligations. Support records are kept as needed to resolve requests and maintain an appropriate service history.

Private access links expire after 30 days. Our application clears temporary email-job access tokens after sending or terminating a job. Completed or terminated email-job recipient details are scheduled for clearing after 30 days, while delivery event records are scheduled for deletion after 90 days. Minimal delivery records may remain to prevent duplicate messages. Suppression records are retained as needed to respect delivery restrictions. These application schedules do not automatically delete records held in Stripe, support email, provider logs, or backups.

Your requests and choices

Contact support@glint.hair to request access to, correction of, or deletion of information associated with your reservation. We may need to verify your identity before acting. We will explain any information we must retain for legal, security, accounting, or transaction purposes. Your rights and applicable exceptions depend on the laws that apply to you.

You can manage necessary browser storage through your browser settings, although disabling it can affect reservation access. Contact support if you cannot access your reservation.

Security and processing locations

We use technical and organizational measures intended to protect information, including encrypted website connections, restricted reservation access, and signed provider callbacks. No system can guarantee absolute security. Keep your private access links confidential.

Our business operates in the United States. Our service providers may process information in the United States and other locations where they operate.

Children

The reservation service is intended for adults and is not directed to children under 13. If you believe a child has provided information to us, contact support so we can investigate and address it.

Policy changes

We will post updates here with a new effective date. For material changes affecting reservation information, we will provide a prominent website notice or notify affected customers by email, as appropriate, and obtain consent when required.

Contact

support@glint.hair

Permanent policy version: 2026-10-07.1. Save or print this page for your records.