Privacy Policy

Who does what with your information

Realm is software used by salons, spas, and independent practitioners to care for their clients. If you are a guest, the business you visit decides what information to collect about you and how to use it — they are the ones who hold that relationship. REALMFLOW LLC operates Realm and stores that information on their behalf, following their instructions.

In plain terms: your therapist or stylist owns your information. We keep it safe for them. If you want your information changed or deleted, the fastest path is to ask them — and we help them do it.

What we collect

• • Contact details you give the business: your name, phone number, and email address.
• • Your appointments: what service, when, with whom, and whether you arrived or cancelled.
• • What you tell us in an intake form: your preferred type of service, areas you want focused on, areas you want avoided, health conditions you disclose, medications you list, and your signature agreeing to the business's consent form.
• • Notes your practitioner records: session notes, color formulas, preferences, and reminders about your care.
• • Messages you exchange with the business inside Realm.
• • Basic technical information needed to run the service securely, such as your session cookie when you log in and standard server logs.

Health information, specifically

Intake forms and session notes can include health information — conditions, injuries, pregnancy, medications, and what should be avoided during your service. We treat this as the most sensitive information in the system.

It is stored separately from ordinary preferences and is marked as sensitive. Inside a business, it is shown only to the practitioner responsible for your care and to the owner or manager; front-desk staff cannot see it at all. Every time an owner or manager opens sensitive details, that access is recorded.

We do not use your health information for advertising, and we never sell it.

What we never do

• • We do not sell your personal information. Not to anyone, for any price.
• • We do not use your information for targeted advertising.
• • We do not run third-party advertising trackers or analytics profiling in the app.
• • We do not share your information with other businesses using Realm. Each business's records are isolated from every other business.

Who can see your information

Access inside a business follows the responsibility for your care, not job title alone:

• • Your practitioner sees what they need to serve you well.
• • Owners and managers can see more, and their access to sensitive details is logged.
• • Front-desk staff see scheduling information only — never preferences, notes, or health details.
• • Other businesses using Realm can never see you at all.
• • Our own staff access customer data only when needed to operate or fix the service.

Where your information is kept

Realm runs on Railway, a cloud hosting provider, using servers and a database located in the United States. Railway stores the data on our behalf and does not use it for their own purposes.

If and when text messaging is enabled, Twilio is used to deliver messages, and would receive the phone number and message content necessary to send them.

These are the only outside services that handle your information.

How it's protected

• • All traffic is encrypted in transit (HTTPS).
• • Staff passwords are stored only as one-way hashes — never as readable text.
• • Permissions are enforced by the software on every page, not just hidden in the interface.
• • Each business's data is isolated; requests for another business's records return nothing.
• • Access to sensitive information is recorded in an audit log.
• • Guest portal links are long random values that cannot be guessed, and they are handed to you directly.

How long we keep it

We keep information for as long as the business you visit uses Realm, because your care history is what makes the service useful to them. Practitioners also have their own professional record-keeping obligations, which may require them to retain treatment records for a set period.

If a business closes its account, we make their data available for export and then delete it. You can ask your business to correct or delete your information at any time, and we will act on their instruction.

Your rights

Depending on where you live — including under the Texas Data Privacy and Security Act — you may have the right to know what information is held about you, to correct it, to obtain a copy, and to ask that it be deleted. Because your business controls your information, the quickest route is to contact them directly. You may also contact us and we will help.

To reach us: privacy@realmflow.app, or write to REALMFLOW LLC, 1915 Judson Road, Longview, TX 75605.

Text messages

If you agree to receive texts from a business using Realm, you can stop at any time by replying STOP. Your choice is recorded and honored automatically. Message and data rates may apply.

Minors

Realm is not designed for children to use on their own. Where a client is a minor, a parent or guardian provides the information and signs the consent form. Realm is not intended for children under 13.

Changes

If we change this policy in a way that matters, we will update the date at the top and notify the businesses that use Realm. This version was last updated August 15, 2026.