1. Who We Are

TonesFly is operated by Thang Pham ("TonesFly," "we," "our," or "us"). This Privacy Policy explains how we collect, use, and protect your information when you use the TonesFly mobile application ("the App").

For GDPR purposes, Thang Pham is the data controller. Contact: support@tonesfly.com

2. Information We Collect

We collect the following types of information:

Account information — your email address, display name, authentication provider, and account/user ID when you create or link an account via Apple Sign-In, Google Sign-In, or email
Audio files — audio files you import into the App for listening practice, processed and stored on your device and, if enabled, in your iCloud account; never sent to our servers
Transcripts and lesson content — created and processed entirely on your device, stored on your device and, if enabled, in your iCloud account; never sent to our servers
Learning progress — practice progress, completion, and streaks, stored on your device and in your iCloud account
Subscription status — if you purchase a subscription, Apple and RevenueCat send us your subscription state (purchase tokens only, never payment details)
Device information — device model, operating system version, and app version for diagnostics
Usage analytics — product interaction metadata used to improve the App, collected only with your consent; never lesson content, transcripts, or search text
Campaign attribution — when you open the App from a marketing link, we may collect anonymous UTM parameters (source, medium, campaign name) to measure marketing effectiveness. These parameters do not contain personally identifiable information and are processed through PostHog subject to your analytics consent

3. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases:

Contract performance (Art. 6(1)(b)) — Account data, audio processing, and learning data are necessary to provide the service you requested
Legitimate interest (Art. 6(1)(f)) — Device information and anonymized analytics help us maintain and improve the App, prevent fraud, and ensure security
Consent (Art. 6(1)(a)) — Non-essential analytics (PostHog) are only processed with your consent, which you can withdraw at any time via Privacy Settings

You may withdraw consent for analytics at any time without affecting the lawfulness of processing before withdrawal.

4. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve TonesFly
Process imported audio on your device and turn it into listening practice lessons
Track your learning progress and streaks on your device and in your iCloud account
Process subscriptions and in-app purchases
Send important service updates and lesson-ready notifications
Respond to support requests
Measure marketing effectiveness using anonymous campaign attribution data from UTM parameters

5. Audio File Processing

You retain ownership of audio files you import to the App. By importing content, you grant the Licensor a limited, non-exclusive license to process such content solely for the purpose of generating listening practice passages for your personal use.

Audio is processed entirely on your device and is never sent to our servers. Transcripts and lesson content are created and processed on your device; our backend never receives them. All lesson content remains on your device and, if you enable iCloud, in your own iCloud account. Practice data is stored locally on your device.

You are solely responsible for ensuring you have the necessary rights to import and use any audio content within the App.

5a. On-Device Processing

TonesFly processes audio entirely on your device to create listening practice challenges. Speech recognition runs on-device — no audio or transcript data is sent to any external service. All lesson content is generated and stored on your device.

5b. Automated Processing (GDPR Art. 22)

TonesFly uses on-device automated processing to generate listening practice challenges from your audio. This includes speech recognition, challenge generation, and adaptive pacing. All of this processing runs entirely on your device.

These automated processes help create your learning content but do not produce legal effects. Under GDPR Article 22, you have the right to request human review of any automated processing decision that significantly affects you by contacting support@tonesfly.com.

For users under the applicable age threshold (13–18 depending on region), optional data collection is disabled entirely.

6. Third-Party Services

We use the following third-party services to operate and improve the App:

RevenueCat — subscription and purchase management
PostHog — product analytics (consent-based)
Firebase — authentication and crash reporting
Cloudflare — cloud hosting and edge network services (Workers, KV)
Brevo — transactional email delivery

These providers process data under data processing agreements with appropriate safeguards. Our Data Processing Agreement is available at https://tonesfly.com/dpa. Apple handles all subscription billing directly. Speech recognition, transcription, and speaker separation run entirely on your device — no third party receives your audio, transcripts, or lesson content.

7. Data Sharing

We do not sell, rent, or trade your personal data to third parties. This applies to all users, including California residents.

Audio, transcripts, and word explanations are processed entirely on your device and are never shared with anyone.

We may share data with:

Authentication providers (identity and account data for sign-in)
Subscription services (subscription state; Apple handles all billing)
Analytics services (product interaction data, with your consent where required)
Email service providers (transactional account and subscription emails)
Legal authorities when required by law or to protect our legal rights

For California residents (CCPA/CPRA): We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not collect or process sensitive personal information as defined by the CPRA, including precise geolocation, racial or ethnic origin, religious beliefs, genetic data, biometric information, or health information. You have the right to know what personal information we collect, request deletion, and opt out of any future sale. Contact support@tonesfly.com to exercise these rights.

8. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/HTTPS). Our infrastructure is hosted on Cloudflare's global network (Workers, KV). Our backend stores only account, subscription, and transactional-email data — all lesson data remains on your device and in your iCloud account. Audio and transcripts are processed entirely on your device and never transmitted to any server.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Article 33-34.

However, no method of transmission over the internet is 100% secure.

9. Data Retention

We retain your data for as long as your account is active or as needed to provide services.

Audio: stored on your device and, if iCloud is enabled, in your own iCloud account — never on our servers.
Transcripts and lesson content: created and processed entirely on your device; our backend never receives them. All lesson content remains on your device and in your iCloud account.
Word explanations and practice data: stored on your device and in your iCloud account; deleted when you remove the app, delete individual lessons, or choose to remove local data.
Account data (identity, email preferences): retained until account deletion.
Analytics data: retained for up to 12 months, subject to your consent settings.

You may delete your account at any time from Settings > Delete Account. Deletion is immediate and permanent: your account and your data on our servers — including your purchase history and email contact records — are deleted right away and cannot be recovered. There is no grace period and no way to cancel a completed deletion. Deleting your account requires an internet connection; if the deletion request fails, nothing is deleted and you can try again.

TonesFly cannot delete data stored in your iCloud account. To manage iCloud data, visit Settings > [Your Name] > iCloud on your device.

10. International Data Transfers

Audio is processed entirely on your device using Apple's on-device speech recognition and our local transcription engine. Audio files never leave your device.

Transcripts and lesson content are also created and processed on your device and are never sent to our servers. The only personal data our service providers process are the account, subscription, transactional-email, and consent-based analytics data described in this policy.

For users in the following jurisdictions, we have implemented additional safeguards:

EU/EEA (GDPR): Standard Contractual Clauses govern any cross-border data transfers. We conduct Transfer Impact Assessments for each sub-processor.
United Kingdom (UK GDPR): International Data Transfer Agreement (IDTA) with Addendum to Standard Contractual Clauses.
China (PIPL): We conduct impact assessments for cross-border transfers of personal information as required under Articles 55-56 of PIPL.
India (DPDP Act 2023): Transfers comply with conditions prescribed by the Central Government.
South Korea (K-PIPA): Cross-border transfers comply with Articles 28-2 and 28-3.
Brazil (LGPD): International transfers follow ANPD-approved mechanisms.
Japan (APPI): Cross-border transfers comply with the Personal Information Protection Commission requirements.
Indonesia (PDP Law 27/2022): Transfers follow adequate protection or binding corporate rules.
Thailand (PDPA 2019): Cross-border transfers comply with PDPC requirements.
Turkey (KVKK): Transfers comply with KVKK Board requirements.
Philippines (Data Privacy Act 2012): Cross-border transfers comply with National Privacy Commission standards.
Saudi Arabia (PDPL 2023): Transfers follow SDAIA-approved mechanisms.

Our sub-processors and their roles:

RevenueCat — subscription management (purchase tokens only)
PostHog — analytics (consent-based, anonymized)
Firebase — authentication (auth tokens only)
Brevo — transactional email delivery (email address only)
Cloudflare — API hosting and edge network services
Apple iCloud — user data sync (managed by user's Apple Account)

11. Children's Privacy

TonesFly uses an age-gate flow to help comply with children's privacy laws including COPPA (US) and GDPR (EU/EEA). If you have not completed that flow yet, the app will ask for your birthday before optional data collection can be enabled. Your exact birthday is processed locally on-device to determine the correct age threshold; we store only an age range (under 13, 13–15, 16–17, or 18+) locally on the device, not on our servers.

If you identify yourself as under the applicable age threshold (13 in the US and most countries, 13–16 in the EU/EEA depending on country, 14 in China and South Korea, and 18 in India), optional data collection — including analytics, crash reports, and diagnostics — is automatically disabled and cannot be re-enabled in Settings.

If you believe a child's data has been collected in error, please contact support@tonesfly.com and we will delete it promptly.

12. Your Rights

Depending on your jurisdiction, you have the following rights:

All users:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Export your data in a portable format
Opt out of analytics data collection

EU/EEA residents (GDPR):

Right to restrict processing of your data
Right to object to processing based on legitimate interest
Right to withdraw consent at any time
Right not to be subject to solely automated decisions
Right to lodge a complaint with your local data protection authority (supervisory authority)

California residents (CCPA/CPRA):

Right to know what personal information is collected
Right to delete personal information
Right to opt out of sale of personal information (we do not sell your data)
Right to non-discrimination for exercising your rights

Japanese residents (APPI):

Right to request disclosure of retained personal data
Right to request correction, addition, or deletion
Right to request cessation of use or erasure
Right to request cessation of provision to third parties

Chinese mainland residents (PIPL):

Right to know and decide about processing of your personal information
Right to access and copy your personal information
Right to correct or supplement inaccurate or incomplete information
Right to request deletion of your personal information
Right to withdraw consent at any time
Right to request explanation of processing rules
Right to data portability

South Korean residents (K-PIPA):

Right to access your personal information
Right to request correction or deletion
Right to request suspension of processing
Right to withdraw consent at any time

Brazilian residents (LGPD):

Right to confirmation of data processing
Right to access your personal data
Right to correct incomplete, inaccurate, or outdated data
Right to anonymization, blocking, or deletion of unnecessary data
Right to data portability
Right to information about entities with which data has been shared
Right to revoke consent at any time

Vietnamese residents (PDPD):

Right to know about personal data processing activities
Right to consent and withdraw consent
Right to access your personal data
Right to request correction of your personal data
Right to request deletion of your personal data
Right to restrict data processing
Right to data portability

United Kingdom residents (UK GDPR):

Right to access your personal data
Right to rectification of inaccurate data
Right to erasure of your data
Right to restrict processing
Right to data portability
Right to object to processing
Right to withdraw consent at any time
Right not to be subject to solely automated decisions
Right to lodge a complaint with the Information Commissioner's Office (ICO)

Indian residents (DPDP Act 2023):

Right to access information about your personal data
Right to correction and erasure of personal data
Right to grievance redressal
Right to nominate a representative to exercise rights on your behalf

Indonesian residents (PDP Law 27/2022):

Right to be informed about data processing
Right to access your personal data
Right to correct inaccurate data
Right to request deletion of your personal data
Right to withdraw consent at any time
Right to data portability

Thai residents (PDPA 2019):

Right to access your personal data
Right to correct inaccurate data
Right to request deletion or anonymization
Right to restrict processing
Right to data portability
Right to object to processing
Right to withdraw consent at any time
Right to lodge a complaint with the Personal Data Protection Committee (PDPC)

Turkish residents (KVKK):

Right to know whether your personal data is being processed
Right to request information about processing
Right to learn the purpose of processing
Right to correct incomplete or inaccurate data
Right to request deletion or destruction of personal data
Right to object to processing
Right to data portability
Right to lodge a complaint with the Personal Data Protection Authority (KVKK Board)

Filipino residents (Data Privacy Act 2012):

Right to be informed about data processing
Right to access your personal data
Right to correct inaccurate data
Right to request deletion or blocking of data
Right to object to processing
Right to data portability
Right to lodge a complaint with the National Privacy Commission (NPC)

Saudi Arabian residents (PDPL 2023):

Right to be informed about data processing
Right to access your personal data
Right to correct inaccurate data
Right to request deletion of personal data
Right to restrict processing
Right to data portability

To exercise any of these rights, contact us at support@tonesfly.com, use the Privacy Settings in the App, or delete your account directly in Settings > Delete Account. We will respond within 30 days for GDPR requests, within 45 days for CCPA requests, within two weeks for APPI requests, within 15 working days for PIPL requests, within 10 days for K-PIPA requests, within 15 days for LGPD and PDPD requests, within 30 days for UK GDPR requests, within 30 days for DPDP requests, within 14 days for Indonesian PDP requests, within 30 days for PDPA requests, within 30 days for KVKK requests, within 15 days for Filipino DPA requests, and within 30 days for PDPL requests (or sooner where required by law).

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the App or by email at least 30 days before the changes take effect. Your continued use of the App after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Thang Pham (TonesFly)
Email: support@tonesfly.com

For EU/EEA users: If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.