سیاست حفظ حریم خصوصی

1. ما کی هستیم

TonesFly توسط Thang Pham («TonesFly»، «ما» یا «ما را») اداره می‌شود. این سیاست حفظ حریم خصوصی نحوه جمع‌آوری، استفاده و حفاظت از اطلاعات شما هنگام استفاده از اپلیکیشن موبایل TonesFly («اپلیکیشن») را توضیح می‌دهد.

برای اهداف GDPR، Thang Pham کنترل‌کننده داده است. تماس: [email protected]

2. اطلاعاتی که جمع‌آوری می‌کنیم

We collect the following types of information:

3. مبنای قانونی پردازش (GDPR)

ما داده‌های شخصی شما را بر مبنای قانونی زیر پردازش می‌کنیم:

شما می‌توانید رضایت خود را برای تحلیل‌ها در هر زمان بدون تأثیر بر قانونی بودن پردازش قبل از لغو، پس بگیرید.

4. نحوه استفاده از اطلاعات شما

We use the information we collect to:

5. پردازش فایل صوتی

Audio is processed entirely on your device and never leaves it.

When you import an audio file:

Automated processing: Speech recognition and challenge generation are fully automated and run entirely on your device. No human reviews your audio or transcripts.

5a. On-Device Processing

TonesFly uses on-device speech recognition to convert your imported audio into text for listening practice. All speech recognition and lesson generation run entirely on your device — no audio or transcript data is sent to any external service.

All lesson content is generated and stored on your device.

5b. Automated Processing (GDPR Art. 22)

TonesFly uses on-device automated processing to generate listening practice challenges from your audio. This includes speech recognition, challenge generation, and adaptive pacing. All of this processing runs entirely on your device.

These automated processes help create your learning content but do not produce legal effects. Under GDPR Article 22, you have the right to request human review of any automated processing decision that significantly affects you by contacting [email protected].

For users under the applicable age threshold (13–18 depending on region), optional data collection is disabled entirely.

6. خدمات شخص ثالث

We use the following third-party services to operate and improve the App:

These providers process data under data processing agreements with appropriate safeguards. Our Data Processing Agreement is available at https://tonesfly.com/dpa. Apple handles all subscription billing directly.

7. اشتراک‌گذاری داده

We do not sell, rent, or trade your personal data to third parties. This applies to all users, including California residents.

We may share data with:

Audio, transcripts, and lesson content are processed entirely on your device and are not shared with any third party.

For California residents (CCPA/CPRA): We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not collect or process sensitive personal information as defined by the CPRA, including precise geolocation, racial or ethnic origin, religious beliefs, genetic data, biometric information, or health information. You have the right to know what personal information we collect, request deletion, and opt out of any future sale. Contact [email protected] to exercise these rights.

8. امنیت داده

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/HTTPS). Our server infrastructure is hosted on Cloudflare's global network (Workers, D1, KV) and handles only authentication and subscription management. Audio, transcripts, and lesson content are processed and stored entirely on your device and in your iCloud account — they are never sent to our servers.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Article 33-34.

However, no method of transmission over the internet is 100% secure.

9. نگهداری داده

We retain your data for as long as your account is active or as needed to provide services.

You may request account deletion at any time from Settings > Delete Account. When you request deletion, your account enters a 7-day grace period during which you may cancel by signing in. After the grace period expires, all your data is permanently deleted from our servers. We send email confirmation when deletion is scheduled, a reminder 24 hours before, and confirmation after deletion.

TonesFly cannot delete data stored in your iCloud account. To manage iCloud data, visit Settings > [Your Name] > iCloud on your device.

10. انتقال بین‌المللی داده

Our server infrastructure is hosted on Cloudflare's global edge network, handling only authentication and subscription management. Audio, transcripts, and lesson content are processed and stored entirely on your device and never leave it. Third-party services including Firebase, RevenueCat, and PostHog process account and analytics data in the United States.

Your information may also be accessed from Viet Nam (where the data controller is located) for administrative and development purposes.

For transfers outside the EU/EEA, we rely on:

You may request a copy of the safeguards in place by contacting [email protected]

Japanese residents (APPI): Your account data is transferred to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller) for the purposes described in this policy. Audio and lesson content remain on your device. We ensure appropriate data protection through contractual obligations with all service providers.

Chinese mainland residents (PIPL): Your account information may be transferred outside the People's Republic of China to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). Audio, transcripts, and lesson content remain on your device and are not transferred. By using TonesFly, you consent to this cross-border transfer for the purposes described in Section 4. You may withdraw consent at any time by contacting [email protected], which may affect our ability to provide the service. We conduct personal information protection impact assessments for cross-border transfers as required by PIPL.

South Korean residents (K-PIPA): Your account data is transferred to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). We provide notice of the recipient, purpose, and items of personal information transferred. These transfers are protected by data processing agreements with all service providers.

Brazilian residents (LGPD): Your account data is transferred internationally to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller) for the purposes described in this policy. These transfers are protected by contractual clauses that ensure an adequate level of data protection as required by the LGPD.

Vietnamese residents (PDPD): As the data controller is located in Viet Nam, your personal data is subject to Decree 13/2023/NĐ-CP on personal data protection. Account data may be transferred to the United States for processing by third-party services (Firebase, RevenueCat, PostHog). We conduct data processing impact assessments for cross-border transfers as required by Vietnamese law.

United Kingdom residents (UK GDPR): Your account data is transferred to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). For transfers from the UK, we rely on the International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses, as approved by the UK Information Commissioner's Office (ICO).

Indian residents (DPDP Act 2023): Your account data may be transferred outside India to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). Audio and lesson content remain on your device. We ensure appropriate data protection through contractual obligations with all service providers. Note: Under the DPDP Act, children are defined as individuals under 18 years of age, and verifiable parental consent is required before processing their data.

Indonesian residents (PDP Law 27/2022): Your account data may be transferred outside Indonesia to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller) for the purposes described in this policy. These transfers are protected by data processing agreements ensuring an equivalent level of data protection.

Thai residents (PDPA 2019): Your account data may be transferred outside Thailand to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). We ensure that adequate safeguards are in place as required by the Personal Data Protection Act, including contractual obligations with all service providers.

Turkish residents (KVKK): Your account data may be transferred outside Turkey to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). We rely on your explicit consent or contractual necessity as the legal basis for these cross-border transfers, in accordance with the Law on the Protection of Personal Data (Law No. 6698).

Filipino residents (Data Privacy Act 2012): Your account data may be transferred outside the Philippines to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). These transfers are protected by contractual safeguards ensuring compliance with the Data Privacy Act of 2012 and regulations of the National Privacy Commission (NPC).

Saudi Arabian residents (PDPL 2023): Your account data may be transferred outside the Kingdom of Saudi Arabia to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). We ensure an adequate level of data protection for cross-border transfers as required by the Personal Data Protection Law.

11. حریم خصوصی کودکان

TonesFly از فرآیند تأیید سن برای کمک به رعایت قوانین حریم خصوصی کودکان از جمله COPPA (ایالات متحده) و GDPR (اتحادیه اروپا/EEA) استفاده می‌کند. اگر هنوز این فرآیند را تکمیل نکرده‌اید، اپلیکیشن قبل از فعال‌سازی جمع‌آوری داده‌های اختیاری، تاریخ تولد شما را می‌پرسد. تاریخ تولد دقیق شما به صورت محلی روی دستگاه پردازش می‌شود تا آستانه سنی صحیح تعیین شود؛ ما فقط یک بازه سنی (زیر ۱۳، ۱۳-۱۵، ۱۶-۱۷ یا ۱۸+) را به صورت محلی روی دستگاه ذخیره می‌کنیم، نه روی سرورهایمان.

اگر خود را زیر آستانه سنی قابل اجرا (۱۳ در ایالات متحده و بیشتر کشورها، ۱۳ تا ۱۶ در اتحادیه اروپا/EEA بسته به کشور، ۱۴ در چین و کره جنوبی و ۱۸ در هند) معرفی کنید، جمع‌آوری داده‌های اختیاری — از جمله تحلیل‌ها، گزارش خطا و تشخیص — به‌طور خودکار غیرفعال شده و نمی‌تواند در تنظیمات مجدداً فعال شود.

اگر معتقدید داده‌های کودکی به‌طور اشتباه جمع‌آوری شده، لطفاً با [email protected] تماس بگیرید و ما فوراً آن را حذف خواهیم کرد.

12. حقوق شما

بسته به حوزه قضایی شما، حقوق زیر را دارید:

برای اعمال هر یک از این حقوق، با ما تماس بگیرید از طریق [email protected]، از تنظیمات حریم خصوصی در اپلیکیشن استفاده کنید، یا حساب خود را مستقیماً در تنظیمات > حذف حساب حذف کنید. ما ظرف ۳۰ روز برای درخواست‌های GDPR، ظرف ۴۵ روز برای درخواست‌های CCPA، ظرف دو هفته برای درخواست‌های APPI، ظرف ۱۵ روز کاری برای درخواست‌های PIPL، ظرف ۱۰ روز برای درخواست‌های K-PIPA، ظرف ۱۵ روز برای درخواست‌های LGPD و PDPD، ظرف ۳۰ روز برای درخواست‌های UK GDPR، ظرف ۳۰ روز برای درخواست‌های DPDP، ظرف ۱۴ روز برای درخواست‌های PDP اندونزی، ظرف ۳۰ روز برای درخواست‌های PDPA، ظرف ۳۰ روز برای درخواست‌های KVKK، ظرف ۱۵ روز برای درخواست‌های DPA فیلیپین و ظرف ۳۰ روز برای درخواست‌های PDPL (یا زودتر در صورت الزام قانون) پاسخ خواهیم داد.

13. تغییرات در این سیاست

ما ممکن است این سیاست حفظ حریم خصوصی را گاهی به‌روزرسانی کنیم. ما تغییرات مهم را از طریق اپلیکیشن یا ایمیل حداقل ۳۰ روز قبل از اجرای تغییرات به شما اطلاع خواهیم داد. ادامه استفاده از اپلیکیشن پس از تغییرات به معنای پذیرش سیاست به‌روزرسانی‌شده است.

14. تماس با ما

اگر سؤالی درباره این سیاست حفظ حریم خصوصی دارید یا می‌خواهید حقوق داده‌ای خود را اعمال کنید، لطفاً با ما تماس بگیرید:

Thang Pham (TonesFly)
ایمیل: [email protected]

برای کاربران اتحادیه اروپا/EEA: اگر از پاسخ ما رضایت ندارید، حق دارید شکایتی نزد مقام نظارتی حفاظت از داده‌های محلی خود ثبت کنید.