1. Sisi ni Nani

TonesFly inaendeshwa na Thang Pham ("TonesFly," "sisi," "yetu," au "etu"). Sera hii ya Faragha inaeleza jinsi tunavyokusanya, kutumia, na kulinda taarifa zako unapotumia programu ya simu ya TonesFly ("Programu").

Kwa madhumuni ya GDPR, Thang Pham ndiye mdhibiti wa data. Mawasiliano: [email protected]

2. Taarifa Tunazokusanya

We collect the following types of information:

Account information — your email address, display name, authentication provider, and account/user ID when you create or link an account via Apple Sign-In, Google Sign-In, or email
Audio files — audio files you import into the App for listening practice (processed and stored on-device only; never sent to any server)
Transcripts and lesson data — generated entirely on your device from your imported audio; stored on-device and in iCloud (if enabled) only
Learning data — practice progress, accuracy scores, challenge completion, and streaks stored locally on your device
Device-linked identifiers — a persistent device_id stored in Keychain and sent to our server for account binding and free-tier limit enforcement
Preferences — your native language, stored locally on your device
Device information — device model, operating system version, and app version for diagnostics
Usage analytics — product interaction data used to improve the App; optional analytics are collected only with your consent
Campaign attribution — when you open the App from a marketing link, we may collect anonymous UTM parameters (source, medium, campaign name) to measure marketing effectiveness. These parameters do not contain personally identifiable information and are processed through PostHog subject to your analytics consent

3. Msingi wa Kisheria wa Uchakataji (GDPR)

Tunachakata data yako binafsi kwa misingi ifuatayo ya kisheria:

Utekelezaji wa mkataba (Kifungu 6(1)(b)) — Data ya akaunti, uchakataji wa sauti, na data ya kujifunza ni muhimu kutoa huduma uliyoomba
Maslahi halali (Kifungu 6(1)(f)) — Taarifa za kifaa na uchambuzi usio na utambulisho hutusaidia kudumisha na kuboresha Programu, kuzuia ulaghai, na kuhakikisha usalama
Ridhaa (Kifungu 6(1)(a)) — Uchambuzi usio muhimu (PostHog) unachakatwa tu kwa ridhaa yako, ambayo unaweza kuiondoa wakati wowote kupitia Mipangilio ya Faragha

Unaweza kuondoa ridhaa ya uchambuzi wakati wowote bila kuathiri uhalali wa uchakataji kabla ya kuondolewa.

4. Jinsi Tunavyotumia Taarifa Zako

We use the information we collect to:

Provide, maintain, and improve TonesFly
Process imported audio entirely on your device to generate listening practice challenges
Authenticate your account and manage subscriptions
Enforce the free tier fairly and prevent abuse across multiple accounts on the same device
Process subscriptions and in-app purchases
Send important service updates via email
Respond to support requests
Measure marketing effectiveness using anonymous campaign attribution data from UTM parameters

5. Uchakataji wa Faili za Sauti

Audio is processed entirely on your device and never leaves it.

When you import an audio file:

Speech recognition runs on your device using on-device models
All transcription, lesson generation, and practice content creation happen on your device
No audio, transcripts, or lesson content are sent to any server
Audio files are stored on-device and in iCloud (if enabled) only
Processed challenge data is stored locally on your device and in your iCloud account for offline practice

Automated processing: Speech recognition and challenge generation are fully automated and run entirely on your device. No human reviews your audio or transcripts.

5a. On-Device Processing

TonesFly uses on-device speech recognition to convert your imported audio into text for listening practice. All speech recognition and lesson generation run entirely on your device — no audio or transcript data is sent to any external service.

All lesson content is generated and stored on your device.

5b. Automated Processing (GDPR Art. 22)

TonesFly uses on-device automated processing to generate listening practice challenges from your audio. This includes speech recognition, challenge generation, and adaptive pacing. All of this processing runs entirely on your device.

These automated processes help create your learning content but do not produce legal effects. Under GDPR Article 22, you have the right to request human review of any automated processing decision that significantly affects you by contacting [email protected].

For users under the applicable age threshold (13–18 depending on region), optional data collection is disabled entirely.

6. Huduma za Watu wa Tatu

We use the following third-party services to operate and improve the App:

RevenueCat — subscription and purchase management
PostHog — product analytics (consent-based)
Firebase — authentication and crash reporting
Cloudflare — cloud hosting and edge network services (Workers, D1, KV)
Resend — transactional email delivery

These providers process data under data processing agreements with appropriate safeguards. Our Data Processing Agreement is available at https://tonesfly.com/dpa. Apple handles all subscription billing directly.

7. Ushirikishaji wa Data

We do not sell, rent, or trade your personal data to third parties. This applies to all users, including California residents.

We may share data with:

Cloud hosting and infrastructure providers (for authentication and account management only)
Analytics services (product interaction data, with your consent where required)
Payment processors (Apple handles all subscription billing)
Legal authorities when required by law or to protect our legal rights

Audio, transcripts, and lesson content are processed entirely on your device and are not shared with any third party.

For California residents (CCPA/CPRA): We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not collect or process sensitive personal information as defined by the CPRA, including precise geolocation, racial or ethnic origin, religious beliefs, genetic data, biometric information, or health information. You have the right to know what personal information we collect, request deletion, and opt out of any future sale. Contact [email protected] to exercise these rights.

8. Usalama wa Data

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/HTTPS). Our server infrastructure is hosted on Cloudflare's global network (Workers, D1, KV) and handles only authentication and subscription management. Audio, transcripts, and lesson content are processed and stored entirely on your device and in your iCloud account — they are never sent to our servers.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Article 33-34.

However, no method of transmission over the internet is 100% secure.

9. Uhifadhi wa Data

We retain your data for as long as your account is active or as needed to provide services.

Audio, transcripts, and lesson content: stored on-device and iCloud only. Never sent to our servers.
Account data (email, display name, device_id, subscription status): retained on our servers until account deletion.
Practice data: stored locally on your device; deleted when you remove the app, delete individual lessons, or choose to remove local data.
Analytics data: retained for up to 12 months, subject to your consent settings.

You may request account deletion at any time from Settings > Delete Account. When you request deletion, your account enters a 7-day grace period during which you may cancel by signing in. After the grace period expires, all your data is permanently deleted from our servers. We send email confirmation when deletion is scheduled, a reminder 24 hours before, and confirmation after deletion.

TonesFly cannot delete data stored in your iCloud account. To manage iCloud data, visit Settings > [Your Name] > iCloud on your device.

10. Uhamisho wa Data wa Kimataifa

Our server infrastructure is hosted on Cloudflare's global edge network, handling only authentication and subscription management. Audio, transcripts, and lesson content are processed and stored entirely on your device and never leave it. Third-party services including Firebase, RevenueCat, and PostHog process account and analytics data in the United States.

Your information may also be accessed from Viet Nam (where the data controller is located) for administrative and development purposes.

For transfers outside the EU/EEA, we rely on:

Standard Contractual Clauses (SCCs) approved by the European Commission
Data processing agreements with all third-party service providers
Where applicable, adequacy decisions by the European Commission

You may request a copy of the safeguards in place by contacting [email protected]

Japanese residents (APPI): Your account data is transferred to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller) for the purposes described in this policy. Audio and lesson content remain on your device. We ensure appropriate data protection through contractual obligations with all service providers.

Chinese mainland residents (PIPL): Your account information may be transferred outside the People's Republic of China to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). Audio, transcripts, and lesson content remain on your device and are not transferred. By using TonesFly, you consent to this cross-border transfer for the purposes described in Section 4. You may withdraw consent at any time by contacting [email protected], which may affect our ability to provide the service. We conduct personal information protection impact assessments for cross-border transfers as required by PIPL.

South Korean residents (K-PIPA): Your account data is transferred to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). We provide notice of the recipient, purpose, and items of personal information transferred. These transfers are protected by data processing agreements with all service providers.

Brazilian residents (LGPD): Your account data is transferred internationally to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller) for the purposes described in this policy. These transfers are protected by contractual clauses that ensure an adequate level of data protection as required by the LGPD.

Vietnamese residents (PDPD): As the data controller is located in Viet Nam, your personal data is subject to Decree 13/2023/NĐ-CP on personal data protection. Account data may be transferred to the United States for processing by third-party services (Firebase, RevenueCat, PostHog). We conduct data processing impact assessments for cross-border transfers as required by Vietnamese law.

United Kingdom residents (UK GDPR): Your account data is transferred to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). For transfers from the UK, we rely on the International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses, as approved by the UK Information Commissioner's Office (ICO).

Indian residents (DPDP Act 2023): Your account data may be transferred outside India to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). Audio and lesson content remain on your device. We ensure appropriate data protection through contractual obligations with all service providers. Note: Under the DPDP Act, children are defined as individuals under 18 years of age, and verifiable parental consent is required before processing their data.

Indonesian residents (PDP Law 27/2022): Your account data may be transferred outside Indonesia to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller) for the purposes described in this policy. These transfers are protected by data processing agreements ensuring an equivalent level of data protection.

Thai residents (PDPA 2019): Your account data may be transferred outside Thailand to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). We ensure that adequate safeguards are in place as required by the Personal Data Protection Act, including contractual obligations with all service providers.

Turkish residents (KVKK): Your account data may be transferred outside Turkey to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). We rely on your explicit consent or contractual necessity as the legal basis for these cross-border transfers, in accordance with the Law on the Protection of Personal Data (Law No. 6698).

Filipino residents (Data Privacy Act 2012): Your account data may be transferred outside the Philippines to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). These transfers are protected by contractual safeguards ensuring compliance with the Data Privacy Act of 2012 and regulations of the National Privacy Commission (NPC).

Saudi Arabian residents (PDPL 2023): Your account data may be transferred outside the Kingdom of Saudi Arabia to the United States (Firebase, RevenueCat, PostHog) and Viet Nam (data controller). We ensure an adequate level of data protection for cross-border transfers as required by the Personal Data Protection Law.

11. Faragha ya Watoto

TonesFly inatumia mtiririko wa lango la umri kusaidia kufuata sheria za faragha za watoto ikiwa ni pamoja na COPPA (Marekani) na GDPR (EU/EEA). Ikiwa bado hujakamilisha mtiririko huo, programu itauliza tarehe yako ya kuzaliwa kabla ya ukusanyaji wa data wa hiari kuwezeshwa. Tarehe yako halisi ya kuzaliwa inachakatwa ndani ya kifaa kutambua kizingiti sahihi cha umri; tunahifadhi safu ya umri pekee (chini ya 13, 13-15, 16-17, au 18+) ndani ya kifaa, si kwenye seva zetu.

Ikiwa unajitambulisha kama mtu aliye chini ya kizingiti cha umri kinachotumika (13 nchini Marekani na nchi nyingi, 13-16 katika EU/EEA kulingana na nchi, 14 nchini China na Korea Kusini, na 18 nchini India), ukusanyaji wa data wa hiari — ikiwa ni pamoja na uchambuzi, ripoti za hitilafu, na uchunguzi — unazimwa kiotomatiki na hauwezi kuwashwa tena katika Mipangilio.

Ikiwa unaamini data ya mtoto imekusanywa kwa makosa, tafadhali wasiliana na [email protected] na tutaifuta mara moja.

12. Haki Zako

Kulingana na mamlaka yako, una haki zifuatazo:

Watumiaji wote:

Kufikia data binafsi tunayoshikilia kuhusu wewe
Kuomba marekebisho ya data isiyo sahihi
Kuomba kufutwa kwa data yako
Kusafirisha data yako katika muundo unaobebeka
Kukataa ukusanyaji wa data ya uchambuzi

Wakazi wa EU/EEA (GDPR):

Haki ya kuzuia uchakataji wa data yako
Haki ya kupinga uchakataji unaotegemea maslahi halali
Haki ya kuondoa ridhaa wakati wowote
Haki ya kutokuwa chini ya maamuzi ya kiotomatiki pekee
Haki ya kuwasilisha malalamiko kwa mamlaka yako ya ndani ya ulinzi wa data (mamlaka ya usimamizi)

Wakazi wa California (CCPA/CPRA):

Haki ya kujua taarifa binafsi zinazokusanywa
Haki ya kufuta taarifa binafsi
Haki ya kukataa uuzaji wa taarifa binafsi (hatuuzii data yako)
Haki ya kutobaguliwa kwa kutekeleza haki zako

Wakazi wa Japani (APPI):

Haki ya kuomba ufunuzi wa data binafsi iliyoshikiliwa
Haki ya kuomba marekebisho, nyongeza, au kufutwa
Haki ya kuomba kusitisha matumizi au kufuta
Haki ya kuomba kusitisha utoaji kwa watu wa tatu

Wakazi wa bara la China (PIPL):

Haki ya kujua na kuamua kuhusu uchakataji wa taarifa zako binafsi
Haki ya kufikia na kunakili taarifa zako binafsi
Haki ya kurekebisha au kukamilisha taarifa zisizo sahihi au zisizo kamili
Haki ya kuomba kufutwa kwa taarifa zako binafsi
Haki ya kuondoa ridhaa wakati wowote
Haki ya kuomba maelezo ya kanuni za uchakataji
Haki ya kubebeka kwa data

Wakazi wa Korea Kusini (K-PIPA):

Haki ya kufikia taarifa zako binafsi
Haki ya kuomba marekebisho au kufutwa
Haki ya kuomba kusimamishwa kwa uchakataji
Haki ya kuondoa ridhaa wakati wowote

Wakazi wa Brazili (LGPD):

Haki ya uthibitisho wa uchakataji wa data
Haki ya kufikia data yako binafsi
Haki ya kurekebisha data isiyo kamili, isiyo sahihi, au iliyopitwa na wakati
Haki ya kufanya data isijulikane, kuzuia, au kufuta data isiyohitajika
Haki ya kubebeka kwa data
Haki ya taarifa kuhusu vyombo ambavyo data imeshirikiwa navyo
Haki ya kubatilisha ridhaa wakati wowote

Wakazi wa Viet Nam (PDPD):

Haki ya kujua kuhusu shughuli za uchakataji wa data binafsi
Haki ya ridhaa na kuondoa ridhaa
Haki ya kufikia data yako binafsi
Haki ya kuomba marekebisho ya data yako binafsi
Haki ya kuomba kufutwa kwa data yako binafsi
Haki ya kuzuia uchakataji wa data
Haki ya kubebeka kwa data

Wakazi wa Ufalme wa Muungano (UK GDPR):

Haki ya kufikia data yako binafsi
Haki ya kurekebisha data isiyo sahihi
Haki ya kufuta data yako
Haki ya kuzuia uchakataji
Haki ya kubebeka kwa data
Haki ya kupinga uchakataji
Haki ya kuondoa ridhaa wakati wowote
Haki ya kutokuwa chini ya maamuzi ya kiotomatiki pekee
Haki ya kuwasilisha malalamiko kwa Ofisi ya Kamishna wa Taarifa (ICO)

Wakazi wa India (Sheria ya DPDP 2023):

Haki ya kufikia taarifa kuhusu data yako binafsi
Haki ya marekebisho na kufutwa kwa data binafsi
Haki ya kutatuliwa kwa malalamiko
Haki ya kuteua mwakilishi kutekeleza haki kwa niaba yako

Wakazi wa Indonesia (Sheria ya PDP 27/2022):

Haki ya kujulishwa kuhusu uchakataji wa data
Haki ya kufikia data yako binafsi
Haki ya kurekebisha data isiyo sahihi
Haki ya kuomba kufutwa kwa data yako binafsi
Haki ya kuondoa ridhaa wakati wowote
Haki ya kubebeka kwa data

Wakazi wa Thailandi (PDPA 2019):

Haki ya kufikia data yako binafsi
Haki ya kurekebisha data isiyo sahihi
Haki ya kuomba kufutwa au kufanywa isijulikane
Haki ya kuzuia uchakataji
Haki ya kubebeka kwa data
Haki ya kupinga uchakataji
Haki ya kuondoa ridhaa wakati wowote
Haki ya kuwasilisha malalamiko kwa Kamati ya Ulinzi wa Data Binafsi (PDPC)

Wakazi wa Uturuki (KVKK):

Haki ya kujua kama data yako binafsi inachakatwa
Haki ya kuomba taarifa kuhusu uchakataji
Haki ya kujua madhumuni ya uchakataji
Haki ya kurekebisha data isiyo kamili au isiyo sahihi
Haki ya kuomba kufutwa au kuharibiwa kwa data binafsi
Haki ya kupinga uchakataji
Haki ya kubebeka kwa data
Haki ya kuwasilisha malalamiko kwa Mamlaka ya Ulinzi wa Data Binafsi (Bodi ya KVKK)

Wakazi wa Ufilipino (Sheria ya Faragha ya Data 2012):

Haki ya kujulishwa kuhusu uchakataji wa data
Haki ya kufikia data yako binafsi
Haki ya kurekebisha data isiyo sahihi
Haki ya kuomba kufutwa au kuzuiwa kwa data
Haki ya kupinga uchakataji
Haki ya kubebeka kwa data
Haki ya kuwasilisha malalamiko kwa Tume ya Kitaifa ya Faragha (NPC)

Wakazi wa Saudi Arabia (PDPL 2023):

Haki ya kujulishwa kuhusu uchakataji wa data
Haki ya kufikia data yako binafsi
Haki ya kurekebisha data isiyo sahihi
Haki ya kuomba kufutwa kwa data binafsi
Haki ya kuzuia uchakataji
Haki ya kubebeka kwa data

Kutekeleza haki yoyote kati ya hizi, wasiliana nasi kwa [email protected], tumia Mipangilio ya Faragha katika Programu, au futa akaunti yako moja kwa moja katika Mipangilio > Futa Akaunti. Tutajibu ndani ya siku 30 kwa maombi ya GDPR, ndani ya siku 45 kwa maombi ya CCPA, ndani ya wiki mbili kwa maombi ya APPI, ndani ya siku 15 za kazi kwa maombi ya PIPL, ndani ya siku 10 kwa maombi ya K-PIPA, ndani ya siku 15 kwa maombi ya LGPD na PDPD, ndani ya siku 30 kwa maombi ya UK GDPR, ndani ya siku 30 kwa maombi ya DPDP, ndani ya siku 14 kwa maombi ya PDP ya Indonesia, ndani ya siku 30 kwa maombi ya PDPA, ndani ya siku 30 kwa maombi ya KVKK, ndani ya siku 15 kwa maombi ya DPA ya Ufilipino, na ndani ya siku 30 kwa maombi ya PDPL (au mapema zaidi inapohitajika na sheria).

13. Mabadiliko ya Sera Hii

Tunaweza kusasisha Sera hii ya Faragha mara kwa mara. Tutakujulisha kuhusu mabadiliko muhimu kupitia Programu au kwa barua pepe angalau siku 30 kabla ya mabadiliko kuanza kutumika. Kuendelea kwako kutumia Programu baada ya mabadiliko kunajumuisha kukubali sera iliyosasishwa.

14. Wasiliana Nasi

Ikiwa una maswali kuhusu Sera hii ya Faragha au ungependa kutekeleza haki zako za data, tafadhali wasiliana nasi kwa:

Thang Pham (TonesFly)
Barua pepe: [email protected]

Kwa watumiaji wa EU/EEA: Ikiwa hujaridhika na jibu letu, una haki ya kuwasilisha malalamiko kwa mamlaka yako ya ndani ya usimamizi wa ulinzi wa data.

Sera ya Faragha