Privacy Policy | ToneForge

1. Scope and Applicability

This Policy applies to Personal Information that we process as a business or controller (or analogous role) under applicable data-protection laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the EU General Data Protection Regulation ("GDPR"), the UK GDPR, Canada's PIPEDA, and comparable U.S. state and non-U.S. privacy regimes (collectively, the "Privacy Laws").

This Policy does not apply to (a) information processed by third parties we do not control, including Apple, Google, and OpenAI, except as expressly described below; or (b) information that has been deidentified or aggregated so that it can no longer reasonably be linked to you.

2. Definitions

"Personal Information" means information that identifies, relates to, describes, or could reasonably be linked with a particular natural person, as defined under applicable Privacy Laws. "Process" means any operation performed on Personal Information, whether or not by automated means.

3. Information We Collect

We collect only what the app needs to function. Specifically:

3.1 Account and Authentication Information

You create an account in one of three ways:

Sign in with Apple. We receive an Apple-issued identifier and your email address. If you choose Apple's "Hide My Email" option, we receive only a private relay address and never see your real email.

Email and password. Your password is handled entirely by our authentication provider, Supabase, and is stored only as a salted cryptographic hash. We never receive, see, or store your password in plaintext, and we cannot recover it.

3.2 Profile Information

Username, display name, chosen instrument, daily practice goal in minutes, profile photo (if you upload one), your private-profile setting, and whether you identified yourself as a beginner during onboarding.

3.3 Practice and Progression Data

Your AMA rating and its history over time, skill tier, current and longest practice streak, date of your last practice session, lifetime practice minutes, count of pieces mastered, and your provisional-rating status.

3.4 Practice Sessions

For each session you log: the date, the duration in minutes, and any free-text notes you write. Session notes are free-text fields — please do not enter sensitive personal information in them.

3.5 Tasks, Repertoire, and Lessons

Practice tasks (title, category, status, notes, dates, and whether the task was created by you or generated by AI); repertoire entries (piece name, composer, status, and difficulty); AI-generated daily practice plans; AI-generated piece practice breakdowns; and, for beginners, Foundations lesson progress including cached lesson content and whether you passed each knowledge check.

3.6 Social Information

Friend relationships and their status (pending or accepted), group challenges you create or join, and your per-challenge practice minutes and best streak.

3.7 AI Consent Record

Whether you have permitted us to share practice context with our AI provider, and server-generated timestamps recording when you granted and, if applicable, when you withdrew that permission. We keep this because it is the record of your consent; we cannot rely on your permission without being able to show it.

3.8 AI Usage Metadata

For each AI request: the type of request, a timestamp, and a salted SHA-256 hash of your IP address. We use this hash solely to enforce per-user and per-address rate limits that protect the service from abuse. We do not store your raw IP address, and the hash cannot be practically reversed to recover it.

3.9 Information Stored on Your Device

Your authentication session tokens are stored encrypted using an AES-256 key held in the iOS Keychain; only the encrypted form is written to app storage. We also store non-sensitive local state on your device, such as cooldown timestamps and cached content, to reduce unnecessary network requests.

3.10 Notifications

Notifications are off unless you turn them on. Nothing described in this subsection happens until you accept the iOS permission prompt.

What we store. For each device you turn notifications on from, we store an Apple Push Notification service ("APNs") device token, the platform, which APNs environment that token belongs to, and when the record was last updated. We also store your notification settings: the master switch, a separate switch for each kind of notification, the hour you chose for your daily reminder, and your device's time zone as an IANA name such as America/New_York. The time zone is what lets a reminder arrive in your evening rather than ours. It is a clock setting rather than a location fix — it does not tell us where you are, and we use it only to decide when to send.

What we queue. Each notification we intend to send is written to a server-side queue as a row holding your account identifier, the kind of notification, its title and body text, the screen it should open, and its delivery status and timestamps. Those rows are how we apply the sending limits described below and how we avoid sending you the same thing twice. They are readable only by you and by our server, and no client can write them.

What a notification contains. Practice notifications are assembled from data you have already given us — your instrument, your daily goal, the minutes you logged today, and your current streak. Friend and challenge notifications carry the display name of the person who added you or invited you. We never put your email address, your session notes, your tasks, or your AI coach conversations into a notification.

Apple receives this. Delivering a push notification necessarily means handing Apple your device token together with that notification's title and body. Apple is the only route to your device, and its handling of that data is governed by Apple's own privacy policy. Notification content goes to no other third party, and tokens are never used for advertising, never shared with other users, and never sold.

How much we send. At most two practice notifications per local day. Friend requests, friend acceptances, and challenge invitations are not counted against that limit, because they are person-to-person and time-sensitive. Nothing is sent between 9:30pm and 8:00am in your local time zone: a practice reminder that comes due inside that window is dropped, and a social one waits until 8:00am.

Turning it off, and deletion. You can turn notifications off at any time in Profile → Settings → Notifications, and you can revoke permission entirely in the iOS Settings app. Turning them off in ToneForge deletes that device's token immediately. We also delete a token when Apple tells us it is no longer deliverable — for example because you removed the app from that device — and your tokens, your notification settings, and any notifications still queued for you are deleted when you delete your account.

3.11 What We Do NOT Collect

To be explicit, ToneForge does not collect: precise or coarse geolocation (the time zone described in Section 3.10 is a clock setting, not a location fix, and we derive nothing else from it); your contacts; health or fitness data; biometric data; payment or financial information (the app is free and contains no purchases); advertising identifiers or cross-app tracking data; audio recordings or microphone input; or camera input. If you upload a profile photo, we access only the single image you select from your photo library — we never browse or upload your library.

We do not knowingly collect Sensitive Personal Information, and you should not transmit it through the Services.

4. Sources of Information

We collect information (a) directly from you, when you register, complete onboarding, edit your profile, log sessions, create tasks, or chat with the AI coach; (b) from Apple or Google, when you use their sign-in services; (c) automatically from your device, limited to the AI usage metadata described in Section 3.8 and — only if you turn notifications on — the push token and time zone described in Section 3.10; and (d) from Apple's push service, when it tells us that a device token we hold is no longer deliverable.

We do not purchase Personal Information, and we do not scrape or enrich your profile from external sources.

5. How and Why We Use Information

We process Personal Information to:

Provide, operate, maintain, and secure the Services (contract; legitimate interests)
Authenticate you and manage your account (contract; legal obligation)
Calculate your AMA rating, streaks, rings, and progression (contract)
Generate personalized practice plans, piece breakdowns, beginner lessons, and coaching responses appropriate to your level, which requires sharing context with our AI provider (consent — see Section 6; withdrawable at any time)
Operate friends, leaderboards, and group challenges (contract)
Enforce rate limits and detect, prevent, and respond to abuse, fraud, and security incidents (legitimate interests; legal obligation)
Communicate with you about the Services, including security and transactional notices (legitimate interests)
Send the practice reminders and friend-activity notifications you asked for, and apply the limits that keep them infrequent (consent — see Section 3.10; withdrawable at any time)
Comply with law and establish, exercise, or defend legal claims (legal obligation; legitimate interests)

Where we rely on legitimate interests, we have determined that those interests are not overridden by your rights and freedoms. You may object as described in Section 9.

6. Artificial Intelligence

This Section is the detailed disclosure of how ToneForge uses AI, what leaves our systems, what you are consenting to, and how to stop it.

6.1 You Are Interacting With an AI, Not a Person

ToneForge's coach, daily plans, piece breakdowns, and Foundations lessons are generated by an artificial-intelligence system. No human teacher reads your messages or writes the replies. The coach is software. It has no feelings, no memory of you outside the data described below, and no professional qualifications. We tell you this before your first exchange, in the app as well as here, and the coach is instructed never to claim to be human.

6.2 The Provider and the Model

AI features are powered by OpenAI, L.L.C. ("OpenAI"), using the GPT-5 model. OpenAI acts as our service provider / processor for this purpose.

All AI requests are made from our secure server, never from your device. The API key never ships inside the app, and your device never contacts OpenAI directly.

6.3 Your Consent Is Required, and It Is Separate

We do not send anything to OpenAI unless you have separately and explicitly agreed to it. During onboarding you are shown a dedicated screen — not a checkbox buried in these documents — that names OpenAI, itemises exactly what would be transmitted, and asks you to choose. Declining is a real option: practice logging, tasks, rings, streaks, the calendar, friends, leaderboards, and challenges all work without AI.

Your decision is recorded on your profile (ai_consent) together with a server-generated timestamp. Our server checks that record on every single AI request and refuses the request if permission is absent or has been withdrawn.

6.4 Exactly What We Send

When you use an AI feature, we transmit only the context needed to produce a useful, level-appropriate response:

Your display name, instrument, and daily practice goal
Your AMA rating, skill tier, current streak, and the date you last practiced
The names and composers of pieces in your repertoire
Summary statistics about your recent sessions (counts and averages only)
The titles and categories of your incomplete tasks
For the AI coach, the messages in that conversation

We do not transmit your email address, your password, your raw IP address, your friends list, your session notes, your location, or any information about other users.

All text you supply is wrapped in explicit delimiters and passed as data, never as instructions, so that user-supplied content cannot alter the AI's behavior.

6.5 What OpenAI Does and Does Not Do With It

Your inputs are sent under OpenAI's API terms, which provide that:

Data submitted through the API is not used to train or improve OpenAI's models.
Inputs and outputs may be retained by OpenAI for up to 30 days to provide the service and to detect abuse, after which they are deleted, unless OpenAI is legally required to retain them.

We do not sell AI inputs or outputs, do not use them for advertising, and do not use them to train any model of our own.

6.6 Withdrawing Your Consent

You may withdraw permission at any time from Profile → Settings → AI features. Withdrawal takes effect on the next request — not the next session — because the check is server-side and re-read every time. After withdrawal, no further data is sent to OpenAI. Withdrawal does not affect the lawfulness of processing carried out beforehand, and it does not delete AI-generated content already saved to your account, which you can delete yourself.

Turning AI off does not disable the rest of the app.

6.7 Limits of AI Output — Please Read

AI output may be inaccurate, incomplete, or unsuitable. It is generated by a probabilistic model and is not professional musical instruction, medical advice, physical-therapy advice, mental-health care, or a substitute for a qualified teacher or clinician. You remain responsible for evaluating any practice suggestion before acting on it, and for stopping any activity that causes pain or discomfort.

The coach is not a counsellor and must not be used as one. It is scope-restricted to music practice. If a message indicates a risk of self-harm, ToneForge does not send that message to OpenAI at all — it is stopped on your device — and the app responds with crisis-support resources instead. Those messages are not logged, not stored, and not transmitted anywhere. If you are in crisis, please contact a local emergency number or a crisis line rather than an app.

6.8 Automated Decisions and Profiling

ToneForge calculates your AMA rating, tier, streaks, and ring progress automatically from data you enter. This is automated processing, and we describe it plainly so you can judge it:

It affects only your experience inside ToneForge — what the app suggests you practice and where you appear on a voluntary leaderboard.
It produces no legal effects and no similarly significant effects on you. It is not used for any decision about credit, finance, housing, insurance, employment, education enrolment, healthcare, or access to any essential service, and we do not use it, or any AI output, to make such decisions.
We do not sell it, and we do not use it to profile you for advertising.
The rules are published in these documents rather than hidden: lower ratings gain faster, inactivity decays a rating, and the first seven days count triple.

Because it does not produce legal or similarly significant effects, the opt-out rights that attach to automated decision-making under the CCPA/CPRA's ADMT rules, Article 22 of the GDPR, and comparable state statutes are not triggered. You may still contact us with any question or objection about how a rating was reached, and a human will look at it.

6.9 Age

AI features are available only to account holders, who must be at least 13 (see Section 12). We do not knowingly provide AI features to children under 13.

We share Personal Information only as described here. We do not sell or share your Personal Information as those terms are defined under the CCPA/CPRA. We do not engage in targeted or cross-context behavioral advertising. We do not disclose your information to data brokers or advertisers.

Supabase — our database, authentication, file storage, and server-function provider, hosting your data in the United States (us-east-1).
OpenAI — receives only the AI context itemised in Section 6.4, and only if you have granted the separate permission described in Section 6.3. OpenAI does not use it to train its models and deletes it within 30 days.
Apple — for Sign in with Apple, if you choose it; and, if you have turned notifications on, Apple's Push Notification service receives your device token together with the title and body of each notification we send you, because that is the only way to deliver one (Section 3.10).
Google — only for Sign in with Google, if you choose it.
Expo / Expo Application Services — application build and distribution infrastructure.
Other ToneForge users — as described in Section 8.
Legal and safety — courts, regulators, or law enforcement where we reasonably believe disclosure is required by law or necessary to protect the rights, property, or safety of ToneForge, our users, or the public.
Successors — in connection with a merger, acquisition, or transfer of the Services, in which case we will notify you and this Policy will continue to apply until superseded.

8. Information Visible to Other Users

ToneForge includes social features. Please read this section carefully.

Public profiles (the default). If your profile is not set to private, any signed-in ToneForge user can see your username, display name, instrument, AMA rating, streak, lifetime practice minutes, pieces mastered, profile photo, and join date.

Private profiles. If you enable "Private profile" in your settings, only users you have accepted as friends can see the information above. Other users can still find you by username and see your display name and profile photo, so that they are able to send you a friend request — similar to a private social-media account.

Profile photos are stored in a public storage bucket. This means a profile photo you upload is reachable by its direct URL by anyone who has that URL, even if your profile is set to private. If this concerns you, do not upload a profile photo.

Friends and challenges. Accepted friends can see your practice statistics on your shared leaderboard. Participants in a group challenge can see the practice minutes and best streak of other participants in that challenge.

Notifications name you. If you send a friend request, accept one, or add someone to a group challenge, and that person has notifications turned on, the notification delivered to their device contains your display name.

Always private. Your email address, your session notes, your tasks, your AI coach conversations, your daily practice plans, your Foundations lesson progress, your notification settings, and your time zone are never visible to other users.

9. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your Personal Information; to object to processing based on legitimate interests; to withdraw consent; and to lodge a complaint with a supervisory authority. You will never be discriminated against for exercising these rights.

Deleting your account. You can delete your account at any time from Profile → Settings → Delete account. This permanently deletes your authentication record and, by database cascade, your profile, sessions, tasks, pieces, practice plans, lesson progress, friendships, challenge participation, AI usage records, push notification tokens, notification settings, and any notifications still queued for you. This action is immediate and cannot be undone.

Withdrawing AI consent. You can turn AI features off at any time from Profile → Settings → AI features, without deleting your account and without losing any other feature. See Section 6.6.

Other requests. To exercise any other right, contact us at the address in Section 15. We will respond within the period required by applicable law. We may need to verify your identity before acting.

10. Data Retention

We retain your Personal Information for as long as your account remains active. When you delete your account, the associated data is deleted as described in Section 9. We may retain limited records where necessary to comply with legal obligations, resolve disputes, or enforce our agreements — for example, the record of your Terms acceptance and your AI-consent decisions, which exist to evidence permissions you gave us. Sent and skipped notification rows are kept as a short operational record of what we delivered to you, and are deleted with your account. Deidentified and aggregated data, which cannot be linked back to you, may be retained indefinitely.

11. Security

We implement administrative and technical safeguards designed to protect your information, including: encryption in transit; encryption of authentication tokens at rest using the iOS Keychain; database Row Level Security policies that restrict every record to its owner and to those you have explicitly shared it with; server-side enforcement of all rating and progression data so it cannot be altered from a device; storage of the AI provider key exclusively on our server; a notification queue that no client is permitted to write to, so nobody can address a notification to another user; and per-user and per-address rate limiting.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

12. Children's Privacy

The Services are intended for users 13 years of age and older (or 16 where required by local law, including in parts of the European Economic Area). We do not knowingly collect Personal Information from children under 13. If you believe a child under 13 has provided us information, contact us and we will delete it promptly.

13. International Transfers

We process and store information in the United States. If you use the Services from outside the United States, you acknowledge that your information will be transferred to and processed in the United States, whose data-protection laws may differ from those of your jurisdiction. Where required for transfers from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

14. State-Specific Disclosures

California residents may request the categories and specific pieces of Personal Information we have collected, the sources, the purposes, and the categories of third parties to whom it was disclosed, twice per twelve-month period and free of charge. We do not "sell" or "share" Personal Information for cross-context behavioral advertising.

California residents also have rights concerning automated decision-making technology. As explained in Section 6.8, we do not use automated processing to make decisions that produce legal or similarly significant effects, so those opt-out rights are not triggered here.

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy statutes have substantially similar rights, including rights concerning profiling, exercisable by contacting us as set forth below.

EU and UK users: ToneForge's AI features are provided under Article 50 of Regulation (EU) 2024/1689 (the EU AI Act) as a system that interacts directly with natural persons. You are informed of that fact in the app before your first exchange, and again in Section 6.1 above. ToneForge does not use emotion recognition, biometric categorisation, or deepfake generation of any kind.

15. Contact

Questions, requests, or complaints regarding this Policy:

ToneForge
Attn: Privacy
Email: vnevdev@gmail.com

EEA and UK users may also lodge a complaint with their local data-protection authority.

16. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last Updated" date above and, where required by law, provide additional notice. Material changes affecting how we use your information will be communicated before they take effect. Your continued use of the Services after an update constitutes acceptance of the revised Policy.

17. Governing Law and Severability

This Policy is governed by the laws of the Commonwealth of Pennsylvania, without regard to conflict-of-laws principles, except to the extent superseded by mandatory provisions of applicable Privacy Laws. If any provision is held invalid or unenforceable, the remaining provisions remain in full force and effect.

ToneForge: AI Music Coach Privacy Policy