Privacy Policy

What changed later on October 20, 2026. We added "Advertising on Meta" (part E of "The Website") and "Ad measurement on Android", which say how the Website shares some personal information with Meta, and the Android app from version 7.0367 with Google and Meta through AppsFlyer, Our ad measurement company (and with Google also through Google Analytics for Firebase), to measure and show Our ads, and how to turn this off. We updated the parts of this policy that these change, and corrected what it said about the advertising ID in earlier versions of the Android app. Nothing else changed.

What changed on October 20, 2026. In "The Website", part C, We now say that when You agree to the automatic renewal before buying Premium on the Website, We keep a record of that agreement, what it holds, where it is kept and for how long. That record is also named where this policy lists how long the Website keeps data, what deleting Your Account or Your data does, what RevenueCat and Stripe receive, the GDPR legal bases and the California categories. We also added a line saying how long each California category is kept, corrected a cross-reference in "How long the Website keeps it", corrected how the iOS app asks about usage data (a "Share usage data?" question after setup, not the first screen), and corrected what deleting Your customer record at RevenueCat does to a running Website Subscription (it does not cancel it). Nothing else changed.

What changed on October 18, 2026. This policy now also covers Binaural Beats on the web, at listen.mellotonestudios.com (the "Website"): its optional sign-in, buying Premium on the Website in the United States and its territories, and the usage analytics and error reports it collects under the privacy rule of the country You are in. See "The Website" below. What the Application collects has not changed.

What changed on October 13, 2026. The Android app's analytics service, Google Analytics for Firebase, is now used to measure Our own ads for the Application on Google: Google Ads receives app events such as installs, free trial starts and purchases, so We can see which of Our ads lead to subscriptions. No name, email address or advertising ID is included, and the Application still shows no ads. Our Firebase project has been linked to Google Ads since September 2026, and the previous version of this policy did not say so.

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy. On iOS, analytics and crash reporting start only after You agree to them in the Application, and You can turn them off at any time (see "Your Choices About Analytics" below). On the Website, it depends on where You are (see "The Website" below).

The short version: the Application has no user accounts and does not ask for Your name, email address, or phone number. On the Website, signing in is optional and needed only to buy and use Premium there; if You sign in, We keep Your email address with Your Account. The Application and the Website show no advertising, and We do not sell Your personal information for money. To measure and show Our own ads, the Website shares some personal information with Meta, and the Android app, from version 7.0367, shares some with Google and Meta, through AppsFlyer, Our ad measurement company, and with Google also through Google Analytics for Firebase. Some US state laws treat this as sharing or as a sale, and You can turn it off at any time (see "Advertising on Meta" in "The Website", and "Ad measurement on Android"). Apart from a Website Account and any email You send Us, the data We work with is pseudonymous usage and purchase information used to run and improve the Service and to measure and show Our ads.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

Account means an optional account You can create on the Website, with Google or with an email address and password. The Application has no accounts.
Application refers to the Company's binaural beats app for Android and iOS: Binaural Beats Brainwaves on Google Play, and Binaural Beats Sleep & Focus on the App Store (shown as Binaural Beats Brainwaves on the iPhone home screen).
Business, for the purpose of CCPA/CPRA, refers to the Company as the legal entity that collects Consumers' personal information and determines the purposes and means of the processing of Consumers' personal information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the State of California.
CCPA and/or CPRA refers to the California Consumer Privacy Act (the "CCPA") as amended by the California Privacy Rights Act of 2020 (the "CPRA").
Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to MelloTone Studios LLC, 422 S Main Street #1129, Lombard, IL 60148, United States.

For the purpose of the GDPR, the Company is the Data Controller.
Consumer, for the purpose of the CCPA/CPRA, means a natural person who is a California resident. A resident, as defined in the law, includes (1) every individual who is in the USA for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the USA who is outside the USA for a temporary or transitory purpose.
Country refers to: Illinois, United States
Data Controller, for the purposes of the GDPR (General Data Protection Regulation), refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
Do Not Track (DNT) is a concept that has been promoted by US regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites.
GDPR refers to EU General Data Protection Regulation.
Personal Data is any information that relates to an identified or identifiable individual.

For the purposes of GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.

For the purposes of the CCPA/CPRA, Personal Data means any information that identifies, relates to, describes or is capable of being associated with, or could reasonably be linked, directly or indirectly, with You.
Service refers to the Application and the Website.
Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used. For the purpose of the GDPR, Service Providers are considered Data Processors.
Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
Website refers to the Company's Binaural Beats web app, at https://listen.mellotonestudios.com.
You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Under GDPR, You can be referred to as the Data Subject or as the User as you are the individual using the Service.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

The Application does not require You to create an account, and it does not collect Your name, email address (unless You email Us, as described below), phone number, contacts, photos, or precise location. On the Website, an optional Account holds Your email address and, if You sign in with Google, the name on Your Google account (see "The Website" below). The information collected while using Our Service is limited to:

Usage Data
Information collected while using the Application (described below)
Information collected on the Website, including Your email address if You create an Account (described in "The Website" below)

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), the type of mobile device You use, Your mobile operating system, device language, the screens of our Service that You visit, the features and sounds You use, the time and date of Your visit, the time spent in the Application, unique device identifiers and other diagnostic data.

Our analytics providers may infer an approximate region (such as country or city) from Your IP address. The Application itself never accesses Your Device's location. The Application also sends Your Device's country, language and time zone settings when it asks Firebase Remote Config for its app text (on Android at every launch; on iOS for the onboarding text, before setup is finished).

Information Collected while Using the Application

While using Our Application, the following information is collected in order to provide and improve features of Our Service:

App identifiers. Pseudonymous identifiers created for analytics and subscription management. The main one is a random ID the Application creates on Your Device, which the Application's Settings show as Your Support ID. The Support ID is the same ID that Mixpanel, Google Analytics for Firebase and RevenueCat use for Your installation. It has no name or email address attached, but the usage, purchase and diagnostic data described in this policy is stored against it. Our Service Providers also create their own app-instance IDs. On iOS, Your Device's identifier for vendor (an Apple ID specific to Our apps on Your Device) is sent to RevenueCat and collected by Google Analytics for Firebase. The iOS app has never used Apple's advertising identifier (IDFA). On Android, earlier versions of the Application also collected the Google Advertising ID. Some versions released before August 2024 included Google's AdMob, which used it to show ads; after that, We used it only as an analytics identifier, and later versions stopped collecting it. From version 7.0367, the Android app collects it again, only while Ad measurement is on, to measure Our ads and to let Google and Meta use it to choose who sees them, and AppsFlyer, Our ad measurement company, creates its own AppsFlyer ID for Your installation (see "Ad measurement on Android" below). You can reset or delete Your Device's advertising identifier at any time in Your Device settings.
In-app selections. The wellness goals You choose during onboarding (for example sleep, anxiety relief, or focus), used to order content suggestions inside the Application and included in the pseudonymous usage analytics described in this policy, so We can understand which goals matter to Our users and improve the Application. We do not use these selections to draw health or medical inferences about You. If You choose "Something else", what You type there (up to 20 characters) is sent as typed with that answer. On iOS, this is the only text You type that leaves Your Device: names You give to Your own creations are not sent, and searches are recorded by the length of what You type, never the words. On Android, the words You type into search are included in search analytics.
Purchase and subscription state. Whether You have an active subscription or purchase, so the Application can unlock what You have paid for. Payments are processed by Google Play on Android and by Apple's App Store on iOS; We never see or store Your payment card details.
Crash, performance and diagnostic data. If the Application crashes or malfunctions, technical information about the crash or error (such as device state, stack traces and error messages) is collected so We can find and fix the problem. On iOS, the Application also sends daily performance summaries that Apple's MetricKit prepares on Your Device: launch, resume and hang times, memory and CPU use, background audio time, and counts of exits and crashes. On Android, the Application sends app start, screen and network timings through Firebase Performance Monitoring, and a record of each time the system closed the Application (the reason, and whether the Device was low on memory).
Anonymous play counts and quote likes. When You play a beat or sound, or like a quote, a counter for that item is updated on Our servers through Firebase Cloud Functions, so everyone can see the most-played content. The request carries the item's ID and no ID tied to You. Both apps do this whatever Your analytics choice.
Support emails. If You email Us, We receive Your email address and whatever You write or attach, including the app details (such as app version and device model) the Application offers to add if You choose. We use them only to answer You.

This information may be uploaded to the Company's servers and/or a Service Provider's server or it may be simply stored on Your device.

Ad measurement on Android

From version 7.0367, the Android app measures which of Our ads lead people to install it and subscribe, with the help of AppsFlyer, Inc. ("AppsFlyer"), an ad measurement company. We advertise the Application on Google and on Facebook and Instagram, which are run by Meta Platforms, Inc. (in the European Union, the European Economic Area and Switzerland, Meta Platforms Ireland Limited) ("Meta"). The Application still shows no ads. Android versions before 7.0367, and the iOS app, contain no AppsFlyer code and have no such switches.

What is collected, and who receives it. While Ad measurement is on (see "Your choices" below):

AppsFlyer's code in the Application receives Your Device's advertising ID, Your Support ID (so that AppsFlyer's records can be matched to Ours), the AppsFlyer ID it creates for Your installation, Your IP address, how You installed the Application, the install itself and each time You open the Application. AppsFlyer's code may also collect technical details of Your Device, such as its model, operating system version and language. The Application does not let it collect Your Device's Android ID or its app set ID.
RevenueCat, which manages Our subscriptions, may report Your free trial starts and purchases to AppsFlyer under the AppsFlyer ID, so that they can be counted against the ad that led to the install.
AppsFlyer may pass these events, with the advertising ID, to Google and Meta, so that they can measure Our ads and, as described below, choose who sees Our ads on their apps and sites.
Google Analytics for Firebase also reads the advertising ID, and Google can use the Application's events for Our ads as described in "Google Analytics for Firebase" below.
The Application reads Google Play's record of how it was installed (from the store, a Google ad, a Meta ad or one of Our links, and the campaign code of that link), and AppsFlyer tells it, for an install from a Google ad, the names or numbers of that ad's campaign, ad group, ad, keyword and creative. The Application keeps these with Your customer record at RevenueCat, together with the AppsFlyer ID, and adds how it was installed and the campaign code to Our analytics (Google Analytics for Firebase and Mixpanel). Before any of these values is kept, the Application drops it if it contains one of a fixed list of words about health, sleep, focus, relaxation, mood, pain and some conditions (such as anxiety, insomnia or migraine). AppsFlyer, Google and Meta still hold the names of Our campaigns and ads as We set them up.

AppsFlyer never receives from the Application the goal You pick, what You play or what You search for. The Application contains no Meta software development kit and no code from Meta that sends data: what Meta receives about the Application comes through AppsFlyer. The Application keeps a record of each choice You make about ad measurement (which switches are on, where You made the choice and which version of the wording You saw) on Your Device and in Our analytics (Google Analytics for Firebase and Mixpanel), so that We can show what You chose.

Where You are.

In the European Economic Area, the United Kingdom, Switzerland and nearby territories and small states (such as Gibraltar, Monaco and Andorra), the Application asks first. On a new install, right after the first welcome screen, a screen titled "We value your privacy" offers "Reject all", "Accept all" and "Customize". "Customize" opens Privacy preferences, with an Ad measurement switch and an Ad personalization switch, both off, and "Save my preferences". If You leave the screen without answering, nothing is turned on. From the moment the Application knows You are in this group, nothing is sent to AppsFlyer, and Google Analytics for Firebase is told not to collect the advertising ID or use the Application's data for advertising, until You accept. The Application counts Your phone as in this group if Your Google Play account's country or Your phone's time zone is in it, or, when the Google Play country is not known, Your phone's region setting is; if it can read none of these, it asks too. We may also ask first in other countries. Our legal basis there is Your consent.
Everywhere else, on a new install, Ad measurement and Ad personalization are on from the first time You open the Application, and You can turn either off at any time.
If You finished the Application's setup in a version before 7.0367, both stay off after the update, in every country, unless You turn them on yourself.

Your choices. In the Application's Settings, under About, "Privacy preferences" (just above "Privacy policy") has both switches, in every country. A change there is saved at once, "Reject all" turns both off, and the Application works the same either way.

Turning Ad measurement off stops AppsFlyer from collecting or sending anything more from the Application, tells Google Analytics for Firebase to stop collecting the advertising ID and stop using the Application's data for advertising, asks RevenueCat to remove the AppsFlyer ID from Your customer record, and tells RevenueCat not to let AppsFlyer pass Your purchases on to any ad network. With Ad measurement off, the Ad personalization switch has no effect.
Turning Ad personalization off tells Google Analytics for Firebase that Google may not use the Application's data to choose who sees ads. In the places where the Application asks first, AppsFlyer is told the same. Everywhere else, turning Ad personalization off reaches Google Analytics for Firebase only: while Ad measurement is on, AppsFlyer can keep passing events to Google and Meta, and they may still use them to choose who sees Our ads. To stop that, turn Ad measurement off. Turning Ad measurement off is also how You opt out of the Application's sale or sharing of Your personal information, and of targeted advertising, under US state privacy laws. To make any other request under Your state's privacy law, or to appeal Our answer, see "The Website", part D, which applies to the Application too.

Turning a switch off does not delete what AppsFlyer, Google or Meta have already received. What RevenueCat holds about how You installed the Application (the values above, apart from the AppsFlyer ID, which the Application asks RevenueCat to remove) stays with Your customer record, and Our analytics keep how You installed it.

How long it is kept. AppsFlyer's Services Privacy Policy (https://www.appsflyer.com/legal/services-privacy-policy/) says it keeps such data for no more than 24 months, unless We direct otherwise or the law requires it. Google and Meta keep what they receive under their own privacy policies (https://policies.google.com/privacy and https://www.facebook.com/privacy/policy). What RevenueCat and Our analytics hold is kept as described for them elsewhere in this policy. To have what AppsFlyer holds about Your installation deleted, email Us: We forward verified requests to AppsFlyer, and to find Your installation there We may ask for Your Support ID or Your Device's advertising ID.

The Website

You can also use Binaural Beats in a web browser at https://listen.mellotonestudios.com (the "Website"). This section says what is different there. Everything else in this policy applies to the Website too.

A. What the Website collects

Request logs. Like every website, Ours is served by a hosting provider, Google Firebase Hosting. Each time Your browser loads a page, the request is logged: the page address (including any campaign tags in the link You followed, such as utm_campaign), the time, Your IP address, the country and city Google derives from that IP address, Your browser's user agent, and the address of the site that linked You to Ours (the referrer). We use these logs to run and protect the Website and to count how many people arrive from each campaign and country. We keep only the loads of the main screens and the Website's About, Beats and Guides index pages, never the addresses of individual categories, searches, exercises or guides, and We do not use the logs to identify You. Logs are deleted automatically after 30 days. Hosting also uses Your country, worked out from Your IP address, to tell Your browser which privacy rule below applies and whether buying Premium on the Website is open where You are; nothing about that is stored. Our legal basis under the GDPR is Our legitimate interest in running a secure website and knowing where visitors come from.

Usage data and error reports, by where You are. The Website can collect two kinds of data, each with its own switch under Settings > Privacy preferences:

Usage analytics, sent to Mixpanel, Inc. (USA), the same analytics provider the Application uses: which pages and features You use and when, for example that You played a sound, of which kind and from which catalogue shelf (such as Focus or Sleep; never which sound, and never a shelf named for a health condition), saved a mix (never its name or the sounds in it), opened or closed the Premium page, signed in, or started or completed a purchase; Your answers to the setup questions about how familiar You are with these sounds and which kinds of content interest You (such as binaural beats, breathwork or meditation; never the goal You pick); with a random identifier created in Your browser, Your browser's language, type and version, Your operating system, the kind of device (computer, tablet or phone) and Your screen size, whether the Website is installed on Your Device, the Website's version, whether You are signed in and whether You have Premium, the campaign tags of the link that brought You to the Website and the domain of the site that linked to it (never the page address or anything You searched for). If You are signed in, We use Your Account ID (never Your email address) in place of the random identifier, and Your setup answers are also kept on Your analytics profile. Mixpanel uses Your IP address to estimate Your country, region and city.
Error reports, sent to Functional Software, Inc. (Sentry, USA): when something on the Website fails, a report of the error, Your browser's type, the kind of page it happened on (never its address) and the steps just before it, with the addresses of pages and sound files removed from those steps. If a sound fails to load (a background sound, a timer chime or a breathing cue), the report names that sound or the address of its file so We can fix it. Error reports carry no account, and Sentry is set not to store Your IP address. The steps before an error may include the random ID the Website uses to read prices in that browser tab (see "Identifiers on the Website" below), which is not linked to Your Account.

Usage analytics never carry the title of what You play, and neither usage analytics nor error reports ever carry the goal You picked during setup or anything You type, in any country. The only sound an error report can name is one that failed to load, as described above.

What happens depends on where You are when You visit:

In the European Union, the European Economic Area, the United Kingdom, Canada, Brazil, Turkey, South Korea and any other country not listed below, We ask first. No usage analytics are sent and no analytics code is loaded until You choose "Accept all" or turn a switch on. In the European Union and the European Economic Area error reports also wait for Your choice; elsewhere in this group error reports are sent from Your first visit, and You can turn them off. If You choose "Reject all", We do not ask again.
In Switzerland and Singapore, a notice on Your first visit tells You about both and offers "Turn off". Usage analytics start only once that notice is shown.
In the United States and its territories, Australia, New Zealand, Japan, Mexico, South Africa and India, both are on from Your first visit, and You can turn either off at any time under Settings > Privacy preferences. (In India We will ask first from 13 May 2027.)

If Your browser's time zone is in Europe, Canada, Brazil, Turkey or South Korea, We ask first too, wherever You are (except that a visitor in Switzerland whose time zone is Swiss still gets the notice), and with a time zone in the European Union or the European Economic Area error reports also wait for Your choice.

On the Website, a Global Privacy Control signal from Your browser turns usage analytics and error reports off, and We do not ask about them, unless You turn them on yourself in Settings > Privacy preferences (a switch You turned on before the signal also stays on). Our campaign record (below) follows usage analytics, except as described there. Turning usage analytics off stops all sending, clears the identifier from Your browser and deletes Your analytics profile if You are signed in. We use usage data, error reports and Our campaign record (below) only to understand, fix and improve the Website and the Application and to count which of Our campaigns bring visitors and subscribers. Apart from the campaign tags and ad click IDs in the address of a page the Meta Pixel sees (part E), We never send them to an advertising network, never use them to choose ads for You, and do not sell or share them. A Global Privacy Control signal also turns Advertising on Meta off (see part E). What the Website shares with Meta for advertising is described in part E, "Advertising on Meta".

Our campaign record (United States and its territories only). If a link from one of Our ads or campaigns brought You to the Website, the Website keeps the link's campaign codes (its source, campaign, ad group and ad) and, for a Google ad, Google's click ID (gclid). A campaign code is kept only if it is a short code of lower-case letters, digits and underscores with none of a fixed list of words about health, sleep, focus, relaxation, mood and some conditions in it. The record is kept in Your browser's storage, used only within 7 days of Your visit and, once You sign in, added once to Your customer record at RevenueCat, so We can count which campaigns bring people who subscribe. It is kept only where buying Premium on the Website is open, and only while usage analytics may run where You are: turning usage analytics off, or a Global Privacy Control signal (unless You turned usage analytics on yourself), drops it from Your browser. Where Advertising on Meta may run, two more rules apply. In Washington and Nevada, and whenever We cannot tell which US state You are in (see part E), the record is also held only in the open page, neither stored in Your browser nor added to Your customer record at RevenueCat, until You turn Advertising on Meta on; if You turn Advertising on Meta off instead, it is dropped. And because the Website does not look up Your state once You have turned Advertising on Meta off, or while Your browser sends a Global Privacy Control signal (see part E), the same rule then applies in every US state from the next page load: the record is dropped unless You turn Advertising on Meta on yourself, while the signal is on if Your browser sends one. A record older than 7 days is ignored, and stays in Your browser until a new campaign link replaces it, it is dropped as just described, or You clear this site's data. We do not send the record itself to Google or to any advertising network. Where Advertising on Meta is on, the campaign tags and Google's click ID in the link can reach Meta as part of the address of a page the Meta Pixel runs on (see part E).

Our legal bases under the GDPR: for usage analytics in the European Union, the European Economic Area and the United Kingdom, Your consent; for error reports, Your consent in the European Union and the European Economic Area, and Our legitimate interest in finding and fixing faults in the United Kingdom and elsewhere. Our campaign record is not kept outside the United States and its territories.

Identifiers on the Website. The Website does not use the Application's Support ID. Mixpanel creates its own random identifier in Your browser's storage when usage data may first be sent, and uses Your Account ID instead once You sign in. When a page shows Premium prices, the Website asks RevenueCat for them under Your Account ID or, before You sign in, under a random ID that Your browser keeps for that tab only and forgets when the tab closes. Your privacy choices, and the sign-in that keeps You signed in (see B below), are kept in Your browser's storage, and so is Our campaign record (used for up to 7 days). The Website's own code sets no cookies; the cookies Stripe's checkout code may set are described in C below. Where Advertising on Meta is on, Meta's code sets two cookies of its own, and the Website keeps the click ID of a Meta ad You followed in Your browser's storage (see part E).

Advertising. The Website shows no advertising. To measure and show Our ads on Facebook and Instagram, it uses Meta's code, the Meta Pixel, on a few pages, as described in part E below. It contains no other advertising network's code. (Google Ads receives events only from the Android Application, as described in "Google Analytics for Firebase" below.)

What stays in Your browser. Your settings, the goal You pick during setup, Your saved mixes, custom beats and sessions, Your recently played list, Your recent searches, the quotes You like, and copies of the catalogue and of sounds, so that the Website also works offline, are kept in Your browser's own storage on Your Device. They are not sent to Us, and We cannot see them. You can delete them by clearing this site's data in Your browser.

Content. Sounds, pictures and the catalogue of beats are loaded from Google Firebase (Firebase Hosting, Cloud Firestore and Cloud Storage), the same servers the Application uses. Google receives Your IP address with those requests, as with any download. Nothing that identifies You is sent with them.

App store links. Links from the Website to the App Store or Google Play carry the name of the campaign and the place on the Website where You tapped them. Apple and Google use them to tell Us, in totals only, how many people installed or subscribed through each campaign. We never send Your IP address or any identifier with these links.

Support emails. Contact us and Report a problem on the Website open Your own email program, and nothing is sent until You send the email. If You choose to add the details to a problem report, they are the Website's version, Your browser and system, the kind of screen, whether the Website is installed on Your Device, and, if You are signed in, Your Account ID. We use them only to answer You.

How long the Website keeps it.

Request logs are deleted automatically after 30 days.
Mixpanel deletes each usage event automatically no later than 5 years after it happened. Your analytics profile (only if You are signed in) is kept until You turn usage analytics off while signed in, or ask Us to delete it, and the random identifier in Your browser until You turn usage analytics off or clear this site's data.
Sentry deletes error reports automatically no later than 90 days after it receives them.
Our campaign record is used from Your browser for up to 7 days, and stays there until a new campaign link replaces it, it is dropped or added to Your customer record at RevenueCat, or You clear this site's data. Once it is added to Your customer record at RevenueCat, it is kept there until that record is deleted.
Meta's _fbp and _fbc cookies last 90 days and are renewed when You come back. The Website uses the click ID of a Meta ad for up to 90 days from when it first sees it, and it stays in Your browser until a new ad click replaces it or You clear this site's data. All of them are deleted from Your browser at once when You turn Advertising on Meta off. An opt-out of Advertising on Meta recorded with Your Account is kept until You turn Advertising on Meta on again while signed in, or ask Us to delete it. What Meta receives, Meta keeps under its own privacy policy (https://www.facebook.com/privacy/policy).
Your privacy choices and everything else the Website keeps in Your browser stay there until You clear this site's data, except as described in part E for Advertising on Meta. The random ID used to read prices before You sign in is forgotten when You close the tab.
Your Account (email address, sign-in method, Account ID and the other details in B below) is kept until You delete it.
RevenueCat keeps the record of Your purchases, and the email address used at checkout, under Your Account ID for as long as We need them to provide Premium and to handle questions and disputes about it, or until You ask Us to delete them, subject to "Retention of Your Personal Data" below. Stripe and Link keep what tax and payment law require, under their own privacy policy.
The record of Your agreement to the automatic renewal (part C below) is kept for at least three years, or one year after the subscription ends if that is longer, even if You delete Your Account or ask for Your other data to be deleted: We copy it out before deleting the rest of Your customer record at RevenueCat.

B. Your Account (only if You choose to sign in)

You can use the Website without an Account. Signing in is needed only to buy and use Premium on the Website. If You sign in, with Google or with an email address and password, We use Google Firebase Authentication to keep Your Account. Firebase Authentication then holds, for Us, Your email address, which sign-in method You used, a random Account ID that Firebase creates, when the Account was created and last signed in, and, if You sign in with an email address, Your password in scrambled (hashed) form only. If You sign in with Google, Google also gives Firebase Authentication the name and profile picture address of Your Google account; the Website does not use or show them. We use all of this only to sign You in, to email You a link to reset Your password when You ask for one (Firebase Authentication sends it), and to recognise Your Premium access in every browser where You sign in: the Website asks RevenueCat, which manages subscriptions for the Application, whether Your Account ID has Premium. Your browser keeps You signed in by storing a sign-in token in its own storage on Your Device; this is needed for the sign-in You asked for, and it is removed when You sign out. Your browser also keeps Your Account ID with whether You have Premium, so that Premium keeps working when You are offline, and, once Our campaign record has been added to Your customer record, a note of that under Your Account ID. These two stay in Your browser after You sign out or delete Your Account, until You clear this site's data. The Application has no sign-in, so an Account is not linked to Your installations of the Application. Our legal basis under the GDPR is the performance of the sign-in You asked for.

You can delete Your Account at any time on the Website, in Settings under Account. Deleting it removes Your Account (Your email address, sign-in method and Account ID) from Firebase Authentication. It does not delete the purchase record, campaign record and record of Your agreement to the automatic renewal that RevenueCat keeps under Your Account ID, usage data already sent to Mixpanel, or an opt-out of Advertising on Meta recorded with Your Account (see part E). To have the purchase record, campaign record and usage data deleted too, email Us from Your Account's email address, before or after You delete the Account; the record of Your agreement to the automatic renewal is copied out first and kept for the period stated in part C. Deleting the Account does not cancel a subscription bought through Apple, Google or the Website: cancel it where You bought it.

C. Buying Premium on the Website (United States and its territories only)

Buying Premium on the Website is open only to visitors whom Firebase Hosting places, from their IP address, in the United States, Puerto Rico, Guam, the US Virgin Islands, American Samoa or the Northern Mariana Islands, and only once You are signed in. Elsewhere the Website shows the prices but sells nothing.

If You buy Premium on the Website, the sale is made by Stripe through its Link service, which is the seller of record ("Sold through Link") and handles sales tax, receipts, refunds and payment support. RevenueCat, which manages subscriptions for the Application, opens Stripe's checkout in a frame on the Website, and You give Your card or other payment details directly to Stripe; We never see or store them. So that You do not have to type it again, We give RevenueCat and Stripe Your Account's email address when the checkout opens, and RevenueCat keeps the email address used at checkout with Your customer record. Link sends You a receipt and Your subscription emails at that address. You can manage or cancel the subscription in Stripe's customer portal, which Your Account on the Website links to, or at https://link.com. Stripe's privacy policy, which also covers Link, applies to what You give them: https://stripe.com/privacy and https://link.com/privacy. RevenueCat records Your purchase under Your Account ID so that Premium works in every browser where You sign in.

When You agree to the automatic renewal before the checkout opens, We keep a record of that agreement with Your customer record at RevenueCat under Your Account ID, so that We can show what You agreed to. The record holds the time, the page You were on, the plan and price shown, the exact renewal terms You saw, the time zone the dates were worked out in (or a note that Your browser hid it), the Website's version and, as far as RevenueCat's size limit allows, the billing line and checkbox wording You saw; Your latest agreement always holds the billing line and checkbox wording in full. We also keep a separate record for each time You agree, as far as RevenueCat's limit on their number allows, and only that separate record holds the time zone. A copy of Your latest agreement, without Your Account ID or the time zone, goes with the purchase to RevenueCat and Stripe. We keep each record for at least three years, or one year after the subscription ends if that is longer, and after that period We delete it when You ask Us to. We keep it for that time even if You delete Your Account; if You ask Us to delete Your other data at RevenueCat, We copy this record out first and keep the copy for that period, because automatic renewal law requires Us to keep proof of Your consent for at least that long (in California, Business and Professions Code section 17602).

When a page shows Premium prices, the Website asks RevenueCat for them under Your Account ID or, before You sign in, under a random ID that Your browser keeps for that tab only and forgets when the tab closes. We have turned off RevenueCat's own usage events, so RevenueCat's code on the Website sends RevenueCat nothing about the page You came from or the campaign that brought You.

When You open the checkout, the Website loads Stripe's code (Stripe.js) from Stripe's servers to show the payment form. Stripe uses it to collect information about Your browser and Device and how You use the checkout, to prevent fraud, under its own privacy policy, and it may set its own fraud-prevention cookies on the Website, such as __stripe_mid and __stripe_sid. Stripe's code is not loaded before You open the checkout.

Our legal bases under the GDPR are the performance of Your purchase contract; for showing current prices to visitors who have not bought, Our legitimate interest in showing them; and, for the record of Your agreement to the automatic renewal, Our legitimate interest in being able to prove it.

D. Your choices and rights on the Website

You can clear everything the Website keeps in Your browser by clearing this site's data in Your browser settings.
You have the same rights over the Website's data as over the Application's (see "Your Rights under the GDPR" and "Delete Your Personal Data"). To ask Us to delete request logs about You before they expire, or the data held under Your Account, email contact@mellotonestudios.com. For logs, tell Us roughly when You visited and from which network, because logs are not stored under Your name.
If You ask Link to delete Your data, Stripe cancels the subscriptions You bought through Link and deletes its records of them. That does not delete Your Account or the records We and RevenueCat keep; email Us for those (the record of Your agreement to the automatic renewal is kept for the period stated in part C).
The Website does not sell personal information for money. It shares some personal information with Meta for cross-context behavioral advertising, as described in part E, which some US state laws also treat as a sale. In the United States and its territories it does so unless You opt out with "Your Privacy Choices" (https://listen.mellotonestudios.com/privacy-choices, linked at the bottom of every page), the "Advertising on Meta" switch or a Global Privacy Control signal, except as described next. In Washington and Nevada, whenever We cannot tell which US state You are in, whenever Your browser's time zone is in Europe, Canada, Brazil, Turkey or South Korea, and outside the United States and its territories, it does so only if You turn Advertising on Meta on. It does not sell or share the Website's data in any other way.
To make any request under Your US state's privacy law (to know, correct or delete Your personal information), email contact@mellotonestudios.com. If We decline a request, We tell You why, and You can appeal by replying to Our answer or by emailing contact@mellotonestudios.com with "Privacy appeal" in the subject. We answer an appeal in writing within 60 days of receiving it, saying what We did and why. If We deny Your appeal, You can contact Your state's Attorney General; in Connecticut, through https://portal.ct.gov/ag/common/complaint-form-landing-page.
If You are in Japan, Our notice about the information Your browser sends from the Website to other companies (外部送信に関する公表事項) is at https://mellotonestudios.com/ja-external-transmission.

E. Advertising on Meta

We advertise the Website on Facebook and Instagram, which are run by Meta Platforms, Inc. (in the European Union, the European Economic Area and Switzerland, Meta Platforms Ireland Limited) ("Meta"). To learn which of Our ads bring people who subscribe, and to show Our ads to people more likely to be interested, the Website uses Meta's code, the Meta Pixel. It is covered by the "Advertising on Meta" switch under Settings > Privacy preferences and by "Your Privacy Choices", a link at the bottom of every page of the Website, which leads to Our opt-out page at https://listen.mellotonestudios.com/privacy-choices. You can also control how Meta uses information from websites to choose the ads it shows You in Meta's ad preferences (https://www.facebook.com/adpreferences), and opt out of interest-based advertising by many companies at https://www.aboutads.info/choices (in the European Union and the European Economic Area, https://www.youronlinechoices.eu/).

The Meta Pixel. It is loaded from Meta's servers, and only on a few pages: the Premium page and the offer page, where You can open the checkout, and the Website's About, Beat categories and Guides index pages (at /about, /beats and /learn). It is never loaded on the player or on any page that shows what You listen to: not Home, Explore, Sounds, Library, Now Playing, Breathwork, the app's Guides tab or any single guide, Settings, Account, sign-in, setup or Your Privacy Choices, and never on a page about a particular category, guide or breathing exercise. Once loaded, it is paused and sends nothing as soon as You move to a page not listed here, and while the sign-in window is open over one of its pages. It also sends nothing from a page whose address or title contains one of a fixed list of words about health, sleep, focus, relaxation, mood and some conditions, or whose address carries anything other than campaign tags and ad click IDs. It tells Meta that You opened one of those pages, that You looked at the Premium plans (which plans were shown), and that You opened the checkout (which plan, its price and currency). With each of these, Meta receives, among other technical details of the request, the address of that page (including any campaign tags and Google or Meta ad click ID in it), the site that linked You to Ours (never a page address from another site), Your IP address, Your browser's type and screen size, any cookies Meta has set on its own sites that Your browser sends with the request, and two identifiers that Meta's code keeps in cookies on Our domain: _fbp, a random ID for Your browser, and _fbc, the click ID of a Meta ad You followed. If You are signed in, and no opt-out of Advertising on Meta is recorded with Your Account, We also give the Pixel Your email address, which Meta's code scrambles (hashes) in Your browser before sending it, and Your Account ID, which the Website scrambles (hashes) in Your browser first, so Meta never receives either in readable form. Meta can use all of this to match the events to a Facebook or Instagram account. We have turned off Meta's options that read buttons, page details and form fields, so the Pixel never reads anything You type, and We never send it which sound You play, the goal You picked or anything You searched for.

Meta uses this data to measure Our ads and show them to people more likely to be interested. Under Meta's own terms (https://www.facebook.com/legal/technology_terms) and privacy policy (https://www.facebook.com/privacy/policy), Meta also uses it, together with information it collects from other websites and apps and elsewhere on the internet through cookies, pixels and similar technologies, to measure, choose and show ads and other content on and off Facebook and Instagram, including other companies' ads, and to provide, improve and research its own products. In the European Union and the European Economic Area We and Meta Platforms Ireland Limited, and in the United Kingdom We and Meta Platforms, Inc., are jointly responsible for collecting this data and sending it to Meta; Meta alone is responsible for what it does with it afterwards. Our respective responsibilities are set out in Meta's Controller Addendum (https://www.facebook.com/legal/controller_addendum) and, for the United Kingdom, Meta's UK Controller Addendum. For what Meta holds after it receives the data, You can exercise Your rights with Meta directly (see Meta's privacy policy).

Where You are. In the United States and its territories, Advertising on Meta is on from Your first visit, unless Your browser sends a Global Privacy Control signal, and You can turn it off at any time. In Washington and Nevada, Advertising on Meta stays off until You turn it on, and the same applies whenever We cannot tell which state You are in. To tell, the Website asks a small service of Ours, which Google runs for Us, which state Your IP address is in. That request carries no cookie or identifier, Google receives Your IP address with it as with any download, and the answer holds only Your country and state. If the service does not answer within a moment, Advertising on Meta waits for You. Only whether Advertising on Meta may start is kept, in Your browser tab: until You close it if it has to wait for You, and for 30 minutes otherwise. If You have already turned Advertising on Meta off, or Your browser sends a Global Privacy Control signal, the Website does not look up Your state. If Your browser's time zone is in Europe, Canada, Brazil, Turkey or South Korea, Advertising on Meta also waits for You, wherever You are. Everywhere else, including the European Union, the European Economic Area, the United Kingdom, Switzerland and Japan, Advertising on Meta is off until You turn it on yourself, under Settings > Privacy preferences, under "Customize" where the Website asks about usage analytics, or with "Your Privacy Choices"; "Accept all" does not turn it on. Until Advertising on Meta is on, the Meta Pixel is not loaded, no Meta cookie is set or read, no ad click ID is stored in Your browser, and nothing is sent to Meta. Buying Premium on the Website is open only in the United States and its territories.

Turning it off. Turning Advertising on Meta off, with the switch, "Your Privacy Choices", "Reject all", the notice's "Turn off" or a Global Privacy Control signal, stops the Pixel at once and deletes the _fbp and _fbc cookies, the copies Meta's code keeps in Your browser's storage, and the ad click ID the Website keeps. Meta's code stays in the open page, paused and sending nothing, until You reload it. If You are signed in when You turn it off, or when Your browser sends a Global Privacy Control signal, We record that choice with Your Account, in Google Cloud Firestore under Your Account ID, so it also applies when You sign in on any other browser or device, until You turn Advertising on Meta on again yourself while signed in. While the Website cannot read Your Account's choice, the Pixel does not run for You while You are signed in. Turning Advertising on Meta off does not delete what Meta has already received.

Global Privacy Control. A Global Privacy Control signal from Your browser turns Advertising on Meta off and counts as Your opt-out of sale, sharing and targeted advertising for that browser and, if You are signed in, for Your Account, and the Website shows "Opt-out request honored" when it receives one. Only a choice You make while Your browser sends the signal can turn Advertising on Meta back on: if You had turned it on before the signal appeared, the signal wins, Our opt-out page tells You so, and You can turn it back on there.

Your choices under US state privacy laws. Using the Meta Pixel counts as "sharing" personal information for cross-context behavioral advertising under the California Consumer Privacy Act, which may also treat it as a sale, and may count as targeted advertising or a sale under other states' privacy laws. You can opt out at any time with "Your Privacy Choices" at the bottom of every page of the Website, or directly at https://listen.mellotonestudios.com/privacy-choices. You do not need an Account. We do not use sensitive personal information in any way that gives You a right to limit it. To make any other request under Your state's privacy law, see part D.

Our legal basis under the GDPR for Advertising on Meta is Your consent, which the Website relies on wherever You are outside the United States and its territories: there, Advertising on Meta stays off until You turn it on, and You can turn it off at any time in Settings > Privacy preferences or with "Your Privacy Choices".

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

To provide and maintain our Service, including to monitor the usage of our Service.
To manage Your Account: to sign You in on the Website and to recognise Your Premium access in every browser where You sign in.
For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.
For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.
For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends and to evaluate and improve our Service, products, services and your experience.
For advertising: to measure which of Our ads lead people to the Website or the Application and to subscribe, and to show Our ads to people more likely to be interested, as described in "Advertising on Meta" (part E of "The Website") and "Ad measurement on Android".

We may share Your personal information in the following situations:

With Service Providers: We may share Your personal information with Service Providers to monitor and analyze the use of our Service and for payment and subscription processing.
For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
With Your consent: We may disclose Your personal information for any other purpose with Your consent.
For advertising: The Website shares some personal information with Meta, and the Android app, from version 7.0367, shares some with AppsFlyer, Google and Meta, as described in "Advertising on Meta" and "Ad measurement on Android". You can turn this off at any time, and in some places it happens only if You turn it on.

Your Choices About Analytics

On iOS, after You finish setup the Application asks "Share usage data?" and says: "Usage and crash data help improve the app. You can turn this off any time in Settings." Analytics (Mixpanel and Google Analytics for Firebase), the daily performance summaries and crash reporting (Firebase Crashlytics) start only if You choose Share. You can turn them off, and on again, at any time with the Share usage data switch in the Application's Settings.

With Share usage data off, the iOS app still sends what it needs to work:

Subscription checks. RevenueCat receives Your Support ID and Your Device's identifier for vendor each time the Application checks or restores a purchase.
Onboarding text. When You first open the Application, before setup is finished, it asks Firebase Remote Config for its onboarding text. That request carries a Firebase installation ID, the Application's version, and Your Device's system version, country, language and time zone settings.
Play counts and quote likes, described above, which carry no ID tied to You.
Content downloads. Sounds and images are downloaded from Our servers when You open them.

On Android, the Application has no switch for analytics and crash reporting: they run while You use the Application, and uninstalling the Application stops all collection. From version 7.0367, the Application's Settings have Privacy preferences, with switches for Ad measurement and Ad personalization (see "Ad measurement on Android"); they do not turn analytics or crash reporting off.

On the Website, Your choices depend on where You are and are described in "The Website" above.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

How long the Website keeps each kind of data is listed in "The Website" above, and how long the data used for ad measurement on Android is kept, in "Ad measurement on Android".

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to, and maintained on, computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.

The Service's data is processed in the United States, including by Google, Mixpanel, Inc. and RevenueCat, Inc., for the Website also by Functional Software, Inc. (Sentry), for purchases on the Website by Stripe, and, for the Android app's ad measurement from version 7.0367, by AppsFlyer, Inc. What the Website and the Android app send Meta for advertising is received by Meta Platforms, Inc. in the United States (from the United Kingdom under Meta's UK data transfer terms) or, in the European Union, the European Economic Area and Switzerland, by Meta Platforms Ireland Limited, which may transfer it to the United States under Meta's own safeguards. For personal data from the European Union, the European Economic Area, the United Kingdom and Switzerland, We rely on the EU-U.S. Data Privacy Framework (with its UK Extension, and the Swiss-U.S. Data Privacy Framework) where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (with the UK's addendum to them) in that recipient's data processing terms. You can ask Us for a copy of these safeguards.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

Because the Application has no accounts, the identifiers We hold are pseudonymous and tied to Your app installation, not to Your name. Uninstalling the Application ends collection from Your Device, and a reinstall generates fresh app identifiers. (On Android, Your Device's advertising identifier, which earlier versions of the Application collected and versions from 7.0367 collect while Ad measurement is on, persists across reinstalls until You reset it in Your Device settings.)

You may also contact Us to request deletion of the data associated with Your installation. We will honor verified requests and forward them to Our Service Providers where applicable. Because We hold no account data, We may ask You for information from Your Device (such as the Support ID shown in the Application's Settings, or Your purchase details) to locate the data associated with Your installation. With Your Support ID We can delete the records stored against it at Mixpanel, Google Analytics for Firebase and RevenueCat. From Android version 7.0367, We also forward verified requests to AppsFlyer (see "Ad measurement on Android").

On the Website, You can delete Your Account yourself (see "The Website", part B). To have the records kept under Your Account ID at RevenueCat and Mixpanel deleted as well, email Us from Your Account's email address; We copy out the record of Your agreement to the automatic renewal before deleting the rest, and keep that copy for the period stated in "The Website", part C. Deleting Your customer record at RevenueCat does not cancel a Website Subscription that is still running, so if You still have one, We ask You to cancel it first. If You never signed in on the Website, the usage data it sent is kept at Mixpanel only under a random identifier that Your browser holds, which We cannot link to You; turning usage analytics off or clearing this site's data removes that identifier from Your browser, and Mixpanel deletes the events as described in "How long the Website keeps it".

Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

Comply with a legal obligation
Protect and defend the rights or property of the Company
Prevent or investigate possible wrongdoing in connection with the Service
Protect the personal safety of Users of the Service or the public
Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot promise its absolute security.

Detailed Information on the Processing of Your Personal Data

The Service Providers We use may have access to Your Personal Data. Each of them (Google Firebase, Mixpanel and RevenueCat, for the Website also Sentry, and for the Android app's ad measurement also AppsFlyer) processes it on Our behalf under contract, and provides the same or equal protection of user data as stated in this Privacy Policy and as required by Apple's App Store Review Guidelines. Stripe, which sells Premium on the Website through its Link service, is the seller of record for those purchases and handles the payment details You give it under its own privacy policy (see "Payments and Subscriptions" below). Meta, and Google when it uses the Android app's events for advertising, are not Service Providers: they use what they receive under their own terms and privacy policies (see "Advertising" below).

Analytics

We use third-party Service providers to monitor and analyze the use of our Service. On iOS, Google Analytics for Firebase, Firebase Crashlytics and Mixpanel run only after You agree, and stop when You turn off Share usage data (see "Your Choices About Analytics"). On the Website, Mixpanel and Sentry follow the rule for where You are (see "The Website").

Google Analytics for Firebase

Google Analytics for Firebase is an app analytics service provided by Google that helps Us understand how the Application is used. We also use it to measure Our own Google ads for the Application: Google Ads receives app events such as installs, free trial starts and purchases from it, without Your name or email address. The Android versions released just before 7.0367 do not let it collect advertising identifiers, and the iOS app never has. From version 7.0367, the Android app lets Google use these events for advertising only as Your Privacy preferences allow: while Ad measurement is on, Google Analytics for Firebase also reads Your Device's advertising ID, and Google can use the events to measure Our ads; while Ad personalization is also on, Google can use them to choose who sees Our ads on Google's services and on other apps and sites where Google shows ads. While Ad measurement is off, it is told not to collect the advertising ID or use the Application's data for advertising (see "Ad measurement on Android"). You can also control the ads Google shows You in My Ad Center (https://myadcenter.google.com), and Google explains how it uses information from apps that use its services at https://policies.google.com/technologies/partner-sites.

For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy
Firebase

Firebase is a platform provided by Google Inc. that We use for content delivery, Remote Config (app text and settings, such as the onboarding text and test variants of it) and Cloud Functions (the anonymous play counts and quote likes). On Android, We also use Firebase App Check, an app-integrity service; Firebase Performance Monitoring, which measures app start, screen and network timing; and a Cloud Function that issues download links for sounds, which receives Your Support ID so it can check whether You have premium access. For the Website, We also use Firebase Hosting, which serves the Website, and Firebase Authentication, which keeps Accounts.

We also encourage you to review the Google's policy for safeguarding your data: https://support.google.com/analytics/answer/6004245
Firebase Crashlytics

Firebase Crashlytics is a crash reporting service provided by Google Inc. If the Application crashes, technical information about the crash (such as device state and stack traces) is collected so We can find and fix the problem.

For more information, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy
Mixpanel

Mixpanel is a product analytics service provided by Mixpanel Inc.

For more information on what type of information Mixpanel collects, please visit their Privacy Policy: https://mixpanel.com/legal/privacy-policy/
Sentry

Sentry is an error reporting service provided by Functional Software, Inc. We use it only on the Website, as described in "The Website".

For more information, please visit their Privacy Policy: https://sentry.io/privacy/

Advertising

AppsFlyer

AppsFlyer is an ad measurement service provided by AppsFlyer, Inc. From version 7.0367, the Android app uses it to measure which of Our ads lead to installs and subscriptions, as described in "Ad measurement on Android".

Their Privacy Policy can be viewed at https://www.appsflyer.com/legal/services-privacy-policy/
Meta

Meta Platforms, Inc. runs Facebook and Instagram, where We advertise. The Website's Meta Pixel and, from version 7.0367 and through AppsFlyer, the Android app send Meta data for advertising, as described in "Advertising on Meta" (part E of "The Website") and "Ad measurement on Android".

Their Privacy Policy can be viewed at https://www.facebook.com/privacy/policy
Google Ads

Google Ads receives events from the Android app through Google Analytics for Firebase and, from version 7.0367, may also receive them through AppsFlyer, as described in "Google Analytics for Firebase" and "Ad measurement on Android".

Their Privacy Policy can be viewed at https://policies.google.com/privacy

Payments and Subscriptions

We provide paid products and/or services within the Service. Payment processing is handled by Google Play on Android, by Apple's App Store on iOS, and on the Website by Stripe through its Link service (see "The Website", part C).

We will not store or collect Your payment card details. That information is provided directly to Google Play, Apple's App Store or, on the Website, Stripe, whose use of Your personal information is governed by their own privacy policies. These companies adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

Google Play In-App Payments

Their Privacy Policy can be viewed at https://www.google.com/policies/privacy/
Apple App Store In-App Purchase

Their Privacy Policy can be viewed at https://www.apple.com/legal/privacy/
Stripe and Link (Website only)

Stripe, through its Link service, sells Premium on the Website as the seller of record, takes Your payment details in its own checkout, and sends Your receipts and subscription emails. With each purchase, Stripe also receives a copy of the record of Your latest agreement to the automatic renewal, without Your Account ID or the time zone (see "The Website", part C).

Their Privacy Policy can be viewed at https://stripe.com/privacy and https://link.com/privacy
RevenueCat

RevenueCat is a subscription management service provided by RevenueCat, Inc. RevenueCat receives Your purchase information from Google Play or Apple's App Store (on Android, purchase tokens) together with Your Support ID, so the Application knows Your subscription status. On iOS, RevenueCat also receives Your Device's identifier for vendor with each request. On Android, RevenueCat also receives the Google Analytics for Firebase app-instance ID, so purchase events can be matched to analytics. From Android version 7.0367, while Ad measurement is on, RevenueCat also receives the AppsFlyer ID and how the Application was installed, as described in "Ad measurement on Android". RevenueCat works whatever Your analytics choice, because the Application needs it to unlock what You have paid for. On the Website, RevenueCat receives the requests for Premium prices (under Your Account ID, or before You sign in a random ID kept for that browser tab only), Your purchases and the email address used at checkout (under Your Account ID), the record of Your agreement to the automatic renewal, and Our campaign record, as described in "The Website".

Their Privacy Policy can be viewed at https://www.revenuecat.com/privacy

What We Do Not Do

We do not sell Your personal information for money.
The Website shares some personal information with Meta for cross-context behavioral advertising, as described in "Advertising on Meta", and the Android app, from version 7.0367, shares some with Google and Meta, through AppsFlyer, Our ad measurement company, and with Google also through Google Analytics for Firebase, as described in "Ad measurement on Android". Some US state laws also treat this as a sale. You can turn either off at any time, and in some places it starts only if You turn it on. The iOS app does none of this.
We show no advertisements in the Application or on the Website, and apart from the Meta Pixel the Website contains no advertising network's code. Android versions 7.03 to 7.0366 share app events with one advertising partner only, Google Ads, to measure Our own ads for the Application (see Google Analytics for Firebase above).
We do not collect Your precise location.
The iOS app does not use Apple's advertising identifier (IDFA) and does not track You across other companies' apps or websites.

GDPR Privacy

Legal Basis for Processing Personal Data under GDPR

We may process Personal Data under the following conditions:

Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with You and/or for any pre-contractual obligations thereof, such as Your purchases and Subscriptions, and signing You in to Your Account on the Website when You ask.
Legitimate interests: Processing Personal Data is necessary for the purposes of the legitimate interests pursued by the Company, such as analytics and crash diagnostics in the Android app, the anonymous play counts in both apps, abuse prevention, the Website's request logs, showing current Premium prices on the Website, keeping the record of Your agreement to the automatic renewal for a purchase on the Website so that We can prove it, and the Website's error reports in the United Kingdom and in other countries outside the European Union and the European Economic Area.
Consent: You have given Your consent for processing Personal Data for one or more specific purposes. In the iOS app, analytics, performance data and crash reporting rely on Your consent, which You give by choosing Share when the Application asks and can withdraw at any time with Share usage data in Settings. On the Website, usage analytics in the European Union, the European Economic Area and the United Kingdom, and error reports in the European Union and the European Economic Area, rely on Your consent, which You give with "Accept all" or a switch in Privacy preferences and can withdraw at any time in Settings > Privacy preferences. Advertising on Meta on the Website relies on Your consent wherever You are outside the United States and its territories, which You give by turning the "Advertising on Meta" switch on and can withdraw at any time in Settings > Privacy preferences or with "Your Privacy Choices". In the Android app, from version 7.0367, ad measurement and ad personalization in the European Economic Area, the United Kingdom, Switzerland and the nearby territories and small states named in "Ad measurement on Android" rely on Your consent, which You give with "Accept all", with the switches and "Save my preferences", or by turning a switch on in the Application's Settings, under Privacy preferences, and can withdraw at any time there.
Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which the Company is subject.

In any case, the Company will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Your Rights under the GDPR

The Company undertakes to respect the confidentiality of Your Personal Data and to make sure You can exercise Your rights.

You have the right under this Privacy Policy, and by law if You are in the European Union, the European Economic Area or the United Kingdom, to:

Request access to Your Personal Data. The right to access, update or delete the information We have on You. Please contact Us and We will assist You. This also enables You to receive a copy of the Personal Data We hold about You.
Request correction of the Personal Data that We hold about You. You have the right to have any incomplete or inaccurate information We hold about You corrected.
Object to processing of Your Personal Data. This right exists where We are relying on a legitimate interest as the legal basis for Our processing and there is something about Your particular situation, which makes You want to object to our processing of Your Personal Data on this ground.
Request erasure of Your Personal Data. You have the right to ask Us to delete or remove Personal Data when there is no good reason for Us to continue processing it.
Request the transfer of Your Personal Data. We will provide to You, or to a third-party You have chosen, Your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which You initially provided consent for Us to use or where We used the information to perform a contract with You.
Withdraw Your consent. You have the right to withdraw Your consent on using your Personal Data. If You withdraw Your consent, We may not be able to provide You with access to certain specific functionalities of the Service. On iOS, You can withdraw consent to analytics and crash reporting at any time with the Share usage data switch in the Application's Settings. On the Website, You can withdraw it at any time in Settings > Privacy preferences. In the Android app, from version 7.0367, You can withdraw consent to ad measurement and ad personalization at any time in the Application's Settings, under Privacy preferences.

Exercising of Your GDPR Data Protection Rights

You may exercise Your rights of access, rectification, cancellation and opposition by contacting Us. Please note that we may ask You to verify Your identity before responding to such requests. If You make a request, We will try our best to respond to You as soon as possible.

You have the right to complain to a Data Protection Authority about Our collection and use of Your Personal Data. For more information, if You are in the European Economic Area (EEA), please contact Your local data protection authority in the EEA; if You are in the United Kingdom, the Information Commissioner's Office (https://ico.org.uk).

CCPA/CPRA Privacy Notice

This privacy notice section for California residents supplements the information contained in Our Privacy Policy and it applies solely to all visitors, users, and others who reside in the State of California.

Categories of Personal Information Collected

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or Device. The following is a list of categories of personal information which we may collect or may have been collected from California residents within the last twelve (12) months.

Category A: Identifiers.

Examples: A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, driver's license number, passport number, or other similar identifiers.

Collected: Yes (limited to pseudonymous device and app identifiers, including the Support ID, Your IP address, and Your email address if You email Us. On the Website, also the random identifiers described in "The Website", Your Account ID and Your Account's email address if You sign in, Google's click ID if a Google ad brought You to the Website, and, where Advertising on Meta is on, Meta's cookie IDs and the click ID of a Meta ad. From Android version 7.0367, while Ad measurement is on, also Your Device's advertising ID and the AppsFlyer ID.)
Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).

Examples: A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

Collected: Yes, only if You sign in to the Website with Google (limited to the name on Your Google account, which Google gives Firebase Authentication and the Website does not use). We do not receive Your payment card, bank or billing details: on the Website You give them directly to Stripe.
Category C: Protected classification characteristics under California or federal law.

Examples: Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

Collected: No.
Category D: Commercial information.

Examples: Records and history of products or services purchased or considered.

Collected: Yes (Your purchases and subscription status in the Application and on the Website, and, on the Website, the record of Your agreement to the automatic renewal described in "The Website", part C).

Category E: Biometric information.

Examples: Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

Collected: No.

Category F: Internet or other similar network activity.

Examples: Interaction with our Service.

Collected: Yes.

Category G: Geolocation data.
```
Examples: Approximate physical location.
```
Collected: Yes (limited to a coarse region, such as country or city, inferred from Your IP address by Our analytics providers and, for the Website, by Firebase Hosting; We never collect Your Device's GPS location).

Category H: Sensory data.

Examples: Audio, electronic, visual, thermal, olfactory, or similar information.

Collected: No.

Category I: Professional or employment-related information.

Examples: Current or past job history or performance evaluations.

Collected: No.

Category J: Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

Examples: Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

Collected: No.

Category K: Inferences drawn from other personal information.

Examples: Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Collected: Yes (limited to the wellness goal You choose during onboarding and Your use of content in the Application, and, on the Website, Your use of content and the kinds of content You say interest You during setup, which together may reflect Your preferences. We use them only to order suggestions in the Application and to understand how the Service is used.)

Category L: Sensitive personal information.

Examples: Account login and password information, precise geolocation data, and personal information collected and analyzed concerning a consumer's health.

Collected: Yes (limited to the wellness goal You choose during onboarding in the Application, such as reducing stress and anxiety or pain relief, which may count as health information, and, on the Website, Your Account's login: Your email address and, if You sign in with an email address, Your password, which Firebase Authentication keeps for Us in scrambled (hashed) form only and uses only to sign You in. We do not collect precise geolocation.)

How long We keep each category: for the Website, the periods are listed in "The Website" under "How long the Website keeps it" (the record of Your agreement to the automatic renewal falls in Category D and is kept for the period in part C); for the Application, see "Retention of Your Personal Data" and, for ad measurement on Android, "How long it is kept" in "Ad measurement on Android".

Under CCPA/CPRA, personal information does not include:

Publicly available information from government records
Deidentified or aggregated consumer information
Information excluded from the CCPA/CPRA's scope, such as:
- Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data
- Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994

Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

Directly from You. For example, preferences You express or provide through our Service, from Your purchases on our Service, from the email address You sign in with on the Website, or from emails You send Us.
Indirectly from You. For example, from observing Your activity on our Service.
Automatically from You. For example, through analytics tools included in the Application and the Website, and the Website's request logs.
From Service Providers. For example, third-party vendors to monitor and analyze the use of our Service, third-party vendors for payment and subscription processing, or other third-party vendors that We use to provide the Service to You.
From sign-in providers. If You sign in to the Website with Google, Google gives Us Your email address and the name on Your Google account through Firebase Authentication.
From the seller of Website purchases. Stripe, through its Link service, tells Us and RevenueCat about the Premium You buy on the Website.
From Google Play and Our ad measurement company. From Android version 7.0367, while Ad measurement is on, Google Play tells the Application how it was installed, and AppsFlyer tells it which ad led to the install (see "Ad measurement on Android").

Use of Personal Information

We may use or disclose personal information We collect for "business purposes" or "commercial purposes" (as defined under the CCPA/CPRA), which may include the following examples:

To operate our Service and provide You with Our Service.
To provide You with support and to respond to Your inquiries, including to investigate and address Your concerns and monitor and improve our Service.
To fulfill or meet the reason You provided the information. For example, if You provide Your personal information to purchase a product or service, We will use that information to process Your payment and facilitate delivery.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
As described to You when collecting Your personal information or as otherwise set forth in the CCPA/CPRA.
For internal administrative and auditing purposes.
To detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities.

Please note that the examples provided above are illustrative and not intended to be exhaustive. For more details on how we use this information, please refer to the "Use of Your Personal Data" section.

If We decide to collect additional categories of personal information or use the personal information We collected for materially different, unrelated, or incompatible purposes We will update this Privacy Policy.

Disclosure of Personal Information

We may use or disclose and may have used or disclosed in the last twelve (12) months the following categories of personal information for business or commercial purposes:

Category A: Identifiers
Category B: Personal information categories listed in the California Customer Records statute (the name on a Google account used to sign in to the Website)
Category D: Commercial information
Category F: Internet or other similar network activity
Category G: Geolocation data (approximate region only)
Category K: Inferences drawn from other personal information
Category L: Sensitive personal information (the onboarding wellness goal, and the login of a Website Account, which only Firebase Authentication holds)

Please note that the categories listed above are those defined in the CCPA/CPRA. This does not mean that all examples of that category of personal information were in fact disclosed, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been disclosed.

When We disclose personal information to a Service Provider for a business purpose, We enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract. What We share with Meta and Google for advertising, they use under their own terms, as described below and in "Advertising on Meta" and "Ad measurement on Android".

Categories of Recipients of Personal Information

We may disclose, and have disclosed in the last twelve (12) months, for business purposes, Your personal information identified in the above categories to the following categories of recipients:

Service Providers
Payment processors
Third party vendors to whom You or Your agents authorize Us to disclose Your personal information in connection with products or services We provide to You

We also disclose personal information to advertising networks (Meta Platforms, Inc. and Google LLC) for cross-context behavioral advertising, which the CPRA calls "sharing", which may also count as a "sale", and which is not a business purpose. The Website shares, and the Android app from version 7.0367 shares, these categories of personal information:

From the Website, with Meta: Category A, Identifiers (Meta's cookie IDs _fbp and _fbc, the click ID of a Meta ad, Google's click ID if the page address carries one, Your IP address and, if You are signed in, Your email address and Account ID, each scrambled (hashed) in Your browser); Category D, Commercial information (the Premium plans shown to You, and the plan, price and currency of a checkout You opened); Category F, Internet or other electronic network activity (which of the Website's Premium, offer, About, Beat categories and Guides index pages You opened, Your browser type and screen size, and the site that linked You to Ours).
From the Android app, with Google and Meta, through AppsFlyer: Category A, Identifiers (such as Your Device's advertising ID); Category D, Commercial information (Your free trial starts and purchases, where RevenueCat reports them to AppsFlyer); Category F, Internet or other electronic network activity (how You installed the Application and each time You open it). Google also receives the Application's events and the advertising ID through Google Analytics for Firebase, as described there.

We share them with one category of third party, advertising networks (Meta Platforms, Inc. and Google LLC), with AppsFlyer, Inc. passing on what the Android app shares, for advertising and marketing: to measure which of Our ads bring people who install the Application or subscribe, and to show Our ads, and through Meta other companies' ads, to people more likely to be interested. The Website began this on the day it first loaded the Meta Pixel, and the Android app with version 7.0367.

Sale of Personal Information

As defined in the CCPA/CPRA, "sell" and "sale" mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's personal information by the Business to a third party for valuable consideration.

We do not sell Your personal information for money. The Website and, from version 7.0367, the Android app share the personal information listed above for cross-context behavioral advertising, which the CCPA calls sharing and which the CCPA and other states' laws may also treat as a sale. You can opt out at any time (see "Your Rights under the CCPA/CPRA"). Our Service Providers process personal information only under contracts that restrict their use of it to providing services to Us.

We do not have actual knowledge that We sell or share the personal information of Consumers under 16 years of age. The Service is not directed to children (see "Children's Privacy").

Your Rights under the CCPA/CPRA

The CCPA/CPRA provides California residents with specific rights regarding their personal information. If You are a resident of California, You have the following rights:

The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
The right to know/access. Under CCPA/CPRA, You have the right to request that We disclose information to You about Our collection, use and disclosure of personal information. Once We receive and confirm Your request, We will disclose to You:
- The categories of personal information We collected about You
- The categories of sources for the personal information We collected about You
- Our business or commercial purposes for collecting that personal information
- The categories of third parties with whom We share that personal information
- The specific pieces of personal information We collected about You
The right to opt out of sale or sharing. You can opt out of the Website's sharing (and any sale) of Your personal information at any time with "Your Privacy Choices" at the bottom of every page of the Website, at https://listen.mellotonestudios.com/privacy-choices, with the "Advertising on Meta" switch under Settings > Privacy preferences, or by emailing contact@mellotonestudios.com. You do not need an Account. A Global Privacy Control signal from Your browser counts as Your opt-out for that browser and, if You are signed in, for Your Account, and the Website shows "Opt-out request honored" when it receives one. In the Android app, from version 7.0367, turning Ad measurement off in the Application's Settings, under Privacy preferences, stops the Application's sharing and targeted advertising; outside the European Economic Area, the United Kingdom and Switzerland, turning only Ad personalization off does not (see "Ad measurement on Android").
The right to limit use of sensitive personal information. The only sensitive personal information We collect is the wellness goal You choose during onboarding and, on the Website, the login of Your Account. We use the goal only to provide and improve the Service and not to infer characteristics about You, and the login only to sign You in, so this right does not apply to them. You can still ask Us to delete them.
The right to correct Personal Data. You have the right to correct or rectify any inaccurate personal information about You that We collected. Once We receive and confirm Your request, We will use commercially reasonable efforts to correct (and direct our Service Providers to correct) Your personal information, unless an exception applies.
The right to delete Personal Data. You have the right to request the deletion of Your Personal Data under certain circumstances, subject to certain exceptions. Once We receive and confirm Your request, We will delete (and direct Our Service Providers to delete) Your personal information from our records, unless an exception applies. We may deny Your deletion request if retaining the information is necessary for Us or Our Service Providers to:
- Complete the transaction for which We collected the personal information, provide a good or service that You requested, take actions reasonably anticipated within the context of our ongoing business relationship with You, or otherwise perform our contract with You.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Enable solely internal uses that are reasonably aligned with consumer expectations based on Your relationship with Us.
- Comply with a legal obligation.
- Make other internal and lawful uses of that information that are compatible with the context in which You provided it.
The right not to be discriminated against. You have the right not to be discriminated against for exercising any of Your consumer's rights, including by:
- Denying goods or services to You
- Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties
- Providing a different level or quality of goods or services to You
- Suggesting that You will receive a different price or rate for goods or services or a different level or quality of goods or services

Exercising Your CCPA/CPRA Data Protection Rights

In order to exercise any of Your rights under the CCPA/CPRA, and if You are a California resident, You can contact Us:

By email: contact@mellotonestudios.com

Only You, or a person registered with the California Secretary of State that You authorize to act on Your behalf, may make a verifiable request related to Your personal information.

Your request to Us must:

Provide sufficient information that allows Us to reasonably verify You are the person about whom We collected personal information or an authorized representative
Describe Your request with sufficient detail that allows Us to properly understand, evaluate, and respond to it

We cannot respond to Your request or provide You with the required information if We cannot:

Verify Your identity or authority to make the request
And confirm that the personal information relates to You

We will disclose and deliver the required information free of charge within 45 days of receiving Your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary and with prior notice.

Any disclosures We provide will cover the 12-month period preceding the verifiable request's receipt. You may request information beyond that period for personal information collected on or after January 1, 2022, and We will provide it unless doing so proves impossible or would involve a disproportionate effort.

For data portability requests, We will select a format to provide Your personal information that is readily usable and should allow You to transmit the information from one entity to another entity without hindrance.

Because the Application has no accounts, We may ask You for information from Your Device (such as the Support ID shown in the Application's Settings, or Your purchase details) to locate the data associated with Your installation. For the Website, if You have an Account, We may ask You to write to Us from its email address.

"Do Not Track" Policy as Required by California Online Privacy Protection Act (CalOPPA)

Our Service does not respond to Do Not Track signals.

On the Website, a Global Privacy Control signal from Your browser turns usage analytics, error reports and Our campaign record off, and the Website does not ask You about them, unless You turn usage analytics or error reports on yourself in Settings > Privacy preferences (a switch You turned on before the signal also stays on). While usage analytics are on, Our campaign record is kept again, except where Advertising on Meta may run: there a Global Privacy Control signal also keeps the record off unless You turn Advertising on Meta on yourself while the signal is on. A Global Privacy Control signal also turns Advertising on Meta off and counts as Your opt-out of sale and sharing, as described in part E of "The Website".

When You use the Website, other companies may collect information about Your activity over time and across different websites only in these cases: where Advertising on Meta is on, Meta's Pixel collects information on a few pages, which Meta uses together with what it collects on other websites and apps (see part E of "The Website"); when You open the checkout, Stripe's code collects information about Your browser and Device to prevent fraud, under Stripe's privacy policy, and Stripe may use it together with what it collects on other websites that use Stripe; and if You sign in with Google, Google's sign-in code and pages handle that sign-in under Google's own privacy policy. Google Firebase, Mixpanel, Sentry and RevenueCat process the Website's data only on Our behalf.

In the Android app, from version 7.0367 and while Ad measurement is on, AppsFlyer, Google and Meta may collect information about Your use of the Application, which Google and Meta can use together with what they collect in other apps and on other websites (see "Ad measurement on Android").

However, some third party websites do keep track of Your browsing activities. If You are visiting such websites, You can set Your preferences in Your web browser to inform websites that You do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of Your web browser.

Your California Privacy Rights (California's Shine the Light law)

Under California Civil Code Section 1798 (California's Shine the Light law), California residents with an established business relationship with us can request information once a year about sharing their Personal Data with third parties for the third parties' direct marketing purposes. We do not share Personal Data with third parties for their direct marketing purposes.

If you'd like to request more information under the California Shine the Light law, and if You are a California resident, You can contact Us using the contact information provided below.

Children's Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers.

If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this Privacy Policy. For material changes, We will also provide a prominent notice in the Application, on the Website or on this page before the change becomes effective.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, You can contact us:

By email: contact@mellotonestudios.com