Privacy Policy

1. Information We Collect

Depending on how you use the App, we may collect or process the following:

• Account information. If you choose to sign in, we use Sign in with Apple or Sign in with Google. We receive a unique provider identifier and, where you permit it, your email address and name. Accounts are created and managed through Amazon Cognito on our behalf. Signing in is optional; you may continue as a guest.
• Token balance and service usage. The App uses a token allowance to meter processing-intensive features. We keep a record of your token balance, grants, and the processing jobs you run, associated with your account or your device.
• Images you select. Images you choose (for example, to recognize an album cover) may be uploaded for processing.
• Audio you select. Audio files or portions of audio files you choose may be uploaded for processing (for example, for stem separation or waveform generation).
• Device and integrity information. We generate an app-specific device identifier and may use platform integrity services — Apple App Attest on iOS and Google Play Integrity on Android — to confirm requests come from a genuine, unmodified app. This helps prevent fraud and abuse of the free service.
• Security and audit logs. Our servers record technical request information such as IP address, timestamps, and request metadata for security, abuse prevention, and operational diagnostics.
• Diagnostics and crash data. We collect anonymous usage, performance, and crash information, which may include device model, operating system version, and app state at the time of an error.

2. How We Use Information

We use the information described above to:

• Provide, operate, and maintain the App’s features
• Create and manage your account and authenticate your sign-in
• Process images and audio using automated and AI-based functionality
• Operate the token allowance, including granting, metering, and replenishing tokens
• Protect the service from fraud, abuse, and unauthorized use
• Enable sharing and export features
• Understand how features are used and improve performance, reliability, and user experience

We do not use your information for advertising, and we do not track you across other apps or websites.

3. Legal Bases for Processing (UK GDPR)

Where UK or EU data protection law applies, we rely on the following legal bases:

• Performance of a contract — to provide the features you request, manage your account, and operate the token service.
• Legitimate interests — to keep the service secure, prevent abuse of the free allowance, and improve the App. We balance these interests against your rights.
• Consent — where required, for example when you grant access to your email and name during sign-in. You can withdraw consent by signing out or deleting your account.

4. Sign in with Apple and Sign in with Google

When you sign in, the provider returns a unique identifier for your account and, if you allow it, your email address and name. We use this only to create and identify your account. We never receive your Apple or Google password. If you use Apple’s “Hide My Email” feature, we receive a private relay address rather than your personal email.

5. Uploads and Remote Processing

When you use features that require processing, the images or audio you select are transmitted from your device to our cloud infrastructure (hosted on Amazon Web Services) and processed using automated and AI-based systems to deliver the requested result. Uploads occur only when you initiate them through the App.

6. Third-Party Services

We rely on trusted third-party providers to operate the App. They process data only to provide services on our behalf, under their own privacy and security practices, and we do not permit them to use your content for their own purposes. These include:

• Amazon Web Services — cloud hosting, storage, account management (Amazon Cognito), and AI/audio processing.
• Apple — Sign in with Apple, App Attest, and the Apple Music API.
• Google — Sign in with Google and Google Play Integrity.
• Firebase / Crashlytics (Google) — crash reporting, performance diagnostics, and remote configuration.
• RevenueCat — purchase and entitlement management. In-app purchases are not enabled in the current release; where the RevenueCat SDK initializes, it uses an anonymous, app-generated identifier and is not linked to your personal identity.
• YouTube (Google) — embedded video playback for preview features.

7. Apple Music API

The App accesses the Apple Music API using a developer token to enable music-related features. We do not collect, store, or have access to Apple Music account credentials or personal Apple ID information.

8. Analytics and Crash Reporting

We collect anonymous, aggregated data about how the App’s features are used and how the App performs, including feature usage, performance metrics, and crash reports. Crash reports may include technical information about your device, operating system version, and app state at the time of the crash. This information is used solely to improve functionality and reliability, is not used for advertising, and is not used to identify you.

9. International Transfers

We are based in the United Kingdom, and our service providers may process your information in the United States and other countries. Where information is transferred outside the UK or EEA, we rely on appropriate safeguards, such as the providers’ standard contractual clauses and equivalent protections.

10. Data Retention

Uploaded images, audio, and processed results are retained only for as long as necessary to provide the requested features, and may then be deleted, anonymized, or aggregated. Account information and token records are retained while your account is active. Security and audit logs are kept for a limited period for fraud prevention and operational purposes. We may retain certain information longer where required for legal, security, or legitimate operational reasons.

11. Your Rights and Choices

Subject to applicable law, you have the right to access, correct, delete, or restrict the processing of your personal data, to object to processing, and to data portability. To exercise these rights:

• Delete your account. You can delete your account and associated personal data from within the App (in the account settings). Deleting your account removes your account record; some information may be retained in anonymized form or where required by law.
• Sign out at any time to stop using account-based features.
• Contact us at the address below to make any other request.

If you are in the UK or EEA and believe we have not handled your data properly, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local supervisory authority.

12. Data Security

We take reasonable technical and organizational measures to protect information from unauthorized access, loss, misuse, or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children’s Privacy

The App is not intended for children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided information through the App, please contact us and we will take appropriate steps to address it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes become effective when the updated policy is made available within the App or on our website. Continued use of the App after changes take effect constitutes acceptance of the updated policy.

15. Contact

If you have questions or concerns about this Privacy Policy, or wish to exercise your data rights, please contact us at:
Curious Forms Digital Ltd.
[email protected]