Privacy Policy — TinySongs

1. Who we are

N5 Labs ("we", "us") is an independent iOS developer. TinySongs is an iPhone app that converts short typed messages into roughly 30-second AI-generated songs you can share.

2. What happens to the message text you type

• When you tap to generate a song, the text you typed (your "lyrics"), the chosen vibe, and an anonymous subscription identifier (see section 4) are sent over HTTPS to our Cloudflare-hosted proxy.
• The proxy forwards the lyrics, vibe, and a style prompt built from them to Google's Gemini API (the Lyria 3 music-generation model at generativelanguage.googleapis.com), which returns the song audio.
• We do not store your message text or the generated song on our servers. The proxy discards the request body once the audio is returned and only retains aggregated counters (see section 4) keyed by your anonymous subscription identifier.
• We do not send your message text to analytics (no PostHog, Mixpanel, Amplitude, or similar event includes the lyrics).
• Google processes the text per their own privacy terms and may retain it transiently for service operation, safety, and abuse prevention. See "Third-party services" below.
• All audio generated by Google Lyria 3 includes an inaudible SynthID watermark identifying it as AI-generated. This is a standard transparency feature applied by Google to all Lyria output and cannot be disabled.
• If you use the on-device fallback engine (when the network or our proxy is unavailable), the audio is generated entirely on your iPhone and the text never leaves your phone.

3. Information the App does not collect or transmit

• No name, address, email, phone number, or government identifier.
• No precise location data.
• No contacts, calendar, microphone, photos, or health data. (TinySongs does not request access to any of these.)
• No social-login or third-party account data.
• No advertising identifiers (IDFA / IDFV). We do not request App Tracking Transparency permission because we do not track.
• No third-party advertising or behavioral profiling SDKs.

4. The minimal data we do use

• Anonymous subscription identifier — RevenueCat assigns the App a random UUID (the "app user ID") that is not derived from any personal information. This ID is sent to RevenueCat to validate your subscription status, and also to our proxy each time you generate a song so we can enforce per-user free / Pro limits and rate limits. We never see your name, Apple ID, or payment details.
• Aggregated usage counters — our proxy stores anonymous counters keyed by the app user ID above: how many songs you have generated today, your lifetime free-song count, and a short-lived cooldown timestamp. These counters are used solely to enforce the limits described in our Terms of Use and are deleted automatically after 26 hours (daily counters) or kept for the duration of your installation (lifetime counter).
• IP-based rate-limit counters — our proxy also stores short-lived counters keyed by the IP address that initiated the request, to throttle abuse. These expire after at most 26 hours.
• Subscription status via RevenueCat and the Apple App Store. Apple handles all payment information; we never see card or payment details.
• On-device-only state (your history of generated songs, your onboarding state, the file containing the audio for each song) stays on the device using Apple's local storage. It is never uploaded.
• Generated audio is saved to your device's app sandbox. It stays on your device unless you choose to share it via the native iOS share sheet.

5. Subscriptions

TinySongs is free to download with one free song generation. An optional "TinySongs Pro" subscription unlocks additional generations. Pricing is shown in the App at checkout and may include an introductory free trial. Purchases are processed by Apple; renewals, refunds, and cancellations are managed via your Apple ID account settings or via the App's built-in subscription management view. We do not have access to your payment details.

6. Third-party services

• Apple App Store — purchase, refund, and renewal of subscriptions.
• RevenueCat — subscription validation and entitlement management. Receives the anonymous app user ID and your purchase status. RevenueCat privacy policy.
• Google AI (Gemini API / Lyria 3) (via our Cloudflare-hosted proxy) — generates the song audio from your typed lyrics. Your typed message, the chosen vibe, and a style prompt are transmitted to Google to produce the audio. Google processes the request per their privacy policy and the Gemini API additional terms. We do not pass your name, account, or device identifier alongside the text.
• Cloudflare Workers — hosts our proxy and the anonymous usage counters that enforce per-user and global rate limits. Cloudflare's standard request logs may include the IP address that initiated the request. Cloudflare privacy policy.

7. Data retention and your rights

Because we do not store your message text or generated audio on our servers, there is nothing for us to delete server-side regarding your content. Anonymous usage counters keyed by your app user ID expire automatically as described in section 4. RevenueCat retains subscription records as long as your subscription is active and for a reasonable period afterward for tax / compliance purposes. To request review, correction, or deletion of any record associated with your subscription, email support@n5labs.com and we will respond within 30 days.

Depending on your jurisdiction (EU/EEA under GDPR, California under CCPA/CPRA, Israel, UK), you have the right to access, correct, delete, port, restrict, or object to processing of your data, and to lodge a complaint with your data protection authority. Use the email above to exercise these rights.

8. Data security

Data in transit (your typed message to our proxy, our proxy to Google, audio back to your device, subscription receipts to Apple and RevenueCat) is protected by industry-standard TLS. The on-device portion of the App is protected by the iOS sandbox. Server-side credentials (Google API key, RevenueCat secret key) are stored as Cloudflare Worker secrets, never embedded in the App binary. No method of transmission or storage is 100% secure; we apply commercially reasonable safeguards.

9. Children

TinySongs is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has used the App, contact support@n5labs.com.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the effective date at the top and, where required, notify you in the App. Continued use of the App after a change constitutes acceptance.

11. Contact

Developer: N5 Labs
Email: support@n5labs.com