Tondo Privacy Policy

This policy applies to Tondo: Stemplayer 1.0 for iPhone and iPad, the Tondo product and privacy pages on adaline.software, and optional support correspondence. Tondo requires no account sign-in and has no advertising or enabled Community service for browsing or publishing songs. It offers an optional monthly Tondo Pro subscription through Apple, with RevenueCat providing subscription services as described below.

• Tondo product page and support ↗

Tondo separates imported audio into vocals, drums, bass, and other instruments on your device using models included with the app. Imported recordings and separated stems are not uploaded to a separation server or sent to Timon Harz. Separation and playback of saved audio can work offline. Apple music services and subscription purchases, restores, and status refreshes use an internet connection.

The app saves the four stems and song information in its local storage. Song information can include title, artist, album, recording identifiers, preview source, and artwork URL. It also stores waveform and lighting analysis, selected colors, import mode, walkthrough completion, and a small recovery record for interrupted experimental imports. These local records are not sent to an Adaline service.

Searching for a preview sends the search text and a country code from your device’s region setting to Apple’s iTunes service. Selecting a Music-library song to find its preview sends its catalogue identifier or a search formed from its title and artist. This uses the selected song’s information; Tondo does not upload your music library. The region code does not come from GPS.

Choosing a preview downloads that excerpt from Apple’s servers. With Music permission, importing audio can also look up its catalogue identifier, ISRC recording identifier, or title and artist through MusicKit to find song details. Artwork is downloaded from Apple’s services. These requests disclose ordinary network information, including your IP address, to Apple and its delivery services. Audio itself is not sent for metadata matching.

The iTunes search and preview client uses temporary network sessions without cookies or a persistent response cache. MusicKit and the system artwork loader have their own network and caching behavior. Apple controls its service-side processing and retention under the notices below; Tondo does not receive Apple account credentials. Links to Apple Music or iTunes open services governed by Apple’s terms.

• Apple Privacy Policy ↗
• Apple Music & Privacy ↗

Importing, separating, playing, and mixing songs remain available without a subscription. Tondo Pro adds mix export, speed and reverb controls, and appearance customization. Apple processes subscription purchases and payments through the App Store and StoreKit. Tondo and RevenueCat do not receive your payment card details or Apple Account password.

RevenueCat, Inc. processes subscription data on Adaline’s behalf to check Pro access, validate and restore purchases, and provide subscription reporting and analytics. The app initializes RevenueCat and requests subscription status and available offers when it opens, even if you have never subscribed. This uses a randomly generated app user identifier. RevenueCat receives purchase and subscription history, transaction or receipt information, product identifiers, and subscription status and dates when available.

Requests also include app and SDK versions, operating-system version, device model, language preferences, storefront country, and Apple’s vendor device identifier (IDFV) when available. RevenueCat receives ordinary network information, including your IP address, and can record when the app last contacted its service. Tondo does not send RevenueCat your audio, separated stems, song library, name, or email address. The app stores subscription information locally to check access when offline; purchases, restores, and fresh status checks require a connection.

You can restore purchases in Tondo and manage or cancel your subscription in your Apple Account subscription settings. Deleting a song or the app does not cancel a subscription or delete Apple’s or RevenueCat’s records. For a request about subscription data handled on Adaline’s behalf, contact hello@adaline.software; we may need limited transaction information to locate the randomly identified record. Do not send payment card details or your Apple Account password.

• App Store & Privacy ↗
• RevenueCat Privacy Policy ↗
• RevenueCat Data Processing Addendum and subprocessors ↗

Music access lets Tondo read information about songs you select, find matching previews, import eligible downloaded audio, and look up song details. You can change this permission in Settings → Privacy & Security → Media & Apple Music. If you decline, you can still import from Files and search iTunes previews directly. The Files picker gives the app access to the audio you choose.

Device orientation changes the light on the player. Motion readings are used in memory for this visual effect and are not saved or transmitted by Tondo. The app does not request microphone, camera, contacts, or location access.

Choose Delete session in a song’s library menu to remove its saved stems, metadata, and analysis. The original source file, exported copies, and copies in backups are managed separately. Appearance preferences, including colors previously assigned to a song, can remain in local preferences after a session is deleted.

Exporting creates a stereo WAV and opens the system share sheet. The destination you choose controls the exported copy; a cloud storage or messaging app may upload it. Temporary import and export files may remain in system-managed temporary storage after use, so deleting a saved session does not promise immediate removal of every temporary copy.

Delete App removes Tondo’s local app data; Offload App can preserve it. Your device’s backup settings can include saved app data in iCloud or computer backups, and restoring a backup may restore that data. Tondo does not operate its own cloud-sync or backup service. Timon Harz cannot access or remotely delete your local library, exports, or personal backups.

Tondo has no advertising or cross-app advertising tracking SDK. RevenueCat provides the subscription reporting and analytics described above; the app has no separate general-purpose analytics or crash-upload SDK. Technical status and error information is written to the device’s system log. The app’s audio models run locally and do not send recordings to their providers.

Depending on your Apple analytics-sharing settings, Apple may collect and share crash, performance, or usage reports with the developer to help diagnose problems. You control this in Settings → Privacy & Security → Analytics & Improvements. Diagnostics you choose to send with a support request are handled with that correspondence.

If you email hello@adaline.software, Timon Harz receives your sender address, any name you provide, subject, message, chosen attachments, timestamps, and ordinary mail-routing metadata. Your mail app and provider send the message. Tondo does not automatically attach recordings or diagnostics. Send only what is needed to explain the issue; a music file is not required for an initial report.

The support mailbox uses Microsoft 365 supplied through GoDaddy. GoDaddy administers the purchased email service and Microsoft provides the email platform. These providers process email content and attachments to deliver the service and may process operational, security, and service information under their applicable terms.

• GoDaddy Privacy Notice ↗
• GoDaddy Microsoft 365 Terms ↗
• Microsoft Privacy Statement ↗

The Tondo product page and this policy are delivered through Cloudflare for hosting, content delivery, availability, and security. Cloudflare can process your IP address, browser and device information, requested URL and referrer, timestamps, status codes, and network or security information needed to deliver and protect the site.

Adaline adds no visitor analytics, advertising, profiling, forms, tracking cookies, remote fonts, or third-party client scripts to these pages. Your English or German language choice is saved in your browser’s localStorage as adaline-language. It is used to remember the display language, is not sent to an Adaline server, and remains until you change it or clear the site’s browser data.

Cloudflare processes some information on Adaline’s behalf and determines other security and service processing independently. Following an external link opens a service with its own privacy practices.

• Cloudflare Privacy Policy ↗
• Cloudflare Data Processing Addendum ↗
• Cloudflare subprocessors ↗

Local audio processing provides the app functions you request. Optional Music access is controlled through the system permission described above. Apple determines the purposes and legal bases of its independent service processing; granting a system permission does not authorize Adaline to upload your recordings.

Processing needed to purchase, provide, or restore Tondo Pro relies on performance of a contract or your requested pre-contractual steps under Article 6(1)(b) GDPR. Subscription-status checks, including for free users, and subscription reporting rely on the legitimate interest in correctly managing access and understanding subscription operation under Article 6(1)(f) GDPR. You may object as described under Your rights below.

Support correspondence is used to answer, resolve, secure, and minimally document your request. The legal basis is the legitimate interest in providing support under Article 6(1)(f) GDPR. Website request data is processed under the same provision for reliable and secure delivery. If a specific legal obligation requires retention, Article 6(1)(c) GDPR may apply. The service providers determine their own legal bases where they act independently.

Subscription records are kept as needed to verify and restore access, handle purchase or support disputes, and meet applicable legal obligations. Tondo does not schedule automatic deletion of RevenueCat records when you stop using or uninstall the app. You may request deletion through the contact above; records that must be retained for legal reasons and provider-controlled backups can remain. Apple determines retention of its purchase records under its own notice.

A support request is resolved 30 days after the final substantive reply if no follow-up arrives. Resolved correspondence is reviewed and deleted monthly, no later than 12 months after resolution. A valid earlier deletion request is honored unless a documented legal hold or legal obligation requires retention.

Deletion covers copies accessible to Timon Harz in Inbox, Sent, Archive, Deleted Items, and recoverable-items areas where available. Provider-controlled backups, security, legal, and service records may persist under the providers’ policies. We cannot delete copies in your mailbox or held by your provider.

Adaline creates no separate visitor profile or application-level visitor log for these pages. Cloudflare’s service records follow its applicable agreements and privacy notice. Provider-controlled security, legal, and backup records cannot be directly altered by Timon Harz.

Apple and its delivery services receive the music requests and purchase information described above. RevenueCat and its subprocessors handle subscription data, which Timon Harz can access through RevenueCat’s service. Support correspondence is accessible to Timon Harz or a documented authorized operator, your email provider, GoDaddy, Microsoft, and their service providers as needed. Cloudflare and its subprocessors handle website request data. Public authorities may receive information where disclosure is legally required. Adaline does not sell this information or disclose it for advertising.

RevenueCat is based in the United States and states that customer data is stored in AWS data centers there. Its Data Processing Addendum incorporates EU Standard Contractual Clauses for applicable transfers to countries without an adequacy decision and lists its subprocessors. The linked documents describe these arrangements; they do not mean that every listed subprocessor receives every Tondo user’s data.

These providers operate internationally, including in the United States. Their linked privacy and data-protection documents explain applicable safeguards, which may include adequacy decisions, Standard Contractual Clauses, and Data Privacy Framework participation. You can request information about safeguards relevant to Adaline’s processing at the contact address above. Your own export destination and email provider govern their separate processing.

Subject to applicable conditions, you may request access, correction, deletion, restriction, or data portability, and object to processing. Where processing relies on consent, you may withdraw it for the future. Email hello@adaline.software with the subject “Privacy request”. A reply from the same address normally verifies you; we request only necessary additional information if there are reasonable doubts.

An objection to processing under Article 6(1)(f) GDPR stops that processing unless compelling legitimate grounds override your interests and rights, or it is needed for legal claims. We answer requests within one month; a necessary extension of up to two further months is explained within the first month. We explain limits on accessing device-only or provider-controlled data and, where possible, forward valid requests through the provider’s privacy process.

You may complain to a competent supervisory authority. The controller’s local authority is the State Commissioner for Data Protection and Freedom of Information Mecklenburg-Vorpommern. Its postal address is Schloss Schwerin, Lennéstraße 1, 19053 Schwerin, Germany.

Tondo does not use personal data for profiling or automated decisions with legal or similarly significant effects. Its audio-separation models process your recording to produce stems. Service providers may perform independent automated security processing described in their notices.

For support or privacy questions, email hello@adaline.software or write to the controller above. This policy is effective from 24 September 2026. Changes to the app, support, or website practices will be reflected here with a revised date. Any future Community service would require an updated notice before it is enabled.