Privacy Policy
Last updated: September 19, 2026
Who we are
ToneID ("ToneID", "we", "us", or "our") is operated by Six String Studio, LLC (the "Company"). ToneID is an iOS app that identifies the guitar tone behind songs and audio clips. This Privacy Policy covers the ToneID app and the ToneID website at toneid.app (together, the "Service"). Contact: contact@toneadapt.com.
ToneID is designed to work without an account. We do not ask for your name, email address, or password to use the app, and we collect the minimum information needed to identify songs and deliver tone breakdowns.
What we collect and why
- Music taste data (optional). If you connect Spotify or Apple Music, we read your top tracks, recently played songs, and genres to personalize recommendations inside the app. This data is stored on your device. We do not post to your accounts, modify your playlists, or share this data with third parties.
- Microphone audio (optional). When you use the Identify feature, short audio samples are matched against Apple's ShazamKit catalog. This happens on your device through Apple's framework. The audio is not sent to our servers and is not stored by us. Microphone access is only active while you use Identify and can be revoked at any time in iOS Settings.
- Videos you share or choose (optional). When you share a TikTok or YouTube link to ToneID, paste one, or open one in the in-app browser, we send that link to our servers. Our servers download the video's audio, cut a short clip from it, and read the video's public text — its title, description, and hashtags — to work out which song it contains. When you pick a video from your camera roll instead, the video itself stays on your device; the app extracts a short audio clip locally and sends only that clip.
- Song lookups. When you request a tone breakdown, the song title and artist are sent to our servers to return tone data. Lookups are not tied to your identity.
- Purchase and subscription state. Subscriptions are processed by Apple and managed through RevenueCat using an anonymous, randomly generated app user ID. We never see or store your payment card details.
- Usage analytics. We collect anonymized usage events (screens viewed, features used, paywall performance) to improve the app. These events are not linked to your name, email, or any other directly identifying information.
- IP address. Used transiently to rate-limit our own endpoints so they can't be abused. Not used to profile you.
We do not collect your device's advertising identifier (IDFA), the app contains no advertising or ad-attribution SDKs, and we do not track you across other companies' apps or websites. ToneID will never show an App Tracking Transparency prompt because it does not track.
How we identify the song in a video
Identifying a song from a video takes several steps, and some of them involve third parties. In order:
- Apple (ShazamKit). A short clip is matched against Apple's catalog to see whether the video uses an original studio recording. This runs on your device.
- OpenAI. If that finds nothing — which is always the case when someone is playing the song themselves — the video's public title, description, and hashtags are sent to OpenAI to work out which song is being referred to. Song and artist names are also sent to OpenAI to research the guitar tone behind a song we don't already have.
- Google (Gemini). If the video's text isn't enough, a clip of up to 30 seconds of its audio is sent to Google's Gemini to identify the song by ear.
We send these providers the video's audio and public text only. We do not send your name, email, device identifiers, listening history, or anything else that identifies you, and we do not permit these providers to use what we send to train their models.
How we use and share information
We use the information above to:
- Identify songs you share, play, or search for, and return their tone breakdowns;
- Personalize your home feed with tones from music you actually listen to (on your device);
- Process and maintain your subscription;
- Maintain, secure, and improve the Service, including rate-limiting and abuse prevention;
- Respond to your support requests.
We do not sell, trade, rent, or otherwise share your personal information for marketing purposes, and we do not use your data for cross-context behavioral advertising. We share information only with service providers acting on our instructions (listed below); where required by law, subpoena, or other legal process, to enforce our Terms, or to prevent fraud or harm; and, if the Company is ever involved in a merger, acquisition, or sale of assets, as part of that transaction — in which case we will require the successor to honor the commitments in this policy or notify you of material changes.
Third-party service providers
The Service relies on the following providers. We encourage you to review their privacy policies.
| Provider | Service |
|---|---|
| Apple | App Store distribution, in-app purchases, ShazamKit on-device matching, MusicKit / Apple Music access |
| RevenueCat | Subscription management using anonymous identifiers; card data is never visible to ToneID |
| Superwall | Paywall presentation and paywall performance analytics |
| OpenAI | Song identification from public video text; tone research by song and artist name |
| Google (Gemini) | Song identification from extracted audio as a final fallback |
| Spotify | Optional listening-history access you explicitly authorize |
| Vercel | Website and API hosting |
These providers are obligated to use data they process for us only under our instructions.
Spotify data
Spotify data is accessed with your explicit consent using the scopes user-top-read and user-read-recently-played, solely to personalize content shown to you inside ToneID. You can disconnect Spotify at any time in Settings, which stops all access and deletes stored taste data from your device. You can also revoke access at spotify.com/account/apps. ToneID complies with the Spotify Developer Policy and does not use Spotify data for advertising, sell it, or transfer it to any third party.
Apple Music data
Apple Music access is granted through iOS's system permission and is used the same way: read-only, on-device personalization. Revoke it anytime in iOS Settings → Privacy & Security → Media & Apple Music.
What we don't do
- We do not sell your personal data.
- We do not share your listening history with anyone.
- We do not store your Spotify or Apple Music credentials.
- We do not collect your advertising identifier or track you across apps and websites.
- We do not send anything that identifies you to OpenAI or Google — only a video's audio and its public text.
- We do not keep copies of videos. Only a short audio clip is retained, and only for the caching described below.
How we protect information
We use administrative, technical, and physical safeguards designed to protect the information we handle, including encryption in transit (TLS/SSL), access controls on our infrastructure, and anonymized identifiers wherever possible. Because ToneID does not use accounts, there is no ToneID password to steal, and your taste data never leaves your device. No security measures are perfect — these measures do not guarantee that information will never be accessed, disclosed, altered, or destroyed by a breach — but the less we collect, the less there is to lose.
Data retention & deletion
Taste data lives on your device and is deleted when you disconnect a service or delete the app. Saved tones live on your device and are deleted when you remove them or delete the app.
Audio clips cut from a shared video are cached on our servers, keyed to the video rather than to you, so that the same video shared again doesn't have to be downloaded twice. That cache is size-limited and clears itself oldest-first as new videos come through; nothing in it is linked to a person or account. Audio you send from your camera roll is not cached at all — it is used for the one lookup and discarded.
Tone research results are stored indefinitely, keyed to the song, and reused for everyone who asks about that song. They describe guitar equipment, not people.
Server-side lookup logs are retained only as needed to operate the service, in anonymized or aggregated form. Subscription records are retained by Apple and RevenueCat as required by tax and financial regulations. Email correspondence is retained up to 2 years. To request deletion of any data associated with you, email contact@toneadapt.com; because most identifiers we hold are anonymous, we may ask you for details needed to locate the relevant records.
Data breach notification
If a data breach affects information relating to you, we will notify affected users without undue delay — within 72 hours of confirming the breach where required by law — including the nature of the breach, the categories of information involved, the steps we are taking, actions you can take to protect yourself, and any regulator notifications made as required.
Your rights and choices
- Permissions. Microphone and Apple Music access can be revoked anytime in iOS Settings; Spotify at spotify.com/account/apps. The app continues to work without them.
- Personalization. Disconnecting a music service in the app deletes the associated taste data from your device.
- Deletion. Delete the app to remove all on-device data; email us to request deletion of server-side records, subject to legal retention requirements.
- Subscription. Manage or cancel anytime in your App Store account settings or from Settings → Manage Subscription in the app.
Your California privacy rights (CCPA/CPRA)
California residents have the right to:
- Know — request disclosure of the categories and specific pieces of personal information we collected, used, or disclosed in the preceding 12 months;
- Delete — request deletion of personal information, subject to legal exceptions;
- Correct — request correction of inaccurate personal information;
- Opt out of sale or sharing — we do not sell your personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of;
- Non-discrimination — we will not discriminate against you for exercising any of these rights.
In the preceding 12 months, the categories of personal information we have collected are: internet or network activity (song lookups, anonymized usage events, transient IP addresses) and commercial information (subscription status held via anonymous identifiers). We collect no identifiers such as name or email through the app. To exercise these rights, email contact@toneadapt.com; we will respond within 45 days. You may use an authorized agent.
Your rights under GDPR (European users)
If you are in the EEA, the United Kingdom, or Switzerland, we process personal data on these legal bases: your consent (microphone and music-service access), performance of a contract (delivering the Service and your subscription), compliance with legal obligations, and our legitimate interests (securing and improving the Service) balanced against your rights. You have the right to access, rectify, and erase your data; to restrict or object to processing; to data portability; and to withdraw consent at any time without affecting prior processing. We respond within 30 days.
Our servers are located in the United States. Where personal data is transferred from your region to the U.S., we use appropriate safeguards to protect it. You also have the right to lodge a complaint with your local data protection authority.
Children
ToneID is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it within a reasonable timeframe. If you believe a child has provided us personal information, contact contact@toneadapt.com.
Links to other services
Tone breakdowns and shared videos may reference third-party platforms such as TikTok, YouTube, Spotify, or Apple Music. This policy applies only to information collected by the Service; those platforms are governed by their own privacy policies.
Website and cookies
The ToneID website does not use advertising cookies, cross-site tracking pixels, or third-party analytics that identify you. Our hosting provider (Vercel) may process standard server logs — such as IP address and user agent — for security and operations. The app itself does not use cookies.
Changes
We'll update this page if our practices change, with a revised "Last updated" date. Material changes will be noted in the app. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
Contact us
For questions about this Privacy Policy: contact@toneadapt.com
Six String Studio, LLC