Privacy Policy

1. Private cloud inventory and essential processing

ToneWood is an account-based cloud inventory service. Registration and sign-in process email, account identifiers and credentials. We store profile fields and avatars you provide to operate your account. Materials and measurements are saved in Supabase for inventory, sync, calculations and history. The updated app asks you to acknowledge cloud storage before entering your inventory. This acknowledgment does not authorize contribution or publication.

Private records include internal and external IDs, batches, names, wood identification, use, part, appearance grade, lineage, geometry, weight, conditions, five tap frequencies and Q values, results, calculation versions, numerical chart previews and notes. Authorized service staff may handle necessary private records for support, security, maintenance and account operations, not automatically for scientific validation or public sharing.

The current measurement flow analyzes microphone audio on-device and does not upload raw audio files for contribution. Numerical spectra, waveforms or decay previews may be saved in your private measurement history. Images you upload, such as avatars, and any audio saved by older versions remain account-managed files. Microphone, camera and photo permissions are not material-sharing consent.

2. Optional: reference statistics and scientific validation

Off by default. After you explicitly enable it, existing and future materials’ selected measurements may enter reference statistics and controlled numerical scientific validation to study wood acoustics, compare split pieces, and validate and improve ToneWood methods. Your full private remeasurement history is not automatically shared.

Percentile cohorts use the same instrument use and part, regardless of species. Metrics may include density, sound speed, Young’s modulus, Q, damping and scores. Density references may also aggregate by part. Each percentile requires at least 20 other eligible reference materials. This is a small-cohort product and statistical rule, not a guarantee of anonymity or representativeness.

Authorized validators may read external material identifiers, wood classification, split relationships, geometry, weight, five fundamental frequencies and Q values, conditions, acoustic results and calculation versions, without contributor names or emails. Internal numbers, batches, notes, images, audio, waveforms and full spectra are excluded. Controlled validation is not a public dossier.

Declining does not restrict material creation, measurement, history or reference comparisons. Consent covers existing and future selected records without repeated prompts for the same scope. Expanded purposes, sharing or a materially changed consent version require a new choice.

3. Optional: identity-hidden chart points

Off by default and independent of statistics. If enabled, global acoustic charts may show selected density, sound speed, modulus, Q/damping, wood classification, use and part for existing and future materials. Responses omit account and material identifiers, private labels, batches, notes, audio, images, waveforms, full spectra and private history.

Each chart scope randomly samples up to 1,000 eligible points, returning all if fewer exist. The app may also show your own private materials to you; that does not share them with others. Identity-hidden is not irreversible anonymization: source records remain account-linked, and distinctive measurements may be recognizable.

This does not publish a dossier. You can disable it in Profile → Privacy & Data or contribute statistics without individual chart points.

4. Optional: per-material public dossiers

Each material is private by default. Publication has its own explanation and explicit confirmation; reference consent cannot replace it. App and website visitors may then view its external ID, classification, use, part, dimensions, weight, conditions, acoustic results and available representative spectrum. Account identity, internal numbers, batches, notes, photos, raw audio, waveforms and private history are not published.

Withdraw a dossier in its detail page or withdraw all in Privacy & Data. Disabling contribution does not unpublish dossiers, and vice versa. Remeasurement preserves the material’s current publication choice; selecting historical results cannot restore a withdrawn publication.

Legacy public flags are not treated as agreement to this notice. At the transition, those materials become private until explicitly republished. Third parties may have copied previously public data, and we cannot recall their copies.

5. Separate optional usage events

Usage sharing has a separate, default-off choice and is not included in acoustic contribution consent. After opt-in we record steps, actions, missing-field categories, recording/save outcomes, foreground duration, app version, language, device class, orientation and text-size category to diagnose workflow difficulties and improve the interface.

Events are account-linked for deduplication and deletion but exclude audio, images, material values, notes and free text. Without separate contact permission, authorized administrators access controlled summaries and journeys without account identity or material content. Events are not used for advertising or cross-service tracking.

“Allow contact about usage difficulties” is a separate, optional, default-off permission (contact notice version 1). With usage sharing enabled, you may additionally allow authorized website administrators to link existing retained and future journeys to your account email only to help with usage difficulties, not for marketing. Email is read from account services when needed, not stored in events or published. Disabling contact permission or usage sharing hides email from subsequent journey queries; enabling usage sharing again does not restore contact permission. Previously viewed information or sent emails cannot be recalled. Manage this choice in App Profile or website My Materials → Privacy & Contact.

6. Optional: how you heard about ToneWood

The updated main app offers an optional “Where did you hear about ToneWood?” entry in Profile. You choose the source category yourself; it is unanswered by default and can be skipped, changed or cleared at any time. Not answering does not restrict registration, inventory, measurement or other core features, and does not enable usage sharing or advertising tracking.

Your answer is linked to your account identifier and reporting time. Only you and platform administrators can view it, to understand how people discover ToneWood and the overall distribution of reported sources. It is self-reported, not a verified download source, and contains no free-text response. It is generally retained until you clear it or delete your account; account deletion removes this record too. Clearing requires server confirmation. If a request fails, the last confirmed answer remains visible with a retry message.

App Store download-source reports, such as search, browse, web or app referrals, are aggregate reports from Apple. We do not match these reports to registered users’ email addresses or use them to infer an individual user’s source. This source feature does not read advertising identifiers or create or use device fingerprints.

7. Retention, withdrawal, deletion and security

Private account content is generally retained until you delete materials or your account. Split families are retained together for traceability and some members cannot be deleted individually. Account deletion removes the family, history, consent preferences and consent events, linked App validation copies and account-owned files. Contact the address below for access, correction, export or deletion requests.

The server records scope, notice version and decision time to implement and evidence your choices. On successful withdrawal, the relevant sharing endpoints exclude your materials, percentiles and quality caches are recomputed, and linked material copies in other validators’ records are removed. Your private measurement history is retained. Material deletion also removes linked validation copies. Completed genuinely non-identifying summaries and third-party copies of public content may not be retrospectively retractable.

Withdrawal requires server confirmation. If a request fails, the device records the withdrawal intent and clearly shows a pending state to retry after reconnection. Existing server sharing may continue until it succeeds. Failed publication withdrawal also requires retry rather than being presented as successful.

Optional usage events are purged daily on a 90-day window. Offline event queues remain on-device for at most 24 hours. Disabling usage sharing does not erase previous events; Profile offers a separate deletion choice. Account deletion removes events too.

Backups may remain within provider rolling backup and recovery cycles until expiry or legally required removal; restored backups must not re-enable withdrawn sharing. We use access controls and reasonable safeguards but cannot guarantee absolute security. Support can confirm deletion status and applicable backup retention.

8. Operator, overseas recipients and separate choices

ToneWood is operated by 北京大陆漂移文化科技有限公司. Contact support@tone-wood.org about your data. Supabase Pte. Ltd. (Singapore; privacy@supabase.com) provides authentication, database and file storage as a processor. Our project database, core account information and files are hosted in Seoul, South Korea. Requests may also pass through our Tencent Cloud relay in Singapore. Website hosting providers and Apple, when you use Sign in with Apple, process the information needed for their services.

Cross-border processing includes email, sign-in credentials or Apple tokens, account and studio details, uploaded images, saved materials and measurements, privacy choices, and necessary network/security information such as IP addresses. Purposes are authentication, private cloud inventory, sync, storage, support and security. Current measurements analyze sound on-device without uploading raw recordings. Contribution, publication and optional usage analytics remain separate choices.

Supabase logs, support, operations or content delivery may be processed outside the selected project region. Seoul hosting does not mean every processing operation stays in South Korea. Its Data Residency and Transfers FAQ and privacy policy explain these locations and safeguards. We use HTTPS and account access controls; overseas laws and protections may differ from yours.

The updated iOS app presents a separate cross-border choice before sign-in and cloud requests. It starts off; previous cloud-storage or contribution consent does not imply this choice. Declining pauses sign-in and cloud inventory on that device; there is currently no offline inventory mode. You may still read this policy, contact support or use the separate account-deletion action when a saved account exists.

Withdraw this device’s consent in iOS Profile → Cross-border data. Withdrawal pauses future cloud requests on that device without deleting existing records or changing other devices. If the withdrawal record cannot sync, the app shows a pending message and retry. Request access, correction, export or deletion through support@tone-wood.org or contact the overseas recipient at privacy@supabase.com; we will assist with relevant requests.

We record the notice version, accepted/withdrawn decision, decision identifier and server timestamp against your account for privacy-choice evidence and rights requests. These records contain no material content, are readable only by that account, and are removed on account deletion. Cross-border consent does not authorize public sharing, contribution or usage analytics. We do not sell personal information or use advertising-tracking SDKs.

We may disclose information as legally required or necessary to protect users and service security. ToneWood serves luthiers and materials professionals, not children under 13. Device permissions can be withdrawn; account deletion is available in Profile and the updated initial cloud notice without agreeing to contribution.

We update the date here and notify material changes, but a policy edit alone does not expand earlier consent. New purposes or material changes in sharing require another explicit choice.