Privacy Policy

This privacy policy describes how Harmofy ("we", "our", "the app") collects, uses, and shares information when you use our Android application.

Summary at a glance

1. What information we collect

1.1 Microphone audio (only when you initiate "Identify Song")

When you tap the microphone button on the Identify Song screen, the app records ~8 seconds of audio from your device's microphone. This audio is sent to one or both of the following third-party services to identify the song:

• AudD (privacy policy) — primary recognition service.
• Google Gemini (Google AI privacy) — used as a fallback if AudD cannot identify the song.

The audio recording happens only while you actively use this feature. The microphone is released as soon as the recording completes. Audio is not retained on our servers because we do not operate any servers; it is sent directly from your device to the third-party service. Each provider's retention policy applies — see their privacy policies linked above.

1.2 Crash diagnostics

The app uses Google Firebase Crashlytics to capture crash reports automatically. When the app crashes, Crashlytics records:

• The stack trace of the crash
• Device model, manufacturer, OS version, and app version
• An anonymous installation ID (a random UUID generated by Firebase, not linked to your Google account)
• The state of your app session leading up to the crash (last few logs, no personal content)

This information is stored by Google in the Firebase project we operate and is used solely to fix bugs.

1.3 Practice progress (stored on your device only)

The app stores the following on your device locally and never uploads it:

• Lessons you've completed
• Exercises you've attempted
• Songs you've played
• Streaks, XP, and badges earned
• Recently identified songs (cache)
• Engine preferences (e.g., recognition engine selection)

This data lives in your app's private storage. Uninstalling the app removes it. We do not back it up to any cloud service. If you change devices, this data does not transfer.

2. What information we DO NOT collect

• Your name, email address, or phone number
• Your physical or precise location
• Your contacts, photos, calendar, SMS, or call logs
• Your IP address (beyond what third-party APIs we call automatically receive as part of any HTTP request)
• Any advertising identifier — we removed AD_ID and ACCESS_ADSERVICES_* permissions explicitly
• Any browsing or web activity outside the app
• Biometric data

3. How we use and share information

3.1 We use the data for:

• Identifying songs you ask us to identify (via the third parties named above)
• Diagnosing crashes and improving the app
• Nothing else

3.2 We share data with:

• AudD and Google (Gemini) — only the audio sample you initiate, only when you tap "Identify Song".
• Google (Firebase Crashlytics) — crash diagnostics.
• Google (Firebase Sessions / Analytics) — anonymous app-installation ID for crash session tagging. We have explicitly opted out of advertising-related Analytics signals (no AD_ID, no ad-services permissions).

3.3 We do not:

• Sell your data
• Share data with advertising networks or data brokers
• Use your data to train any AI model (we are users of Gemini — we do not contribute training data)

4. Children's privacy

Harmofy is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at mohamedosama2929@gmail.com and we will delete it.

5. Your rights

You can:

• Stop all data collection by uninstalling the app. All on-device data is removed. Crashlytics will stop receiving reports.
• Request deletion of your crash data. Email mohamedosama2929@gmail.com with your installation ID (find it in app settings → "About") and we will delete the corresponding records from Firebase Crashlytics within 30 days.
• Disable crash reporting. This is currently not exposed as an in-app toggle. Email us if you need it disabled and we will guide you through clearing app data, which clears the Firebase installation ID.

If you are in the EU, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA, including the right to access and the right to erasure. Contact mohamedosama2929@gmail.com to exercise them.

6. Data retention

• On-device data: retained until you uninstall the app or clear its data.
• Audio sent to AudD / Gemini: retained per their published policies (we do not store it ourselves).
• Crash diagnostics in Firebase: retained per Firebase Crashlytics defaults (~90 days for individual records, longer for aggregated metrics).

7. Security

• All data sent over the network is encrypted with TLS (HTTPS).
• The app's release builds disable cleartext traffic at the system level (network_security_config.xml).
• No user-installed certificate authorities are trusted in release builds (mitigates MITM attacks on rooted devices).
• The app does not store any credentials or authentication tokens.

8. Third-party services

Below is the complete list of third parties the app contacts. The app does not contact any third party not listed here.

9. Changes to this policy

If we change this policy, we will update the "Last updated" date at the top and post the new policy at the same URL where you found this one. Material changes will be announced in the app's release notes.

10. Contact

For any privacy-related question or request:

Email: mohamedosama2929@gmail.com
Subject: "Harmofy privacy"