Privacy notice

  1. Who we are
    • Selftone is operated by AI Eh By Solutions. You can reach us, including our privacy officer, at contact@ai-eh-by.ca.
    • This notice covers the Selftone web app, the Selftone apps for iOS and Android, the emails and text messages we send, and Selftone share pages.
  2. Information we collect
    • Account: your name, email address, avatar, sign-in provider IDs (Google, Apple) or, for email sign-in, your email address and a password, language and timezone.
    • Voice: the recordings you make and the data we derive from them (12 note scores, 108-bin octave data, average frequency, reports and tracks).
    • Onboarding answers: your goals, best time of day, preferred channels, experience, recording frequency and how you heard about us.
    • Usage: plays and listening time, streaks, badges, reminders, device and browser information, and logs.
    • Contact: your phone number (only if you add text messages), your browser’s push subscription (web app) and your device’s push notification token (iOS and Android apps).
    • Social: who you follow, your followers, cheers and invitations (including the email address or phone number of people you invite).
    • Consent records: what you agreed to, the version of the wording, and the date and time.
  3. The iOS and Android apps
    • Microphone: the apps ask for access to your microphone, and use it only to record your voice when you choose to record in Selftone. You can turn microphone access off at any time in your device’s settings; Selftone then cannot make new recordings.
    • Push notifications: if you turn on notifications, your device gives us a push notification token, which we store with your account to send you reminders. Notifications are delivered through Firebase Cloud Messaging (Google) and, on Apple devices, the Apple Push Notification service. You can turn notifications off in Settings or in your device’s settings, and deleting your account deletes your device tokens.
    • Sign-in: you can sign in with Google or Apple. We receive your email address, your name if the provider shares it, and an ID that links that sign-in to your Selftone account. We never receive your Google or Apple password.
    • No tracking or advertising: the apps contain no advertising or tracking SDKs, do not use your device’s advertising identifier, and do not track you across other companies’ apps or websites. Firebase Analytics collection is turned off.
    • We do not sell your data.
    • You can delete your account in the app (Settings > Delete my account) or at selftone.ca/delete-account (see section 8).
  4. Voice as biometric or sensitive data
    • Recordings and the voice data derived from them may be biometric or sensitive information.
    • We collect them only with your explicit, separate consent, and use them only to create your tracks, reports and progress. We never use them to identify you.
    • We never sell them. We never use them to train artificial intelligence or machine learning models unless you give separate, optional consent, which you can withdraw at any time.
    • We follow a written retention and destruction schedule (see section 8).
  5. How we use information
    • We use your information to provide the service, check recording quality, send reminders according to your choices, produce reports and trends, run social features within your privacy settings, keep Selftone secure, produce aggregate, de-identified statistics and comply with the law.
    • We make no health, emotional or medical inferences, and no automated decisions with legal effects.
  6. Messages
    • We send email and text messages only with your express opt-in (CASL / TCPA), and push notifications only with your browser’s or device’s permission.
    • Push notifications are a separate opt-in: you turn them on with “Turn on notifications”, we record that choice with the date and time, and you choose each type (reminders, streak nudge, cheers from friends) in Settings > Notifications.
    • In the web app, notifications travel through the push service of your browser’s maker: Apple (Safari), Google (Chrome and most Android browsers), Mozilla (Firefox) or Microsoft (Edge). We send that service your browser’s push address and the notification itself (a short title, a short text and the Selftone page it opens), encrypted so only your browser can read it. In the iOS and Android apps, notifications go through Firebase Cloud Messaging (Google) and the Apple Push Notification service.
    • Notifications can appear on your lock screen, so they never contain your recordings, reports, notes or any health or personal detail. When you sign out, we remove that browser’s push address; signing out everywhere or deleting your account removes them all, and addresses not used for 60 days are deleted.
    • Every email has an unsubscribe link, you can reply STOP or ARRET to any text message, and you can change your choices at any time in Settings.
  7. Sharing
    • Service providers that host our data and deliver our emails, text messages and push notifications process information for us under contracts that limit their use of it.
    • Other users see only what your privacy settings allow, and tracks are shared only through share links you create.
    • We may disclose information when the law requires it, or as part of a business transfer, in which case we will notify you.
    • We do not sell your information or share it for cross-context advertising.
  8. Retention and deletion
    • Ask Selftone: we keep your chat with the assistant for 7 days after your last message so you can pick it up again, then delete it; “New chat” deletes it at once. It can change your settings when you ask and never sends anything to another person without your Confirm tap. We also keep which notifications we sent you and which you opened (type and time only) for 14 days to suggest what to do next.
    • We keep your recordings, tracks and reports while your account is active, and delete them when you delete them or your account.
    • We destroy biometric data once its purpose is met or within the maximum period the law allows, whichever comes first.
    • When you delete a recording or your account, we remove it from our active systems promptly and then from our backups. Share links you created stop working, and your followers no longer see your activity.
    • To delete your account, use Settings > Delete my account in the app, or send us a request at selftone.ca/delete-account. That page lists what is deleted and what we may keep.
  9. Your rights
    • You can access, correct, export (JSON and an audio ZIP) or delete your information, withdraw your consent, restrict or object to processing, and complain to a regulator (the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or your state attorney general).
    • You can export or delete your data in Settings, request deletion of your account at selftone.ca/delete-account, or make any request by emailing contact@ai-eh-by.ca. We may ask you to confirm your identity, and we respond within the time the law requires.
  10. Where data is stored
    • We store your information in Google Cloud in Montréal, Canada (region northamerica-northeast1).
    • When your information is stored or processed outside your province, state or country, we protect it with contractual and technical safeguards.
  11. Security
    • We use encryption in transit and at rest, access controls, and signed, revocable share links, and we notify you and the authorities of breaches as the law requires.
  12. Risks
    • No system is perfectly secure. Despite the safeguards above, someone could gain unauthorized access to your account or our systems (for example through a stolen password or a security flaw), and your information could be seen, changed or lost.
    • Your voice recordings are personal information, and voice can be sensitive. Treat recordings and share links like other personal files.
    • We store your information in Google Cloud in Canada, but some services we rely on process information outside Canada, where other laws apply: sign-in (Google, Apple), push notifications (Apple, Google, Mozilla, Microsoft), and, if you use Ask Selftone, Google’s Gemini service on Vertex AI, which receives your messages, a summary of your own Selftone data and the results of the actions you ask for, to write the answer.
    • Notifications can appear on a locked screen, so we keep their text general.
    • To reduce these risks we collect only what Selftone needs, encrypt data in transit and at rest, limit who can access it, keep your account protected with sign-in safeguards, and let you delete recordings or your whole account at any time. If you think your account or data is at risk, contact us at contact@ai-eh-by.ca.
  13. Children
    • Selftone is not intended for children, and we do not knowingly collect information from children.
  14. Changes to this notice
    • We post any changes on this page and tell you about important changes by email or in the app before they take effect.
  15. Contact