Privacy Policy

CymaTones LLC ("CymaTones," "we," "us," or "our") values your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have regarding your personal information when you use CymaTones — including our website, mobile applications, and TV applications (collectively, the "Service").

1. What We Collect

Information You Provide

Information Collected Automatically

2. How We Use Information

We use your information to:

• Provide the Service: create your account, stream frequency tracks, run scans, generate reports, and deliver features you request across web, mobile, and TV apps.
• Personalize your experience: tailor Custom Intelligence dashboards, Cosmos readings, and Custom Playlists based on your preferences and history.
• Process payments: handle subscriptions, one-time purchases, refunds, and billing communications via Stripe.
• Communicate with you: send service announcements, billing receipts, scan-completion notifications, and support responses via Resend.
• Improve the Service: analyze aggregate usage patterns to identify bugs, optimize features, and develop new offerings.
• Security and fraud prevention: detect and prevent abuse, enforce our Terms, comply with law.
• Legal compliance: meet legal, regulatory, and contractual obligations.

We do not use your personal information to train external AI models, nor do we sell or rent your personal information to third parties for their marketing.

3. How We Share Information

We share information only as follows:

• Service providers (subprocessors): trusted third parties that help us operate the Service (see §4).
• Legal requirements: when required by law, court order, or to protect CymaTones' rights, users, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with advance notice where practicable.
• With your consent: when you explicitly ask us to share information (e.g., publishing a public garden or a shared playlist).

We do not sell your personal information.

4. Subprocessors

We work with the following trusted partners to operate CymaTones:

Each partner is bound by a data processing agreement or equivalent contractual protection. We review partners periodically to ensure they meet our privacy and security standards.

5. Voice, Audio & Scan Data

CymaVoice scan (bioscan)

What we do store from bioscans:

• The derived numerical frequency spectrum
• Calculated harmony scores and TCM-based analysis
• Scan date, payment status, and the generated report content

What we do not store from bioscans:

• Raw audio files from your scan
• Waveform data that could be played back to reconstruct your voice

Vision, Tongue, Face, and Nails scanners follow the same principle: images are processed for analysis and only the derived scores / report content are retained.

Voice affirmation recordings (Sanctuary)

Separately from bioscans, the Voice Affirmations feature (Sanctuary → Affirmations) lets you record audio clips of your own affirmations. These recordings are stored on our servers because you replay them yourself. Storage rules:

• Stored in a private, owner-only Supabase Storage bucket (owner-only enforced by row-level security).
• Streamed back to you via short-lived signed URLs; no public URLs are ever generated.
• Never shared with third parties, never used for marketing, never used to train AI models.
• You can delete a recording at any time from the Affirmations page; deletion removes the audio file from storage.

Scrapbook image uploads (Journal)

Photos you upload for your journal scrapbook follow the same owner-only pattern: private Supabase Storage bucket, RLS-gated signed-URL access, no public URLs, no third-party sharing.

6. AI Processing

CymaTones uses AI (currently Anthropic Claude) to enhance scan reports and generate personalized interpretations. When you complete a scan:

1. Your scan data (derived spectrum values, scores, and demographic context if provided) is sent to Anthropic via secure API.
2. Anthropic processes the data and returns an enhanced analysis.
3. Per Anthropic's enterprise terms, your data is not used to train Anthropic's models.
4. Results are stored on CymaTones servers for you to access.

You may opt out of AI-enhanced analysis by contacting us; in that case, you will receive the local (non-AI) version of your report.

7. Cookies & Local Storage

We use cookies and similar technologies to operate the Service. Types we use:

• Essential cookies: required for login, session maintenance, and security (cannot be disabled).
• Preference cookies: remember settings like volume, visual mode, and your timezone (cymatones-tz) so times render correctly.
• Anonymous scan cookies: on public pages, we set a 30-day cyma_anon cookie to associate your scans with your device if you are not logged in.

You can control cookies through your browser settings. Disabling essential cookies will break Service functionality.

Local storage: On public pages, we use your browser's local storage to save your scan history so you can return and review past results. This data stays on your device and is not transmitted to us unless you create an account.

8. Analytics & Tracking

As of the "Last updated" date above, CymaTones does not run third-party analytics, Google Analytics, Facebook Pixel, or advertising trackers on the Service. Basic infrastructure telemetry (request logs, error rates) is collected by Vercel and Supabase for uptime + security purposes only. If we add analytics in the future, we will update this section.

9. Mobile & TV Applications

CymaTones is offered as a website, a mobile application (subject to release), and a TV application (subject to release · currently targeted at Fire TV via the Amazon Appstore).

• On mobile and TV, the platform (Google Play, Apple App Store, Amazon Appstore) may collect its own device identifiers, install/uninstall telemetry, and — for in-app purchases — payment information per that platform's terms.
• The audio/frequency streaming, listening history, scanners, journal, and affirmations all follow the same privacy rules as on the web — private data stays owner-only.
• Microphone access on mobile/TV apps is only used for scan/affirmation features you explicitly initiate. It is never listened to in the background.

10. Data Retention

11. Security

We take security seriously:

• Passwords are stored hashed via Supabase Auth (bcrypt-derived).
• Connections to the Service are encrypted via HTTPS/TLS.
• Database access uses row-level security (RLS) — you only see your own data.
• Private user content (voice affirmations, scrapbook images) is served only via short-lived signed URLs.
• Payment handling is delegated to Stripe, a PCI-DSS Level 1 certified processor.
• Webhook signatures are verified with HMAC to prevent tampering.
• Access to internal admin tools requires a dedicated founder role with audit logging.

No method of transmission or storage is 100% secure. If we become aware of a data breach affecting your information, we will notify you as required by law.

12. Your Rights

You have the right to:

• Access your personal information.
• Correct inaccurate information.
• Delete your account and associated data.
• Export your data in a machine-readable format.
• Opt out of marketing communications (transactional emails continue for active accounts).
• Withdraw consent for optional processing (e.g., AI enhancement).

To exercise any of these rights, email support@cymatones.com. We'll respond within 30 days.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act give you additional rights:

• Right to know what personal information we collect, use, and share.
• Right to delete personal information.
• Right to correct inaccurate personal information.
• Right to opt out of the "sale" or "sharing" of personal information (we do not sell; we do not share for cross-context behavioral advertising).
• Right to limit the use of sensitive personal information.
• Right to non-discrimination for exercising your rights.

To exercise California rights, contact support@cymatones.com. We may need to verify your identity before fulfilling the request.

Shine the Light

California Civil Code § 1798.83 allows California residents to request certain information about our disclosure of personal information to third parties for direct marketing. We do not disclose personal information to third parties for their direct marketing.

14. EU/UK Users (GDPR/UK GDPR)

If you are in the European Economic Area or United Kingdom, the GDPR gives you rights including access, correction, deletion, restriction, portability, and objection to processing of your personal information.

Legal bases for processing:

• Contract: to provide the Service you signed up for.
• Consent: for optional features like Cosmos birth data or marketing emails.
• Legitimate interests: for service improvement, security, and fraud prevention.
• Legal obligation: for tax, accounting, and compliance.

You may contact a supervisory authority in your country if you believe we have violated data protection law. We would appreciate the opportunity to resolve your concern first — please contact support@cymatones.com.

International Transfers

Our servers are primarily located in the United States. By using the Service, you consent to the transfer of your information to the United States and other countries where our service providers operate. We use standard contractual clauses or equivalent safeguards for transfers from the EEA/UK where required.

15. Children's Privacy

CymaTones is not intended for users under 18 years of age. We do not knowingly collect personal information from children under 13 (per COPPA in the U.S.) or under 16 (per GDPR in the EU/UK). If you believe a child has provided us personal information, please contact support@cymatones.com and we will take steps to delete it.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. For material changes, we will notify you via email and/or an in-app notice at least 30 days before the changes take effect where required by law.

17. Contact

Questions about this Privacy Policy or how we handle your information?

• Email: support@cymatones.com
• Mailing address: CymaTones LLC, PO Box 1114, Placerville, CA 95667, USA