Privacy Policy
This policy explains what Tono ("we", "the app") collects, why, and how you can control it. If anything is unclear, email [email protected].
In short: your chat history stays on your device. To answer you, the messages you send pass through our server to an AI model provider. We keep a log of the questions you ask, but not the AI's answers or your images. We do not sell your data, show ads, or use your conversations to train models.
1. Information we collect
- Messages you send: the text and any images in your current conversation are sent to our server and forwarded to an AI model provider to generate a reply. Recent turns of the conversation are included so the AI has context.
- Voice recordings (Tono Pro): if you use voice input, the recording is sent to our server and forwarded to OpenAI to be turned into text. We do not store the recording.
- Generated images (Tono Pro): images the AI creates for you are stored on our servers so the app can show them. Each image is reachable only through its own hard-to-guess link and is not linked to your account or install ID.
- Question log: we store the text of each question you send, with its language, time, and how many images were attached. The log is linked to your install ID (below), not to your email. We do not store the AI's replies or the images you attach.
- Install ID: a random identifier the app creates on first launch. We use it to apply free daily usage limits without requiring an account.
- Usage records: for each request, the feature used, the model, the number of tokens, the credits charged and whether it succeeded. These records are used for usage limits, billing and cost control.
- Usage analytics: events about how the app is used, such as app opens and time spent in the app, AI requests and whether they succeeded, voice input results, and sign-in and subscription steps. Each event carries your install ID, app version, platform, download channel, system language, and an approximate location (country, region and city) and network derived from your IP address; the IP address itself is not stored with the events; when you are signed in, also your account ID. Analytics never include the content of your messages, your email address or device identifiers. They are collected by our own code and stored on our own server, not by a third-party analytics service.
- Account (optional): if you sign in, your email address and the time you signed up and last signed in. We sign you in by emailing a one-time code, which is stored for a few minutes and discarded after use or expiry.
- Session metadata: for each signed-in device, the user agent, IP address and timestamps, so we can detect abuse and keep you signed in.
- Subscription status: if you subscribe to Tono Pro, we receive your subscription status, plan and renewal date from our payment provider. We never receive your card details.
Your chat history is stored only in the app on your device and is never uploaded to our servers. Your device's own backup, such as Android backup to your Google account, may include it depending on your device settings.
The app contains no third-party analytics, crash-reporting or advertising SDKs. We do not collect your contacts, precise location or device identifiers beyond what is described above.
2. How we use it
- Generate AI replies to your messages.
- Apply free usage limits and Pro benefits.
- Prevent abuse and investigate problems or reports.
- Improve answer quality, for example by reviewing which kinds of questions fail.
- Understand how the app is used and fix what does not work, using usage analytics.
We do not use your conversations to train AI models, show ads, or build an advertising profile. We do not sell your data.
3. Service providers
Each provider only receives the data it needs to do its job:
| Provider | Purpose | Data |
|---|---|---|
| Zhipu AI (China) | AI models that generate replies | The messages and images in your request. We ask the provider not to store them. |
| OpenAI (United States) | AI models, voice transcription and image generation | The messages, images and voice recordings in your request. Under its API terms, OpenAI does not use them to train models and may keep them for up to 30 days for abuse monitoring. |
| Amazon Web Services (United States) | Forwarding requests to OpenAI from regions where OpenAI cannot be reached directly | The same request, passed through without being stored |
| Cloudflare | Hosting, database and storage | Everything stored on our server, described in section 1 |
| Amazon Web Services (SES) | Sending sign-in codes | Your email address and the code |
| Paddle | Payments, as merchant of record | Your payment details and billing information, under Paddle's privacy policy |
If we add or change AI model providers, we will update this table before the change takes effect.
4. International transfers
Tono is operated from China. Your requests are processed on Cloudflare's global network and by the providers listed above in China and the United States, which may be in a country other than yours. By using Tono, you consent to this processing.
5. Data security
All traffic between the app and our servers uses HTTPS. Sign-in codes are short-lived. Data stored on our servers is not end-to-end encrypted, so it is technically accessible to us as the operator.
6. Data retention
- Account and subscription records are kept while your account exists and are deleted when you delete your account. Paddle keeps transaction records as required by tax law.
- The question log is deleted 90 days after each question is sent.
- Usage records and usage analytics are kept until you ask us to delete them.
- Sign-in sessions are kept until you sign out or they expire.
- Generated images are currently kept with no fixed deletion date. Because they are not linked to you, we can delete one on request if you send us its link.
- Chat history on your device stays until you delete it in the app or uninstall the app.
7. Your rights
You can ask us to access, export or delete your data by emailing [email protected]. We will respond within 30 days. To delete your account, see Delete Account.
8. Children
Tono is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has used Tono, contact us and we will delete the related data.
9. Changes
If we make material changes, we will update the date at the top of this page and, where reasonable, notify signed-in users by email.