TONIC NOTES PRIVACY POLICY
Date of Last Revision: October 26, 2026
When you use the Tonic Notes services of Pocket Conservatory Inc. ("Tonic,” “we," “us," or “our”), you’re trusting us to handle your personal data. We take that trust seriously. This Privacy Policy describes how we collect, use, and disclose personal information through and in connection with our websites, including tonicnotes.com, our Tonic Notes applications, and any other website or service that we own or control and that links to this Privacy Policy (collectively, the “Service” or “Services”). This Privacy Policy applies to our website visitors, users of our applications, and other individuals who interact with us.
Personal Information We Collect
We collect the following categories of personal information about you:
Information you provide to us:
- Contact and profile information, such as your name and email address, instrument(s) played, and role (student, teacher, or parent).
- User content, such as free form text prompts, audio, video, images, photographs, and documents you add to the Service.
- Audio information, such as audio recordings of your sessions. Depending on the features you use, this may involve processing certain information derived from the audio you upload, such as voice characteristics, acoustic patterns, voice match identifiers, and audio or voice embeddings. Please see our Biometric Notice for additional information about how we handle this data.
- Payment information needed to complete your transactions with us, including name and payment card information. This information is processed by our payment service provider, which may handle your payment information in accordance with its own privacy policy. We do not have access to your full payment card information.
- Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
- Marketing information such as your preferences for receiving our marketing communications and details about your engagement with them.
- Other information not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.
Where you provide us with the personal information of third parties, such as your friends or other contacts, it is your responsibility to inform them about the processing of their personal information in accordance with this Privacy Policy, and to confirm that they have given their permission.
Automatic data collection. We and our service providers may automatically log and combine information about you, your computer or mobile device, and your interactions over time with the Services, online resources, and our communications.
- Device data, including your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, device type (e.g., phone, tablet), IP address, unique identifiers, language settings, preferred language, and general location information such as city, state, or geographic area.
- Usage data, including pages, screens, and features you viewed, accessed, or used, how long you spent on a page, screen, or feature, the website you visited before browsing to the Services, navigation paths between pages or screens, information about your activity on a page, screen, or feature, access times, duration of access, and whether you have opened or otherwise engaged with our communications, such as our marketing emails or text messages, or clicked links within them.
We use the following tools for automatic data collection:
- Cookies, which are text files that websites store on a visitor‘s device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, and helping us understand user activity and patterns.
- Local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.
- Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.
Information we obtain from other sources:
- Third-party platforms. When you interact with our Services through a third-party platform or service, that platform may provide us with certain information in accordance with its own policies and your settings on that platform.
- Social media. We may maintain pages on social media platforms, such as Instagram, TikTok, and other third-party platforms. When you visit or interact with our pages on those platforms, you or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.
- Other sources. We may obtain personal information from other third parties, such as marketing partners, publicly-available sources, and data providers.
How We Use Personal Information
We use personal information for the following purposes or as otherwise described at the time of collection:
To provide our Services. This includes:
- Providing, operating, and improving our Services;
- Communicating with you and responding to any inquiries you may have; and
- Analyzing your use of our Services to allow us to evaluate, maintain, and improve the Services.
For research, development, benchmarking, and improving our Services. We may use personal information to analyze and improve the Services, identify trends, and operate and expand our business activities. We may also create aggregated, anonymized, or other de-identified statistics, which we may use for lawful business purposes, including for analytics, forecasting, and strategic planning.
For marketing and advertising. We and our advertising partners may collect and use personal information for marketing and advertising purposes. We do not serve interest-based advertising to children through our application for children.
- Email. We or our advertising partners may from time-to-time send you direct marketing emails as permitted by law, including, but not limited to, notifying you of special promotions, offers and events via email. You may opt out of our marketing emails as described in the “Opt out of marketing communications” section below.
- Interest-based advertising. We may engage advertising partners, including third-party advertising companies and social media companies, to display ads around the web. These companies may use cookies and similar technologies to collect information about your interaction over time across our Services, our communications, and other online services, and use that information to serve online ads that they think will interest you. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms, including by providing hashed phone numbers or other identifiers to advertising partners for retargeting or to create similar audiences. You can learn more about your choices for limiting interest-based advertising in the "Opt out of online tracking" section below.
For compliance and protection. We may use personal information to comply with legal obligations, including to enforce any applicable terms and conditions, defend against legal claims or disputes, protect the security and integrity of our Services, and identify and investigate fraudulent, harmful, unauthorized, unethical or illegal activity.
How We Disclose Personal Information
We may disclose personal information to the following parties and as otherwise described in this Privacy Policy or at the time of collection:
Other users. If you link your account to another user's account, use our communications or collaboration features, or otherwise interact with other users through the Services, certain information associated with your account may be visible to or shared with those users. This may include your name, profile information, and any content you choose to share or make available through such features. Please exercise caution when disclosing personal information to other users.
Service providers. Companies and individuals that provide services on our behalf or help us operate the Services or our business, including providers of hosting and cloud infrastructure, artificial intelligence and content generation, information technology and security, error monitoring, customer support, SMS delivery, payment processing, data analytics, fraud detection, and professional services. We do not allow third-party service providers to develop or train models using your personal information. We also take steps to minimize the personal information shared with our service providers. The types and extent of information transmitted will depend on the content you provide through the Services.
Professional advisors. Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.
Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.
Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, our business (including, in connection with a bankruptcy or similar proceedings).
Your Privacy Rights and Choices
Access or update your information. If you have registered for an account with us, you may review and update certain personal information in your account profile by logging into the account.
Opt out of marketing communications. You may opt out of marketing-related communications – both emails and texts – by following the opt-out or unsubscribe instructions in the communications you receive from us or by contacting us as provided in the “How to Contact Us” section below. You may continue to receive Services-related and other non-marketing communications.
Opt out of online tracking. There are a number of ways to opt out of having your online activity and device data collected through our Services, which we have summarized below:
- Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.
- Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
- Using privacy plug-ins or browsers. You can block our Services from setting cookies by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, DuckDuckGo, Ghostery or uBlock Origin, and configuring them to block cookies/trackers.
- Google Analytics. We use Google Analytics to help us better understand how people engage with our Services by collecting information and creating reports about how users use our Services. For more information on Google Analytics, click here. For more information about Google’s privacy practices, click here. You can opt out of Google Analytics by downloading and installing the browser plug-in available at: https://tools.google.com/dlpage/gaoptout.
- Platform opt-outs. The following advertising partners offer opt-out features that let you opt out of use of your information for interest-based advertising:
- Microsoft
- Advertising industry opt-out tools. You can also use these opt-out options to limit use of your information for interest-based advertising by participating companies:
- Digital Advertising Alliance
- Network Advertising Initiative
Note that because these opt-out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.
Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.
Other Sites and Services
Our Services may contain links to websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions. This Privacy Policy does not apply to such third-party sites or services. Please review the privacy policies and terms of all third-party services carefully.
Security
We use reasonable organizational, technical, and administrative measures designed to protect against unauthorized access, misuse, loss, disclosure, alteration, and destruction of personal information we maintain. Unfortunately, data transmission over the Internet cannot be guaranteed as completely secure. Therefore, while we strive to protect your personal information, we cannot guarantee the security of personal information.
Retention of Personal Information
Where required under applicable laws, we retain personal information only for as long as is necessary to fulfil the purposes for which it was collected and processed, in accordance with our retention policies, and in accordance with applicable laws and regulatory obligations.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information, the purposes for which we use personal information and whether we can achieve those purposes through other means, and the applicable legal and regulatory requirements.
Children’s Privacy
This section serves as our direct notice to parents and guardians and describes our practices with respect to personal information collected from children under 13 years of age.
Parental Consent. We require advance parental consent before collecting personal information from children under 13. Before collecting personal information from a child under 13, we seek verifiable parental consent. During the registration process, we determine your age and eligibility for the Service. Where parental consent is required, we use an “email plus” method to obtain parental consent where we are permitted to do so. We send a notice to the parent or legal guardian at the email address provided during registration describing our information practices and requesting consent. The parent or legal guardian must affirmatively respond to or otherwise confirm the consent request, and we take an additional confirmatory step to help ensure that consent was provided by the parent or legal guardian.
By providing consent, you represent that you are the parent or legal guardian of the child for whom you are registering an account and consent to our collection, use, and disclosure of the child’s personal information as described in this Privacy Policy. A parent or legal guardian may modify or revoke consent at any time by contacting us as described in the “How to Contact Us” section below.
Information We Collect from Children. We may collect the following categories of personal information from children under 13: basic identifiers, vocal information, identifiers contained in photographs, video and audio recordings processed through the Services, device information, and limited automatically collected information used solely for internal operations.
Parental Rights. Parents and legal guardians have the right to review the personal information we have collected from their child, request deletion of their child's personal information, and refuse further collection or use of their child's personal information. To exercise these rights, parents may contact us as described in the "How to Contact Us" section below and we will respond to such requests within a reasonable time. If you close an account, we will mark the account in our database as “Closed,” but may retain personal information from the account to deactivate the account with our service providers, allow you to reactivate the account for some period in the future, collect any fees owed, resolve disputes, troubleshoot problems, assist with any investigations, prevent fraud, enforce our terms, or take other actions as required or permitted by law. If you request that we delete your child’s personal information, we will delete as much information as we are legally permitted. Due to regulatory recordkeeping obligations, we may be required by law to retain some information associated with a closed account. If we learn that we have inadvertently collected the information of a child without parental consent, as required by law, we will delete this information.
How We Use Children's Information. We use children's personal information solely to provide and support the internal operations of our child-directed Services, including generating AI-enhanced music lessons and insights. We do not use children's personal information for model training, research or development. We do not serve behavioral or targeted advertising to children under 13 through our child-directed Services, and we do not direct third parties to do so on our behalf.
Disclosure of Children's Information. We may disclose children's personal information only to service providers that support the internal operations of our child-directed Services, such as hosting, AI assisted processing, and security providers. Our service providers may operate or support certain functions of the Service. Below is an illustrative list of functions for which we may use third party service providers and the names of the providers we may use to perform these functions:
- Hosting and cloud infrastructure: Google
- Analytics: Amplitude, Sentry
- AI and text processing: Amazon Web Services, Anthropic, OpenAI
- Media streaming: Mux
- Customer support: Intercom
- Email communications: Customer.io, Amazon Web Services
- Deep linking and install attribution: Branch
- Subscription management: Stripe, RevenueCat
- Push notifications: Expo
- Search: Typesense Cloud
We do not sell or otherwise disclose children's personal information to third parties for their own commercial purposes. We do not share children's personal information with advertising partners.
Changes to This Privacy Policy
We reserve the right to modify this Privacy Policy at any time. Where we do so, we will update the date of this Privacy Policy and post it on the Services. If we make material changes to this Privacy Policy, we will let you know.
How to Contact Us
Contact us. If you have any questions or comments about this Privacy Policy, our privacy practices, or if you would like to exercise your rights with respect to your personal information, please email us at privacy@tonicnotes.com.