Privacy Policy

1. Who we are

Quiet Again: Tinnitus Relief ("Quiet Again", "the app") is published by Heldig Lab ("we", "us"). Heldig Lab decides how the data described here is used (it is the "controller" under EU and UK data protection law). You can reach us at heldig.lab@pm.me.

This policy covers the iPhone app. Quiet Again was previously called TinniCalm on the App Store. The Android app TinniCalm has its own privacy policy.

2. Data that stays on your device

The app stores the following data only on your iPhone, in the app's local database and local storage:

• Listening sessions: start and end time, duration, the preset name and the sounds used.
• Your tinnitus pitch: the frequency you set in the Frequency Finder.
• Programme progress: your place in the daily listening programme, based on your sessions.
• Presets and mixer settings: your saved sound mixes, volumes and last-used mix.
• Preferences: theme, reminder settings, background playback and similar settings.
• Access status: whether premium is unlocked on this device, including whether you keep full access as an existing customer. Reset All Data keeps this status (see section 8).

We cannot see this data, and it is not sent to us, RevenueCat, Google or anyone else. Your tinnitus pitch and listening history are health-related information, which is why we keep them on the device. The app does not read from or write to Apple Health. It does not use your microphone, camera, contacts, photos or location services.

If you use iCloud or iTunes device backups, iOS may include this app data in your backup. Apple handles those backups under its own privacy policy.

3. Reminders and notifications

If you turn on reminders, the app schedules local notifications on your iPhone. These include the daily listening reminder and, during a free trial, a reminder before the trial ends. iOS creates these notifications on the device. We run no notification server and do not collect a push token. You can turn reminders off in the app or in iOS Settings → Notifications.

4. Purchases and subscriptions

Apple

Apple processes all payments through the App Store: the free trial, the annual and monthly subscriptions and the lifetime purchase. We never receive your card details, your Apple ID email address or your name. You manage or cancel subscriptions in iOS Settings → [your name] → Subscriptions. Purchases are governed by Apple's Standard License Agreement (EULA) and Apple's privacy policy.

RevenueCat

We use RevenueCat to confirm purchases and to decide which features you can use. When the app starts, and when you buy or restore, the RevenueCat software in the app sends RevenueCat:

• a random app user ID that RevenueCat creates for this installation. It is not your name or email address. The app shows it in Settings as your Support ID;
• your App Store transaction and subscription data: products bought, prices, trial status, renewal and cancellation status, refunds, and the app version you first downloaded. We use that version to keep full access for people who bought or downloaded the app before the switch to subscriptions;
• Apple's identifier for vendor, a device identifier that is the same for all apps by one developer on your device. It is not the advertising identifier;
• technical data: device model, iOS version, app version, language settings, App Store country and the IP address of the request.

We use this data to unlock the features you paid for, restore purchases, prevent fraud, answer support requests and see total sales and subscription numbers. RevenueCat processes it for us as a service provider.

5. Analytics and ad measurement (Google Analytics for Firebase)

We use Google Analytics for Firebase, a Google service, for two purposes: to understand how the app is used, and to measure how well our ads for Quiet Again work, including ads we run through Google Ads. The Firebase software in the app sends Google:

• a random app instance ID that Firebase creates for this installation;
• app usage events: first open, app sessions, screens viewed, paywall views, review prompt answers, trial starts and purchases (product, price and currency);
• device and technical data: device model, iOS version, app version, language and an approximate country or region derived from your IP address. Google says it masks this IP address.

We have configured Firebase not to collect Apple's identifier for vendor or the advertising identifier. You can turn analytics off at any time in the app's Settings. In the European Economic Area, the United Kingdom and Switzerland, analytics stays off unless you turn it on in Settings.

We do not send Google your tinnitus pitch, your listening history, the sounds you use, your name or your email address. We link the Firebase app instance ID to your RevenueCat app user ID so that trial starts and purchases are counted correctly. Firebase does not access your device's advertising identifier (IDFA), and we have turned off Google's ad personalisation and Google signals for this app.

We send key events such as first open, trial start and purchase to our Google Ads account. This lets Google Ads report how many installs and subscriptions our campaigns produce. On iPhone this measurement relies on Apple's SKAdNetwork and on Google's on-device conversion measurement. Google describes the latter as working on the device so that no identifiable information leaves it. Google turns it off for users in the European Economic Area, the United Kingdom and Switzerland. We do not use your data to show you personalised ads, and we do not sell it or share it with data brokers. Google does not receive your advertising identifier.

Learn more about how Google uses information from sites or apps that use its services and read Google's privacy policy.

5a. Ad measurement with Meta (from version 1.2.42)

We also use the Meta (Facebook) SDK to measure which of our ads on Facebook and Instagram lead to installs, trial starts and purchases. While usage analytics is on, it receives app events (install, app open, trial start, subscription and purchase, with price and currency), an anonymous ID created by Meta and device data (model, iOS version, app version, language, IP address). It receives your advertising identifier only if you allow tracking when your iPhone asks (Apple's App Tracking Transparency). If you choose "Ask App Not to Track", Meta measures our ads without it, using Apple's privacy-preserving methods. When the app starts, the Meta SDK also downloads its settings from Meta, which shows Meta your IP address and device model even if analytics is off. Meta never receives your tinnitus pitch, listening history, name or email address.

You can change your choice at any time in iPhone Settings → Privacy & Security → Tracking, or turn analytics off in the app's Settings. Meta's processing is described in Meta's privacy policy. The provider is Meta Platforms Ireland Ltd. for users in the EEA, the UK and Switzerland, and Meta Platforms, Inc. for other users.

6. What we do not do

• No accounts, sign-up or login.
• No ads inside the app.
• No sale of personal data. Tracking for ad measurement happens only if you allow it when your iPhone asks.
• No health, listening or tinnitus data leaves your device.
• No location services, microphone, contacts or Apple Health access.

7. Legal bases (EEA, UK and Switzerland)

• Purchases and access (RevenueCat, Apple): to perform our contract with you, that is, to give you the features you bought.
• Fraud prevention and support: our legitimate interest in protecting purchases and helping you.
• Analytics and ad measurement (Firebase): your consent. Analytics is off by default in the EEA, the UK and Switzerland and runs only if you turn it on in Settings. You can withdraw consent at any time by turning it off again.
• Ad measurement (Meta): your consent, given by turning analytics on and, for the advertising identifier, by allowing tracking. The settings download at app start is based on our legitimate interest in the SDK working correctly.

8. How long data is kept

• On-device data is kept until you delete the app. Settings → Reset All Data deletes your sessions, presets, tinnitus pitch and preferences, but keeps your access status so that you do not lose what you paid for. Deleting the app removes it too.
• RevenueCat keeps purchase records while they are needed to provide your purchases and meet accounting obligations, or until you ask us to delete them.
• Google Analytics keeps event-level data for the retention period we set in Google Analytics (2 months). After that, only aggregated reports remain.

9. Your choices and rights

• Delete your sessions, presets, tinnitus pitch and preferences with Settings → Reset All Data. To remove all on-device data, including your access status, delete the app.
• Turn analytics on or off in the app's Settings.
• Turn off notifications in the app or in iOS Settings.
• Manage or cancel subscriptions in iOS Settings. Deleting the app does not cancel a subscription.
• To access, correct or delete the data RevenueCat, Google Analytics or Meta holds about your installation, email heldig.lab@pm.me with your full Support ID. Settings shows only its last characters; tap the Support ID row to share or copy the full ID. Without that ID we cannot find your data, because we do not know who you are.
• If you live in the EEA, the UK or Switzerland, you can complain to your local data protection authority. If you live in California, you have the rights the CCPA/CPRA gives you. We do not sell personal information. If you allow tracking, sending ad events to Meta may count as "sharing" for cross-context behavioural advertising; you can opt out by choosing "Ask App Not to Track" or turning analytics off.

10. International transfers

RevenueCat, Google and Meta may process data in the United States and other countries. They do this under their data processing terms, which include safeguards such as the EU Standard Contractual Clauses.

11. Children

Quiet Again is not directed at children under 13, or under 16 in the EEA. We do not knowingly collect personal data from children. If you believe a child has used the app and data about them is held by RevenueCat, Google or Meta, contact us and we will delete it.

12. Health disclaimer

Quiet Again is not a medical device. It does not diagnose, treat, cure or prevent any medical condition. Its sounds are for relaxation and general wellness. If you have tinnitus or another hearing condition, see a qualified healthcare professional.

13. Changes to this policy

If this policy changes, we will update the date at the top of this page. If a change affects what data leaves your device, we will also say so in the app update notes.

14. Contact

Heldig Lab · heldig.lab@pm.me