Effective: April 27, 2026 · Last updated: October 28, 2026
Controller: Sparkwell Studios LLC (Alabama, USA), operating Tonebook. Contact: privacy@sparkwellstudios.com
Tonebook is designed to be a private AI-assisted personal-color guide. We do not perform identity recognition, do not store face embeddings or other biometric identifiers, and do not use your photos for model training. Photos are used only to generate your color report; in Live AI mode the selfie is sent to our processor in transit and is not saved in a Tonebook photo library. Sim mode never uploads it. Tonebook does process color samples derived from a face, which qualifies as biometric information under some state laws — see our Biometric Information Policy for the full disclosure. You can delete your saved data anytime in Settings.
For users in the EU, EEA, UK, and Switzerland, processing is performed under the lawful basis of your explicit consent (Article 6(1)(a) and Article 9(2)(a) where applicable). You give that consent the first time you enable Live AI mode in Settings, and you can withdraw it at any time by toggling Live AI off, deleting your data in Settings, or emailing the address above. Color analysis is provided on a non-discriminatory basis whether you consent or not — sim mode is fully functional offline.
Where data is transferred to processors in the United States (OpenAI, Supabase, PostHog, Sentry), the transfer relies on the Standard Contractual Clauses adopted by the European Commission, with each processor's published SCCs and data-processing addendum incorporated by reference.
| Data | When | Purpose |
|---|---|---|
| Selfie photo (you upload) | When you tap "Analyze my style" | Generate your AnalysisResult. In sim mode the photo never leaves your device. In live-AI mode — the default once you consent — the photo is sent to our Supabase edge function which calls OpenAI's vision API. We process it in transit and do not save it in our photo library. Under OpenAI's API data policy, API inputs are not used for training unless the API customer opts in; abuse-monitoring logs may contain content for up to 30 days, or longer in stated legal and safety circumstances. |
| Derived colour result | Each live-AI analysis | Your results and cached report are linked to a pseudonymous product-data identifier. Tonebook does not require a named account or an email/password for its core experience. An authenticated installation can secure backend requests without identifying you by name. Purchase restoration uses a separate purchase identity. Deletion is a request whose server and provider completion must be verified; local deletion alone is not proof. |
| Onboarding answers | During first-run | Personalize your report copy. Stored locally in your device's UserDefaults and included in the profile sent for a live-AI analysis, including the city or location text you provide. When product analytics is enabled, onboarding responses are also sent to PostHog as event properties. |
| Saved reports | Each generated analysis | Stored locally in your device's Application Support directory as Codable JSON. Never uploaded. |
| Pseudonymous product analytics | When you enable product analytics | PostHog receives events such as paywall_viewed and report_viewed, event properties including onboarding responses and loading times, and a persistent pseudonymous identifier that links your activity across sessions. These are not anonymous records. You can turn product analytics off anytime using the setting currently labelled “Send anonymous analytics”. |
| Crash reports and performance diagnostics | During app use, including errors, crashes, app hangs, and sampled performance measurements | Sent to Sentry to diagnose failures and measure performance, including analysis request timing. Sentry's default collection of personally identifiable information is disabled. Diagnostics run separately from product analytics; turning off “Send anonymous analytics” does not turn off Sentry diagnostics. |
| Location for weather and personalization | When you search for a city, choose a city suggestion, enable weather, or submit a live-AI analysis with location text in your profile | City search text is sent to Apple Maps to find matching places. Coordinates for your selected city, or your device location after you grant location permission, are sent to Apple WeatherKit for forecasts. The app requests device location at approximately kilometre-level accuracy. The city or location text you provide is also included in your profile sent to our Supabase analysis endpoint for live-AI processing, and in onboarding events sent to PostHog when product analytics is enabled. |
| App Store purchase receipts | When you buy | Verified by Apple's StoreKit + RevenueCat for entitlement gating. Standard Apple-mediated flow. |
Calendar: If you enable calendar suggestions on Today, Tonebook requests calendar access and reads upcoming event titles and times on your device to suggest outfits. This feature does not send those event details to Tonebook's servers or write to your calendar. You can change calendar permission in iOS Settings.
Save to Photos: When you choose to save a generated color card, Tonebook requests add-only Photos permission and writes the card to your photo library. Saving a card does not upload it to Tonebook or grant access to read your existing photo library. You can change Photos permission in iOS Settings.
| Service | Data sent | Purpose |
|---|---|---|
| Apple StoreKit / App Store | Purchase receipts | Subscription billing |
| RevenueCat | Pseudonymous purchase identifier + entitlement state, and your email address if you gave us one | Subscription dashboard + cross-device entitlement sync. Delete all my Tonebook data clears the email address there; the purchase record itself is kept so you can restore what you paid for. |
| OpenAI (via our Supabase Edge Function, live-AI mode only) | Compressed selfie + onboarding profile JSON | Generate AnalysisResult. Subject to OpenAI's API data policy: not used for training. |
| Supabase | API requests | Edge Function hosting |
| PostHog | Event names and properties, including onboarding responses and loading times, and a pseudonymous product-data identifier | Product analytics when enabled. Turn off using “Send anonymous analytics” in Settings. |
| Sentry | Crash and error reports, app-hang diagnostics, and sampled performance traces | Reliability and performance diagnostics, independent of the product analytics setting. |
| Apple Maps / WeatherKit | City search text and coordinates for city lookup and weather requests | Find the city you choose and provide forecasts for weather-aware suggestions. Device location requires your permission. |
| Disabled services | Nothing in this release | Virtual try-on and third-party product feeds are disabled in this release. Tonebook does not send photos to FASHN.ai or searches to Apify. |
Delete all my Tonebook data clears local content and requests deletion of linked server data and removable provider data. Server and provider work remains pending until verified; an offline, failed or unproved request is not complete. Possession of an email address or knowledge of a purchase identifier alone does not establish ownership of an old installation. If the installation cannot prove ownership, contact privacy@sparkwellstudios.com for the available independent verification or support path. Email-only subscriptions have a separate verified-mailbox scope. Purchase history needed to restore purchases and limited suppression records may remain. Suppression records prevent unwanted contact or recreation of erased data; they are not a recovery credential.
The sections above describe the iPhone app. The browser analyzer is a separate service: after you choose analysis, your resized image is sent through Tonebook's Vercel endpoint to OpenAI. It does not require an account or email and does not add the upload to a photo library. The photo-free quiz uses your answers instead. Provider processing and retention are separate from the optional website analytics described below.
If you use Tonebook's proposed free quiz through Muse, Muse sends the eight answers you choose and your adult confirmation to Tonebook's connector, then receives a suggested palette to show in your conversation. The tool does not require an email, account, photo, app installation or payment. It does not intentionally store your answers in a Tonebook application database. Muse may retain your conversation under its own privacy controls. The connector's optional website link is not required to receive the free palette.
The connector may count prepared palette results with a single event name in our hosting logs. That application event contains no quiz answers, palette, photo or account identifier. Our host separately keeps operational request logs. This limited connector count is separate from the optional website analytics choice below, which applies if you visit tonebook.app; it does not control Muse's own conversation records.
When website analytics is enabled, campaign measurement uses only registered source and campaign labels. We add a shared campaign token to Tonebook’s App Store links so we can compare website visits with Apple’s aggregate download and sales reports, when available. These tokens describe campaigns, not people; we do not join connector conversations, quiz answers or account identifiers to App Store purchases. Turning website analytics off stops this source-specific link decoration. Apple handles activity on the App Store under its own privacy policy.
The website does not set advertising or cross-site tracking cookies. The same choice controls both analytics services. Both stay off when the preference cannot be saved or a browser privacy signal applies, and neither runs on excluded sensitive routes or queries. Necessary storage, such as your consent preference and the analyzer's abuse-prevention cookie, is separate.
Tonebook is intended for adults 18 and older. The app's first-run consent flow requires explicit confirmation that you are 18+. We do not knowingly collect data from minors.
We will update the "Last updated" date and post the new version at this URL. Material changes will be surfaced in-app on the next launch.
Email: privacy@sparkwellstudios.com