1. Introduction and Scope
This policy explains how we collect, use, store, share, protect, and delete information related to your use of TonoCam (the "App"). TonoCam is a native iPhone toning-camera app that offers photo and Live Photo capture, classic color and monochrome looks, a local gallery, and a non-destructive "digital negative" workflow built around original files plus editable recipes. This policy also applies to the App's Camera Control extension (Control Center / Lock Screen camera control widget).
This policy is based on, among others:
- Mainland China laws and regulations: the Personal Information Protection Law, the Cybersecurity Law, the Data Security Law, the Consumer Rights and Interests Protection Law, and applicable App personal-information processing rules;
- Apple platform requirements: the App Store Review Guidelines (including privacy and permission-purpose requirements) and the App privacy manifest (PrivacyInfo.xcprivacy);
- General principles: lawfulness, legitimacy, necessity, good faith, purpose limitation, minimization, transparency, accuracy, and security.
If this policy conflicts with mandatory laws, regulations, or platform policies, the mandatory rules prevail.
2. Key Points (Please Read First)
- No account: the App has no sign-up or login; core features require no phone number, email, or other identity information;
- On-device processing: capture, look rendering, gallery management, and recipe re-rendering happen on your iPhone by default; photos and works are never uploaded to our servers, and the main flow does not depend on the network;
- No ads, no tracking: the App contains no advertising SDK, no third-party analytics or crash-reporting SDK, does not read the IDFA, and does not track you across apps (the privacy manifest declares NSPrivacyTracking = false and declares no collected data types);
- On-demand permissions: camera, microphone, and photo-library permissions are requested by the system only when you use the corresponding feature; denial does not make the App unusable;
- Your works stay yours: photos, Live Photos, and recipes are stored on your device, and deletion is in your hands;
- Purchases are handled by Apple: membership purchases go through StoreKit on the Apple App Store; Apple processes payment information, and we never touch your payment account details.
3. Definitions and Scope
- The App: the TonoCam main application on iPhone and its Camera Control extension;
- Works: photos, Live Photos, videos, and their original files that you capture or import with the App;
- Recipe: the reproducible parameters associated with a work (lens, look, filters, strength, exposure/white balance/HSL, aspect ratio, etc.);
- Digital negative: an original file plus a complete editable recipe, from which new versions can be re-rendered;
- Local data: data stored only on your device storage and managed by the App.
Third-party platforms (Apple) and any services you choose to use are governed by their own policies. The App integrates no third-party service that requires sharing your data.
4. Operator Information
- Operator: TonoCam Team
- Contact email: support@cuebuddy.cn
5. Inventory of Information We Process
The App follows a data-minimization principle. The table below lists all data-processing activities:
| Category | Contents | Source | Storage location | Leaves your device? |
|---|---|---|---|---|
| Camera frames | Preview frames and the photos / Live Photos / videos you capture | Captured by the system after you grant camera access | On-device (App sandbox gallery) | No (saving to the system photo library is triggered by you) |
| Microphone audio | Sound for Live Photos / videos with audio | Captured after you enable audio capture and grant microphone access | On-device | No |
| Works and recipes | Original files, outputs, versions, filter parameters, hashes | Generated by the App on capture or import | On-device | No |
| Settings and preferences | Capture-habit switches, UI preferences | Your in-app configuration | On-device | No |
| Motion data | Device orientation for the level indicator | When you enable the level tool and sensors are available | Real-time in memory only; not persisted | No |
| Purchase information (optional) | Subscription status, entitlement verification results | Apple App Store / StoreKit | Processed by Apple; the App stores only a minimal entitlement marker | Handled by Apple's StoreKit system |
| Information you send us | Email body and attachments | Emails you send to us | In our mail-handling system | Yes (only when you contact us proactively) |
5.1 Information We Do NOT Collect (Negative List)
- Identity information such as phone number, email, or name (unless you email us proactively);
- Precise or coarse location information (the App does not request location permission, and outputs contain no GPS data);
- Contacts, call logs, messages, or clipboard contents;
- Advertising identifiers (IDFA) and cross-app tracking data;
- Facial or other biometric features (camera frames are used only for viewfinding, capture, and look rendering; no face recognition or feature analysis);
- Any data processed by third-party analytics, statistics, advertising, or cloud AI services (the App integrates no such SDK).
5.2 Note About Audio
Microphone permission is requested only when you actively use Live Photos or video capture with sound; ordinary still-photo and silent capture does not collect audio. Denying microphone permission does not affect still photography.
6. Network Behavior (Important)
- On-device by default: capture, look rendering, RAW decoding, and recipe re-rendering all run locally; the current version does not upload photos, Live Photos, videos, or recipes to our servers;
- No cloud generation: the App provides no cloud image processing, cloud generation, or filter store; the self-hosted processing service described in project documentation is not implemented or deployed; if it is ever offered, we will ask for your separate consent and update this policy before launch;
- Limited network dependence: the main flow works in airplane mode; the network is used only by Apple's own services (App Store purchases, subscription validation), which Apple handles;
- Local inference component: the App bundles the open-source ONNX Runtime for on-device inference; inference runs locally, is off by default, and involves no data upload.
7. Permissions
The permissions below are requested by the system when you use the corresponding feature, and you can change or revoke them at any time in system Settings:
| Permission | Purpose | Effect of denial |
|---|---|---|
| Camera | Viewfinding and capturing photos, Live Photos, and videos | No capture; you can still browse, import, and edit existing works |
| Microphone | Recording sound for Live Photos / videos with audio | Still photography unaffected; silent capture available |
| Photo Library (add-only) | Adding works you choose to save to the system photo library | Works remain in the App gallery; you can retry saving |
| Photo Library (read/write, on demand) | 24MP deferred processing: reading back the final image after the system finishes processing | Standard-resolution capture unaffected |
| Motion | Viewfinder level indicator | No effect on capture; the level tool is unavailable |
| Photo import (system picker) | Importing photos you actively select into the App | No import; the App never uses this to read your entire library |
8. Digital Negatives and Recipes
- Every capture and edit stores the original file and recipe in a versioned way; non-destructive re-rendering creates new versions and never overwrites your originals;
- A digital negative means "original file + editable recipe" and is not a way to turn a JPEG back into sensor RAW; information already discarded in a JPEG (highlights, color depth, noise) cannot be recovered, and neither this policy nor the product documentation claims otherwise;
- Exported negative packages (.cmnegative directory bundles) are triggered by you on-device and include original files, recipes, and required LUTs; the App does not promise that other apps can read this format.
9. Data Storage and Retention
| Data | Retention | How to delete |
|---|---|---|
| Works, original files, and recipes | Until you delete them or uninstall the App | Delete in the App gallery, or uninstall the App |
| Settings and preferences | Until you change them in the App or uninstall the App | Removed on uninstall |
| Entitlement markers | For the membership term and any period required for accounting | Removed with local data; Apple-side receipt records are handled by Apple under its policies |
| Microphone audio | Only inside Live Photos / videos with sound that you save | Delete the corresponding work |
| Records of your emails to us | Until your issue is resolved and any necessary follow-up support period ends | You may request deletion at any time |
The App currently offers no automatic gallery cleanup; uninstalling the App removes its sandboxed local data.
10. Your Rights
Under applicable law, you may:
- Access and correct: view and manage works and recipes and change settings directly in the App;
- Delete: delete single works or the entire gallery in the App, or uninstall the App to remove all local data;
- Withdraw consent: revoke camera, microphone, and photo-library permissions at any time in system Settings; the corresponding features stop working;
- Request explanations: email the contact address in Section 4 for further details on data-processing rules.
Because the App has no account system, these rights are exercised mainly through in-app features and system settings.
11. Protection of Minors
- The App is designed for photography users with a preference for film-like looks and everyday recording; minors are not the target audience;
- If you are a minor, please use the App under the guidance of a guardian, who should help you read this policy;
- If you believe a child has provided us with personal information without guardian consent, contact us immediately and we will take necessary measures such as deletion as required by law.
12. Cross-Border Data Transfer
The App's photos, Live Photos, videos, and recipes are processed and stored only on your device; no cross-border data transfer is carried out by us. Third-party scenarios (App Store purchases) are handled by Apple under its global service architecture, subject to Apple's privacy policy and commitments. If we ever introduce features that require servers, we will update this policy and state server locations and compliance arrangements before implementation.
13. Data Security
Technical and organizational measures we take include:
- Works and recipes are stored in the on-device App sandbox; imports and exports use system file mechanisms, and negative packages include per-file SHA256 verification;
- Original files are atomically persisted immediately after capture, before any fallible processing; if processing or output fails, originals are preserved and no false "saved successfully" state is recorded;
- No third-party analytics, advertising, or cloud AI SDKs are integrated, reducing supply-chain risk;
- The privacy manifest is declared truthfully: no tracking, no collected data types, and accessed restricted APIs (UserDefaults, file timestamps, disk space) are declared with Apple-required reason codes.
Please also note that device security is shared with the device and system you use; we recommend setting a device passcode and keeping your system updated.
14. Policy Updates
When we update this policy, we will publish the new version in the App or on the release page and update the version number and effective date. Changes that materially affect your rights and obligations will be prominently highlighted; before adding new permissions, new data categories, or new third-party SDKs, we will update this policy first.
15. Contact Us
- Email: support@cuebuddy.cn
- We will respond to your privacy requests and complaints within a reasonable period.