Privacy Policy

Version 2.9 · Effective 2026-08-30 (section 1.7 takes effect with app version 2.23) · Applies to the Soniclyze iOS / macOS / visionOS app

Wings ("we," "our," or "us") values your privacy. This Privacy Policy describes how Soniclyze collects, uses, and protects your personal information.

1. Data Collection and Use

1.1 Data We Collect

  • Coarse location — used for Apple Core Location and MapKit nearby place suggestions (measurement record metadata). Persisted locally in UserDefaults, never uploaded to a server. Not linked to your identity.
  • User ID (Sign in with Apple only) — used for account and subscription restoration. Stored in iCloud Keychain (device-only sync). Linked to your identity.
  • Usage counts (product interaction, purchase tendencies) — used to understand where new users drop off and which entry points lead to subscriptions. Stored in the developer's Apple CloudKit public database. Linked to your identity because CloudKit attaches an account code (see section 1.7).

1.2 Data We Do NOT Collect

  • Audio recordings — 100% on-device processing, never uploaded to any server
  • Measurement results — 100% local storage
  • Contacts, Photos, Health data
  • Device identifiers (IDFA / IDFV)
  • Third-party analytics or crash-reporting SDKs (no Firebase / Crashlytics / Sentry or similar); the only usage measurement is the first-party usage counts described in section 1.7
  • Third-party advertising SDKs
  • User behavior tracking

1.3 Microphone Access

Soniclyze accesses your microphone only when you explicitly start a measurement. Audio data is:

  • Processed only on your device (DSP algorithms run locally)
  • Never uploaded to any external server
  • Never shared with any third party
  • Revocable at any time in iOS/macOS Settings

1.4 Camera Access

Soniclyze accesses your camera only when you explicitly use the "Report Verification" feature (Toolbox → Report Verification) to scan a measurement report QR code:

  • The camera feed is used solely for real-time on-device QR code recognition — no photos or videos are ever captured or saved
  • The recognition result (report integrity credential) is compared locally only and never uploaded to any server
  • The camera is not used for any purpose other than QR scanning
  • You can revoke camera permission at any time in Settings; alternatively, you can verify via "Import Image / PDF" file import without using the camera

1.5 Report QR Credential

The QR code on the cover of an SPL measurement report PDF (used to verify report integrity) contains the measurement location's latitude and longitude in plain text, plus a one-way hash of the user/device identifier (the original identifier cannot be recovered from the hash).

  • The QR code is used only for the recipient to verify the report has not been tampered with; it is never actively uploaded to any server
  • If you send the PDF to someone via "Share Report," note that scanning the QR code reveals the measurement location's coordinates — if the measurement site is sensitive (for example a private residence or non-public location), please consider this before sharing
  • Some other report types use a newer credential format (report fingerprint and timestamp only, no coordinates or identifiers)

1.6 Data Archive (Backup and Restore)

Settings → Data Management → Backup & Restore lets you export your on-device data as a single .soniclyzearchive file (plain-text JSON) and restore from it. An archive is created only when you ask for it, is written to the app's local temporary directory, and is handed to you to save or share — it is never uploaded to any server.

An archive includes: all measurement records (including measurement location coordinates and place names where recorded), projects, saved measurements, exam-room inspection data, and calibration history. Exam-room inspection data may contain information about other people that you entered manually (for example a school contact's name and phone number) — you entered and control this data; please consider the recipient before sharing an archive file.

An archive does not include: audio recordings, device-local settings (calibration cache, input/output device selection), or login credentials.

1.7 Usage Counts

To understand where new users drop off and which entry points lead to subscriptions, starting with version 2.23 Soniclyze keeps daily counts of the following on your device and uploads them to the developer's public database in Apple CloudKit when the app moves between foreground and background:

  • Completing onboarding; the subscription page being shown (which entry point opened it and your membership tier at the time); tapping purchase, a successful purchase (whether it is a free trial, and the tier and billing period purchased), cancelling a purchase
  • Your answer to "How did you hear about Soniclyze?" on the last onboarding page (optional; nothing is uploaded if you skip it)
  • Alongside: the date (UTC), platform (iOS / macOS / visionOS), app version and distribution environment (App Store / test build)

Not included: any recordings, measurement results, files, location or device model, and no user or device identifier set by us. However, Apple CloudKit automatically attaches an account code specific to this app's container to every record (the developer cannot learn your Apple Account or name from it, but can tell that records came from the same account), so we disclose this data as "linked to you". It is used only for statistics — not for tracking, advertising or profiling — and is not shared with any third party.

Your choices: nothing is uploaded while you are signed out of iCloud (counts stay on your device and are deleted automatically after 30 days). You can turn this off at any time in Settings → Data Management → Share Usage Statistics; counting stops immediately and counts not yet uploaded are deleted from your device. To delete records already uploaded, email [email protected].

2. Third-Party Services

2.1 Sign in with Apple

When you choose "Sign in with Apple," your Apple ID credentials are verified by Apple.

  • We only receive Apple's anonymous User Identifier; we cannot access your real name or email
  • You can revoke authorization at any time in your Apple ID settings
  • Apple Privacy Policy: https://www.apple.com/legal/privacy/

About maps and POI data: Soniclyze uses only Apple Core Location and MapKit (MKLocalSearch / CLGeocoder) for nearby place suggestions. These APIs are handled by Apple's networking and data infrastructure. As Apple first-party SDKs, they are not disclosed in this "Third-Party Services" section. In mainland China, MapKit is provided by Apple; the app cannot differentiate the underlying data source, and your privacy during Apple service usage is governed by Apple's Privacy Policy.

2.2 Apple WeatherKit (Enterprise subscription, only when exporting PDF reports)

Enterprise subscribers may optionally fetch weather metadata (temperature, relative humidity, atmospheric pressure) at the measurement location through Apple WeatherKit when exporting PDF reports, to enrich the measurement-condition record.

  • Calls go to Apple's official domain (weatherkit.apple.com) via the first-party SDK
  • The location passed in is used only as input for the weather query and is processed by Apple. Soniclyze does not persist location or weather query logs locally and does not upload them to any external server
  • Free and Professional tiers do not call WeatherKit
  • Apple WeatherKit data attribution: https://developer.apple.com/weatherkit/data-source-attribution/

3. Data Storage

3.1 Local Storage

All measurement data, reports, and settings are stored on your device with Apple standard data protection:

  • Measurement records, reports → SwiftData / Documents directory
  • Login credential (Sign in with Apple userIdentifier) → iCloud Keychain (device and iCloud sync only)
  • Temporary cache → Caches directory (the system may purge it under low storage)

3.2 Cloud Storage

iCloud Sync (optional, off by default, Professional): You can turn it on in Settings → Data Management → iCloud Sync to keep the following data in sync across the iPhone, iPad and Mac signed in to the same Apple Account: measurement records (including measurement location coordinates and place names where recorded), projects, saved measurements (including thumbnails), exam-room inspection data (including information about other people you entered manually, such as school contacts), and calibration history.

  • Data is stored via Apple CloudKit in your own private iCloud database (container iCloud.com.soniclyze.sync), protected by your Apple Account credentials; neither Soniclyze nor its developer can read it, and it never passes through any Soniclyze server.
  • Among these, other people's contact details (school name, address, contact person and phone), precise location coordinates, place names and street addresses, and the notes and names you enter (projects, exam rooms, organization name, inspector, and so on) are stored with CloudKit end-to-end encryption: Apple cannot read these fields even if you have not turned on Advanced Data Protection.
  • Everything else is not encrypted and lives in the same private database, including: acoustic measurement values (sound level, reverberation time, intelligibility and the like), timestamps, device model and sample rate, analysis blobs such as spectra and transfer functions, GPS accuracy and time zone, and the measurement-method descriptions you may optionally fill in (microphone position, mounting method, windscreen, source description, special events). The identifiers used by the report QR code are stored as irreversible hashes and contain no recoverable account or device identifier.
  • The company logo in a report template is not uploaded: it stays on the device and is stripped when preferences sync. When you re-export a report on another device, the logo from that device's own template is used.
  • Besides the measurement data above, turning sync on also syncs your app preferences through iCloud key-value storage: unit system, default report template (including organization name and inspector name, but not the logo image), custom noise standards, measurement standard region, scheduled measurement tasks, RTA presets, toolbox favourites and recent features, report redaction switches, and so on. These preferences likewise live in your own iCloud and are not readable by Soniclyze or its developer.
  • So that changes from your other devices arrive promptly, the app uses Apple Push Notification service silent pushes (used only for CloudKit sync; no user-visible notifications; the app has no push server of its own).
  • Not synced: audio recordings, input/output device selection, the current calibration (calibration is tied to the specific device), and login credentials.
  • After you turn sync off, previously synced data remains in your private iCloud database; you can delete Soniclyze's iCloud data in iOS/macOS Settings → Apple Account → iCloud → Manage Storage. Switching iCloud accounts affects synced data on this device; we recommend exporting an archive via Backup & Restore first.
  • When sync is off, all data is stored on-device only.

4. Data Sharing

We do not share, sell, rent, or trade your personal information with any third party, except:

  • With your explicit authorization (for example, using "Share Report" to send a PDF to a contact you choose)
  • As required by law (for example, lawful requests by judicial authorities)

5. Your Rights (GDPR / CCPA / PIPL)

Under GDPR, CCPA, and China's Personal Information Protection Law, you have the right to:

  • Access — view all your local data via Settings → Soniclyze
  • Delete — account deletion path: Settings → Profile → Delete Account (clears login credentials and account-linked state, including feature trial status; local measurement records and on-device settings (calibration, unit preferences, report templates, and so on) are retained as on-device data; measurement records can be manually deleted from the in-app history)
  • Export — measurement records exportable as CSV / JSON / FRD / WAV; all on-device data can be exported as a .soniclyzearchive archive and restored at any time (data portability, see section 1.6)
  • Revoke — revoke microphone, camera, or location permissions at any time in Settings; turn off "Share Usage Statistics" in the app at any time (section 1.7)
  • No tracking — this app declares NSPrivacyTracking = false; zero tracking

6. Children's Privacy

Soniclyze is not directed to children under 13. We do not knowingly collect data from children. If you discover such data has been collected by mistake, please contact us immediately for removal.

7. Data Security

  • All local data uses iOS File Protection (NSFileProtectionComplete)
  • API calls are encrypted via HTTPS
  • Sign in with Apple credentials are protected by Apple Secure Enclave

8. Policy Updates

This policy may be updated; significant changes will be announced via in-app notification. The latest version is always available at:

9. Contact

For any privacy-related questions or data requests: