Privacy Policy

1. Information We Collect

Account Information

When you create or use an account, we collect information such as:

• Name
• Email address, including private relay email addresses if you choose to hide your email with Apple
• Avatar or profile image URL, if provided by a sign-in provider
• Authentication provider, such as email/password, Google Sign-In, or Sign in with Apple
• Google or Apple account identifiers used to connect your Celyris account
• Account verification status, password status, selected language, premium status, and account creation/update timestamps

If you use an email/password account, we store a password hash, not your raw password. If you sign in with Google or Apple, we receive identity information from that provider, such as an identity token and the email or name information the provider makes available.

Learning and Practice Information

We collect information needed to run the learning experience, including:

• Lessons, modules, and practice items you access
• Lesson completion records
• Practice completion records and practice dates
• Recently played practice activity
• Premium-gated content access status

Subscription and Purchase Information

If you buy, renew, restore, cancel, or expire a premium subscription, we receive subscription information from the app stores and RevenueCat, our subscription management provider. This may include:

• Product and entitlement identifiers
• Store platform, such as Apple App Store or Google Play
• Store product ID and original transaction ID
• Purchase, renewal, expiration, cancellation, pause, and resume timestamps
• RevenueCat app user ID, event ID, aliases, and environment
• Purchase country, currency, and price when included in RevenueCat webhook events

We do not receive or store your full payment card number. Payments are handled by Apple, Google, and their payment systems.

Device, App, and Technical Information

We automatically receive limited technical information when you use the Service, such as:

• IP address
• Request ID
• Requested API path, HTTP method, status code, latency, and timestamp
• Selected app language sent with API requests
• App version, build number, environment, screen name, lesson slug, and crash/error information if Sentry crash reporting is configured

We use this information to keep the Service working, investigate errors, prevent abuse, and secure accounts.

Local Device Information

Some information is stored only on your device, including:

• Login tokens stored in iOS Keychain or Android Keystore
• Language, theme, MIDI setting, and other local preferences stored in app storage
• Cached lesson and practice content, including downloaded audio assets
• Cached API responses used to improve startup and offline behavior
• Piano playground settings such as keyboard range, labels, and sustain

If you enable MIDI features, Celyris may read connected MIDI device information and note events so the app can respond to your keyboard input. MIDI information is processed in the app for the learning experience and is not sent to our backend based on the current implementation.

Audio

Celyris plays piano sounds, lesson audio, sound effects, and backing tracks. Some audio assets may be downloaded and cached on your device so lessons and practice sessions can load more smoothly.

2. How We Use Information

We use information to:

• Create, verify, authenticate, and secure accounts
• Send verification codes and password reset codes
• Provide lessons, practice items, progress tracking, and localized content
• Sync account sessions and refresh login tokens
• Provide premium subscription access and reconcile subscription status
• Send service-related emails, such as OTP and password reset emails
• Detect, prevent, and respond to security issues, abuse, fraud, and unauthorized access
• Debug crashes, diagnose app performance, and improve reliability
• Respond to support, privacy, and legal requests
• Comply with legal obligations and enforce our terms

We do not sell personal information. We do not use personal information for third-party behavioral advertising based on the current implementation.

3. How We Share Information

We share information only as needed to operate, secure, and improve the Service:

• Service providers. We use vendors for infrastructure, databases, caching, email delivery, crash reporting, authentication, asset delivery, subscription management, and app distribution.
• Sign-in providers. If you choose Google Sign-In or Sign in with Apple, your use of those providers is also subject to their privacy policies.
• Payment and subscription providers. Apple, Google, and RevenueCat process or help us reconcile purchases and subscription status.
• Legal and safety purposes. We may disclose information if required by law, legal process, or to protect rights, safety, security, and the integrity of the Service.
• Business transfers. If Celyris is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction.

We do not sell your personal information or share it for cross-context behavioral advertising based on the current implementation.

4. Third-Party Services

Celyris uses or may use the following third-party services:

• Google Sign-In for authentication
• Sign in with Apple for authentication
• Apple App Store and Google Play for app distribution, billing, and subscriptions
• RevenueCat for subscription management and webhook reconciliation
• Sentry for crash and error reporting, if configured
• Email/SMTP providers for verification and password reset emails
• Cloud hosting, database, Redis/cache, and CDN or asset-delivery providers, including signed private audio asset delivery

These providers process information under their own terms and privacy policies. We encourage you to review the policies for any third-party service you use with Celyris.

5. Cookies and Similar Technologies

The Celyris mobile app does not use web browser cookies for advertising based on the current implementation. The app may use local storage, Keychain/Keystore, cached files, and similar mobile storage technologies to keep you signed in, remember preferences, cache content, and improve reliability.

If Celyris later launches web features that use cookies or analytics, this policy will be updated before those features are released.

6. Data Retention

We keep personal information for as long as needed to provide the Service, maintain account records, comply with legal obligations, resolve disputes, enforce agreements, and protect the Service.

Current retention behavior includes:

• Email verification OTP codes expire after about 5 minutes.
• Password reset OTP codes expire after about 10 minutes.
• Password reset tokens expire after about 15 minutes.
• Refresh tokens expire according to the configured token lifetime and are rotated when used.
• Cached local app data may remain on your device until you clear app data, sign out, delete the app, or the app refreshes its cache.
• Account records, progress records, and subscription records are retained while your account remains active unless deletion is requested or otherwise required.

When you delete your account, Celyris deletes the account and associated owned backend records such as lesson completions, practice completions, and subscription rows through database cascade behavior, and clears server-side refresh-token and user-cache state. Some information may remain where retention is required for legal, security, billing, backup, or fraud-prevention reasons.

7. Your Choices and Rights

Depending on where you live, you may have rights to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account or request deletion of personal information
• Receive a copy of certain information in a portable format
• Object to or restrict certain processing
• Opt out of sale or sharing where applicable
• Withdraw consent where processing is based on consent
• Appeal or complain to a privacy regulator

You can delete your Celyris account from within the app where the account deletion feature is available, or by contacting us at support@celyris.com. We may need to verify your identity before fulfilling a request.

For subscriptions, deleting your Celyris account does not necessarily cancel an Apple App Store or Google Play subscription. You may need to cancel the subscription through your Apple or Google account settings.

8. Children

Celyris may be used by learners of different ages. If a user is under 13, a parent or legal guardian must provide consent, review this Privacy Policy, and supervise or manage the user’s use of the Service.

Parents and legal guardians may contact us at support@celyris.com to ask about, review, correct, or request deletion of personal information associated with a child.

If Celyris is offered to schools, churches, families, or youth programs, this policy and the product flow should be reviewed for child privacy, parental consent, and age-appropriate requirements before launch.

9. Security

We use technical and organizational safeguards designed to protect information, including:

• Password hashing using Argon2id
• Token-based authentication
• Server-side token rotation and refresh-token revocation
• Device Keychain/Keystore storage for app tokens
• Short-lived OTP and password reset flows
• Rate limiting and login attempt tracking
• Request IDs and structured logs for security investigation
• Signed, time-limited URLs for private lesson audio assets

No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

10. International Transfers

Celyris and its service providers may process information in countries other than where you live. These countries may have data protection laws that differ from your local laws. Where required, we use appropriate safeguards for international transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date and provide additional notice where required by law or appropriate for the change.

12. Contact Us

For privacy questions or requests, contact:

• Email: support@celyris.com
• App Name: Celyris
• Developer: Developer Celyris
• Address: Jakarta, Indonesia