ToneAhead is provided by an independent developer. Questions about this policy can be sent to captainlongevity@gmail.com.
ToneAhead does not require an account. Installed versions let you enter text and choose an action, but cannot obtain a new coaching result while the gateway is paused. During online operation, before the first AI request, ToneAhead asks for your explicit permission. Only after you grant permission and request coaching are the selected text, workflow, communication goal, and style sent to the ToneAhead gateway. The operating gateway sends the information needed for the request to DeepSeek, which generates the result and a safety verdict, including tentative communication cues for clarity, assumptions, pressure, and escalation. If you deny or withdraw permission, ToneAhead does not submit your text for coaching.
Do not submit highly sensitive personal information, access credentials, payment information, health information, or information you do not have permission to share.
Before the first coaching request, the in-app permission sheet identifies what will be sent, the ToneAhead gateway and DeepSeek as recipients, the purpose of processing, possible processing in China, and relevant retention practices. You can choose Allow and Continue or Don't Allow. Declining leaves the text in the editor and does not send a coaching request.
You can review, grant, or withdraw this permission at any time under Settings > Data and privacy > AI data sharing. Withdrawal stops future coaching transmissions. It does not retroactively affect a request you already submitted or delete completed History stored on your device; you can delete each local History record separately.
The ToneAhead gateway processes coaching text and generated results in memory for the requested action. It is designed not to write coaching text, provider prompts, generated coaching, or provider request bodies to ToneAhead databases or operational logs. The gateway also checks the model’s safety verdict and generated advice before returning a result; missing or refused verdicts do not produce a coaching result. Filtering reduces risk but cannot guarantee that all harmful content is caught. Operational records may include a correlation ID, route, timestamp, selected workflow, model, status, latency, token counts, retry count, safe error category, and technical network information needed to operate and protect the service. These records support service operation and troubleshooting, not behavioral advertising. Their retention depends on the hosting service's configured log availability and applicable security or legal requirements; the challenge and verification-record expiry periods below do not describe operational-log retention.
DeepSeek receives the selected text, requested workflow, communication goal and style instructions, and an opaque pseudonymous identifier. DeepSeek processes that information to generate the requested coaching and may use provider-managed transient API context caching. See its Open Platform terms and API context-caching documentation. The gateway's in-memory processing does not mean that provider-side caching or retention is absent, and deleting local History or withdrawing permission does not immediately erase information already processed by a provider. ToneAhead does not use coaching content or the pseudonymous identifier for advertising or cross-app tracking.
The app creates a random installation identifier that rotates approximately every 30 days. The gateway hashes this identifier before storing or deriving provider identifiers from it. ToneAhead does not use it to create an advertising profile or identify you by name.
ToneAhead uses Apple App Attest to help determine whether a request came from a genuine instance of the app. A single-use challenge is retained for up to five minutes and deleted when used. Upstash Redis stores rate-limit counters and an App Attest verification record containing a hashed installation identifier, public verification key, Apple attestation receipt, assertion counter, environment, and timestamps. The verification record expires after 180 days without a successful request. Upstash does not receive or store coaching text or generated coaching. A random request reference is mapped to a hashed safety principal for up to 30 days so a report can be investigated. A confirmed service-abuse restriction can be stored against that hash for a reviewed, explicitly expiring period; it contains no coaching content.
ToneAhead requires its service providers to process information only for the documented service purpose and to provide the same or equivalent protection described in this policy and required by applicable privacy obligations. If a provider cannot meet those requirements, ToneAhead will stop sharing information with that provider.
Completed coaching history stores the submitted original message or draft, chosen workflow and style, date, and generated analysis and reply or rewrite, including communication cues and any quoted evidence, locally on your iPhone. New results also retain their random request reference locally so you may include it in a report. You can delete individual history entries in the app. Unsubmitted editor text is held in the active editing session; ToneAhead does not provide a durable draft archive. The app also stores local preferences such as your AI-sharing choice, preferred styles and goals, onboarding state, and Face Lock setting.
The optional free Face Lock can protect this local content after the app enters the background. Face ID and device-passcode authentication are handled by Apple's LocalAuthentication service on the device; ToneAhead receives only whether authentication succeeded and does not receive or store your face data, biometric template, or device passcode. Face Lock is an access control, not separate encryption of every saved History field, and does not protect screenshots or text you copy to the system clipboard. ToneAhead does not send messages on your behalf; copies you paste or share elsewhere are handled by the destination you choose.
The Free plan stores the current calendar-day date and completed coaching count in the device Keychain, with a fallback in the app's local settings, to apply the three-request allowance consistently after an ordinary reinstall. This small state contains no message text or coaching result and resets logically each calendar day. The Keychain item uses a device-only accessibility setting and may remain after an ordinary reinstall until that item or the device Keychain is erased. Removing the app removes its local History and preferences, subject to any backup you control. Ordinary iOS device backups may include app-container data depending on your Apple settings; this is separate from app-provided sync. ToneAhead does not provide a cloud account or a server-side history archive to restore. Server-side challenges and rate-limit counters expire automatically, and inactive App Attest verification records expire as described above.
ToneAhead previously offered optional monthly and yearly auto-renewable subscriptions through Apple's StoreKit; both are now removed from sale. Apple processes payment and billing information. Existing installed versions check verified transactions and store a local entitlement-expiry cache to provide eligible purchased features. Purchase entitlement information is not sent to the coaching gateway. The app does not receive your Apple ID, payment method, or full billing details. Apple may separately provide transaction and sales information to developers through its App Store services under Apple's privacy policy. We use relevant purchase and subscription reports to check outstanding access and handle the discontinuation, without accessing your local History.
In the updated app, each current or saved AI result and Settings offer a report preview. You select the reason, optional notes and whether to include generated content. The original message and History are not automatically attached, although an AI result may repeat personal details. A request reference, when available, is included to locate limited security metadata. Preparing an email or share draft does not send it; you must choose to send it in the destination app. If you email support or send a report, we receive your email address, selected report fields and any content or attachments you choose to send. We use them to respond, investigate the issue, prevent abuse, and meet legal obligations, and retain correspondence only as long as reasonably needed for those purposes. Support uses Gmail under Google's privacy policy. Do not attach private conversations, payment details, or credentials. Reports are used to review harmful results, respond to you and restrict confirmed service misuse. There is no automatic upload of your History to support. These interface changes apply after installing the updated app; safety checks and security-reference handling apply when the updated gateway is deployed.
Vercel also hosts these static support and legal pages. Website visits may involve IP address, browser or device information, requested URL, and access time for delivery and security, under Vercel's privacy notice. We have not added advertising, analytics scripts, tracking pixels, or optional tracking cookies to these pages. Providers may retain technical security or backup records under their own applicable policies.
AI data-sharing permission is a ToneAhead privacy control, separate from iOS system permissions, and can be changed in the app as described above. ToneAhead requests Face ID access only if you explicitly enable Face Lock in Settings. If you decline, Face Lock remains off and the app provides a link to iOS Settings if you later want to allow it. The current version does not request access to your camera, microphone, photos, location, contacts, or health data. It does not include advertising tracking or an advertising identifier, and ToneAhead does not sell personal information.
ToneAhead is not directed to children under 13. We do not knowingly collect personal information from children.
After you grant permission and request coaching, your selected text may be processed by service providers in locations other than your own. DeepSeek may process coaching requests in China. ToneAhead discloses this before asking you to allow AI data sharing. Do not grant permission or use AI coaching if you do not agree to this processing.
Support email and technical website-access information may also be processed internationally through Google and Vercel. Their linked notices describe their processing and transfer safeguards. The local History deletion control does not delete support correspondence, Apple purchase records, or external copies you control.
Depending on your location, you may have rights to access, correct, delete, obtain a copy of, restrict, or object to processing of personal information we hold, and to complain to a data-protection authority. Contact us for requests concerning support or provider-processed information; we may need proportionate information to verify and locate a request. We cannot remotely retrieve or delete your on-device History. Use the app's individual deletion controls and remove external copies separately. Withdrawing AI permission stops future submissions without canceling an Apple subscription.
We may update this policy when the app or its data practices change. The last-updated date above identifies the current version. A material change to how coaching data is handled will be described in an updated policy before the changed practice applies.
For privacy questions, requests concerning provider-processed information, or help exercising a privacy choice, contact captainlongevity@gmail.com. ToneAhead will coordinate with a service provider when its cooperation is needed to address a valid request. See ToneAhead Support and the Terms of Service.
The updated App pauses the normal record interface if its persistent database cannot be opened and only a temporary in-memory store is available. New recording and editing through that interface are blocked. The App keeps the existing database and attachment files rather than treating the temporary empty store as your archive. Database-dependent startup work in that interface is paused; previously scheduled reminders, widget snapshots or independent copies may remain.
Check available device storage, close and reopen the App, and contact support before deleting or reinstalling it. This recovery screen is not a backup, a repair guarantee or an automatic restoration of missing records. Older installed versions may behave differently until updated; publishing this document does not update an installed App.