Privacy Policy

This policy covers the Kaka Music iOS app and the website at kakamusic.calvityai.com.

Three things shape everything below. There is no account — no email address, no password, no sign-up. There is no tracking — no advertising identifier, no analytics or attribution SDK, no cross-app or cross-site profiling. And each permission is asked for only when you reach the feature that needs it, so declining one leaves the rest of the app working.

Device identifier and basic device information

On first launch the app creates an anonymous identifier and stores it in your device’s keychain. It is used to keep track of your creations, your creation allowance and your subscription status on our service. It contains no name, email address or phone number.

Basic device information travels with it: platform and OS version, app version, device model, interface language and time-zone offset. This is used for compatibility and troubleshooting.

What you enter

If you enter a display name during onboarding or choose a cover image, those are stored on the same record. You can change them in the app.

Words, photos and creations

Generated audio, artwork, titles and lyrics are stored on your device and can be backed up to our cloud storage. How the words and photos you give the app are used to make them is described under “Sending content to Google’s AI” below.

Speech

When you choose to speak instead of type, speech-to-text is performed by Apple’s speech recognition, which may process it on Apple’s servers. We receive the resulting text only. We do not keep your recording.

Health

With your permission, the app reads workouts, step count, heart rate and walking, running and cycling distance from Health, in order to turn a workout into music. When you make a song from a workout, a short summary of these readings is sent to Google’s AI, as described below. Access is read-only — the app never writes to Health — and Health data is never used for advertising or marketing, and never shared with third parties for those purposes.

Location

While you are using the app, and only to city-level accuracy, your approximate location is used to look up the day’s weather. Weather data comes from Apple’s WeatherKit. We neither need nor record your street address. When you make a song from the weather, the day’s weather and your city name are sent to Google’s AI; your coordinates are not.

Sending content to Google’s AI

Kaka Music makes songs with Google’s Gemini models. Before anything is sent, the app shows what will be shared and asks for your permission. You can withdraw it at any time in Settings → AI & data sharing; while it is withdrawn, nothing is sent to Google and new songs cannot be made. Depending on how you create, the following is sent through our service to Google:

• Words you type or dictate — descriptions, lyrics and style notes. Dictation is turned into text by Apple first, and only the text is sent.
• Photos you choose or take to make a song, so that the scene can be understood.
• A summary of Health data — steps, distance, heart rate and workouts — only when you make a song from a workout.
• The day’s weather and your city name — only when you make a song from the weather.

The anonymous device identifier is not sent to Google. Google processes this content only to return the lyrics, music, title or cover you asked for. It acts as our service provider under the Gemini API terms for paid services and Google’s data processing terms, which protect this content at least as well as this policy does: Google does not use it to improve its products or for advertising, and keeps it only for a limited time to detect and prevent abuse and to meet legal obligations.

Subscriptions

Subscription entitlement is verified on our service using the receipt Apple provides, in order to determine your creation allowance. We never see or store your payment method, card number or billing address — Apple handles all of that.

Support

If you write to support or use the in-app Help Centre, we receive what you send: your message, a category, an email address if you provide one, and the device identifier, so that we can reproduce the problem.

On-device only

In-app usage counts, such as how many songs you have made, stay on your device and are never uploaded.

We use what is described above to provide the features you ask for, to generate music from your input, to store and restore your creations, to apply your creation allowance and subscription entitlement, to answer support requests, to keep the service secure and to fix problems, and to meet legal obligations.

We do not sell personal information, and we do not use it for cross-app or cross-site advertising.

Information reaches a provider only as far as the features require:

• Apple — App Store purchases and subscription verification, speech recognition, WeatherKit, push and system services.
• Google — the Gemini AI models that understand photos, write the lyrics and generate the music and cover art. They are reached through our own service rather than directly from your device, and only after you allow it in the app (see “Sending content to Google’s AI”).
• Supabase — our cloud database, storage and server functions, which hold the device record, allowances and creation backups.
• Vercel — hosting for this website.

These providers process information on our behalf or as independent controllers under their own terms, and are not permitted to use it to advertise to you.

Creations and backups are kept while you use the app, until you delete them. Deleting a song in the app also starts deletion of its cloud backup; a network failure can delay that step, and it is retried when the connection returns.

The anonymous identifier, and the display name, cover and allowance records attached to it, are kept until you ask us to delete them. Records needed to verify subscriptions are kept for as long as financial and compliance obligations require. Support messages are kept as long as needed to resolve the request and to keep a record of it. Website request logs roll off on the hosting provider’s ordinary schedule.

Where the GDPR or a similar law applies, we rely on: performance of a contract for the features you ask for and for subscriptions; legitimate interests for security, troubleshooting and preventing abuse; consent for camera, photo library, microphone, speech recognition, location and Health access, which you can withdraw at any time in system settings, and for sending your content to Google’s AI, which you can withdraw in the app under Settings → AI & data sharing; and legal obligation where the law requires us to keep or disclose something.

Our providers operate in several countries, so information may be processed outside the country where you live, including in the United States. Where a transfer requires a safeguard, we rely on the mechanisms our providers make available, such as the European Commission’s standard contractual clauses.

In the app you can withdraw any permission at system level, turn off AI data sharing in Settings → AI & data sharing, delete any creation — its cloud backup is deleted with it — and change or remove the display name and cover you entered.

Depending on where you live, you may also have the right to ask for access to your information, correction, deletion, restriction, objection, or a copy in a portable form. To exercise any of these, or to delete everything including the anonymous identifier and the records attached to it, write to the address in section 11 and we will verify and action the request. You may also complain to your local data protection authority.

Because there is no account, the device identifier is the only way we can locate your records. If you have deleted the app and lost that identifier, we may be unable to find anything to act on.

Traffic between the app and our service uses HTTPS. The device identifier is stored in the iOS keychain. Every database table denies access by default, and the app reaches data only through specific, audited server functions using a publishable key that carries no privileged access. Privileged keys live only on the server.

No service can promise perfect security, but we work to protect information against loss, misuse and unauthorised access, and we review this as the service changes.

Kaka Music is not directed at children, and we do not knowingly collect personal information from children under 13 — or under the higher age that applies where you live. If you believe a child has provided us with information without the consent of a parent or guardian, write to us and we will delete it.

We may update this policy to reflect changes to the app, to the providers we use, or to the law. We will give notice of material changes in the app or on this website and update the date above.

For a privacy question or a request about your information:

• Service: Kaka Music
• Provider: Calvity AI
• Email: support@calvityai.com

Please include the app version and what you are asking for. Do not send passwords, payment details or unrelated private photos.