Kebijakan Privasi Effa

1. Introduction

Gndsoft LLC ("Gndsoft," "we," "our," or "us") publishes Effa under the GndWell label. This Privacy Policy explains what information is handled when you use the Effa app on iPhone or Android (the "App"), why, and the choices you have.

Effa is a hearing check for reference only. It does not require an account. We do not ask for your name, email address, phone number, contacts, photos, advertising ID, or precise location.

2. Summary

• Your check results stay on your phone unless you choose to share them.
• Sharing anonymous results is optional, off by default, needs your explicit consent, and is not available under 16.
• The microphone is used only to measure background noise. Nothing is recorded, saved, or sent.
• We do not sell your information or use it for advertising.
• You can delete everything on your phone and on our server at any time with Delete my data in the App's Settings.

3. Information We Handle

Stored only on your phone

Your age, the answers you give before a check (for example about tinnitus), your hearing thresholds and charts, your check history, and your settings are saved on your device. We do not receive them unless you turn on anonymous sharing.

Microphone

Before and during a check, the App uses the microphone to measure how loud the background noise is, so it can tell you whether the room is quiet enough. The sound is analyzed on your phone as it comes in. It is not recorded, saved, or sent to us.

Headphone detection

To identify your headphones, the App reads the connection type (for example Bluetooth or wired) and the device name on your phone. Device names often contain a person's name (such as "Alex's AirPods"), so the App keeps only the recognized model name and drops the rest before anything could be shared. We never collect the Bluetooth address or other hardware identifiers of your headphones.

Anonymous results you choose to share (health data)

If you are 16 or older and turn on sharing, each completed check is uploaded together with:

• your age in years and, if you gave them, your sex and your answers about tinnitus or sudden hearing changes;
• your hearing thresholds for each ear and pitch, the reliability values of the check, and, for some checks, the timing of your responses to individual tones;
• the headphone model you confirmed, the cleaned device name, the connection type, the system volume, and the background noise level;
• your phone model, operating system version, App version, and your phone's region and language settings.

This data is linked to a random installation ID that the App creates through an anonymous sign-in. It is not linked to your name, email address, phone number, or advertising ID. Hearing results are health data, so we only collect them with your explicit consent.

Headphone list and correction profiles

The App downloads the list of headphone models and the latest correction profiles from our server. These requests do not include your results.

Crash reports

We use Firebase Crashlytics to find and fix crashes. When the App crashes, a report may be sent containing technical details such as the phone model, operating system version, App version, the state of the App at the time of the crash, and a Crashlytics installation identifier. Crash reports do not include your hearing results.

Connection data

Like any app that connects to the internet, the App's requests reach our servers and providers together with your IP address. It may appear briefly in their security logs. We do not store it with your results or use it to locate or identify you.

Result cards you share

If you share a result card, the App creates the image on your phone and opens your phone's share sheet. Where it goes is up to you; we do not receive a copy.

4. How We Use Information

• To run the hearing check and show your results.
• To build correction profiles for popular headphone models and reference curves by age, so that checks become more accurate for everyone.
• To improve the check's method and reliability.
• To find and fix crashes and bugs.
• To prevent abuse of our server, for example with a daily upload limit per installation.
• To comply with law and to protect users, Gndsoft, and others.

We do not sell your information, share it for advertising, use it to make decisions about you, or try to identify you from it. Correction profiles and reference curves are statistics computed from many checks and do not contain any one person's results.

5. Legal Bases (EEA, UK and Switzerland)

Where the GDPR applies, we process shared hearing results on the basis of your explicit consent (Article 9(2)(a) GDPR). We process crash reports and connection data on the basis of our legitimate interests in keeping the App working and secure. You can withdraw your consent at any time in the App's Settings; withdrawal does not affect processing before it.

6. Service Providers and International Transfers

Information is processed by these providers on our behalf:

• Supabase (database, anonymous sign-in, and server functions for shared results) — supabase.com/privacy
• Google Firebase Crashlytics (crash reports) — firebase.google.com/support/privacy
• Apple App Store and Google Play for distribution.
• Professional advisers or authorities when reasonably necessary to comply with law or protect rights and safety.

These providers may process information in the United States and other countries outside the one where you live. When information is transferred, we rely on safeguards required by law, such as the European Commission's standard contractual clauses.

7. Retention

Data on your phone stays until you delete it or uninstall the App. Shared results are kept for as long as they are useful for correction profiles and reference curves, until you delete them with Delete my data. Crash reports are kept by Google for 90 days. Statistics that no longer contain any individual's results may be kept after the underlying data is deleted.

8. Your Choices and Rights

• Sharing: you can use every feature without sharing. Turn sharing on or off at any time in the App's Settings; turning it off stops future uploads.
• Delete my data: in the App's Settings, this removes every result from your phone and from our server, including the anonymous installation ID.
• Microphone: you can deny or withdraw microphone access in your phone's settings. The App then cannot check the background noise for you.

Depending on where you live (for example under the GDPR, Korea's Personal Information Protection Act, or US state law), you may also have the right to access, correct, delete, or receive a copy of your information, to withdraw consent, and to object to or restrict certain processing. Because shared results are not linked to your name or email, the quickest way to delete them is Delete my data in the App; for other requests, contact us at [email protected]. We do not discriminate against you for using these rights. You may also lodge a complaint with your local data protection authority.

9. Consumer Health Data (United States)

Some US state laws, such as Washington's My Health My Data Act, treat hearing results as consumer health data. We collect such data only to provide the App and to improve its accuracy as described above, only with your consent, and we do not sell it. You can delete it at any time as described in this policy.

10. Security

Data sent by the App is encrypted in transit. On our server, each installation can only reach its own records, and access by our staff is limited to what is needed to run the service. No method of storage or transmission is completely secure, but we use reasonable safeguards.

11. Children

Effa is intended for a general audience and is not directed to children under 13. Sharing is not available to users who enter an age under 16, so the App keeps their results on the phone only. If you believe a child has shared data with us, contact us and we will delete it.

12. Additional Information for Users in Korea

Hearing results are sensitive information under Korea's Personal Information Protection Act. We process them only with your separate consent, given in the App before any upload. The overseas transfer and outsourcing of processing work as follows:

• Recipients: Supabase, Inc. (data storage and server functions) and Google LLC (crash reports).
• Countries: the United States and other countries where these providers operate.
• When and how: sent over an encrypted network connection each time a shared check is uploaded or a crash report is sent.
• Items: those listed under "Anonymous results you choose to share" and "Crash reports" above.
• Retention: as described under "Retention" above.
• Refusal: you can use every feature of the App without sharing; only the contribution to correction profiles is lost.

When data is deleted, it is removed from our database without delay and cannot be restored. For privacy questions and complaints, contact Gndsoft's privacy officer at [email protected].

13. Changes and Contact

We may update this policy when the App, our practices, or the law changes. We will update the date above and give additional notice where required. For questions or privacy requests, contact Gndsoft LLC at [email protected].