Thetaloom
Effective 2026-11-01
Privacy Policy
This policy covers the app Thetaloom: Binaural Beats (formerly BrainSync) for iOS and Android (bundle ID and package name com.appkadag.brainsync) and this website. Short version: there is no account, your data stays on your device, and we do not sell personal data.
1. No account
You do not need to sign up or log in. We do not ask for your name, email or phone number inside the app.
2. Data stored on your device
Session history, mood ratings, custom presets, playlists, timelines, favorites, streaks and settings are stored only on your device (iOS: Core Data and UserDefaults, Android: Room and DataStore). We do not receive this data. You can export or delete it in the app, and uninstalling the app removes it.
3. Audio
Tones, noise and effects are generated on your device. The app does not use the microphone and does not make recordings.
4. Content downloads
AI sound beds and video scenes are downloaded from our content delivery network at cdn.thetaloom.com, hosted on Cloudflare R2. To deliver the files, Cloudflare processes your IP address and request data (see the Cloudflare Privacy Policy). We do not log individual users.
5. Ads (free tier only)
The free version shows Google AdMob banner ads on the Home and Stats screens. Pro users see no ads. In the EEA, UK and Switzerland we ask for consent through Google's User Messaging Platform (UMP), and personalized ads are shown only with your consent. To serve and measure ads, Google receives your device's advertising identifier, ad interactions and an approximate location derived from your IP address. You can change your ad choices any time in Settings, Privacy choices.
- iOS: the App Tracking Transparency prompt asks for your permission. Without it, the app does not access the advertising identifier (IDFA).
- Android: the advertising ID is used according to your Google settings, and you can reset or delete it there.
Google may process data such as your advertising ID, IP address and device information. See how Google uses data.
6. Analytics and crash reports
We use Firebase Analytics and Firebase Crashlytics (Google) on iOS and Android to understand usage and fix crashes. On Android, Analytics collection in release builds starts only after you consent. Android also uses Firebase Cloud Messaging (for optional reminders) and Firebase Performance Monitoring.
Retention: Analytics data up to 14 months, Crashlytics data 90 days. See Firebase privacy information.
7. Purchases
The Pro subscription and the lifetime purchase are processed by Apple (App Store) or Google Play. We receive no payment card data. The app only checks the purchase status on your device (StoreKit 2 or Google Play Billing, verified locally).
8. Permissions
Android: internet and network state (downloads), notifications (optional reminders), exact alarms (timer and reminders), wake lock and foreground service for media playback (background audio), boot completed (to reschedule reminders after a restart).
iOS: background audio, so sessions keep playing with the screen locked.
9. Children
Thetaloom is not directed to children under 13 (under 16 in the EEA). We do not knowingly collect data from children. If you think a child has given us data, contact us and we will help.
10. GDPR (EEA, UK, Switzerland)
Controller: see the Imprint.
Legal bases:
- Consent (Art. 6(1)(a) GDPR): personalized ads and analytics. You can withdraw consent at any time in the app's privacy settings or your device settings.
- Legitimate interest (Art. 6(1)(f) GDPR): crash reports and content delivery through the CDN, to keep the app stable and working.
- Contract (Art. 6(1)(b) GDPR): handling purchases through Apple or Google.
Your rights: access, rectification, erasure, restriction, objection, data portability, and the right to complain to a supervisory authority. Most data lives only on your device, so you can exercise many of these rights directly in the app. For anything else, email us.
International transfers: Google and Cloudflare may process data outside the EEA, including in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses otherwise.
11. California (CCPA/CPRA)
We do not sell your personal information. Ad partners may receive data for advertising in the free version; you can limit this through the in-app consent choices and your device ad settings. California residents may request to know, delete or correct personal information by emailing us. We will not discriminate against you for using these rights.
12. Changes
If we change this policy, we will update the effective date above. Material changes will also be noted in the app or store listing.