Privacy Policy

1. Who we are

Tonic is a social platform for heartbreak recovery — Connect. Heal. Grow. This Privacy Policy explains how Tonic App Ltd ("Tonic", "we", "us") collects, uses, shares, and protects your information when you use the Tonic iOS app and the tonicapp.co website (together, the "Services").

It applies to everyone who uses the Services. If you do not agree with this policy, please do not use the Services.

2. Information we collect

We collect the following categories of information, most of which you provide directly or generate by using the Services:

Account & profile

When you sign in with Sign in with Apple, we receive an Apple-provided identifier and, if you allow it, your name and email (which may be a private Apple relay address). We also store your username, display name, avatar, bio, and account settings.

Content you create

Social posts, discussion posts, diary entries, comments, likes and upvotes, saved items, follows, and any photos or video you upload. Diary entries may be private to you; social and discussion content is shared with other users according to your choices.

Health & fitness data

If you enable them, we access activity, heart rate, and sleep data from Apple HealthKit (read-only) and data from connected services such as WHOOP, Strava, and Oura, so you can include wellness context in your diary and profile.

Location

If you grant permission, a diary entry may include the approximate location where it was created. Location is only captured when you choose to add it.

Camera, photos & microphone

With your permission, we access your camera, photo library, and microphone so you can capture and attach images or video to your content. We only access these when you use the relevant feature.

Device & push data

To deliver notifications we store a push token along with device details such as platform, app version, locale, time zone, a device identifier, and the notification environment.

Identity verification

If you choose to verify your identity, verification is performed by Stripe Identity. Stripe processes your identity documents; we receive only the verification status, not the underlying documents.

Usage & diagnostics

We collect app and site analytics, crash reports, and diagnostic logs to keep the Services reliable and to understand how features are used.

Communications & feedback

Emails, support requests, and in-app feedback you send us, and our correspondence with you.

3. How we use your information

• Provide, operate, and maintain the Services and your account.
• Display your content and enable social features such as posts, comments, likes, and follows.
• Show wellness context you have connected from HealthKit, WHOOP, Strava, or Oura.
• Send push notifications and service communications you have not opted out of.
• Keep the Services safe — detect, prevent, and respond to fraud, abuse, spam, and policy or safety violations.
• Verify identity where you request it.
• Measure, understand, and improve product performance and features.
• Comply with legal obligations and enforce our Terms.

4. Health and sensitive data

Health and fitness information is sensitive. We handle Apple HealthKit data in line with Apple's requirements:

• We only read HealthKit data you explicitly authorise, and only to provide features within the Services.
• We do not use HealthKit data for advertising, marketing, or sale to data brokers.
• We do not share HealthKit data with third parties except to provide a service you request, and never for their independent use.

Because Tonic is a heartbreak-recovery platform, some content you create may reveal sensitive personal circumstances. You control what you write and what you share publicly.

5. How we share information

We do not sell your personal information. We share it only as described here:

With other users

Content you choose to make public — such as social posts, discussion posts, comments, and profile details — is visible to other users of the Services.

With service providers (processors)

We use trusted vendors who process data on our behalf under contract: Supabase (authentication, database, media storage), Google Firebase (push delivery, analytics, crash reporting), Google Analytics (website analytics), Stripe (identity verification), and an email provider for transactional messages.

With connected integrations

When you connect WHOOP, Strava, or Oura, data flows between Tonic and those services as you authorise. Their handling of your data is governed by their own privacy policies.

For legal & safety reasons

We may disclose information if required by law, or to protect the rights, safety, and security of our users, the public, or Tonic.

Business transfers

If Tonic is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction.

6. Third-party integrations

Connecting a third-party service such as WHOOP, Strava, or Oura is optional. You authorise the connection through that provider and can disconnect it at any time in Tonic or in your account with the provider. Once disconnected, we stop receiving new data from that provider, though data already imported into your Tonic content remains until you delete it.

7. Analytics and advertising

We use Firebase Analytics and Crashlytics in the app and Google Analytics on the website to understand usage and improve reliability. Some features, including advertising, are controlled by feature flags and may not be active for all users. If we introduce advertising, we will not use your Apple HealthKit data to personalise ads.

8. Data retention

We keep your information for as long as your account is active or as needed to provide the Services. We retain and use information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete content or your account, we delete or de-identify the associated personal information within a reasonable period, except where retention is legally required.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can exercise these controls in the app or by contacting us:

• Access & update — edit your profile and content in the app.
• Delete — delete individual posts, diary entries, and comments, or delete your entire account.
• Notifications — turn push notifications on or off in the app or in your device settings.
• Integrations — disconnect HealthKit, WHOOP, Strava, or Oura at any time.
• Requests — contact us to exercise any privacy right; we will respond as required by applicable law.

10. Security

We use administrative, technical, and organisational measures to protect your information, including encrypted transport and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Children

The Services are not directed to children under 16 (or the minimum age required in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

12. International data transfers

We and our service providers may process and store your information in countries other than your own. Where required, we use appropriate safeguards for such transfers.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you in the app or by email. Your continued use of the Services after an update means you accept the revised policy.

14. Contact us

If you have questions about this Privacy Policy or how we handle your information, contact Tonic App Ltd at hello@tonicapp.co.