Tonic privacy policy
Last updated 28 October 2026.
Who we are
Tonic is made by Northpocket Software Inc. (“North Pocket”, “we”, “us”), a software company in Canada. This policy covers the Tonic app on iPhone, iPad, Android, Mac and Windows.
The short version
- Tonic needs the internet once: to sign in. After that it works with no internet.
- If you write to us in Chat with us, we keep the chat, what you attach to it and a few facts about the app and your device, so we can help.
- We keep your email address, your account, and, if you hold one, which Founding Player spot is yours. If you sign in with Google, we also keep the name on your Google account.
- If you buy Tonic, the App Store or Google Play takes the payment. We never see your card. We keep a record that your account bought Tonic, so it opens on every device you sign into.
- Tonic sends no usage counts, no crash reports and nothing about what you play. It shows no ads and does not track you across other apps or websites. We do not sell your data.
Your Tonic account
You sign in one of four ways: with Apple, with Google, with your email and a password, or with a link we email to you.
Your account keeps your email address, a random id and the way you signed in. If you sign in with Apple or Google, they send us a sign-in token; we never see your Apple or Google password. Apple lets you hide your real address; if you do, we only ever see the address Apple gives us. If you continue with Google, Google also gives Tonic your Google account’s name and profile picture address. Your account keeps them, so you can sign in again, until you delete it.
If you use a password, it is never kept as you typed it. Supabase, which runs our accounts, keeps only a scrambled form of it (a hash) that cannot be turned back into your password, until you delete your Tonic account. Your device does not keep it.
When you ask for a link, Tonic sends your email address, your device’s own name (such as “Ana’s iPhone”) and its kind (iPhone, Android, Mac or Windows), and a scrambled form (a hash) of a random secret your device keeps. The page the link opens shows the device’s name and kind, so you can check it is yours before you confirm. That sign-in request keeps a hash of your email address, never the address itself, and is deleted after one day.
Each sign-in is kept, with the internet (IP) address it came from and the kind of device and app that made it, for as long as that sign-in lasts. A sign-in ends when you sign out, when you set a new password on another device, or when you delete your Tonic account.
We email you only to sign you in, to confirm your address, or to let you set a new password.
Founding Players
Founding Player spots are closed: no new spot is given, and the players who hold one keep it. For each spot we keep its number (1 to 500), the account’s id and when it was claimed. That is the founding record, and it is why a spot is yours on every device. The app keeps a signed copy of your claim on the device, so Tonic works offline.
Each time Tonic asks what your account holds (a spot, a purchase, or Tonic given to you), the call, and each refused one, is recorded with its time, your account’s id when we know it, and a scrambled form of the internet address it came from (a salted hash, never the address itself), so the service cannot be abused. These records are deleted after 90 days.
So that each device held one spot, a claim also checks the device it comes from. On iPhone and iPad, Apple’s DeviceCheck tells us only whether that device has claimed before, and we ask Apple to remember that it has. On Android, Google Play checks that the claim comes from Tonic on a genuine device, and the claim sends a scrambled form of the device’s id for Tonic. On a Mac or a Windows computer, the claim sends a scrambled form of the computer’s id. We keep only a further scrambled form of that id (a salted hash), with the spot’s number and when, never the id itself; it is kept with the spot.
Buying Tonic
Tonic is one purchase in the App Store or Google Play. If you are a beta tester, or Tonic was given to you, we keep your email address on the list of who it was given to, with when it was added and, for a beta tester, when it ends, until we take you off it; write to us and we will. The store takes the payment and keeps your payment details; we never see your card or your store account’s password.
RevenueCat checks each purchase with the store for us. It is given your Tonic account’s random id and the store’s record of the purchase: what was bought, when, the store’s order number, the price and currency, and the store’s country. We keep the same record with your account, so Tonic opens on every device you sign into, and so a refund can be matched to it.
What stays on your device
Your keyboards, your keys, your presets and your settings stay on the device. So does Tonic’s own log of what it did, which never holds the notes you play and is never sent to us.
Support chat
Chat with us needs you signed in. When you open it, Tonic sends a few facts so we can help: the app’s version, your device’s kind and system version, your keyboard’s model, your language and your time zone. We keep your messages, our replies and those facts.
You can attach up to four pictures or videos to a message. You pick them yourself; Tonic never asks to see your photos and does not use the camera. Pictures are drawn again on your device before they are sent, and every picture and video has its hidden details (such as where and when it was taken and the phone’s make) removed when it reaches us. They are kept in private storage and open only inside the chat, through a link that lasts five minutes.
Chats are not deleted, so the help you were given stays there. When you delete your Tonic account, the chat stays but loses everything that names you: the link to your account, the facts about your device and every email address written in it.
Where it is kept
| Who | What |
|---|---|
| Supabase, which runs on Amazon Web Services | Your account, your sign-ins, the sign-in requests, the Founding Player records, the record of a purchase and the support chat |
| RevenueCat | Checks purchases made in the App Store or Google Play and keeps the store’s record of them, with your Tonic account’s random id; never your email address |
| Cloudflare R2 | The pictures and videos you attach to the support chat, in private storage |
| Cloudflare | Sends the sign-in, confirm and password emails; it is given your email address and the message, nothing else |
| Apple and Google | Sign you in, if you choose Apple or Google. Take the payment, if you buy Tonic in their store. They also check the device a claim comes from (Apple’s DeviceCheck on iPhone and iPad, Google Play on Android); for that they are given the check from your device, never your email address or account |
These providers may store data outside your country. They act on our instructions and may not use it for their own purposes. Everything travels encrypted.
How long we keep it
- Your account: until you delete it.
- Your sign-ins: while you stay signed in.
- Sign-in requests: 1 day.
- Claim records with the scrambled internet address: 90 days.
- The scrambled device id of a claimed spot: kept with the spot, so the device cannot claim a second one.
- The support chat and what is attached to it: kept, without what names you once you delete your Tonic account.
- The record of a purchase: kept as the record of the sale. When you delete your Tonic account, your account is taken off it.
- Your Founding Player spot: kept as the founding record. When you delete your Tonic account, your account is taken off it and the number is never given to anyone else.
Deleting your data
Your Tonic account: delete it in Tonic’s Settings, or email hello@northpocketsoftware.com from the address on your account and say “Delete my Tonic account” (we tell you when it is done, within 30 days). We take your account off your Founding Player spot, the claim records and the support chat, take the device facts and email addresses out of the chat, and sign you out of Tonic. Your spot’s number stays taken and is never given to anyone else. A purchase stays with your App Store or Google Play account, so Restore purchase brings it back if you make a new Tonic account later.
Your email address and sign-in are deleted with it, unless you use another of our apps with the same email address: deleting your Tonic account does not affect that app, which keeps them until you delete your account there too.
Claim records are deleted after their 90 days and sign-in requests after their 1 day. Deleting the app removes everything it kept on your device.
Your rights
Wherever you live, you can ask us for a copy of what we hold about you, to correct it, or to delete it. Email us from the address on your account and we will answer within 30 days. If you are not happy with our answer, you can complain to the data protection authority where you live.
Children
Tonic is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has given us data, email us and we will delete it.
Changes to this policy
When this policy changes, we update the date at the top. If a change affects what we collect or how we use it, we will say so in the app before it takes effect.