Privacy Policy
For the Surtaal iOS app · Effective 4 August 2026
Surtaal ("the app") is made by KTM Studio ("we", "us"). This policy explains what the app collects, what never leaves your device, and who else is involved. It covers the app only.
The short version. We collect the account details you give us when you sign in, and we sync the practice material you create — your custom patterns, practice sessions and favourites — so it follows you between devices. Your audio recordings stay on your device and are never uploaded. We do not use advertising, analytics or tracking SDKs, and we do not sell or share your data with data brokers.
1. What we collect
Account information
Surtaal requires an account. Depending on how you sign in, we receive:
- Email sign-up: your name, email address, and a password. Passwords are hashed by our authentication provider; we never see or store the plain text.
- Sign in with Apple: your name and the email address Apple provides. If you choose Apple's Hide My Email, we only ever receive the relay address.
- Sign in with Google: your name and the email address on your Google account.
Practice content you create
When you are signed in, the following is stored on our server so it is available on your other devices:
- Custom patterns you build in the pattern generator
- Practice session records (what you practised and when)
- Items you mark as favourites
Purchases
If you buy a subscription or the lifetime unlock, Apple processes the payment. We never receive your card details, billing address, or Apple ID password. Our purchase provider receives an app-specific user identifier and the transaction receipt so the app knows your Premium access is active.
2. What stays on your device
Microphone audio is not sent anywhere. Surtaal asks for microphone access for two things, and both are handled entirely on your iPhone:
- The pitch tuner analyses incoming sound in real time to show the swara you are singing or playing. That audio is processed as it arrives and is not written to disk or transmitted.
- Practice recordings are saved as audio files on your device so you can listen back. They are never uploaded to us or to any third party, and they are not included in the sync described above.
Deleting a recording in the app deletes the file. Deleting the app removes all recordings held on the device.
3. What we do not do
- No advertising, and no ad networks.
- No analytics or behavioural tracking SDKs.
- No advertising identifier (IDFA), and no App Tracking Transparency prompt, because we do not track you across other companies' apps or websites.
- We do not sell your personal information, and we do not share it with data brokers.
4. Service providers
We use a small number of providers to run the app. Each receives only what it needs:
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase | Accounts and sync | Your account details and the practice content listed in section 1 |
| Apple | Payments, Sign in with Apple | Handled by Apple under its own privacy policy |
| Sign in with Google (only if you use it) | Handled by Google under its own privacy policy | |
| RevenueCat | Managing your Premium entitlement | An app-specific user identifier and purchase receipt data |
5. Legal basis and retention
We process your account details to provide the app you asked for (contractual necessity). We keep your account and synced practice content for as long as your account exists. When you delete your account, that data is deleted from our server.
6. Your rights
You can ask us to give you a copy of your data, correct it, or delete it. Depending on where you live — including under the GDPR in the EU/UK and the CCPA in California — you may also have the right to object to or restrict processing, and to lodge a complaint with your local data protection authority.
To make a request, email info@ktm-studio.com from the address on your account. We aim to respond within 30 days.
7. Children
Surtaal is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.
8. International transfers
Our providers may store and process data on servers outside your country. Where data is transferred out of the EEA or the UK, it is done under the safeguards those providers have in place.
9. Security
Connections between the app and our server are encrypted in transit. Passwords are hashed. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and will notify you if a breach affects it.
10. Changes
If we change this policy we will update the effective date at the top of this page. Material changes will be highlighted in the app.
11. Contact
KTM Studio · info@ktm-studio.com