Privacy Policy

Effective date: October 12, 2026 · Applies to the Rhyme Rhino app for iPhone, iPad and Android · Publisher: Griffonix Inc., Waukee, Iowa, United States

Rhyme Rhino turns your personal stories into songs with AI-written lyrics and AI vocals. This policy explains what the app stores on your device, what is sent to our servers and to Google's AI services, how long it is kept, and how you can delete it. We designed the app to keep your content on your device wherever possible.

1. What stays on your device

The following is stored in the app's private storage on your device until you delete it. Selected data is sent for generation as described below; completed library items may also be included in your platform device backup:

• your stories and the details you type (names, facts, occasions);
• voice notes you record or import;
• photos you choose in any scenario (used as local cover art only);
• every lyric version, including your manual edits;
• finished songs, their lyrics, covers and the order of your library;
• your song-language and style choices.

Completed songs, lyrics, covers and the library order are eligible for standard Apple or Android device backup, according to your backup settings. Source recordings, story drafts and pending requests are excluded. This is not a separate cloud library or automatic song sync. You can also export a song with Share song to keep a copy.

2. What is sent to our servers, and why

When you tap Write my lyrics (after confirming that you agree to processing) the app sends to our server the text needed to write lyrics: your typed story or details, the recipient or pet name, the occasion, the chosen song language and style, and, for Voice to Song, your voice note so it can be transcribed. If you ask for another lyric version, your current lyrics and your note about what to change are sent too. When you tap Create my song, the app sends the title, the lyrics you approved, the style, the song language and a short pronunciation guide for names, together with your selected vocal type and arrangement balance. These are generation instructions, not a voice clone or separate adjustable audio tracks.

Our server forwards this material to Google's generative AI services to transcribe speech, write lyrics and generate the music. Cover photos are never uploaded. Google processes submitted material under its API terms. We request that the music interaction is not stored as conversation state; this request does not disable Google's separate safety monitoring. Google's published abuse-monitoring policy retains prompts, contextual information and outputs for 55 days, with review by authorised staff if potential abuse is flagged. Under Paid Services, submitted prompts and responses are not used to improve Google's products. Our own cleanup does not erase these provider copies, and we do not promise zero provider retention. See Google's abuse-monitoring policy.

Our servers run on Google Cloud in the United States.

If you choose Report content and tap Send report, we receive the selected title and lyrics, your reason and optional note, and an installation reference. We use this information to investigate AI-content problems and improve safeguards. Reports do not include your recording or cover photo, do not go to Amplitude or AI prompts, and are accessible only to authorised support staff. Please avoid adding unnecessary personal details in a report.

3. How long we keep it

• Input for processing (your text and voice note): stored in private cloud storage only while the job runs and deleted when processing finishes or fails. Deletion is attempted immediately and repeated by scheduled cleanup; the production storage lifecycle schedules leftover objects for deletion after two days, with recoverable soft deletion disabled. Current TestFlight storage also has a two-day lifecycle, but retains recoverable deleted objects for a further seven days. Legacy test storage may use a seven-day lifecycle. Cleanup and provider retention are separate; a delivery deadline is not a guarantee of instantaneous physical deletion.
• Results (lyrics, generated audio): kept until your device confirms that it has saved them, or until the delivery window ends — 24 hours after the request for current app versions (7 days for versions before 0.4). After that they are no longer available for delivery and are scheduled for cleanup; retries and storage lifecycle handle temporary cleanup failures.
• Job records without content (job ID, status, timestamps, error category, allowance reservation): retained to prevent duplicate processing and charging. Deletion tombstones and subscription/allowance records are separate from content and may outlive the delivery window. Installation and purchase records are retained for service access, accounting and dispute handling; you can request deletion where legal and security obligations allow. Do not assume Delete all content erases these records or resets an allowance.
• AI-content reports and deletion requests. Submitted report content, deletion-request records and their installation lookup records expire 90 days after creation. Automatic expiry deletion is enabled in our Google Firestore databases. Technical counters used to limit support requests expire after two days. Google processes expiry deletion in the background, usually within 24 hours after expiry, so these periods do not promise instantaneous physical deletion. Expiry of a request record is separate from fulfilling your deletion request; you can request erasure as described below. Support uses deletion requests to locate installation-linked records; the request itself does not cancel your subscription or reset usage. If a legal obligation requires retaining a specific record, we explain it when responding.
• Server logs: contain technical metadata, including timestamps, request paths, IP addresses, app/browser identifiers, status codes, error categories and token counts. Operational logs are retained for 30 days. Google Cloud administrative audit logs are retained for 400 days; these record cloud-resource administration rather than the contents of your songs. We do not intentionally log stories, lyrics, recordings or photos.

4. Identifiers we use

• Installation identity. The app uses Apple's App Attest to prove that requests come from a genuine copy of Rhyme Rhino on an Apple device. Our server stores a hashed key identifier and a public key for your installation, plus short-lived access tokens (stored as hashes). This identity is not your name, Apple Account or email; we never receive those from Apple.
• Purchase verification. To unlock paid music generation, the app sends Apple's signed purchase confirmation to our server. We store the signed confirmation and the Apple transaction identifiers, and we check the current subscription state with Apple. We do not receive your payment card, billing address or Apple Account email.
• Android device and purchase verification. The current Android update identifies an installation using Play Integrity and a public key from Android Keystore, without a separate Google sign-in. We store the installation identifier, public key and hashed short-lived access tokens. Google Play purchase tokens, product/plan identifiers and verified subscription state are stored to provide paid access and handle renewals, restores, refunds and disputes. Restoring a purchase links the installation to the existing subscription and its allowance; it does not reset usage. Card and billing details remain with Google Play. Earlier Android test versions used Google sign-in: for those existing records we retain a keyed hash of the Google account identifier and a separate keyed hash of the verified email for deletion lookup. We do not store raw email, name, profile photo or Google identity token, or send these profile fields to AI providers or analytics. Android and Apple purchases remain separate.
• Allowances. We keep a counter of lyric and song generations per allowance period so that limits are applied consistently, using a verified platform app, account or purchase identity. TestFlight and Google Play license-test purchases are verified separately from production purchases.

5. Product analytics

The app reports a small set of events so we can see whether creation and playback work: scenario selected, lyrics ready, paywall opened, purchase verified, song delivered, first playback, example played, lyrics regenerated, generic error, share sheet opened or completed. Each event may include the scenario, the song language, a technical outcome and, for share events only, a coarse share category (Messages, Mail, AirDrop, Files, copy, system, other app or unknown). Events never include names, stories, lyrics, recordings, photos, purchase receipts or your contact details. The app has no third-party advertising or analytics SDK; limited events are forwarded by our server to Amplitude as described below. We do not use advertising tracking or track you across other companies' apps or websites.

Events use pseudonymous identifiers for an installation or a verified platform account/purchase identity. They may also include the selected genre, app build, phone/tablet class, playback milestones, interface language, voice/text input category, selected vocal setting, whether a local cover exists, broad error category and duration bucket. Server events also describe subscription renewals, changes, expiry, billing failures, refunds and revocations, and creation acceptance, completion, failure, cancellation and uncertain outcomes. These events contain plan and period categories, not payment-card details or purchase receipts. Raw analytics in Google Cloud have a 90-day retention setting and are scheduled for deletion as their daily partitions expire; an offline device buffer holds at most 300 events for up to seven days. Server event delivery buffers expire after seven days. Aggregated reporting does not include stories or song content.

For the publicly distributed app, our server also sends these limited events to Amplitude, our product analytics service, in its United States region. Installation and verified account identifiers are transformed on our server before export; raw Apple/Google account identifiers and purchase receipts are not sent to Amplitude. TestFlight, Android Alpha/Sandbox and debug activity is excluded from Production Amplitude. We use Amplitude to understand the steps from creating lyrics to purchasing, generating a song, listening and sharing; we do not enable session replay or advertising tracking.

Our Rhyme Rhino project in Amplitude has an enabled event-retention setting of 13 months from ingestion. Amplitude schedules automatic deletion of older events; its processing schedule means expiry is not a guarantee of instantaneous physical deletion. The setting was enabled on October 12, 2026, and Amplitude starts applying deletion 24 hours after confirmation. This is separate from the 90-day retention for raw Google analytics. You may request deletion of analytics associated with your installation or verified account by contacting us; we will explain how to identify the relevant records without asking you to send private song content.

6. How to delete your data

• One song: in Listen, open the song menu and choose Delete song.
• Everything: Settings → Delete all content. This removes your stories, recordings, photos, lyrics and saved songs from the device. Any pending or undelivered server job is queued for deletion and the request is sent when the app is online; if the app is removed before it reconnects, temporary server copies still expire as described above.
• Stop sending stories: Settings → Allow story processing can be switched off. You can keep listening to saved songs.
• Android app account: Settings → Request account deletion or visit Account deletion. Android versions with the in-app request form authenticate the request and provide a reference; no Google sign-in or subscription is needed. Keep the reference to follow up after uninstalling. You can also contact support without reinstalling, even if you lost the reference; we will explain verification. We verify the request, delete associated account and installation records and temporary content, and explain any limited accounting or anti-abuse records that must be retained. This deletes your Rhyme Rhino account, not your Google Account.
• Deleting content does not cancel a subscription (see Apple Account or Google Play subscription settings) and does not reset already used allowances.

7. Children

Rhyme Rhino is intended for adults aged 18 or over. Store age ratings use regional categories. We do not add a separate in-app adult declaration. Where applicable regional requirements require age assurance, the Apple app uses Apple's native age-range mechanism. We do not collect identity documents, birthdays or exact ages. Required age checks that do not establish eligibility cannot unlock generation. Regional Store ratings do not lower the intended minimum.

8. Legal bases and international processing

Where the GDPR applies, processing needed to provide a generation you request, verify paid access and administer subscriptions is based on performance of our contract with you. Protecting access and preventing abuse relies on our legitimate interests in operating a secure service. Statutory accounting or legal records are processed to comply with legal obligations. Your in-app story-processing choice controls whether new source content is submitted; it is not consent to unrelated purposes.

We use limited reliability and usage metrics for our legitimate interests in finding failures and improving the app, where this basis is permitted by applicable law. You may object to this processing by emailing ivan@griffonix.com. Where local law requires prior consent for non-essential analytics, legitimate interests do not replace that consent. The story-processing choice is not analytics consent, and pseudonymous or server-delivered events are not automatically anonymous.

Google Cloud, Google's AI services and Amplitude may process data in the United States or other locations under their applicable service terms. Their data-processing terms provide contractual safeguards for personal data, including standard contractual clauses and UK transfer provisions where applicable. See the Google Cloud Data Processing Addendum, the Google addendum referenced by the Gemini API paid-service terms and the Amplitude Data Processing Addendum. The applicable safeguard depends on the service, transfer and law; storing data in the United States does not remove your privacy rights. You can contact us for information about applicable safeguards.

9. Your rights and how to contact us

Depending on where you live, you may have the right to access, correct, delete, receive a portable copy of, restrict or object to processing of your personal data. Where processing relies on consent you can withdraw it without affecting prior lawful processing. You may complain to your local data-protection authority. We respond within the period required by applicable law, normally one month for GDPR requests, subject to permitted extensions. Most of your content is only on your device and can be deleted by you directly. For requests about server-side data (installation identity, purchase verification records, job metadata), email ivan@griffonix.com or see the Support page. Please do not include recordings or private details in a public request; we will tell you how to send them privately if needed.

10. Changes

We will post updates to this page with a new effective date. Material changes will also be described in the app's release notes.