VioSound privacy policy

This policy covers VioSound, our music game for iPhone and Android. It says what the app stores, what it sends and to whom, why, how long it is kept, and what you can ask us to do about it. The privacy notice for violabs.co.uk covers this website.

Who we are

Vio Labs LTD makes VioSound and is the controller of the personal data described here. The company is registered in England and Wales, company number 17466165, with its registered office at 128 City Road, London EC1V 2NX.

To ask about your data or make a request, email contact@violabs.co.uk or write to us at the registered office.

In short

There are no accounts, no analytics, no crash reporting and no chat. We do not sell personal data.
Your settings and unlocks stay on your device.
Online jams go through our jam server. It holds rooms in memory only while people are in them, and its log has no IP addresses, names or room codes.
Adverts are optional and come from Google AdMob, which collects data under Google's own policies.

On your device

The app keeps these on your device only:

your settings: volume, vibration, how loud the backing groove is, whether chord names are shown, and the part and sound you last chose in each style;
whether you have seen the welcome message;
your unlocks: when a 24 hour advert pass ends, whether you own Unlock everything forever, and the latest time the app has seen on your device's clock, so that changing the clock cannot make a pass last longer.

None of this holds a name, an email address or a device identifier, and none of it is sent to us. Google's software also keeps your advertising choices on your device, as described under "Advertising" below. Uninstalling the app deletes all of it.

On Android, the app opts out of Android's backup of app data, so these files are not copied to your Google account. On iPhone, your iPhone's own backups, to iCloud or to a computer, may include them, as they do for other apps. We cannot see those backups.

Online jams

When the app opens, and whenever you play online, it connects to our jam server at wss://violabs.co.uk/viosound/ws. The connection is encrypted. The jam server runs on a dedicated server that OVH SAS hosts for us in France, the same server as violabs.co.uk. UK law recognises the European Economic Area as giving personal data adequate protection. Play offline uses no network: the app closes the connection while you play offline.

When it connects, the app sends your platform (iPhone or Android), the version of the app and of its music engine, the list of styles it has, and whether extra instruments are unlocked on your device. The server uses these to check that your app can play with the others, to choose which styles you are offered and to give you a sound you can play. In a room, the app sends the part and sound you choose, your votes for the next style, and what you play: whether your finger is on the screen, how high it is, and the notes it makes. To join a private room, it sends the four-letter room code you enter. If the connection drops, the app sends your room code and your name again so that you go back to the same room.

The server gives you a name made of two random words, such as Amber Fox, for each room. You never type a name or a message, and there is no chat. The other players in your room see your name, your part and sound, your platform, and what you play.

The server keeps rooms in memory only. A room is deleted as soon as the last person leaves it, and the server keeps no record of who played with whom. It ends the connection of a player who has not played or changed anything for 30 minutes in a room, or for 3 minutes outside one.

Its own log records technical events: connections, with their platform, app and engine version and how long they lasted; rooms opening and closing, with their style and tempo; style changes; and when a player is removed for sending invalid messages or too many. It does not record IP addresses, names or room codes. To protect the service from abuse, the server also uses your IP address in memory, to limit how many connections and wrong room codes come from one address. It never writes it to its log, and forgets it within about 10 minutes of your last connection. The log is rotated daily, and each day's log is kept for 14 days after that day ends and then deleted.

The connection passes through the web server for violabs.co.uk, which records it in its access log like any other request: your IP address, the time, the address requested, whether it succeeded and your device's user agent string. If the connection fails, the web server's error log also records your IP address. Both logs are kept for 14 days, as the site privacy notice explains.

We use this data to run the online jams you ask for. We keep the logs because we have a legitimate interest in keeping the service working and secure.

Advertising

Adverts in VioSound are optional rewarded videos. One plays only when you press Watch an advert, and watching one unlocks extra instruments for 24 hours. The adverts come from Google AdMob, which is provided by Google Ireland Limited for people in the UK and the European Economic Area, and by Google LLC elsewhere. The app tells Google that it is not directed at children and asks for adverts suitable for teenagers at most.

To show, measure and protect adverts, Google's software in the app may collect your device's advertising identifier where it can read one, your IP address and the approximate location it shows, information about your device and the app, how the adverts perform, and how you interact with them. Google uses this under its own policies: how Google uses information from sites or apps that use its services and the Google Privacy Policy. Google may work with other advertising companies, which Google's consent message lists. AdMob reports to us in totals, such as the number of adverts shown.

Unless you own Unlock everything forever, Google's software starts when the app opens and checks with Google whether your consent is needed. Where the law requires consent, as in the UK and the European Economic Area, the app shows Google's consent message the first time you press Watch an advert, and no advert is requested until you have made your choices. Google's software keeps your choices on your device. You can change them at any time in the app's Settings, under Privacy options.

Once your choices allow it, or where no consent is needed, Google's software may load an advert in the background so that one is ready when you ask. An advert is only shown when you press Watch an advert.

On iPhone, the app does not ask for permission to track you through Apple's App Tracking Transparency, so Google's software cannot read your iPhone's advertising identifier. On Android, you can reset or delete your advertising ID in your device's settings.

Where consent is needed, the legal basis for advertising is your consent. Otherwise it is our legitimate interest in paying for the free version with optional adverts.

If you buy Unlock everything forever, VioSound does not use Google's advertising and consent tools on your device once your purchase is confirmed: the Google Mobile Ads SDK and Google's User Messaging Platform are not started, and no advert is requested or shown. On a new phone or after reinstalling, VioSound checks your purchase with the App Store or Google Play before starting them.

Purchases

Unlock everything forever is bought through the Apple App Store or Google Play. Apple or Google handles the payment, and we never see your card or payment details. Each time the app opens, it asks the store whether you own the purchase, so that it works offline once bought, and Restore purchases in Settings brings it back after reinstalling or on a new device. The app remembers on your device that you own it. Apple's or Google's own privacy policy applies to the purchase.

The Share button opens your device's share sheet with a short message: "Join my VioSound jam. Room code" and the code of your room. Nothing is sent unless you choose an app and send it yourself. If the share sheet is not available, the message is copied so that you can paste it.

What the app does not do

The app has no accounts and no sign-in. It runs no analytics and no crash reporting. It does not use the microphone or record anything you play. It does not ask for your location, contacts, photos or camera. We do not sell personal data.

Children

VioSound is meant for people aged 13 and over. It is not directed at children under 13, and it asks Google for adverts that are not for children. We do not knowingly collect personal data from children under 13. If you think a child under 13 has used online jams, email contact@violabs.co.uk and we will delete anything we hold.

How long it is kept

On your device: until you uninstall the app, or longer in your own phone backups.
Rooms on the jam server: in memory only, until the last person leaves.
Your IP address on the jam server: in memory only, for up to about 10 minutes after your last connection.
The jam server log: 14 days after the day it was written.
The web server access and error logs: 14 days after the day they were written.
Email you send us: only for as long as we need it to deal with what you asked.

Your rights

Under UK GDPR you can ask for a copy of the personal data we hold about you, and ask us to correct it, erase it, restrict how we use it or stop using it. Where it applies, you can also ask for your data in a portable format. Email contact@violabs.co.uk or write to us at the registered office above.

Most of what VioSound handles never reaches us: it stays on your device. For the web server log, tell us the IP address you used and roughly when you played, so we can find any entries. For data that Google collects for adverts, use Google's own tools, or contact Google.

You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.

Changes to this policy

If a new version of the app stores or sends anything new, we will update this policy before that version is released. The date of the last change is at the end of this page.