Cybertouch Ltd (company number 15384458), 124 City Road, London, England, EC1V 2NX, is the data controller for the personal data described here. Contact: support@cybertouch.co.uk.

When Cybertouch runs a study with a partner, such as a school or university, the partner may also be responsible for some of the study's data. The study's information sheet says who does what.

• Your account. Your email address and password. The password is stored only in a scrambled form that cannot be read back. On iPhone you can sign in with Apple instead; Apple then shares an email address (which can be a private relay address) and an account identifier.
• Your age check. At sign-up the app asks for your date of birth, to check that you are 13 or over. Cybertouch's servers never store the date of birth itself: at most, they keep the result of the check and when it was made. If the check shows someone is under 13, the app does not let them in. With email sign-up, the check comes first, so no account is created for anyone under 13. In versions of the app where Cybertouch's under-18 protections are switched on, the date of anyone who passes waits on the phone, encrypted, until the first sign-in on that phone, for at most 14 days. It is then sent once to Cybertouch's servers, which keep at most the result, and deleted from the phone. Otherwise the date is used only for the check and is not kept. Sign in with Apple creates a sign-in record before the check can run; if the check then shows someone is under 13, the app signs them out. A parent or guardian can ask Cybertouch to delete that record at support@cybertouch.co.uk.
• Your profile. Display name, @handle, picture and bio. These are public.
• What you make. A video you film or choose in Create (including its sound), a sound or a song you choose, and any text you type, are sent to Cybertouch's servers to make a pattern. The video, sound or song is deleted within about an hour. The pattern, and any text you typed for it, are kept until you delete your account, or ask Cybertouch to delete it.
• What you share and do. Posts and their titles, drafts, favourites, likes, saves and follows. Posts, likes and follows can be seen by other people.
• Reports and blocks. If you report a post or an account, Cybertouch keeps the report: the reason you chose and any note you add. If you block someone, Cybertouch keeps a record of the block. Both are used to keep Cybertouch safe.
• Usage analytics (off unless you switch it on, in Settings). When it is on, Cybertouch receives which features get used; which profiles you open or follow and which posts you share; which song or file an event was for (a catalogue ID for a song, or a one-way coded reference for a file on your phone, never its name); and your choices when the app asks whether to keep a new feel. Each event comes with a random ID for this install and basic phone details. It carries no name or email address, and it is not linked to your account.
  PostHog, the analytics service, also adds some details by itself, which the app does not switch off: the app's name and version and the screen size. It may also add the phone's model and maker, its operating system and version, its language and its time zone. Earlier test versions of the app also let it record when the app was installed, updated, opened, or moved to or from the background; current versions do not. PostHog receives the phone's IP address with each event. The app asks PostHog not to use it to work out a location (earlier test versions of the app did not ask).
  Switching Usage analytics off stops it. Reset all preferences clears the ID on the phone.
• The Korus waitlist. The app has a Korus waitlist screen, reached only from a direct link. It is for adults 18 and over: nothing is sent until you tick “I am 18 or over.” Joining sends your email address, your phone type (iPhone or Android) and a record that you agreed. Your address is kept on the Korus waitlist. Cybertouch plans to send a weekly note from Cybertouch to the list, through MailerLite; every email will have an unsubscribe link.
• Server records. Cybertouch's servers keep ordinary logs, which include IP addresses, and send error reports, to keep the service secure and fix faults. They are not used to work out where you are.

The app does not:

• show ads, use the advertising identifier, or sell data;
• use the phone's location, contacts or messages, or look through its files;
• send crash reports from the phone.

• Settings such as vibration strength, theme and the phone check result.
• If you connect Spotify, the access token Spotify issues. It is stored encrypted on your device only and is never sent to Cybertouch's servers. Signing out of Cybertouch, or deleting your account, deletes it from the phone. To remove Cybertouch's access to your Spotify account at any time, use the apps page of your Spotify account (spotify.com/account/apps).
• When Feel your music uses the microphone on Android, it reads only the song the phone is playing, on the phone. Nothing is recorded or sent.
• Around You, where available, works on sound around you on the phone only. The sound is never recorded or sent.

• The beta list. Your name and email address, and any phone number or social handles you choose to share, plus a record of what you agreed to: the exact wording, its version, the time, and that you confirmed you are 18 or over.
• The news list (optional, adults 18 and over only). If you tick the news box, your email address is added to the news list, with the same record of what you agreed to. It is separate from any test, and taking part in a test never depends on it. Cybertouch may email you once to confirm the address is yours. Every news email has an unsubscribe link; anyone who leaves is never added back.
• Waitlists and the contact form. Your email address, and your name and message when you write in.
• The security check. The beta form and the contact form use Cloudflare Turnstile, which looks at information about your browser and device to tell people from automated traffic.
• Website analytics. Plausible and HubSpot load only after you accept analytics in the cookie banner. If you decline, none are loaded.

• To let a phone into a test, Cybertouch adds the email address of the Google account (for Google Play testing) or Apple ID (for TestFlight) that the tester gives to the test list in Google Play Console or App Store Connect, or to a Google Group whose members only its managers can see.
• That address is used only for the test and for messages about it. It is never used for news or advertising, and never added to the news list.
• It is deleted within 30 days of the test's end date: from the test list, any Google Group, and any paper slips.
• Google and Apple run their testing services under their own privacy policies.

• The app is for people 13 and over. Cybertouch does not knowingly keep an account, or a sign-in record, for anyone under 13, and deletes one if it learns of it.
• In the UK, people aged 13 and over can agree to use an online service themselves. If you are under 18 and live where the law requires a parent's or guardian's consent (in India, for example), use Cybertouch only with their agreement.
• Where Cybertouch's under-18 protections are switched on, an account whose age check shows the holder is under 18 cannot publish, follow anyone or be followed, or switch on Usage analytics, and anything it published before is hidden from other people.
• Young people can take part in a study or test only with the agreement of a parent or guardian and the approval of the school or research partner.
• The beta list, the news list and the Korus waitlist are for adults 18 and over. Cybertouch sends no marketing to anyone under 18.
• Analytics is off unless switched on. The app has no ads and does not track anyone for advertising.
• Cybertouch never labels or groups anyone by health or disability.
• A parent or guardian can ask about, or ask Cybertouch to delete, a child's data at support@cybertouch.co.uk.
• How Cybertouch keeps children safe, and how to report a concern about a child, is on the Child safety page.

• To provide the app you asked for (contract): your account, profile, patterns, posts and follows, and making patterns from what you send.
• With your consent: the news list, the beta list, the Korus waitlist, website analytics and Usage analytics in the app. You can withdraw consent at any time, as easily as you gave it.
• For legitimate interests: protecting children, in line with the Information Commissioner's Children's Code (the age check and the under-18 protections); keeping Cybertouch safe and secure (reports, blocks and moderation, security checks, server logs and error reports); running tests of the app; and answering your messages. Where young people are involved, their interests come first.
• To meet legal duties: such as keeping records the law requires.

To create an account you must give an email address and a password (or use Sign in with Apple on iPhone) and pass the age check. Without them Cybertouch cannot give you an account. You can browse the Feed without signing in, and everything else is optional.

The age check automatically stops anyone under 13 from signing up or getting into the app and, where the under-18 protections are switched on, limits some features for anyone under 18 (see Children and young people). The title and other text shown with a post are checked automatically for offensive words before it is published. A post that several people report can be hidden automatically; if that happens to yours and you think it is wrong, email support@cybertouch.co.uk and ask for a person to look at it again. Cybertouch makes no other decisions about you by automated means alone.

Cybertouch uses a small number of service providers. Most handle personal data only on Cybertouch's instructions. Apple, Google and Spotify are independent companies; their own privacy policies apply to what they receive.

• Supabase: database, sign-in and file storage. Hosted in London.
• Resend: sends the sign-up, password-reset and account emails, and delivers contact form messages to Cybertouch.
• Railway: runs Cybertouch's servers. Hosted in the Netherlands.
• Cloudflare: website hosting, the security check, and network protection for the website and servers.
• An AI model provider, based in the United States: AI services used by Cybertouch's servers. It receives only what those services need. Its contract forbids it to train its models on Cybertouch's customer data, and protects data leaving the UK with safeguards recognised under UK data protection law.
• Sentry: error reports from Cybertouch's servers. Hosted in the European Union.
• PostHog: app analytics, only if you switch them on. Hosted in the European Union.
• MailerLite: email lists and delivery, for the lists you join.
• HubSpot: contact management, and website analytics after you accept them in the cookie banner. European Union data centre.
• Plausible: privacy-friendly website analytics, after you accept them in the cookie banner.
• Google: Google Play, app testing and Google Groups for testers.
• Apple: the App Store, TestFlight and Sign in with Apple. When you search Apple Music in the app, the search goes from your phone straight to Apple.
• Spotify AB: when you sign in to Spotify inside the app, your device signs in with Spotify directly and Spotify's own privacy policy applies to that account. Cybertouch never receives your Spotify password or your library. Signing out of Cybertouch deletes the Spotify token from the phone; spotify.com/account/apps removes Cybertouch's access to your Spotify account at any time.

Cybertouch is based in the United Kingdom. Its database is in London and its servers run in the Netherlands. Some of the providers above handle data in other countries, including the United States.

If you use Cybertouch from India, or anywhere else outside the UK, your data is sent to the UK and to those countries. Where data leaves the UK, Cybertouch relies on the UK's adequacy rules or on data-transfer contracts recognised under UK law. You can ask for a copy of those safeguards at support@cybertouch.co.uk.

• Videos, sounds and songs sent to make a pattern: about an hour.
• Your account, and the patterns and posts you make and share: until you delete your account, or ask Cybertouch to delete them. Drafts, likes, saves and follows you can also remove yourself in the app.
• Your date of birth: never stored on Cybertouch's servers. With email sign-up, where the under-18 protections are switched on, it waits on your phone for at most 14 days, as described above. Any age-check result stays with the account.
• A sign-in record left when the age check stops someone under 13 who used Sign in with Apple: deleted at once where Cybertouch's servers run the age check; until then, deleted when a parent or guardian asks.
• Reports and blocks: until the account that made them, or the account or post they are about, is deleted.
• Corrections sent with an earlier version of the app, while its “Contribute your corrections” setting was on (the setting has been removed, and no more are collected): until Cybertouch deletes them, or you delete your account, whichever comes first.
• Cybertouch's server logs, which include IP addresses: up to 30 days.
• Error reports from Cybertouch's servers: up to 90 days.
• Usage analytics events: for as long as PostHog keeps events under Cybertouch's plan (one year on PostHog's free plan, seven years on its paid plans), or until you ask Cybertouch to delete them.
• Copies in Cybertouch's daily database backups: up to 7 days after the data is deleted.
• Tester email addresses: deleted within 30 days of the test's end date.
• The news list: until you unsubscribe. The record of what you agreed to is kept while you are on the list, and afterwards only as long as Cybertouch needs to show that you agreed.
• The beta list: until you ask to be removed, or when the Beta Program ends.
• Website waitlists: until you ask for your address to be deleted, or Cybertouch closes the waitlist.
• Contact form messages, and contact records in HubSpot: for as long as needed to answer you and deal with any follow-up, or until you ask for them to be deleted.
• The Korus waitlist: until you ask for your address to be deleted. Once the weekly note starts, the unsubscribe link in any email stops the emails.

In the app: Profile, then the gear icon (Settings), then Account, then Delete account. The account and its data are deleted as soon as you confirm. If the app shows a recovery period, the account is closed at once and erased when that period ends, at most 30 days later.

Without the app: email support@cybertouch.co.uk from the address your account uses, with the subject “Delete my Cybertouch account”. Cybertouch deletes it within one month.

Delete your account lists what is deleted, when, and what is not deleted with the account.

Under UK data protection law you can ask for a copy of your data, and ask Cybertouch to correct it, delete it, limit how it is used, or pass it to you in a portable form. You can object to uses based on legitimate interests, and withdraw consent at any time. Users in India have similar rights under Indian law, including to name someone to act for them.

Email support@cybertouch.co.uk. Cybertouch replies within one month. Download your data is not yet available in the app, so ask by email.

If you are unhappy with how Cybertouch handles your data, email support@cybertouch.co.uk with “Data protection complaint” in the subject. Cybertouch acknowledges a complaint within 30 days, looks into it without undue delay, and tells you the outcome.

You can also complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you live in India, you can take a complaint that Cybertouch has not resolved to the Data Protection Board of India.

When this policy changes, Cybertouch posts the new version here with its date and, for important changes, takes reasonable steps to tell account holders. The Terms of Service cover the rules for using Cybertouch.