Privacy Policy

Effective date: 4 October 2026

Last updated: 4 October 2026

App: Sonary: MP3 & Noise Remover AI (Google Play package com.newagedevs.sonary; Apple App Store ID 6798929819)

Developer: NewAgeDevs (Md. Imam Hossain), Bangladesh

Contact: imamagun94@gmail.com

This policy explains what Sonary does with information: what stays on your phone, what leaves it, who receives it and why, and the choices you have. It replaces the version dated 15 September 2026.

The short version. Your audio and video files are processed on your device by every standard tool (extract, convert, trim, split, merge, mix, equalize, speed, volume, compress, record) and by Offline AI, and never leave it. The only time audio leaves your device is when you start a Cloud AI job (vocal separation or noise removal in the cloud), after the app has asked your permission. That audio goes over an encrypted connection to our backend and on to our AI provider, Replicate, and is deleted from Replicate when the job finishes. The app creates an anonymous account automatically so it can keep track of your AI minutes; you never have to give us your name or email, though you can choose to sign in with Google or Apple to back your minutes up. The free version shows ads from AppLovin. We never sell your data.

1. Who we are

Sonary (“Sonary”, “we”, “us”) is a mobile audio toolkit published by NewAgeDevs. It lets you extract audio from video, convert between formats, trim, split, merge and mix audio, adjust equalizer, speed and volume, compress and record audio, and run AI features — vocal/instrument separation and background-noise removal. This policy explains what data the app handles, why, who processes it on our behalf, and the choices you have.

This policy covers the Sonary app for Android and iOS and the backend service the app talks to. It does not cover third-party services you may open from the app (for example, if you share an exported file to another app), which have their own policies.

2. What we collect and why

We collect the minimum needed to make the app work, keep track of the AI minutes you have, keep the app stable, process purchases, and (for the free tier) show ads. Here is everything, grouped by purpose.

2.1 Audio, video & media you choose

• What: audio files, video files, and voice recordings that you select or record so the app can process them.
• Where it is processed: on your device for every standard tool (extract, convert, trim, split, merge, mixer, equalizer, speed, volume, compress, voice recorder) and for Offline AI. For these, your media never leaves your device. On-device processing uses FFmpeg and an on-device AI runtime (ONNX Runtime).
• Cloud exception: if you choose Cloud AI for vocal separation or noise removal, the audio for that one job is uploaded for processing (see Section 3). If you picked a video, its audio track is extracted on your device and only that audio is uploaded — never the video.
• Why: to perform the exact task you asked for.

2.2 Your Sonary account

• Anonymous account (automatic). The first time the app starts, it signs in anonymously with Firebase Authentication (Google). This creates a random account ID with no name, email or other details attached. You don’t register or type anything.
• Why: your AI-minute balance, any subscription allowance and your Cloud AI jobs are kept on our server under this ID. Every request the app makes to our server carries a short-lived, signed token that proves the ID, so a balance can’t be forged or spent by anyone else.
• Optional sign-in. In Settings you can back up your minutes by signing in with Google (Android and iOS) or with Apple (iOS). If you do, Firebase Authentication links that sign-in to your account ID and stores what the provider shares with it: your email address (or an Apple “Hide My Email” relay address), the provider’s identifier for your account and, where the provider supplies it, your name. The app shows the email in Settings so you can see which account holds your minutes. We don’t use it for anything else — no marketing email, no newsletters.
• Why sign in: so your minutes survive reinstalling the app and can be restored on another device. The first sign-in with a given Google or Apple account also adds a one-time bonus of free minutes.
• Undoing it: “Remove backup” in Settings unlinks the Google or Apple sign-in and keeps your minutes on this device; “Delete account” deletes the account and its server data (see Section 9).

2.3 Purchases & subscriptions

• What: which subscription or minute pack you bought, the store’s purchase token for it, whether a subscription is active, when it renews or ends and whether it is set to renew, and the minutes it added to your account. Payments are handled by Google Play or the Apple App Store — we never see or store your card number or billing details.
• How: the store gives the app a purchase token, which the app sends to our server. Our server asks Google Play (Google Play Developer API) or Apple (App Store Server API) whether that purchase is genuine and what it covers, and only then credits your account. A record of each redeemed purchase — the token stored as a one-way hash, the product, and your account ID — is kept so the same purchase can’t be redeemed twice.
• Why: to sell and restore subscriptions and minute packs, unlock what you paid for, and prevent purchase fraud.
• Sonary does not use a third-party subscription service. Earlier versions of this policy named RevenueCat; the app no longer includes it.

2.4 Advertising (free tier)

• Who: ads are served by AppLovin through its AppLovin MAX SDK. Sonary currently bundles no third-party mediation adapters, so no other ad network’s SDK runs in the app. AppLovin may pass ad requests to advertisers and buyers on its own exchange, under AppLovin’s privacy policy.
• What AppLovin collects: your device’s advertising identifier (the Google Advertising ID on Android; on iOS, the IDFA only if you allow tracking when Apple’s App Tracking Transparency prompt asks), device information such as model, operating-system version, language and network type, your IP address and the approximate location it implies, and your interactions with ads (impressions, clicks, rewarded-ad completions).
• Your Sonary account ID: the app also gives AppLovin your Sonary account ID. When you finish a rewarded ad, AppLovin’s server sends that ID back to ours so the minute you earned is credited to the right account. It is the random ID from Section 2.2 — never your email or name.
• Why: to show the ads that keep the free tier free (app-open, interstitial, and optional rewarded ads), and to credit rewarded-ad minutes. Ads never interrupt a job that is running.
• Sonary Pro: Pro removes ads from the app. The AppLovin SDK is still started when the app launches, before your subscription status is known, and may load ads in the background, so it can still receive the device data above — but Pro users are not shown ads.

2.5 Analytics, diagnostics & crash reports

• What: app-usage events — app opened, an export completed, an AI job requested and its outcome (task, Cloud or Offline tier, minutes charged, processing time) — plus events Firebase records automatically, such as first open and session start; a Firebase app-instance identifier and device/app information; crash logs and stack traces; and performance diagnostics. Our events contain no file contents, file names or paths, and we don’t attach your account ID or email to analytics or crash reports. On Android, Firebase Analytics may also read the device advertising identifier.
• Processed by: Firebase (Google) — Analytics, Crashlytics, and Remote Config. Remote Config only delivers settings to the app (for example, a switch that can turn Cloud AI off during an outage).
• Why: to understand which features are used, fix crashes and bugs, keep the app stable, and safely roll out configuration changes.

2.6 Data stored on your device

• What: your Library (processing history and the files you created), recordings, app settings (theme, save folder, whether you allowed Cloud AI), counters the app uses to space out ads and review requests, a cached copy of your minute balance, and any on-device AI models you downloaded. The Firebase Authentication SDK keeps your sign-in session in the app’s private storage (on iOS, in the Keychain).
• Public copies: on Android, finished files are also saved to a shared folder (Download/Sonary by default — you can change the folder or turn this off in Settings). Those copies are yours and stay on your device after you uninstall Sonary. On iOS, the app’s own folder is visible in the Files app and is removed when you uninstall.
• Why: so your history and exports are available offline and the app remembers your choices.

3. Your audio & cloud AI processing

This is the most privacy-sensitive part of the app, so we’re explicit about it.

• Only on your action. Each AI screen offers two tiers: Offline AI, which runs on your device and uploads nothing, and Cloud AI, labelled “Uploads this file · Deleted after · Uses minutes”. Audio is uploaded only when you choose Cloud AI and start the job. There are no background, automatic, or speculative uploads, and the app never scans your library.
• Asked before it happens. Before the first Cloud AI upload, the app shows a “Send audio to Cloud AI?” dialog that names Replicate, Inc. as the AI processing partner, says what is sent and that it is deleted after the job, and links to this policy. Nothing is uploaded unless you tap Allow & Continue; Not now cancels the job. Your answer is stored on your device. You can withdraw it at any time in Settings → Cloud AI data sharing → Revoke, and the dialog will appear again before the next Cloud AI upload.
• What is sent. The audio file for that one job. A file goes with its file name and any tags embedded in it (such as title or artist); files the cloud models can’t read, and audio taken from a video, are first converted on your device to a FLAC file with an app-generated name. Nothing else about you is attached: no name, email, account ID, Apple ID, device identifier, advertising ID, or purchase data reaches Replicate.
• Where it goes. The file travels over an encrypted (HTTPS) connection to our backend (Google Cloud Functions, run through Firebase), which checks your minute balance and forwards the file to our AI processing provider, Replicate, to run that one job on an AI model hosted there. Our backend records the job — task, minutes charged, status, Replicate’s job reference, and links to the results — under your account ID, so it can charge the right account and so only you can fetch the result. Replicate is never given that ID.
• Getting the result. The app downloads the result directly from Replicate’s file-delivery service over HTTPS. As with any web server, that service sees your device’s IP address for the download; no account or device identifiers are sent with it.
• Deletion after processing. As soon as Replicate reports the job finished — succeeded, failed, or cancelled — our backend deletes your uploaded file from Replicate through its API. If that call ever fails, Replicate’s own automatic clean-up removes the file, and the same clean-up removes the result files Replicate produced (Replicate’s documentation currently gives one hour for jobs created through its API). We keep no copy of your audio on our own servers: an upload passes through our backend’s memory and is not stored there.
• No training. We do not use your audio to train AI models.
• Offline AI stays local. Offline AI runs on-device models (htdemucs for separation, GTCRN for noise removal) that the app downloads once, after asking you, from Hugging Face and GitHub. Those downloads carry no audio; the download servers see only your IP address, as for any download.

4. What we do not collect

• We do not require you to register. The account the app creates is anonymous; we only hold an email address or name if you choose to sign in with Google or Apple.
• We do not collect precise (GPS) location, and the app never asks for location permission.
• We do not access your audio, media, contacts, photos, or files except the specific items you pick or record for a task.
• We do not scan your library, upload media in the background, or read your media for advertising.
• We do not sell your personal data, and we do not share your audio with anyone except Replicate, to run a Cloud AI job you started.

5. Third-party processors & sub-processors

We use a small number of established providers to run parts of the service. Each handles data only for the purpose listed and under its own privacy policy.

6. How we protect your data

• Encryption in transit. All network traffic — audio uploads, sign-in, purchase checks, analytics, and ads — uses encrypted HTTPS (TLS) connections.
• No secrets on the device. The Replicate API token, the store-verification keys and other provider credentials live only on our server.
• Verified identity. Every request to our backend carries a short-lived Firebase ID token that the server verifies. A Cloud AI job’s status and results can only be read with the token of the account that started it.
• Server-authoritative. Minute balances, purchases and subscription allowances are decided on our server from the store’s own answer, so they can’t be forged on the device.
• Minimal telemetry. Analytics events are built without file contents, file names, paths, or account identifiers.
• No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

7. Data retention

• On-device data (Library, recordings, settings, downloaded models) stays on your device until you delete it in the app or uninstall the app. Copies saved to shared folders stay until you delete them.
• Cloud AI audio is deleted from Replicate when the job finishes, and Replicate’s automatic clean-up removes the result files shortly after (see Section 3). We never store your audio.
• Your account and its server records — the account itself (with any linked Google or Apple sign-in), your minute ledger, Cloud AI job records and rewarded-ad records — are kept for as long as the account exists, and deleted when you delete the account (see Section 9).
• Purchase records — redeemed purchase tokens, stored as one-way hashes, are kept so a purchase can never be redeemed twice. When you delete your account, your account ID is removed from them. Google Play and Apple keep their own transaction records under their policies.
• Sign-in bonus marker — a one-way hash of each Google or Apple account that has claimed the sign-in bonus is kept permanently, so the bonus can only be claimed once per account. It contains no email address, name, or Sonary account ID.
• Server logs — our backend’s operational logs (for example, a purchase verified or minutes credited, with the account ID) are kept by Google Cloud for a limited period under its log-retention settings.
• Analytics, crash, and advertising data are retained by Firebase and AppLovin under their own retention policies.

8. Your rights & choices

• Keep audio on your device. Use Offline AI, or revoke Cloud AI consent in Settings → Cloud AI data sharing.
• Sign-in is optional. “Remove backup” in Settings unlinks Google or Apple sign-in at any time.
• Delete your account from inside the app at any time — see Section 9.
• Access & other requests. You can ask for a copy of, a correction to, or deletion of the data our server holds about your account by emailing imamagun94@gmail.com. If you signed in, include the email address of the Google or Apple account you used so we can find your account.
• Advertising choices. On Android, you can reset or delete your advertising ID under Settings → Privacy → Ads, which also opts you out of personalised ads. On iOS, the app asks once for permission to track; you can change your answer at any time under Settings → Privacy & Security → Tracking. Declining changes nothing else in Sonary. Sonary Pro removes ads from the app.
• Analytics. You can limit ad and analytics identifiers in your device’s privacy settings.

9. Deleting your account and data

9.1 Delete in the app

Open Settings → Account → Delete account and confirm. This is available whether or not you ever signed in with Google or Apple, and it needs an internet connection.

9.2 What is deleted

Immediately, from our servers:

• your Firebase Authentication account, including any linked Google or Apple sign-in and the email address stored with it;
• your minute ledger (balance, plan, allowance);
• your Cloud AI job records;
• your rewarded-ad records.

The app then starts over on a new anonymous account.

9.3 What is kept

• Purchase-token records stay, with your account ID removed, so the same receipt can’t be redeemed again by a new account.
• The sign-in bonus marker described in Section 7, which holds no email, name or account ID.
• Store records at Google Play or Apple, under their policies.
• Analytics and crash data held by Firebase, which isn’t linked to your Sonary account and expires under Firebase’s retention settings.
• Advertising data held by AppLovin, including the account ID the app gave it (Section 2.4), under AppLovin’s own retention policy. After deletion the app gives AppLovin your new account ID instead. To limit advertising data, reset your advertising ID (Section 8) or contact AppLovin.
• Server logs, until they expire (Section 7).
• Files on your device — Library items, exports, and copies in shared folders — until you delete them or uninstall the app.

9.4 Before you delete

• Remaining minutes, including ones you paid for, are lost and can’t be restored.
• Deleting your account does not cancel a subscription. Cancel it in Google Play → Subscriptions, or on iOS in Settings → [your name] → Subscriptions, or you will continue to be charged.

9.5 By email

If you can’t use the app, email imamagun94@gmail.com with the subject “Sonary data deletion request”. If you signed in with Google or Apple, send it from that account’s email address (or include it) so we can find your account. We will confirm your request and complete the deletion within 30 days.

An anonymous account that was never signed in has nothing an email can be matched to, so it can only be deleted from the app on the device that created it — use Delete account before uninstalling.

10. Device permissions we request

The iOS app also contains purpose descriptions for location, camera and the media library, because code linked into the app references those system features. Sonary never asks for any of these permissions, so you won’t see those prompts.

11. Children’s privacy

Sonary is a general-purpose audio productivity tool intended for a general audience. It is not directed to children under 13 (or the equivalent minimum age in your region), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at imamagun94@gmail.com and we will delete it. This app is not enrolled in Google Play’s Families program and is not designed for or marketed to children.

12. International data transfers

Our backend runs on Google Cloud (Firebase) in the United States, and our providers (including Google/Firebase, Apple, AppLovin, and Replicate) may process data on servers in the United States and other countries. By using the app you understand that the limited data described here may be processed in those countries under the safeguards those providers maintain.

13. Changes to this policy

We may update this policy as the app evolves. We will change the “Last updated” date above and, for material changes, provide an in-app notice where appropriate.

14. Contact us

For any privacy question, or an access or deletion request:

imamagun94@gmail.com
NewAgeDevs — Md. Imam Hossain, Bangladesh