Privacy Policy
Last updated: 18 October 2026
This policy explains what Tino: Music for Your Mood ("Tino", "we") collects, why, who else sees it and how you can get a copy of it or delete it. We wrote it to match what the app actually does.
The short version
- You sign in with Apple, or with a 6-digit code we email you. We never see your Apple password, and there is no Tino password.
- We store your playlists (song titles and artists), your daily ratings and the mixes Tino makes for you, so the app works across launches.
- Your songs and ratings go to OpenAI only after you turn on AI sharing, and never with your name or email.
- No ads, no tracking, no third-party analytics tools, and we never sell your data.
- You can export or delete everything from Profile at any time.
1. Who is responsible
Tino is published by the developer named on its App Store page, who is the data controller for this app. Questions and requests: supportino@gmail.com.
2. What we collect
Account. When you sign in with Apple we receive an Apple user identifier, and, if you choose to share them, your email address (which can be an Apple private relay address) and your name. Apple also gives us a token that we keep encrypted and use only to cancel the Apple sign-in link when you delete your account. When you sign in with email instead, the email address you confirmed is what your account is known by.
Things you tell Tino. The name Tino calls you, the genres and moods you picked, your language, your time zone (so your day starts at your midnight), whether explicit songs are allowed, and when you turned AI sharing on. We also keep your phone's region setting, so songs are looked up in your country's Apple Music store.
Daily ratings (mood calendar). Your 1 to 5 answer to "How was your day?", the date, and whether you took Tino's suggestion. We keep these only after you agree on a separate consent screen at your first rating. You can delete a single day from its rating screen, or turn off "Keep mood ratings" in Profile to delete them all and withdraw your consent. Turning it off also removes the ratings' effect from the mood values of mixes already made; their titles and texts stay. They are not medical data, we never use them for advertising, and only you can see them. A rating you give without a connection waits on your phone, for up to a few days, until it can be sent; it is removed from the phone once it is sent, when you sign out, delete your account or turn off "Keep mood ratings".
Playlists. The link you paste, the playlist title, and the title and artist of each song. If you import a screenshot, the image is sent to our server, read once and then discarded. We do not store screenshots.
What Tino makes. Moods, mixes, and songs you report as wrong. We do not store what you type into Ask Tino on our server; it goes to OpenAI only to prepare the answer (see section 4).
Email sign-in. If you choose to sign in with email, we keep your email address and send you a 6-digit code. We store only a scrambled (keyed hash) form of the code, next to the address it was sent to and how many codes were sent and wrong codes were tried that day (to stop abuse). The code works for 10 minutes. It is deleted from our database as soon as you use it; a code that was never used is deleted, with the address stored next to it, within a day after it stops working. Resend, which sends the email, keeps a copy of it for up to 30 days (see sections 5 and 6). To apply the free allowance per mailbox, not per spelling of the address, we also keep a scrambled (keyed hash) form of your address written in one standard way (lower case, without a "+tag" and, for Gmail, without dots); it is never turned back into the address and it is not shared.
Phone identifier. Tino makes a random identifier on your phone and keeps it in the iOS Keychain, so it stays the same if you delete and reinstall the app. It never leaves that phone in a backup. When you sign in, the app sends it to our server, which keeps only a scrambled (keyed hash) form of it, linked to your account together with when the account was last used on that phone. We use it to apply the free allowance and the free-trial limits per phone and to stop repeated free trials through extra accounts. It is not used for advertising or tracking, and it is not shared. The server's copy is deleted with your account, unless another account on the same phone still uses it; the usage tied to it is kept for 30 days after deletion (see section 6). The identifier on your phone is not removed when you sign out or delete your account; it is a random value that says nothing about you.
AI cost log. For every AI request we keep a short technical record for 30 days: the kind of request, the model, how many tokens it used and whether it succeeded. It holds no song names, ratings or text; its link to your account is removed when you delete the account.
Usage records. The time and type of each AI action (a playlist analysis, a daily mix, an Ask Tino request, a screenshot import), so we can apply the plan limits. Deleting a playlist doesn't remove these records; deleting your account does, except what section 6 keeps for 30 days.
Subscription. Whether you have Pro, which plan, when it ends, whether it is in the free trial, whether it will renew and whether Apple could not charge it. This comes from Apple through RevenueCat. We never see your payment details.
Sign-in sessions. A session token so you stay signed in. We only store a one-way hash of it, and it expires after a year (365 days) without use. Each time the app uses it, the year starts again, so you stay signed in until you sign out (at most 10 years). Signing out deletes it from our server.
What we do not collect. Your location, contacts, photo library (you pick one screenshot yourself), advertising identifier, browsing history or the music library on your device. If you use Add to Apple Music, iOS asks you to allow Tino to use Apple Music; Tino then creates the one playlist you asked for in your Apple Music library, and never reads your library or sends anything about it to us. The daily reminder, and the one "we miss you" reminder that follows a few days away, are scheduled on your device; the only thing we learn about it is the daily count of people who turned it on (see Daily step counts below).
Server logs. For each request our server logs the method, the address inside our API (which can include the day you are viewing), the response code and the time. These request logs contain no IP addresses, device details or content you send. When our web server itself fails to reach the app, its error log may note the IP address; those logs are rotated within 14 days. To enforce request limits, our server also keeps the IP address of recent requests in memory for a few minutes. It is never written to disk or linked to your account. The daily limits per network (for email sign-in codes and new accounts) keep a one-way code made from the network's address, never the address itself, for up to 2 days.
Daily step counts. To improve the app and the Tino Pro screen we count, per day, how many times each of these happens:
- the first steps are reached: starting and finishing the questions, each question, the answer to the reminder question, seeing the sample mix, the sign-in screen, signing in, the first playlist and the first mix, turning the daily reminder on;
- the AI sharing and mood rating screens are answered yes or no;
- the sample playlist is used;
- a reminder is tapped;
- the app is opened again the day after it was first used on a phone;
- a mix is added to Apple Music;
- the Pro screen is opened or closed, and from which part of the app;
- a purchase is started, finished or cancelled;
- a limit of the Basic plan or a daily limit of a paid plan is reached;
- from the App Store notices RevenueCat forwards, a trial starts, turns into a paid plan, is cancelled or refunded, or has a failed charge.
Only the daily totals are stored, with nothing that links them to you or your device, and the steps before sign-in are sent without any account.
The app also shows a reminder about a day before a free trial ends and, if Apple can't charge your payment method, up to two notices about it. They are set on your device and send us nothing.
Error reports. When the app runs into an error or closes because of one, it sends our server the kind of error, the first line of its technical message with anything that could point to a person removed (email addresses, links, ids, numbers and quoted text), and the app version. No account, device identifier or IP address is kept with it: the server counts such reports per day and writes them to its log, which is rotated within 14 days. We use them only to find and fix bugs.
3. How we use it
- To run the app: show your playlists, rate your day, build mixes and remember your settings.
- To work out today's mood and suggest songs (see section 4).
- To know whether you have Pro and apply the plan limits.
- To keep the service safe, for example by limiting how many requests one account can make.
We do not use your data for advertising, we do not build advertising profiles and we do not sell or rent your data to anyone.
The legal bases, where the GDPR (Art. 6) or Türkiye's KVKK (Art. 5) applies:
| Purpose | Data | Legal basis |
|---|---|---|
| Running the app: account, playlists, mixes, settings | Account, playlists, what Tino makes | Performing our contract with you |
| Keeping mood ratings | Daily ratings | Your consent, given on a separate screen; withdraw it in Profile |
| AI processing and sending it to OpenAI in the United States | See section 4 | Your consent (AI sharing); withdraw it in Profile |
| Signing in with email | Your email address, the code (scrambled), the day's send and attempt counts | Performing our contract with you |
| Plan limits and subscription status | Usage records, subscription | Performing our contract with you |
| Applying the free allowance and trial limits per phone and stopping repeated free trials | Phone identifier (scrambled), when each account was last used on that phone | Our legitimate interest in preventing abuse |
| Keeping the service safe: request limits, checking Ask Tino text, the 30-day limit codes after deletion | IP address in memory, a one-way code of your network for up to 2 days, Ask Tino text, one-way codes (see section 6) | Our legitimate interest in preventing abuse |
| Daily step counts | Daily totals only | Our legitimate interest in improving the app |
| Error reports | Kind of error and a cleaned message, app version | Our legitimate interest in keeping the app working |
| Answering support emails | Your email and message | Performing our contract with you |
| Disclosures the law requires | Only what is required | Legal obligation |
4. AI processing
Tino uses the OpenAI API to read the mood of your songs, build mixes, answer Ask Tino requests and read playlist screenshots. This only happens after you turn on Share playlists with AI, and you can turn it off in Profile at any time.
What is sent: song titles and artists, today's rating (only if you also agreed to keep mood ratings; never earlier days), your genres and moods, your language, whether explicit songs are allowed, the text you type into Ask Tino, and screenshots you import. Each request also carries a scrambled (keyed hash) code made from your account, so that OpenAI can tell requests apart for abuse prevention; it cannot be turned back into your account, name or email. What is not sent: your name, email or Apple identifier.
Before Tino answers an Ask Tino request, the text you typed is checked with OpenAI's moderation service. Requests that break OpenAI's usage policies are refused and not answered. If the text suggests you may be going through something very hard, Tino shows where to find support instead of a mix.
We ask OpenAI not to store these requests. Under OpenAI's API terms, API data is not used to train their models, and it may be kept for up to 30 days to detect abuse before it is deleted.
AI answers can be wrong. Tino describes the mood of your music. It does not assess your health.
5. Service providers
We share data only with the providers we need to run Tino, and only the part each of them needs:
| Provider | What for | What they receive | Where |
|---|---|---|---|
| Apple | Sign in with Apple, App Store payments, Apple Music catalogue and iTunes Search | Sign-in data; for song lookups the titles and artists Tino suggests and a store country based on your language; for Apple Music links the playlist ID. Song cover images also load from Apple's servers straight onto your phone, so Apple sees that request | United States |
| OpenAI | Mood reading, mixes, screenshot reading, checking Ask Tino text (moderation) | See section 4 | United States |
| RevenueCat | Subscription status | A random Tino user ID, your App Store purchases, and the technical details its SDK sends to process them (device model, system and app version, IP address, which screen the purchase started from) | United States |
| Google (YouTube Data API) | Importing YouTube Music playlist links | The playlist ID from the link you paste | United States |
| Resend | Sending your email sign-in code | Your email address and the code; Resend keeps them for up to 30 days | United States |
| Google (Gmail) | Answering support emails | Your email address and what you write to us, only if you email support | United States |
| Our hosting provider | Running our server and database | Everything described in section 2 | Türkiye |
When you import a YouTube Music playlist, Tino uses YouTube API Services. The Google Privacy Policy applies to that request.
Each provider commits, in its own terms or in its contract with us, to protect your data at the level this policy describes or better, and to use it only for the service it gives us.
Providers in the United States process data under their own data processing terms and the transfer safeguards they offer, such as the EU Standard Contractual Clauses. Turning on AI sharing is also your consent to that data going to OpenAI in the United States.
Our server and database run in Türkiye. If you live in the EU, the UK or another country with data transfer rules, your data is stored in Türkiye to provide the app you asked for.
We may also disclose data if the law requires it, and only as much as it requires.
6. How long we keep it
We keep your data while you have an account. Sign-in sessions expire after a year (365 days) without use; a sign-in you keep using lasts until you sign out, for 10 years at most. When you delete your account, your data is removed from our database right away, and we ask Apple to cancel the Sign in with Apple link and RevenueCat to delete your customer record. If Apple does not answer, we ask again every hour for up to 7 days; the encrypted Apple token for that request waits on our server until then and is deleted afterwards. If RevenueCat can't be reached, we keep asking every hour; a request it still refuses after 30 days is dropped, and we follow it up by hand. OpenAI may keep AI requests for up to 30 days, as described in section 4.
A copy of each AI answer is kept for up to 24 hours, so that a request retried after a lost connection is not counted twice against your limits. Our database backups stay on our own server and are overwritten within 14 days, so deleted data leaves them within 14 days too.
Song lists imported from YouTube Music are read from YouTube again every 30 days, as YouTube's rules require. Songs you removed stay removed. If the playlist is no longer on YouTube, or can't be read by then, we delete it from Tino; the mixes made from it stay.
Email sign-in codes are deleted from our database as soon as they are used. A code that was never used is deleted, together with the email address stored next to it, within a day after it stops working. Resend keeps a copy of each sign-in email it sends, with your address and the code in it (the code stops working after 10 minutes), for up to 30 days. Deleting your account here does not shorten that.
To stop free limits from being reset by deleting and re-creating an account, we keep, for 30 days after deletion, only one-way codes made from your Apple ID or sign-in email and from the phones you used (they cannot be turned back), and the dates of the AI features you used. If a new account is made with the same Apple ID or email, or on the same phone, in that time, those limits carry over. After 30 days this is deleted too. Even so, someone who got hold of our key could tell whether a given email address or phone produced such a code, so we treat these codes, and every keyed hash in this policy, as personal data (pseudonymised data under the GDPR) and keep them only as long as stated here.
For 15 days after you delete your account, we also keep a random account number, a one-way code made from your Apple ID or sign-in email, and a short note of anything you had deleted or withdrawn (a consent, or a day's rating, never the rating itself). If one of our backups is ever restored, this lets us delete your account again instead of bringing it back. After 15 days this is deleted too.
7. Your rights
You can, at any time and without giving a reason:
- Get a copy of your data: Profile › Export my data. Songs of a mix that need Pro are not in a Basic plan export: they are Tino's suggestions, not data about you.
- Correct your data: change settings in Profile, or email us to fix anything else.
- Withdraw AI consent: Profile › Share playlists with AI.
- Delete your account and data: Profile › Delete account. Deleting your account does not cancel a Pro or Ultra subscription. Apple handles billing, so cancel it in Settings › Apple Account › Subscriptions.
Article 11 of KVKK and the GDPR also give you the right to learn whether your data is processed and who it is shared with, to object to processing or ask for it to be restricted, and to ask for compensation if you were harmed. You can complain to the Personal Data Protection Authority (KVKK) in Türkiye, or to your own data protection authority in the EU or UK. Email us first if you like; we will answer within 30 days.
8. Security
All traffic is encrypted with HTTPS. Your Apple token is encrypted in our database, session tokens and email sign-in codes are stored only as hashes, and on your phone the session and the phone identifier live in the iOS Keychain. No system is perfectly secure, and if a breach affects you we will tell you and the authorities as the law requires.
9. Children
Tino is not meant for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has an account, email us and we will delete it.
10. Changes
If we change this policy we will update the date at the top. If a change affects how your data is used, we will tell you in the app before it takes effect.