Short, and specific about what leaves the phone.
There is no account to create and no way to sign in. There is no advertising identifier, no App Tracking Transparency prompt, no crash reporter, and no ads.
To see whether onboarding and the paywall work, Tidesong sends a small set of events to PostHog, on a project owned by Ryoma Services LLC — never another company:
first open after install; each cold start; onboarding started and completed; the paywall was shown, and from where; a StoreKit purchase succeeded, with the product identifier; and Restore purchases finished, with whether this Apple Account is premium.
Those events use an anonymous identifier created on the device. They do not include your name, email, Apple Account, or payment details. If the analytics key is not configured on a given build, nothing is sent.
If you send or open a gift, the same channel also records that a link was sent, opened, or redeemed, that a gifted night counted, that those nights ran out, that a purchase followed a gift, and that the sender's night of that beach was granted. Those events include the beach id. They do not include your name.
If you play a beach, the same channel records that it started and that it stopped: which beach, the kind of sound (gentle lapping, rolling surf, and the other characters), whether that beach is a premium one, whether this install is premium, where you started it from, the sleep timer if one was set, and how many seconds you actually heard. A pause is not counted. Pausing and resuming are recorded too, with the beach id and name. These events do not include your name.
If the app asks Apple to show the rating prompt, the same channel records that it asked, and which moment it was: a finished night, or the second day the app was opened. It does not record whether you rated, or what you wrote.
Your favourites, your chosen beach, the sleep timer, the alarm, the light or dark setting, how many gifted nights you have used, and when a rating prompt was last requested are stored on your device only, using the system's own storage. Deleting the app deletes them.
The beach sounds are generated on your phone as you listen. Nothing is streamed, so Tidesong still works with no network connection.
Subscriptions and the lifetime unlock are handled entirely by Apple. We never see your name, your card, or your Apple Account. Tidesong asks Apple whether this device has an active entitlement and gets back yes or no. After a successful purchase we record the product identifier in the events above — nothing about how you paid.
Sharing a beach creates a single-use link on tidesong.app. Opening one redeems it. To do that, the app sends an anonymous install identifier (a random id created on the device, not the advertising identifier) and the beach's id. There is still no account, no name, and no email. We use those two facts to give the recipient seven nights of that beach, and, when the beach was locked for the sender, one night back once the link is opened. How many of those gifted nights you have used is counted on your phone and is not sent. Which beach played, and for how long, is in the listening events above.
Tidesong has an optional box for suggesting a beach we should add. If you use it, we receive the text you typed and nothing else — no name, no email, no device identifier. We use it to decide which coastlines to record next. If you would rather not, do not use the box; everything else works the same.
Tidesong is safe for all ages. What leaves the device is the purchase-funnel events above, the listening events above, a rating request when one is made, and, if you use a gift link, the anonymous install id and beach id described above. None of it is tied to a name or an account.
If this ever stops being true, this page will change before the app does, and the date above will say when.
Questions to hello@tidesong.app.