Privacy Policy

Resonance is a place to share stories as cards, made up of the website resonance.channel and the iOS and Android apps. It is built and run by the Resonance team ("we"). This policy explains what we collect, why, who processes it for us, and how you can manage or delete it.

What we don't do

• We don't show ads, and we don't sell or share your data with advertisers.
• We don't use third-party analytics or tracking tools, and we don't track you across apps or websites.
• We don't use your writing to train AI models.

What we collect

• Account: the email address you sign in with (provided by Google or Apple if you use them; Apple may give us a private relay address) and an account ID the system creates.
• Profile: your pen name, bio, region, preferred languages and avatar. These are shown publicly on your profile page.
• What you write: cards (title, story, tags, images) and drafts, resonances, links between cards, notes to authors, messages with your connections (including the pictures sent in them), your thought map, bookmarks, your block list, and reports you send.
• Interactions: who you're connected with and the notifications you receive.
• Device (apps only): a push token, an ID for this installation, the app version, platform, interface language and time zone, so notifications reach your phone in your language. They are removed when you sign out.
• Technical logs: our hosting provider keeps connection logs (such as IP address, browser type and time) for operations and abuse prevention. The website only uses the cookie that keeps you signed in; interface preferences (such as which tips you've seen) are stored in your browser or on your device.

Who can see your content

Each card can be public, connections only or only me. Public cards can be seen by anyone and may appear in other people's recommendations; messages are seen only by the people in the conversation; your pen name, bio and avatar are public. We look at non-public content only to handle a report, keep the service safe, or when the law requires it.

How we use it

• To run the service: signing in, storing and showing your content, delivering messages and notifications.
• Notifications you turn on: under Settings → Notifications you can ask for a card picked for you on up to three evenings a week, and for a notification when someone you're connected with publishes a new public card under their pen name. Both are off until you turn them on; we keep your choice and when you made it, and you can turn either off there at any time. To keep to their limits we also note which cards we've sent you this way and when, and the day you last opened the stories picked for you: an evening card is never sent to you twice within 30 days, no more than three notifications of new cards come in a day, and no evening card comes on a day you've already looked at your picks.
• AI features: an English web address for each card, suggested tags, the "core insight" shown before you publish, illustrations drawn from a story, and the index behind recommendations. That index includes your private cards, but only to recommend cards to you; nobody else sees private content through it.
• Safety: handling reports, enforcing blocks, preventing abuse and spam.

Who processes it for us

We share only what each service needs to run Resonance:

• Google Firebase (Authentication, Cloud Firestore, Cloud Messaging, App Check): your account, all written content, push delivery, and checking that requests come from our real website and apps.
• Cloudflare R2: images you upload or generate. Images in cards and stories, and profile photos, are served from public addresses; anyone with the address can see them. Pictures sent in messages are kept apart, with no public address: only the two people in the conversation can see them, through our service.
• OpenAI: for the AI features above, a card's title and text are sent to OpenAI's API. Under OpenAI's API policy this data is not used to train its models.
• Vercel: hosting for the website and API.
• Cloudflare Turnstile: on the website, checks in the background that requests come from a browser a person is using rather than an automated script (no challenge is shown). To do so it processes your IP address and technical information about your browser and device, under the Cloudflare Turnstile Privacy Addendum.
• Apple and Google: if you sign in with them, to deliver notifications to iPhones (Apple Push Notification service) and Android phones, and to confirm the app is a genuine copy installed from the App Store or Google Play (Apple App Attest, Google Play Integrity).

These providers may process data outside Taiwan (for example in the United States or Japan).

Keeping and deleting data

We keep your data until you delete it or delete your account.

On the website, and in versions of the apps that have a trash, a card you delete first moves to your trash, where only you can see it and can restore it for 30 days; it is deleted for good after 30 days, or as soon as you choose Delete forever or Empty trash. When an anonymous card goes to the trash, the notes other people left on it are deleted at once and don't come back if you restore it. Versions of the apps without a trash delete a card for good straight away, as their confirmation says.

A message you unsend disappears for both of you; what it said (including any picture in it) is kept on our servers for 30 days, read only if the conversation is reported, and then deleted for good.

You can delete your account at any time under Settings → Delete account (on the website and in the apps). You're signed out right away, and signing back in within 7 days cancels it. After 7 days your account, profile, cards and drafts, resonances, notes, every conversation you took part in (including the other person's messages and pictures in it), connections, notifications, notification settings and the record of what we've sent you, thought map, push devices and uploaded images are deleted for good.

We keep reports other people made about you (safety and moderation records). Cards other people wrote in response to yours belong to them and stay, but no longer link to your card.

Before deleting, you can use "Download my data" on the same page to get everything you've written as a JSON file. If you can't sign in, email us from the address you registered with and we'll delete the account once we've confirmed it's yours.

Your rights

You can see, correct (edit your profile and cards in the app), download and delete your data, and you can email us to ask how we handle it or to ask us to stop.

Children

Resonance is not meant for children under 13, and we don't knowingly collect their data. If you believe a child has given us data, email us and we'll delete it.

Security

All connections are encrypted (HTTPS). Database access is governed by permission rules, so non-public content can be read only by you and the people you allow.

Changes

If we make significant changes, we'll announce them on the website and in the apps and update the date on this page.

Contact

support@resonance.channel