PRIVACY_
PROTOCOL.

01 / THE SHORT VERSION

KROMA phone is local-first. Its handset, menus, utilities and bundled games run on your device. Supported iOS releases use Firebase Analytics to understand app usage and improve the handset experience. This usage analytics is enabled separately from advertising measurement. SDK-enabled iOS releases include optional TikTok advertising measurement, activated only when you allow tracking in Apple’s permission prompt. It helps us measure and improve advertisements for KROMA. Website analytics remains optional and requires separate consent.

When a supported app release connects, KROMA automatically sets up a device account and a ten-digit KROMA number. Messaging, Internet calls, cloud backups and number recovery are features you choose to use. You do not need to provide a name, email or mobile number to receive a KROMA number.

02 / DATA WE PROCESS

• Website analytics: after you choose Allow analytics on kromaphone.com, Google Analytics processes page activity, broad device/browser characteristics, approximate region and diagnostic context. This website choice is separate from the iOS tracking permission.
• iOS usage analytics: Firebase Analytics processes app launches, sessions and engagement, an app-instance identifier, app and device context such as versions and language, and approximate region derived from IP information. We also measure selected handset model and color, 2D/3D use, download outcomes, screen views, and actions and outcomes in messages, contacts, call handoffs, settings, accounts and utilities. Game events include starts, pauses, resumes, levels, finishes, scores and active play duration. Subscription events include opening plans, selecting locked models, purchase and restore outcomes, the selected plan tier and monthly or yearly billing period. These custom events use predefined categories and numeric metrics; they do not include message text, contact details or the contents of your saved tools. We use these signals to understand feature usage and improve the app. Our Firebase integration does not collect the Apple advertising identifier (IDFA) or vendor identifier (IDFV), use GPS or precise location, or receive your account ID, name, email, phone number, Cloud content, entered text, photos, URLs or raw error messages from KROMA. The app-instance identifier can associate activity from the same app installation; it is not your KROMA Cloud account.
• Optional iOS advertising measurement: when you allow tracking, the TikTok App Events SDK can send install, app-open and next-day return events, event times, advertising and device identifiers, session identifiers, IP/network information, and app/device context such as versions, language and time zone. It can also send technical performance, error and SDK-related crash information. TikTok uses measurement signals to attribute and improve our advertising. KROMA does not provide your Cloud account, backups, contact details or other app content to TikTok.
• App Store subscriptions: Apple processes payment and manages your subscription. The app checks verified StoreKit entitlements to provide handset access and restore purchases. KROMA does not receive your payment card or bank details. Firebase receives subscription interaction and outcome categories, plan tier and billing period, associated with the app-instance identifier for usage analytics. KROMA does not send transaction IDs, receipts or Apple Account identifiers in its custom analytics events. Purchase measurement is disabled in the TikTok integration.
• Server records: request time, requested path, response status and network/security metadata used to deliver and protect the website, online catalogs and optional KROMA Cloud service.
• Device permissions: microphone, notifications, camera/flashlight and photo-library access are requested only when you invoke a feature that needs them. Core phone data stays on your device unless you deliberately use an online feature.
• Device identity and optional KROMA Cloud: the service stores a random account identifier, an assigned KROMA number and a one-way hash of the private access key held in your device-only iOS Keychain. It also stores any phone backup you choose to submit and files you upload. A backup can contain general, phone and profile settings, reminders and Composer tunes. Your PIN, security code, lock state, local message archive and local call register are never included.
• Optional number recovery: if you link Sign in with Apple, we verify Apple's temporary identity token and store a one-way hash of its app-specific user identifier to associate the KROMA numbers you link. We do not request your name or email from Apple. If you keep a recovery code, the server stores only its one-way hash; the private code is saved in your device-only Keychain and can be copied by you for safekeeping. Recovery replaces the chosen number's device credential; it does not merge separate KROMA accounts or restore message and call history already removed from the relay.
• Contacts and invitations: you save KROMA numbers and choose your own names for them. KROMA does not read or synchronize your iPhone address book. Previously saved local contact details are retained. Invite to KROMA opens the iOS message composer with your KROMA number and the App Store link; you choose the recipient and decide whether to send using the system messaging service.
• KROMA Connect: we store your account identifier, assigned ten-digit KROMA number, any older number retained as a lookup alias, and profile information retained from earlier releases. When you use communication features, we also store your saved KROMA contact names and block relationships, pending message content and its sender/recipient identifiers, timestamps, delivery confirmations and read status. In version 1.0.9 and later, text, picture messages and voice clips are saved in an account-specific archive on each participating device for offline use. The service relays their content until both participants confirm that their devices have saved it. Other Connect users can find you using your complete KROMA number. Each person chooses their own saved contact names; an unknown number is shown as its KROMA number. Messages are encrypted in transit but are not end-to-end encrypted. For Internet calls, we process participant identifiers, call times and status, and technical connection information that can include network addresses. Call audio uses encrypted WebRTC media (DTLS-SRTP), sent directly between devices when possible or through a TURN relay. KROMA does not record or store call audio.
• Voice messages: when you choose to record, KROMA uses the microphone to make a clip of up to 30 seconds and processes its sound on your device. You can preview it before sending. Only when you send do we upload the audio to private Cloudflare storage, along with its sender, recipient, duration and preset. Authenticated participants can retrieve the clip. Voice messages are encrypted in transit but are not end-to-end encrypted.
• Photo and video messages: you choose a photo or video from the retro phone's Photos library; importing an iPhone photo or video uses Apple's picker. Sending uploads a prepared JPEG photo or MP4 video to private Cloudflare storage, together with the sender, recipient, file size, dimensions, duration and content digest. Each attachment must be smaller than 5 MB, and a video can be up to five minutes. Only authenticated participants can download it. You can save received items to retro Photos and, with photo-library permission, to iPhone Photos. Photo and video messages are encrypted in transit but are not end-to-end encrypted.
• Pet: when you adopt and care for a pet, KROMA stores its identifier, species, chosen name, birth time, care values and current owner with your account. Pet gifts also store the sender, recipient, a snapshot of the pet, timestamps and the offer status. A pet transfers to the recipient only after they choose Accept; its existing identity and care values are preserved. Pet names and care records are not sent to advertising or analytics services.
• Custom phones and gifts: designs you create stay on your device unless you choose to share them. Send via KROMA uploads a copy of the selected design to private Cloudflare storage, including its front and back photos, crop settings, model, design name and optional gift message. The service also stores the sender and recipient identifiers, file size and digest, timestamps and gift status. Only authenticated participants can retrieve an available package. The app can download and verify received packages in the background for local previews and history; this does not accept a gift or change your phone. Accepting a KROMA gift creates a separate design on the recipient's device after server authorization and leaves the sender's original unchanged. Use in Gifts is a separate choice. AirDrop or share uses the destination you select in the iOS share sheet. KROMA gifts are encrypted in transit but are not end-to-end encrypted. Design photos and gift messages are not sent to advertising or analytics services.
• Connect notifications: when enabled and available, we store device push tokens, an installation identifier and the app's push environment. Apple Push Notification service receives the token and routing identifiers needed to deliver message, call or gift notifications, including the sender or caller's display name where used. Gift notifications contain routing identifiers and status, not the design photos, gift message or pet name. We do not include message text, photos, videos, voice clips or call audio in push payloads.

03 / ANALYTICS & ADVERTISING CONTROLS

Personalized-ad signals, advertising storage and advertising user-data consent are disabled for the website. Website Analytics is optional: the Firebase Analytics module is not loaded until you choose Allow analytics, and you can change that choice through Analytics settings in the homepage footer. You can decline the Apple tracking prompt and still use KROMA. You can later change tracking permission in iOS Settings → Privacy & Security → Tracking. Permission withdrawal stops future authorized advertising measurement; it does not erase data already received by a provider.

Native Firebase usage analytics is enabled in the iOS releases described above and is separate from both the website analytics choice and the Apple tracking prompt. Declining tracking prevents the optional TikTok advertising measurement; it does not disable native Firebase usage analytics. Advertising storage, advertising user-data use and ad personalization are disabled for our native Firebase integration. We do not use its usage or subscription events for personalized advertising.

04 / SERVICE PROVIDERS

We use TikTok for consented iOS advertising measurement, Firebase and Google Analytics for native iOS usage analytics and separately consented website measurement, and Cloudflare plus dedicated KROMA origin infrastructure to deliver the website, online catalog and optional KROMA Cloud service. Apple provides App Store payments, subscription management and optional Game Center leaderboards. When you use Game Center, game scores are submitted for your Game Center player according to Apple’s service settings. These providers process relevant data under their own terms and privacy commitments. Learn more in the TikTok Business Products Data Terms, TikTok Privacy Policy, Firebase privacy documentation and Google Privacy Policy.

Apple Push Notification service delivers Connect notifications when enabled and available. Sign in with Apple provides optional proof of ownership for number recovery. Cloudflare, our KROMA origin and TURN infrastructure process the identity and connection data needed to deliver Connect messages and Internet calls.

05 / RETENTION & CHOICES

Measurement and server records are handled according to the relevant provider terms and configured retention periods. TikTok may retain previously received measurement data under its applicable terms; disabling tracking does not itself submit a deletion request. KROMA Cloud keeps submitted backups and uploaded files until you replace or delete them; deleting the KROMA ID removes its server-side backup and files. You can deny or withdraw optional website Analytics from the homepage footer, use device controls for the app, or remove the app to erase its local container. For support, privacy requests or questions about this notice, email hello@chromaphone.com.

For supported local-storage releases, the active relay removes text and picture-message bodies after both sender and recipient confirm durable local storage. Voice clips, photos and videos follow the same rule after both devices have saved and verified the complete file: further downloads are denied immediately, and physical storage deletion is retried if needed. Reading a message or receiving a notification is not a storage confirmation. Content remains pending if either participant has not confirmed storage, including while using an older app; available attachments do not expire merely by age. Previously removed or expired content cannot be recovered. The service retains content-free message identifiers, participants, timestamps, content digests, delivery/read state and attachment descriptors to prevent duplicate sends and coordinate delivery. Account deletion removes that account's server-side profile, contacts, blocks, message records, calls, device registrations and recovery links and codes, and requests removal of its shared relay attachments. Ending a session or deleting a contact does not erase locally saved history. Local message and call archives are excluded from KROMA Cloud and device backups; deleting the app or its local data removes these archives. Explicit account deletion also removes that account's local archives on the device making the request. Unsent voice, photo and video drafts stay on the device until sent, discarded, the associated account is deleted, or app data is removed. Copies saved separately in retro Photos or iPhone Photos are not removed when a message is deleted; you manage those copies in their photo libraries. Temporary previews and abandoned incomplete uploads are removed when no longer needed. Call register entries already saved on your device remain available offline independently of server retention. Call setup records and connection candidates become eligible for removal seven days after a call ends and are removed during subsequent Connect service activity. Device push tokens remain until they are successfully unregistered, the account is deleted, or Apple reports the token as unregistered. Copies already saved on another participant’s device are outside this server-side deletion. We retain the account identifier, deletion time and revoked credential hashes to prevent stale requests from recreating deleted data. A retired KROMA number remains reserved without its former profile or identity mapping, so it is not reassigned. Temporary Apple recovery challenges and ownership grants expire after five minutes and are removed during subsequent service activity. Cloudflare may retain previous database versions for recovery for up to 30 days after active data is deleted.

Pet care and ownership records remain with the current account. Pending pet gift offers expire after seven days; accepted, declined, cancelled and expired offer history remains until a participant account is deleted. Deleting an account removes its owned pets and related gift history. A pet already transferred to another account stays with its current owner if the former owner deletes their account.

Custom-phone gift packages are available for up to seven days after sending. Download access ends immediately when the recipient confirms that the design was saved. An inaccessible server package may remain until the sender confirms durable storage of the outgoing package and history, or until the original seven-day expiry, whichever comes first. Declining or cancelling a pending gift, blocking, or deleting a participant account also revokes access and queues package deletion. Storage cleanup is retried if needed.

The gift's original design name and optional message are removed from the active relay once the gift has reached a terminal state and both participants confirm durable local storage of the original history. Pending or accepted gifts retain that text while consent is unresolved; terminal text also remains if either confirmation is missing. Merely viewing a gift or receiving a notification is not a storage confirmation. Small records of gift and client identifiers, participants, model, file size and digests, timestamps, status and operation confirmations remain for delivery history and duplicate-send prevention. Deleting a participant account removes its related server gift records. These rules do not remove copies already stored on another device.

Each account's gift history and verified package cache stay on its device for offline viewing, including after the server package expires or is removed. They are excluded from device backups. Ending a session hides that account's private archive without deleting it; explicit account deletion removes the archive on the device making the request. Removing the app or its local data removes these archives. Accepting a KROMA gift still requires server authorization; a cached preview alone does not authorize import. Accepted design copies are owned locally, remain in Gifts after logout, and are independent of the account archive. Saved copies appear in Gifts, and authored designs in Custom; deleting an account does not delete the original or a separately saved design. Number recovery does not restore a former device's gift archive.

Removing the app deletes its local container but may leave its device-only Keychain identity. Reinstallation alone does not delete server data or guarantee recovery of a number. Use account deletion to remove the account, or keep your number with Apple or a private recovery code before moving to another device. Number recovery does not transfer the former device's local message or call archive.

06 / UPDATES

We may update this notice as KROMA phone evolves. The effective date above will change when a material revision is published.