PRIVACY_
PROTOCOL.

01 / THE SHORT VERSION

KROMA phone is local-first. Its handset, menus, utilities and bundled games run on your device. Supported iOS releases use Firebase Analytics to understand app usage and improve the handset experience. This usage analytics is enabled separately from advertising measurement. SDK-enabled iOS releases include optional TikTok advertising measurement, activated only when you allow tracking in Apple’s permission prompt. It helps us measure and improve advertisements for KROMA. Website analytics remains optional and requires separate consent.

When a supported app release connects, KROMA automatically sets up a device account and a ten-digit KROMA number. Messaging, Internet calls, cloud backups and number recovery are features you choose to use. You do not need to provide a name, email or mobile number to receive a KROMA number.

02 / DATA WE PROCESS

• Website analytics: after you choose Allow analytics on kromaphone.com, Google Analytics processes page activity, broad device/browser characteristics, approximate region and diagnostic context. This website choice is separate from the iOS tracking permission.
• iOS usage analytics: Firebase Analytics processes app launches, sessions and engagement, an app-instance identifier, app and device context such as versions and language, and approximate region derived from IP information. We also measure selected handset model and color, 2D/3D use, download outcomes, screen views, and actions and outcomes in messages, contacts, call handoffs, settings, accounts and utilities. Game events include starts, pauses, resumes, levels, finishes, scores and active play duration. Subscription events include opening plans, selecting locked models, purchase and restore outcomes, the selected plan tier and monthly or yearly billing period. These custom events use predefined categories and numeric metrics; they do not include message text, contact details or the contents of your saved tools. We use these signals to understand feature usage and improve the app. Our Firebase integration does not collect the Apple advertising identifier (IDFA) or vendor identifier (IDFV), use GPS or precise location, or receive your account ID, name, email, phone number, Cloud content, entered text, photos, URLs or raw error messages from KROMA. The app-instance identifier can associate activity from the same app installation; it is not your KROMA Cloud account.
• Optional iOS advertising measurement: when you allow tracking, the TikTok App Events SDK can send install, app-open and next-day return events, event times, advertising and device identifiers, session identifiers, IP/network information, and app/device context such as versions, language and time zone. It can also send technical performance, error and SDK-related crash information. TikTok uses measurement signals to attribute and improve our advertising. KROMA does not provide your Cloud account, backups, contact details or other app content to TikTok.
• App Store subscriptions: Apple processes payment and manages your subscription. The app checks verified StoreKit entitlements to provide handset access and restore purchases. KROMA does not receive your payment card or bank details. Firebase receives subscription interaction and outcome categories, plan tier and billing period, associated with the app-instance identifier for usage analytics. KROMA does not send transaction IDs, receipts or Apple Account identifiers in its custom analytics events. Purchase measurement is disabled in the TikTok integration.
• Server records: request time, requested path, response status and network/security metadata used to deliver and protect the website, online catalogs and optional KROMA Cloud service.
• Device permissions: microphone, notifications, camera/flashlight and photo-library access are requested only when you invoke a feature that needs them. Core phone data stays on your device unless you deliberately use an online feature.
• Device identity and optional KROMA Cloud: the service stores a random account identifier, an assigned KROMA number and a one-way hash of the private access key held in your device-only iOS Keychain. It also stores any phone backup you choose to submit and files you upload. A backup can contain general, phone and profile settings, reminders and Composer tunes. Your PIN, security code, lock state, local message archive and local call register are never included.
• Optional number recovery: if you link Sign in with Apple, we verify Apple's temporary identity token and store a one-way hash of its app-specific user identifier to associate the KROMA numbers you link. We do not request your name or email from Apple. If you keep a recovery code, the server stores only its one-way hash; the private code is saved in your device-only Keychain and can be copied by you for safekeeping. Recovery replaces the chosen number's device credential; it does not merge separate KROMA accounts or restore message and call history already removed from the relay.
• Contacts and invitations: you save KROMA numbers and choose your own names for them. KROMA does not read or synchronize your iPhone address book. Previously saved local contact details are retained. Invite to KROMA opens the iOS message composer with your KROMA number and the App Store link; you choose the recipient and decide whether to send using the system messaging service.
• KROMA Connect: we store your account identifier, assigned ten-digit KROMA number, any older number retained as a lookup alias, and profile information retained from earlier releases. When you use communication features, we also store your saved KROMA contact names and block relationships, pending message content and its sender/recipient identifiers, timestamps, delivery confirmations and read status. In version 1.0.9 and later, text, picture messages and voice clips are saved in an account-specific archive on each participating device for offline use. The service relays their content until both participants confirm that their devices have saved it. Other Connect users can find you using your complete KROMA number. Each person chooses their own saved contact names; an unknown number is shown as its KROMA number. Messages are encrypted in transit but are not end-to-end encrypted. For Internet calls, we process participant identifiers, call times and status, and technical connection information that can include network addresses. Call audio uses encrypted WebRTC media (DTLS-SRTP), sent directly between devices when possible or through a TURN relay. KROMA does not record or store call audio.
• Voice messages: when you choose to record, KROMA uses the microphone to make a clip of up to 30 seconds and applies your selected sound effect on your device. You can preview it before sending. Only when you send do we upload the audio to private Cloudflare storage, along with its sender, recipient, duration and preset. Authenticated participants can retrieve the clip. Voice messages are encrypted in transit but are not end-to-end encrypted.
• Connect notifications: when enabled and available, we store device push tokens, an installation identifier and the app's push environment. Apple Push Notification service receives the token and routing identifiers needed to deliver message or call notifications, including the sender or caller's display name. We do not include message text, voice clips or call audio in push payloads.

03 / ANALYTICS & ADVERTISING CONTROLS

Personalized-ad signals, advertising storage and advertising user-data consent are disabled for the website. Website Analytics is optional: the Firebase Analytics module is not loaded until you choose Allow analytics, and you can change that choice through Analytics settings in the homepage footer. You can decline the Apple tracking prompt and still use KROMA. You can later change tracking permission in iOS Settings → Privacy & Security → Tracking. Permission withdrawal stops future authorized advertising measurement; it does not erase data already received by a provider.

Native Firebase usage analytics is enabled in the iOS releases described above and is separate from both the website analytics choice and the Apple tracking prompt. Declining tracking prevents the optional TikTok advertising measurement; it does not disable native Firebase usage analytics. Advertising storage, advertising user-data use and ad personalization are disabled for our native Firebase integration. We do not use its usage or subscription events for personalized advertising.

04 / SERVICE PROVIDERS

We use TikTok for consented iOS advertising measurement, Firebase and Google Analytics for native iOS usage analytics and separately consented website measurement, and Cloudflare plus dedicated KROMA origin infrastructure to deliver the website, online catalog and optional KROMA Cloud service. Apple provides App Store payments, subscription management and optional Game Center leaderboards. When you use Game Center, game scores are submitted for your Game Center player according to Apple’s service settings. These providers process relevant data under their own terms and privacy commitments. Learn more in the TikTok Business Products Data Terms, TikTok Privacy Policy, Firebase privacy documentation and Google Privacy Policy.

Apple Push Notification service delivers Connect notifications when enabled and available. Sign in with Apple provides optional proof of ownership for number recovery. Cloudflare, our KROMA origin and TURN infrastructure process the identity and connection data needed to deliver Connect messages and Internet calls.

05 / RETENTION & CHOICES

Measurement and server records are handled according to the relevant provider terms and configured retention periods. TikTok may retain previously received measurement data under its applicable terms; disabling tracking does not itself submit a deletion request. KROMA Cloud keeps submitted backups and uploaded files until you replace or delete them; deleting the KROMA ID removes its server-side backup and files. You can deny or withdraw optional website Analytics from the homepage footer, use device controls for the app, or remove the app to erase its local container. For support, privacy requests or questions about this notice, email hello@chromaphone.com.

For supported local-storage releases, the active relay removes text and picture-message bodies after both sender and recipient confirm durable local storage. Voice clips follow the same rule after both devices have saved and verified the complete audio file: further downloads are denied immediately, and physical storage deletion is retried if needed. Reading a message or receiving a notification is not a storage confirmation. Content remains pending if either participant has not confirmed storage, including while using an older app; available clips no longer expire merely by age. Previously removed or expired content cannot be recovered. The service retains content-free message identifiers, participants, timestamps, content digests, delivery/read state and voice descriptors to prevent duplicate sends and coordinate delivery. Account deletion removes that account's server-side profile, contacts, blocks, message records, calls, device registrations and recovery links and codes, and requests removal of its shared relay clips. Ending a session or deleting a contact does not erase locally saved history. Local message and call archives are excluded from KROMA Cloud and device backups; deleting the app or its local data removes these archives. Explicit account deletion also removes that account's local archives on the device making the request. Unsent voice drafts stay on the device until sent, discarded, the associated account is deleted, or app data is removed. Temporary previews and abandoned incomplete uploads are removed when no longer needed. Call register entries already saved on your device remain available offline independently of server retention. Call setup records and connection candidates become eligible for removal seven days after a call ends and are removed during subsequent Connect service activity. Device push tokens remain until they are successfully unregistered, the account is deleted, or Apple reports the token as unregistered. Copies already saved on another participant’s device are outside this server-side deletion. We retain the account identifier, deletion time and revoked credential hashes to prevent stale requests from recreating deleted data. A retired KROMA number remains reserved without its former profile or identity mapping, so it is not reassigned. Temporary Apple recovery challenges and ownership grants expire after five minutes and are removed during subsequent service activity. Cloudflare may retain previous database versions for recovery for up to 30 days after active data is deleted.

Removing the app deletes its local container but may leave its device-only Keychain identity. Reinstallation alone does not delete server data or guarantee recovery of a number. Use account deletion to remove the account, or keep your number with Apple or a private recovery code before moving to another device. Number recovery does not transfer the former device's local message or call archive.

06 / UPDATES

We may update this notice as KROMA phone evolves. The effective date above will change when a material revision is published.