your laugh is not ad inventory.

01 · who we are

One company is responsible, and one human support address reaches it.

HA. is provided by Off Script Foundry, Inc., 1248 W 700 S, Pleasant Grove, UT 84062, USA. In this policy, “HA.,” “we,” and “us” mean that company.

02 · what stays on your iPhone

Most of the app is local by design.

Calibration recordings, practice recordings, scores, feature measurements, listening judgements, streaks, reminders, and the saved reel are stored in the app container on your iPhone. The widget receives only a small worth snapshot through the app group. We do not receive this local data.

When you use the iOS share sheet, you choose another app or person to receive the selected file. Apple and the receiving service handle that transfer under their own terms; HA. does not learn who received it.

03 · what the optional Room sends

Joining and posting are explicit actions.

Account and consent

Sign in with Apple provides a stable account identifier. HA. requests no Apple name or email scopes. We retain the Supabase account ID, assigned file number, accepted terms version and timestamp, and the timestamp of your confirmation that you are 13 or older.

Posts

When you press Post, HA. uploads a short WAV, generated reel, poster, claimed score, and random object paths. The server re-scores the WAV and deletes that raw scoring upload after the request. The reel, its audio, poster, server score, rank, timestamps, and chain relationship remain until the reel or account is deleted.

Room actions

We retain blocks, reports, and the minimum posting metadata needed to deliver and moderate the Room. Reports use a fixed reason rather than free-form text.

Service logs

Our hosting providers may process request metadata such as IP address, timestamps, and error information to secure and operate their services. We do not use it to advertise, profile, or track you.

04 · usage analytics

Product events and landing-page views, not recordings or interaction replay.

In the app, HA. sends an event when the app opens; when a named screen appears; when onboarding, recalibration, a drill, a sitting, ear training, or a perfect attempt completes; when a reel is created or shared; and when a Room join or post starts, succeeds, or fails. Events may include a fixed screen, drill, or sitting label, a pass-or-fail value, app and iOS versions, random device and session identifiers, and a timestamp. The Room’s publishing function sends one additional event stating that a reel was published and whether it was a reply.

The tryha.app landing page sends a page-view event to PostHog unless your browser sends Global Privacy Control or Do Not Track. That event may include the page URL and referrer, browser and device metadata, a random identifier held only in memory, and a timestamp. The landing page does not use PostHog cookies or local storage, capture clicks or text, or connect its identifier to the app’s identifier; reloading the page resets it.

Automatic interaction capture, session replay, surveys, feature flags, push capture, crash and error capture, person profiles, and IP-derived location are disabled. We do not send audio, recordings, scores, acoustic measurements, free text, posting identifiers, object paths, error messages, or the raw Supabase account ID. Before Room sign-in, app analytics use a random identifier. After sign-in, future app events and the server-confirmed publish event use the same one-way, account-derived pseudonymous identifier; pre-sign-in history stays separate. Settings → Usage Analytics can stop future app analytics collection at any time.

05 · how we use data

App functionality, product improvement, and safety only.

• understand which product flows are used and where they succeed or fail;
• authenticate the Room account and keep it signed in;
• score and publish a reel you chose to post;
• deliver Room content to other Room accounts;
• apply blocks, process reports, and remove violations;
• prevent abuse, diagnose failures, and secure the service;
• complete reel and account deletion requests.

We do not use this data for third-party advertising, our own advertising, marketing profiles, data brokerage, or tracking across other companies’ apps and sites.

06 · who receives data

Other people in the Room, and service providers.

• Other people in the Room: any other Room account can hear reels you post and see the associated file number, score, rank, worth, and posting time. The Room is open to anyone with an account, so treat a post as public to that audience. They do not receive your Apple name or email from us.
• PostHog: processes the limited app events and landing-page views described above on our behalf.
• Supabase: provides authentication, Postgres, private object storage, and Edge Functions for the Room.
• Apple: provides Sign in with Apple and receives token validation and revocation requests.
• Vercel: hosts tryha.app, relays the landing page’s same-origin analytics requests to PostHog, and may process ordinary web request logs.
• Legal and safety: we may preserve or disclose information when legally required or reasonably necessary to protect people, rights, and service security.

We do not sell or rent personal data.

07 · retention and deletion

A post lasts until you remove it; an account lasts until you delete it.

Room media and metadata remain while the post exists. Raw WAV scoring uploads are deleted after scoring; failed uploads are cleaned up. Reports remain while needed for moderation and enforcement. We retain analytics events only while they remain useful for understanding and improving HA.; provider security logs follow each provider’s operational retention.

Deleting a reel marks its row removed and deletes its private reel and poster before the app reports success. Settings → Delete Everything removes Room objects, blocks, reports, the Room account, the Supabase Auth user, and revokes the associated Sign in with Apple token. It then erases local recordings and app data and resets the identifier used for future analytics. Earlier analytics events are not automatically erased by that in-app action; contact us to request their deletion. If the server is unreachable, the app says so and can erase the phone while preserving only the credential needed to retry server deletion.

08 · your choices and rights

The app puts the ordinary controls next to the data.

• Turn off future app analytics in Settings.
• Send Global Privacy Control or Do Not Track from your browser to prevent landing-page analytics.
• Do not join the Room; the practice app still works.
• Choose whether to post each reel.
• Delete your own reel from its menu.
• Report a reel or block an account immediately.
• Delete the complete Room account and local file in Settings.
• Contact us to ask a privacy question, request analytics deletion, or exercise a right available where you live.

Because local practice data never reaches us, support cannot view, recover, export, or remotely delete it.

09 · age

The Room is not for children under 13.

HA. requires a 13-or-older confirmation before creating a Room account. We do not knowingly collect Room data from a child under 13. If you believe that happened, contact us so we can investigate and delete it.

10 · changes

Material changes are listed here.

September 1, 2026 — landing-page analytics

The tryha.app landing page now sends the limited, non-persistent page-view event described in section 04. It does not change the app’s analytics settings or connect a website visitor to an app user.

August 27, 2026 — the Room opened

Until August 27, 2026 the Room was invitation-only: a reel you posted could be heard only by accounts you had connected with by exchanging a code. That restriction has been removed. A reel you post to the Room can now be heard by any other Room account, except accounts either of you has blocked.

Nothing about the Room is retroactive: posting is still an explicit action, nothing leaves your iPhone unless you press Post, and you can still delete a reel or the whole account in the app. Two things did go: the invitation records, and the names you assigned to people in your Room. The app deletes those local names from your iPhone the next time you open it.

If you would rather not post to an open Room, delete your Room account in Settings; the practice app keeps working without one.

11 · security and changes

Private storage and least privilege reduce exposure; no system eliminates risk.

Room buckets are private, access is checked against row-level database policies, short-lived signed URLs deliver media, service credentials remain server-side, and stored Apple refresh tokens are encrypted before entering the database. We may update this policy when the product or law changes. We will revise the date above and provide additional notice when a material change requires it.

12 · contact

Email privacy questions and rights requests to contact@offscriptfoundry.com, or use the support page. You may also mail requests with “HA. privacy” on the envelope:

Off Script Foundry, Inc.
1248 W 700 S
Pleasant Grove, UT 84062
USA