Privacy Policy

Odd Magne Gynnild, Norway, is the data controller for personal data processed by the eyra app.

Contact for privacy questions: app.lyttetrening@gmail.com.

When you create an account and use eyra, we process the following categories of personal data, all of which you provide directly or which the app generates from your activity:

• Account. Email address, nickname, and the sign-in identifier from Apple, Google, or email/password.
• Settings. Language preference, notification preference, voice preference (male, female, or random), and per-exercise parameter values you choose (signal-to-noise ratio, gap length, etc.).
• Training activity. Exercise results (correct/incorrect), response times, replay counts, daily and monthly aggregated counts.
• Subscription state. A RevenueCat anonymous user identifier and your current subscription status (no subscription, premium-monthly, premium-annual). We do not see or store your card details — those go directly to Apple or Google.
• Device language as reported by the operating system, used to localize the app.
• Anonymous analytics events generated by your activity in the app, sent to Aptabase. These contain no email, nickname, IP address, or other identifier — only low-cardinality counters and bucketed values such as event names and exercise types.

We process your data for the following purposes, on the following legal bases under Article 6 of the GDPR:

• To provide the service — running your account, saving your progress, syncing your settings across devices, and showing your statistics. Legal basis: performance of a contract (Article 6(1)(b)).
• To deliver subscriptions — checking whether you have an active premium subscription, and tying it to your account through RevenueCat. Legal basis: performance of a contract (Article 6(1)(b)).
• To improve eyra — anonymous, aggregated analytics via Aptabase, used to understand how features are used and to spot bugs. Because Aptabase events do not contain identifiers and cannot be linked back to you, this is processed under our legitimate interest in improving the app (Article 6(1)(f)). You have the right to object — see "Your rights" below.
• To communicate with you — responding when you contact us, and replying to support or deletion requests. Legal basis: performance of a contract or our legitimate interest in user support (Article 6(1)(b) or (f)).

We use a small set of trusted service providers to operate eyra. They process data only on our instructions and under data processing agreements:

• Google / Firebase — account authentication, encrypted database (Firestore), and file storage. Hosted in the United States. Transfers are protected by the EU Standard Contractual Clauses and by Google's certification under the EU–US Data Privacy Framework. See firebase.google.com/support/privacy.
• RevenueCat — subscription state management. Hosted in the United States. Transfers are protected by Standard Contractual Clauses. See revenuecat.com/privacy.
• Aptabase — anonymous, EU-hosted product analytics (no IP, no cookies, no identifiers). See aptabase.com/legal/privacy.
• Apple and Google process payment, receipt, and refund records when you buy a subscription. We do not see your payment details. See apple.com/legal/privacy and policies.google.com/privacy.

Some of our sub-processors are located outside the European Economic Area, primarily in the United States. Where data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses and, where applicable, on certifications such as the EU–US Data Privacy Framework. You can request a copy of the relevant safeguards by emailing us.

We keep your account and training data for as long as your account is active. When you delete your account, we permanently remove your personal data within 30 days, except where we are required or permitted by law to retain it longer (such as payment records held by Apple or Google).

Anonymous, aggregated analytics events processed by Aptabase cannot be linked back to you and are kept for as long as needed to improve the app.

Under the GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your account and personal data. See Delete account.
• Restriction of processing — ask us to limit how we use your data while a question is being resolved.
• Objection — object to processing based on legitimate interest, including our use of anonymous analytics.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — where processing is based on consent, withdraw it at any time. Withdrawal does not affect prior lawful processing.

You can change most of your data inside the app, or delete your account from Settings → User → Delete account. For other requests, email app.lyttetrening@gmail.com. We reply within 30 days.

eyra does not make any automated decision about you with legal or similarly significant effect.

eyra is not directed at children under 13. If you are under the age of digital consent in your country (16 in Norway), you must have a parent or guardian's permission to use eyra. If you become aware that a child under 13 has provided us personal data, contact us and we will delete the data.

If you believe we have not handled your personal data in accordance with the law, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

Contact: datatilsynet.no, telephone +47 22 39 69 00.

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date at the top of this page and, where appropriate, notify you in the app. Continued use of eyra after the change takes effect means you accept the updated policy.