Privacy Policy

Last updated: April 17, 2026

This Privacy Policy explains what information Humlo collects, how we use it, with whom we share it, and the rights you have over it. It applies to the Humlo iOS app and the services at humlo.app and api.humlo.app (the “Service”), operated by [LEGAL ENTITY NAME] (“Humlo”, “we”, “us”).

1. Overview

Humlo lets you record a short voice sample, pick a song, and receive an AI cover or a short video of yourself appearing to sing it. To make that work we process voice recordings, photos, song files, subscription status, and basic usage data. We do not sell your personal data. We do not build advertising profiles about you from the content you create.

2. Information We Collect

2.1 Information you provide

Voice recordings — the short voice sample(s) you record to create your personal AI voice model, and any subsequent recordings you choose to upload.
Photos — images you choose to upload or capture with the camera when you generate an AI singing-head video.
Songs and song references — uploaded audio files, YouTube/streaming links, or search queries you use to select tracks.
Account preferences — voice model names, library metadata, notification opt-ins, and any feedback you send us.

2.2 Information collected automatically

Device identifier — a randomly generated UUID created on first launch and stored in the iOS Keychain. It identifies your account without requiring a sign-up.
Device and app information — iOS version, device model (e.g., iPhone 15), app version, locale, and time zone.
IP address — captured transiently by our servers and our content-delivery network for request routing, rate-limiting, and abuse prevention.
Push notification tokens — an Apple Push Notification service (APNs) token for your device, if you grant us permission to send push notifications.
Usage events — anonymous-level product analytics such as which screens you view, when a generation succeeds or fails, and which features you use.
Crash and diagnostic logs — technical logs when the app crashes or the pipeline fails, so we can debug.

2.3 Purchase information

Subscription status — whether you have an active Humlo Pro subscription, the plan type, the renewal date, and the App Store transaction identifier. Actual payment details are handled by Apple — we never see your credit-card or banking information.

2.4 Attribution information

Install-attribution data — if you tapped a marketing link before installing Humlo, our attribution provider may associate your install with that campaign. Where Apple’s App Tracking Transparency (ATT) applies, this only happens after you allow tracking; if you do not allow tracking, only aggregate, non-identifying attribution is recorded.

3. How We Use It

We use the information we collect to:

Create and improve your personal AI voice model;
Separate instrumentals from vocals, generate a cover in your voice, animate your photo, synchronise lips to audio, and render the final audio/video;
Store your library so you can revisit, share, and re-render Generated Media;
Process subscription purchases, entitlements, trials, and renewals through Apple and our subscription back-end;
Measure how the product is used, diagnose failures, and prioritise improvements;
Send you push notifications when a generation is ready (only if you opted in);
Attribute marketing campaigns and measure their effectiveness;
Detect, prevent, and respond to fraud, abuse, or technical attacks on the Service;
Comply with applicable legal obligations.

We do not use your voice recordings, photos, or Generated Media to train foundation AI models without your explicit opt-in consent, and we do not sell your personal data.

4. Legal Bases (EEA & UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following bases under the GDPR:

Contract — to provide the core functionality of the app, including voice cloning, cover generation, video rendering, and subscription management.
Consent — for push notifications, optional tracking under Apple’s ATT framework, and any feature expressly presented as opt-in.
Legitimate interests — to secure the Service, prevent abuse, measure product quality, and understand aggregate usage patterns.
Legal obligation — to comply with applicable laws, court orders, and regulatory requests.

5. Third-Party Services

Humlo relies on the following service providers. Your data flows to them only to the extent needed for the specific feature they support. Each operates under its own privacy policy; we recommend you review them.

Apple Inc. — App Store distribution, in-app purchases (StoreKit), and push notifications (APNs). Privacy.
AppHud — subscription lifecycle and receipt-validation provider. Receives your device identifier and subscription status. Privacy.
AppsFlyer — mobile install attribution. Receives your device identifier and, subject to ATT, your IDFA. Privacy.
Amplitude — product analytics. Receives pseudonymous usage events and a random analytics identifier. Privacy.
Cloudflare, Inc. — object storage (R2) and content-delivery network for your voice recordings, photos, and Generated Media. Privacy.
Humlo Kometa — our own AI inference service that performs voice cloning, vocal separation, and voice conversion on GPU hardware. Receives the voice sample, the source song, and the resulting files. Data is processed transiently and not retained beyond the job lifetime.
HeyGen — photo-to-video animation. Receives the photo you upload and the vocal audio used to drive the animation. Privacy.
Hedra — alternative photo-to-video animation provider used for some plans. Receives the photo and vocal audio. Privacy.
Zyla API Hub — YouTube search and audio extraction. Receives the search query or URL. Privacy.
RunPod — infrastructure on which our own inference service runs. Privacy.

6. Data Retention

Voice models are retained until you delete them or request account deletion. You can delete a voice model at any time from My Voice in the app.
Generated Media in your library is retained until you delete individual items or request account deletion.
Temporary processing files (for example, intermediate audio during rendering) are stored under a tmp/ prefix and deleted automatically within 24 hours.
Usage and crash analytics are retained for up to 14 months or the default retention of the analytics provider, whichever is shorter.
Attribution data is retained for up to 24 months in line with our attribution provider’s default.
Subscription and transaction records are retained for as long as required by applicable tax, accounting, and consumer-protection laws.

7. Data Security

Data in transit is encrypted using TLS. Stored media are served over HTTPS via our CDN. Voice models, photos, and Generated Media are stored in Cloudflare R2 with access limited to authorised service credentials. Your device identifier is kept in the iOS Keychain, which is protected by iOS at the operating-system level. We maintain reasonable administrative, technical, and physical safeguards, but no method of electronic storage or transmission is 100% secure.

8. Your Rights

Depending on where you live, you may have some or all of the following rights:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Deletion — ask us to delete your voice models, library, and associated account data.
Portability — request an export of your data in a portable format.
Restriction / Objection — restrict or object to certain processing (for example, analytics).
Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting prior processing.
Complaint — lodge a complaint with your local data-protection authority.

To exercise any of these rights, email us at support@humlo.app from the email address associated with your device. We may ask for additional information to verify your identity before acting on the request. We will respond within 30 days, or as required by applicable law.

You can also control certain data flows directly from iOS:

Disable analytics tracking via Settings → Privacy & Security → Tracking;
Revoke push notifications via Settings → Humlo → Notifications;
Revoke microphone or photo access via Settings → Humlo;
Manage or cancel your subscription via Settings → [your name] → Subscriptions.

9. Children’s Privacy

Humlo is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we may have done so, please contact us and we will delete the information.

10. International Transfers

Our infrastructure, and those of our providers, may be located outside the country in which you reside, including in the United States and the European Union. Where we transfer personal data out of the EEA, UK, or other regulated jurisdictions, we rely on lawful transfer mechanisms such as the European Commission’s Standard Contractual Clauses.

11. Cookies & Tracking

The Humlo website (humlo.app) does not use cookies or trackers. The iOS app uses an anonymous analytics identifier and, only with your explicit ATT permission, the Identifier for Advertisers (IDFA). You can revoke tracking permission at any time in iOS Settings.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the “Last updated” date above and, where required by law, announced in-app or by other means. Your continued use of the Service after the changes take effect constitutes acceptance of the updated policy.

13. Contact

Questions, requests, or complaints: support@humlo.app.

Humlo · [LEGAL ENTITY NAME] · [ADDRESS]