Your photographs never leave your phone.

What we collect.

Nothing. There is no account, no sign-in, no email address, no device identifier and no usage reporting. We do not have a server, and the app has no code capable of contacting one.

What the app stores, and where.

All of it is on your device, in the app's own storage, and none of it is readable by us or by anyone else:

• Your roll. Photographs you take stay in the app until you clear them. If you have 保留原檔 on, the unedited frame is kept beside the graded one so a look can be re-chosen later.
• Your settings and history. Which looks you have used, favourited or hidden, and the roll number.
• A small local counter file. The app records first launch, first export and first share so it can tell whether its own features are being reached. It is a file on your phone. It is never sent anywhere.

Deleting the app deletes every one of these. There is nothing to request, because there is nowhere else a copy exists.

Permissions, and why each is asked for.

• Camera. To show the viewfinder and take photographs. Asked for when you first tap 開始拍照, not on launch.
• Add to Photos. To save a finished photograph to your own library.
• Full Photos access. Only requested if you turn on 「每捲存成相簿」, which needs permission to create and add to an album named for the roll. Leave that setting off and the app never asks.

Location is never requested. Photographs saved by Tono carry the metadata the original capture had; the app adds none of its own beyond the camera and software fields.

Tracking, analytics and advertising.

None of the three. No advertising identifier, no attribution SDK, no crash-reporting service, no third-party code at all. Tono's privacy manifest declares no tracking and no collected data types, and App Review checks that declaration against the binary.

Children.

Tono is a camera. It has no accounts, no messaging, no user-generated content visible to anyone else, and collects nothing — so there is no children's data for it to handle differently.

Changes, and how you would know.

If a future version ever sends anything off the device, this page changes before that version ships, and the change will say plainly what is sent and why. The date at the top is the honest way to check.

Contact.

Tono is made by CharlX Studio, a one-person studio in Taiwan. Email reaches a person.

charlx.studio@gmail.com