Privacy policy

Earbunny is provided by Omnibus, Ltd. (“we”, “us”). We are the controller of your personal data: we decide why and how it is used.

• Registered office: available on request at the email below
• Company number: available on request at the email below
• Privacy questions and requests: privacy [at] earbunny.app or the contact form
• EU representative (GDPR Art. 27): will be named here once appointed; until then write to the email above
• UK representative (UK GDPR Art. 27): will be named here once appointed; until then write to the email above

Regional notices add to this policy where a law asks for more detail; see section 15. If a regional notice and this policy differ, the regional notice wins for that region.

Data protection law asks us to name a “legal basis” (the legal reason) for every use. For the EU, EEA and UK this is GDPR / UK GDPR Art. 6, and Art. 9 for special-category data such as health data. For Türkiye it is KVKK Art. 5 and 6; details are in the KVKK notice.

Where we rely on legitimate interests, we have weighed them against your rights; you can object at any time (see section 13). We do not make decisions with legal or similarly significant effects by automated means, and we do not profile children.

Listening levels, sound dose and posture can tell something about a person's health, so we treat them as health data (special-category data under GDPR Art. 9, “özel nitelikli kişisel veri” under KVKK Art. 6, and consumer health data under some US state laws). We process them only with explicit consent: a clear, separate “yes” in the app before measuring starts. For a child, the parent gives this consent.

You can withdraw consent at any time: turn off the permission in the app or in iOS Settings, stop monitoring, or delete the account. Withdrawal stops future processing; it does not make earlier processing unlawful. Without this consent the measuring features cannot work, but you can still keep your account.

With your permission the app reads Headphone Audio Levels and Environmental Sound Levels from Apple Health. It writes nothing to Apple Health. Data from Apple Health:

• is used only to provide Earbunny's features to you and the parents linked to you;
• is never used for advertising, marketing or data mining;
• is never sold or given to third parties, except the hosting processors that run the service for us;
• is not stored in iCloud by us, and raw samples are deleted from our servers after 30 days.

If you do not allow Apple Health, the app estimates the level from the volume setting and headphone model and marks it as “estimated”.

• Only a parent or legal guardian can create a child's account. Children have no email or password and cannot use the web dashboard.
• The child's phone is paired with a 6-digit code or QR code from the parent's account. Codes work once and expire after 10 minutes.
• For a child under 13, the parent must give a recorded consent declaration before pairing. For older children, the parent gives the consents in this policy when adding them, so consent is always given by a parent, whatever age your local law sets (13 to 16 in the EU, under 18 in Türkiye).
• No hidden mode: the child always sees that monitoring is on and who can see their data on the “Who sees me” screen, and gets a reminder every 30 days. iOS shows its location indicator when background monitoring is on.
• No ads, no third-party analytics and no profiling or marketing based on children's data.

Read the children's privacy notice (it has a part written for kids) and, for the United States, the COPPA notice.

We do not sell personal data and we do not share it for advertising. We disclose data to authorities only when the law requires it, and we push back on requests that are not lawful. Our providers are listed on the sub-processors page.

Our servers, database and backups are hosted in the EU. Some providers (for example Apple, Google, Cloudflare, Vercel and Sentry) are based in, or work from, other countries such as the United States. When data leaves the EU/EEA or the UK we use one of these safeguards:

• an adequacy decision, including the EU–US Data Privacy Framework (and the UK Extension) where the provider is certified;
• otherwise the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), plus extra technical measures such as encryption;
• for data from Türkiye, the safeguards of KVKK Art. 9 (adequacy decision, standard contract notified to the Personal Data Protection Authority, or other appropriate safeguards);
• for other countries, the transfer rules of the local law (see the regional notices).

You can ask us for a copy of the relevant safeguards at privacy [at] earbunny.app.

On the Free plan, history older than 7 days is hidden in the app, not deleted; it follows the periods above.

• Delete an account in the app under Settings → Delete account. The deletion is completed 30 days after the request; signing in during that time cancels it. After that it cannot be undone.
• The same email address can be used to open a new account 24 hours after the deletion request.
• When a parent removes a member, that member's account and data are deleted. When a parent deletes their own account, the member accounts they own are deleted too.
• Deleted data disappears from encrypted backups within a further 30 days.

Data is encrypted in transit (TLS) and at rest, including backups. Sessions are short-lived, every request passes one access rule (you see yourself; a parent sees only linked members), admin accounts need two-step verification and every staff access to personal data is logged. Sign-in and pairing codes are never written to production logs. More on the security page.

If a personal data breach puts you at risk, we tell the supervisory authority (under GDPR within 72 hours) and you, as the law requires.

Depending on where you live, you have the right to:

• know whether we process your data and get a copy (access);
• have wrong data corrected (rectification) and data deleted (erasure);
• restrict or object to processing, including at any time to processing based on legitimate interests;
• receive your data in a machine-readable format (portability);
• withdraw consent at any time, without affecting earlier processing;
• complain to a data protection authority.

How: in the app use Settings → Download my data (a JSON file) and Settings → Delete account. For anything else write to privacy [at] earbunny.app or use the contact form. We may ask you to confirm your identity. We answer free of charge within one month (KVKK: 30 days; some US states: 45 days), and tell you if we need more time where the law allows it. Parents can use these rights for their children.

Canada: under PIPEDA and Québec's Law 25 you can access and correct your information and withdraw consent; in Québec also ask for portability. Complaints go to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

Under laws such as the Washington My Health My Data Act and similar laws in Nevada and Connecticut, listening levels, sound dose and posture may be “consumer health data”. We collect it only with your consent and only to provide the app, never sell it, and share it only with the processors that run the service. You can access or delete it and withdraw consent at any time. Details are in the US privacy notice.

These notices add the details each law requires:

• European Union and EEA (GDPR)
• United Kingdom (UK GDPR and the Children's Code)
• United States (state privacy laws, CCPA/CPRA)
• United States: children under 13 (COPPA)
• Türkiye (KVKK information notice)
• Brazil (LGPD)
• Japan (APPI)

An overview of every law we follow is on the compliance page.

You do not need an account to use this website. It stores your theme, language and privacy choice in your browser, protects the contact form with Cloudflare Turnstile and loads cookieless, aggregated Vercel analytics only if you allow it. Our hosting providers keep short technical logs (IP address, browser) for security. Contact messages are kept for 24 months. See the cookie policy. The app itself uses no cookies.

Earbunny is not a medical device. It builds awareness and habits and does not diagnose, prevent or treat any condition. See the health disclaimer.

We tell you about important changes in the app and by email before they take effect, and ask for consent again if we want to use data for a new purpose or collect a new type of data. The date at the top shows when this policy last changed.