Tonis
Tonis is a face fitness app published by Digital Therapeutics Solutions LLC (“Tonis,” “we,” “us”). This policy explains what we collect, why, where it is stored, how long we keep it, and how you can delete it. It applies to the Tonis iOS app and to tonislabs.com.
The short version. Tonis measures your face using your iPhone’s TrueDepth camera. All scoring happens on your device — we do not run facial analysis on our servers and we do not use facial recognition to identify you. We never sell your data, never share it with advertisers, and you can delete every scan, or your entire account, from inside the app at any time.
This is the most sensitive category of information Tonis handles, so we describe it separately and in full.
When you run a face scan, the app captures:
A 3D face mesh is a biometric identifier under laws including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington’s My Health My Data Act, and Article 9 of the EU/UK GDPR.
Because of that, Tonis requires your explicit, informed opt-in before your first scan. The scanner will not open until you consent. We record the fact and time of your consent, and the version of the consent notice you agreed to, so there is an auditable record. You can withdraw consent at any time by deleting your face data (see section 7); the app will ask again before any future scan.
Illinois (BIPA). If you are in Illinois, a face geometry is a biometric identifier. We collect it only after you tap Continue, only to measure your face and show you your own progress, and we destroy it on the schedule in this section (when you delete it, or within three years of your last use of Tonis if you never come back). We do not sell it. We do not use it to identify you to anyone else. Wyoming formation does not turn this off: BIPA follows the person in Illinois, not the state printed on our LLC papers.
Scoring is performed entirely on your iPhone. The measurement and scoring engine runs locally in the app. We do not send your mesh to a server for analysis, we do not use a third-party facial-analysis provider, and we do not perform facial recognition — that is, we never attempt to identify you, or match you against any other person, from your face.
Workouts and scans are different. Guided workouts use Apple ARKit and, on iPhones with Face ID, the TrueDepth camera to watch facial movement in real time so the app can count reps and coach form. That live tracking stays on your iPhone for the session. We do not upload the live workout mesh, we do not use it to identify you, and we do not send it to advertisers or analytics companies. A Face Scan is the separate step that saves a still photograph, a depth map, and the measurements derived from them, and only after you tap Continue on the first-scan screen.
So your history and progress charts survive reinstalling the app or changing phones, scans are stored in your private account area on Google Firebase:
Access is enforced by server-side security rules that permit only the signed-in owner of the data to read it. Data is encrypted in transit and at rest by Google Cloud. Our staff do not routinely access scan content.
The purpose of a scan is to show you your own measurements and how they change over time. We do not keep a separate copy of your photo or mesh to train a model, to improve a model, or to build a dataset.
We keep each scan until the first of these happens:
When you delete a scan or your account, we remove the photograph, mesh, and measurements from the live account promptly, and from this iPhone. Any backup that we control is overwritten or deleted within 30 days. Google, our hosting provider, then clears residual copies from its own storage systems on its own deletion schedule; those copies are not accessible to us or to anyone using Tonis. We do not keep a biometric archive.
The three-year limit is enforced by a monthly job that checks the last day you opened Tonis and deletes face data for accounts past the limit. Your workouts and account stay until you delete them.
We do not sell, lease, trade, or otherwise profit from your facial data, and we do not disclose it to third parties, except to our hosting provider (Google Firebase) acting as our processor, or where compelled by valid legal process.
If Digital Therapeutics Solutions LLC is sold, merged, or transfers the Tonis business, your information can transfer to the buyer as part of that business, and we will tell you. That is a transfer of the company. It is not a sale of your personal information for advertising, and it is not permission for the buyer to use your face to identify you or to train a model.
| Data | Why | Linked to you |
|---|---|---|
| Email address and account identifier | To create and authenticate your account. Sign in with Apple is supported, including Apple’s private relay addresses. | Yes |
| Name and profile details you enter | To personalise the app and show your name to friends you connect with. | Yes |
| Workout and fitness activity | Exercises completed, reps, duration, streaks, XP and awards — the core progress features. | Yes |
| Progress photos you choose to take | Optional before/after comparisons, stored in your private account area. | Yes |
| Contacts (optional) | If you grant Contacts access to find friends, we send irreversibly hashed identifiers to match against other Tonis users. You can decline; the rest of the app works normally. | Yes |
| Product interaction | Which screens and features are used, to understand what works and improve the app. | Yes |
| Crash and performance data | Diagnostics to find and fix bugs. | No |
| Push notification token | To deliver reminders and updates, only if you allow notifications. | Yes |
We do use Firebase Analytics to see which screens and features are used (for example, that a workout or a scan finished). That is our own product measurement. It is tied to your account identifier. It is not sold, and it is not used to advertise to you on other apps.
We buy ads so people can find Tonis. Those ads live outside the app (App Store search, Instagram, TikTok, Meta, and similar). We do not put ads inside the app. We do not put the Facebook or TikTok tracking SDK in the app. We do not read Apple’s advertising identifier (IDFA). We never use your face, scans, photos, or workouts to target or measure ads. Buying an ad is not a sale of your personal information.
To learn which ads work, we use two things:
You can stop sharing these events with Google Ads at any time: Profile → Privacy → Ad measurement. Our own product analytics keep working when it is off.
We do not sell your personal information. We do not use it for personalized ads or remarketing. Sharing app milestones with Google Ads for ad measurement may count as “sharing” under the CPRA, so we treat it that way and give you a switch: Profile → Privacy → Ad measurement. Turning it off is your opt-out of sharing. Face data, scans, and workouts are never shared for advertising, whatever the switch says.
The website sets no advertising cookies, so a Global Privacy Control signal there has nothing to switch off. If you would rather we turn ad measurement off for your account, email info@dtsolutions-llc.com and we will. You can exercise your other California rights at the same address.
This is the notice at collection for the California Consumer Privacy Act, as amended by the CPRA. We collect the categories in the table in section 2, plus facial geometry, photographs, and fitness activity described in sections 1 and 2. We collect them to provide the app: your account, your workouts, your scans, and your progress. Facial geometry and fitness activity are sensitive personal information. We use them only to provide the app to you. We do not sell personal information. App milestones (not sensitive information) may be shared with Google Ads for ad measurement unless you turn that off, as described above; we keep them no longer than the analytics window in section 1. We do not use sensitive personal information for purposes that would require a “limit the use” link. You can delete it in the app, as described in section 7, or email info@dtsolutions-llc.com.
Every permission can be revoked at any time in the iOS Settings app.
We rely on a small number of processors:
Tonis offers an optional auto-renewing subscription. Billing is handled entirely by Apple through your App Store account. We receive a transaction record from Apple confirming that a subscription is active, renewed, expired or refunded, so the app can unlock the right features. Manage or cancel any time in Settings → Apple Account → Subscriptions.
Depending on where you live, you may have the right to access, correct, port, restrict, or delete your personal information, to withdraw consent, and to object to certain processing. Residents of California have rights under the CCPA/CPRA, including the right not to receive discriminatory treatment for exercising them — note that we do not sell or share personal information as those terms are defined. Residents of the EU, UK, and other GDPR jurisdictions may also lodge a complaint with their supervisory authority.
The in-app controls above satisfy most requests immediately. For anything else, contact us at support@tonisfacefitness.com and we will respond within 30 days.
Tonis is not directed to children under 13, and we do not knowingly collect personal information from them. Given the biometric nature of face scanning, we ask that anyone under 18 obtain a parent or guardian’s permission before using the scanner. If you believe a child has provided us information, contact us and we will delete it.
We are based in the United States and our infrastructure runs in Google Cloud regions in the United States. If you use Tonis from outside the US, your information will be transferred to and processed there, under appropriate safeguards for transfers from your jurisdiction.
Data is encrypted in transit (TLS) and at rest. Access is restricted by server-side security rules that scope every record to its owner. Subscription receipts are verified cryptographically against Apple. No system is perfectly secure, but we work to protect your information and will notify affected users of any breach as required by law.
If we change this policy we will update the date above. For material changes — particularly any change to how facial data is handled — we will notify you in the app and, where required, ask for your consent again.
Digital Therapeutics Solutions LLC
30 N Gould St, Ste R
Sheridan, WY 82801
USA
Product support:
support@tonisfacefitness.com
Privacy and legal:
info@dtsolutions-llc.com