Privacy Policy

Last updated: 13 September 2026

This Privacy Policy explains how My Song ("we", "us") collects, uses, shares and protects information when you use the My Song Android application, distributed on Google Play, and this website (myringtone.co). It is written to meet the Google Play User Data policy and India's Digital Personal Data Protection Act, 2023.

1. Who we are

My Song is operated by Handful Labs, a sole proprietorship of Kaustubh Khandelwal, registered at 17-B, New Colony, Gumanpura, Kota, Rajasthan 324007, India (GSTIN 08CVRPK6564P1ZF). Handful Labs is the data fiduciary for the purposes of the Digital Personal Data Protection Act, 2023. Contact: kaustubh.khandelwal4@gmail.com.

2. Information we collect

• Mobile number, used to sign you in with a one-time code. It is your account identifier.
• Name you enter, used to display your profile and to generate personalised ringtones.
• App language and your in-app activity (ringtones played, liked and set, generation requests), used to run the service and improve the catalogue.
• Contacts, only if you choose "Ringtone for selected contacts". The app reads your contact list on-device to let you pick contacts and writes the ringtone setting to those contacts. Contact names and numbers are never uploaded to our servers; we store only the number of contacts you selected.
• Photos, only if you choose a photo option. The photo stays on your device.
• Payment information is handled entirely by our licensed payment gateway when you buy My Song Premium. We receive only a payment reference, the amount, the status and a masked UPI handle or card suffix, which we keep as proof of purchase and for refunds and accounting. We never see or store your full card number, UPI PIN, CVV or bank credentials.
• Device information (app version, OS version, push notification token) for security and notifications.
• Advertising identifier and app events (Android advertising ID, app installs and opens, and in-app actions such as creating or setting a ringtone), shared with Meta Platforms to measure and improve our advertising. Meta processes this under its own privacy policy; you can reset or delete your advertising ID in Android settings under Privacy → Ads. When a paid subscription starts, our servers also send Meta that event with your advertising ID, device details and a hashed (scrambled) copy of your phone number, so Meta can measure our advertising.
• Crash reports (device model, OS version, app version and the technical state of the app when it crashed), collected through Google Firebase Crashlytics so we can fix defects. They contain no name, number or contacts.

3. Permissions we ask for

• Contacts (read/write): only for per-contact ringtones.
• Modify system settings: required by Android to set your default ringtone.
• Notifications: to tell you when a generated ringtone is ready and before a renewal.

4. How we use information

To provide the service, process payments, generate ringtones, send service notifications, prevent fraud and abuse, and comply with law. We do not sell personal data and we do not show third-party ads inside the app; we do advertise the app on other platforms and measure those campaigns.

5. Sharing

We share data only with processors needed to run the service: a payment provider (only if a paid plan is offered), our cloud hosting and storage providers, an SMS/authentication provider (one-time codes), a text-to-speech provider (only the lyric line containing the name you typed, for generation), Google Firebase (notifications and crash reporting), Meta Platforms (advertising measurement), and Amplitude (product analytics: which screens and features are used, keyed to an internal user id, never your number or name). Each processes data under contract and only on our instructions. We disclose data to authorities where required by law.

6. Retention

Account data is kept while your account is active. Generated ringtones are kept so you can re-download them. Payment records are kept for 8 years as required by Indian tax law. When you delete your account from the app (Mera Profile → Delete Account), your profile, generated ringtones and activity are deleted within 30 days; payment records are retained as required by law.

7. Your rights

You can access, correct or delete your data from within the app or by emailing us. You may withdraw consent for optional permissions at any time in Android settings. You can nominate another person to exercise your rights in case of death or incapacity, as provided by the DPDP Act. Grievance Officer: Kaustubh Khandelwal, kaustubh.khandelwal4@gmail.com. We respond within 30 days.

8. Children

The service is not directed at children under 18. We do not knowingly collect data from children.

9. Security

Data is encrypted in transit (TLS) and at rest. Access is limited to personnel who need it. No method is 100% secure; report concerns to the email above.

10. Changes

We will post updates here and, for material changes, notify you in the app.