Privacy Policy — Sono AAC Communicator

Last updated: 25 May 2026

1. Introduction and Identity of the Data Controller

Sono is a picture-symbol communication app designed to help people express themselves using images and spoken words.

Publisher and privacy contact: For personal data processing that we control in connection with the App, contact:

Matan Ljubas 10A Ul. Joze Krstića, Zadar, Zadarska županija 23000, Croatia Contact: lj.matan@gmail.com

EU Representative: The publisher is established in Croatia, within the European Economic Area. No separate EU representative is appointed for this app.

The core principle: Sono is designed to run on your device. It does not create user accounts, does not track you across apps or websites, and does not transmit your symbol board activity, custom content, recordings, or communication history to our servers.

2. Information Stored on Your Device

Sono stores app settings and user-generated communication content locally on your device. This data does not leave the device through the App unless you use an operating-system backup, device migration, file-sharing, or cloud backup service (such as iCloud or Google Drive), which is governed by that service’s own privacy policy.

Message history is stored locally for quick re-use and can be cleared from the relevant app controls or by deleting the App’s data. It is not transmitted to our servers.

3. How We Use This Information

The information listed above is used solely to operate the app on your device:

• Display and board settings — adapt the communication board to the user’s needs.
• Voice selection — drives the text-to-speech engine.
• On-device language model files — when present and enabled, used solely as input to the local sentence-suggestion engine (see Section 5).
• Custom content and media — displays personalised symbols, photos, labels, and voice recordings.
• Activity history — supports recents, message history, and faster re-use of common communication.

None of this information is used for analytics, advertising, profiling, or any purpose other than operating the app locally on your device.

4. Legal Basis for Processing (GDPR)

The App stores the data in Section 2 on the device under the user’s or caretaker’s control. We do not receive that data through ordinary App use. Choosing a setting, adding content, or importing a model is a feature choice; it is not, by itself, GDPR consent to processing by us. We therefore do not assign an Article 6 legal basis to each on-device item as though we received and controlled it.

When you contact us, we process the personal information you provide to respond to your enquiry. Where GDPR applies, our basis is our legitimate interest in handling enquiries (Article 6(1)(f)); for a request to exercise data protection rights, we process the information needed to meet our legal obligations (Article 6(1)(c)). Optional requests to external hosts are described in Sections 7, 10, and 11; those hosts provide information about their own processing.

The App does not make automated decisions that have legal or similarly significant effects on an individual (see Section 13).

5. Sentence Suggestions and On-Device AI

Sono can offer suggestions to help turn a sequence of selected symbols into a more natural sentence. The caretaker can choose between two engines in Settings > Smart Sentences:

Rule-based engine (default): A deterministic, local grammar engine that applies fixed rules to the symbol sequence. It does not use machine learning, does not transmit anything externally, and produces no profile or inference about any individual.

On-device language model (optional, caretaker-supplied): Some builds of the App include a “Bring Your Own Model” path that allows the caretaker to import a GGUF-format language model file from device storage or fetch one from a URL the caretaker chooses, and use it to generate sentence suggestions locally. No language model is bundled with the App. Whether this feature is available, and which on-device inference engine (if any) is used to run the imported model, depends on how the build is configured by the publisher or by the caretaker.

Where this feature is available and the caretaker has imported a model:

• The selected symbol sequence (in plain text form) is provided as input to the imported model only when sentence suggestion is invoked, and only on your device.
• No prompt, no input, no model output, and no other communication content is transmitted to us or to any external service when a suggestion is generated.
• Model files are imported or downloaded at the caretaker’s explicit request, from a location the caretaker chooses (see Section 7 and Section 10). The App does not recommend, host, or pre-select any particular model file or vendor. Once imported, the model runs locally.
• The model produces only short text suggestions for the caretaker or user to accept, reject, or edit. It does not perform profiling or automated decision-making within the meaning of Article 22 GDPR, and its output has no legal or similarly significant effect on any individual.
• You are informed here, and via the Smart Sentences setting itself, that suggestions originate from an AI system. This is intended to support the transparency obligations for AI systems that interact with natural persons under Article 50 of Regulation (EU) 2024/1689 (the “EU AI Act”), to the extent applicable to this feature. The upstream model provider may have separate obligations for its model; we remain responsible for any obligations applicable law assigns to us.

If you turn the on-device language model off, or do not import any model file, no language-model processing takes place. Imported model files can be deleted in Settings > Smart Sentences at any time.

6. Text-to-Speech

Sono offers two text-to-speech modes:

Offline voices (preferred): The app can download language-specific voice models from a public repository (the Sherpa-ONNX project’s GitHub releases). The synthesis engine is built on the open-source sherpa_onnx library, which runs entirely on the device via ONNX Runtime. Once a voice model is downloaded, all speech synthesis happens locally with no data transmitted externally.

Caretaker-provided voices (“Bring Your Own Voice”): The caretaker may optionally import voice model files from a folder or download link, or record short audio samples for individual symbols. Imported voice model files, generated voices, and per-symbol voice recordings are stored only on the device and are never transmitted by the App. The caretaker is responsible for obtaining any consent required by applicable law for recording, storing, importing, or sharing another person’s voice (see Section 7 of the Terms and Conditions).

Device system voices (fallback): When an offline voice is not available for the selected language, the app uses your device’s built-in text-to-speech service (provided by Apple or Google, depending on your device). These system services are governed by the privacy policies of Apple and Google respectively, and may transmit spoken text to their servers to synthesise it. You can avoid this by downloading an offline voice in Settings > Voice.

7. Optional Internet Connections

Sono has no mandatory internet connection for core communication. The communication board, sentence strip, and text-to-speech using an installed offline voice operate offline after installation. Device system voices used as a fallback may process text under the device provider’s terms, as explained in Section 6.

The following network activity may occur, depending on caretaker choices and on how the build is configured:

• Offline voice models — downloaded from Sherpa-ONNX releases on GitHub (github.com) when you select and download a voice in Settings. Model size varies by language.
• On-device language model files — where the Smart Sentences “Bring Your Own Model” path is available and the caretaker chooses to download a model, the file is fetched over HTTPS from the URL the caretaker provides. The App does not pre-configure any particular model URL and does not embed credentials, account identifiers, or telemetry in this download.
• Custom caretaker-provided voice files — when the caretaker chooses to import a voice model from a folder or download link, the corresponding file is fetched over HTTPS from the URL the caretaker provides.
• Remote lesson catalog and content — the App fetches a lesson manifest list, individual lesson JSON files, and scene images over HTTPS from its configured lessons media host (the default is https://ljmatan.github.io/apps/communicator; builds may override it at compile time with GCM_LESSONS_BASE_URL). This happens as the caretaker or user opens the Learning area. Downloaded lesson content is cached locally for offline replay; lesson progress is stored on the device and is not transmitted back to us.
• Legal documents — opened from the document URLs configured in the App. Where the App is configured to fetch legal documents from a remote URL, those requests are made to the hosting service identified in Section 10.

These requests transfer the data inherent to an HTTPS request, such as your IP address, basic request headers, and the URL path of the resource being fetched. No communication content, custom content, or usage data is included in these requests. Once a resource is downloaded or cached, the associated feature operates locally.

The treatment of HTTPS request metadata under GDPR is addressed in Section 11.

8. Device Permissions and Platform Access

The App requests the following user-facing device permissions:

The App also uses the following platform capabilities, which do not require a user-facing permission prompt on most devices:

The App does not request access to location, contacts, Bluetooth, health data, calendar, SMS, call logs, or any other sensitive permission beyond those listed above.

Platform-level processing outside our control: Independently of the App, your operating system, app store, and any device management software may collect data such as crash reports, diagnostic information, app store usage, advertising identifiers, and device backup contents. Examples include Apple App Store, Google Play Store, iOS/iCloud system services, Android system services, and the device’s text-to-speech engine (used as a fallback — see Section 6). These services are governed by their own privacy policies (see Section 10) and are not under our control.

9. Information We Do Not Collect

Sono does not collect, transmit, or store any of the following on our servers:

• Communication content, custom photos, custom recordings, or symbol history
• Inputs to, or outputs from, the on-device language model (Smart Sentences)
• Usage patterns, session duration, or frequency of use
• Device identifiers, advertising IDs, or fingerprinting data
• Crash reports or diagnostic logs sent to our server (your operating system and app store may collect their own crash and diagnostic data — see Section 8)
• Names, email addresses, or other identifiers through the App itself (information you send us in an enquiry is handled separately as described in Sections 4 and 20)
• Location data of any kind
• Biometric data within the meaning of GDPR Article 9 — the App does not process voice recordings, photographs, or any other data for the purpose of uniquely identifying a person

There are no analytics SDKs, no advertising networks, and no third-party tracking libraries integrated into the app. The on-device language model and on-device speech engines do not telemeter their inputs or outputs.

10. Third-Party Services

Third-party services involved with the App include optional download sources, remote lessons where configured, externally hosted legal documents, and device-level platform services:

The App has no relationship with advertising networks, analytics providers, or data brokers.

11. International Data Transfers

The App itself does not transfer your communication content to our infrastructure. However, when you voluntarily download TTS voice model files, import on-device language model files from a URL, open externally hosted legal documents, or use a build configured with a remote lessons backend, those requests are sent to servers operated by third parties identified in Section 7 and Section 10. Those servers may process the requests in the United States or other countries outside the EEA.

These requests do not contain communication content, custom photos, custom recordings, on-device language model inputs or outputs, lesson progress data, or user preferences. They do contain the standard information included in any HTTPS request — including the caretaker’s IP address, basic request headers, and the URL path being requested.

Treatment under GDPR. IP addresses and similar online identifiers can be personal data. A request to a third-party host may involve processing outside the EEA, but the destination and the legal relationship depend on the service and the App build. We do not assert that every direct request from your device is an international transfer by us under Chapter V GDPR, or that a particular transfer mechanism applies to every recipient.

The services that may receive request metadata are:

Consult the relevant service’s privacy notice for details of its own processing, including locations and any transfer safeguards. If we make a transfer for which we are responsible under GDPR, we must meet the applicable Chapter V requirements. Avoiding an optional download avoids that download request; opening the Learning area in a build with a remote lessons backend may still generate requests. Using a previously installed offline voice avoids a new voice download, while device-level services may process data separately as described in Section 8.

12. Children’s Privacy

Sono is designed to support people of all ages who benefit from picture-symbol communication, including children.

Because the app does not transmit communication content to our servers and stores communication content locally on the device, it presents a reduced privacy risk for users, including children.

EU/EEA — Children’s consent (GDPR Article 8): Article 8 applies when an information society service is offered directly to a child and the processing relies on the child’s consent under Article 6(1)(a). The relevant age varies by member state. This policy does not treat a caretaker’s creation of local custom symbols, labels, photos, or recordings as GDPR consent given to us. Parents and guardians should review how the device and any selected external services handle a child’s information and obtain any permissions required for media involving other people.

If you choose to download a TTS voice model, import a caretaker-selected model file, or use a build configured with a remote lessons backend, those downloads occur over encrypted HTTPS connections. Parents and guardians who wish to prevent internet access by the App can do so by restricting internet access at the device or router level — the App will continue to function using the device’s available speech voices, any previously downloaded offline voices, and any bundled or already-cached lesson content.

Where the remote lessons backend is configured, lesson content (text, images, and audio) is delivered by the operator identified in Section 10, and lesson progress is stored locally on the device. The App does not send the child’s name, communication content, custom photos, custom recordings, or sentence history to that backend.

13. Your Rights Under GDPR

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with equivalent data protection legislation, you may have the following rights where we act as controller and the legal conditions for each right are met. Most App content remains on your device, so the App’s controls are usually the quickest way to view, change, or remove it. You can also contact us about personal data we process, such as information you send in an enquiry.

To exercise rights that cannot be addressed directly within the app, or to raise a concern about our data practices, contact us using the details in Section 20.

14. Rights Under US State Privacy Laws

If you are a resident of a US state with an applicable consumer privacy law, you may have rights regarding personal information that we process. The App does not send your communication content to us, but we may hold information you send in an enquiry. Whether a particular state law applies to us depends on that law’s scope and thresholds.

California (CCPA/CPRA): Where this law applies, California residents may have rights to know, delete, correct, and opt out of certain uses of personal information, subject to the law’s conditions and exceptions. We do not sell or share personal information for cross-context behavioural advertising. Contact us about any information you have sent us.

Other US states: Where an applicable state law gives you a right concerning personal information we hold, contact us using the details in Section 20. Rights and exceptions vary by state.

15. Data Retention and Deletion

Activity history: Recent symbols and message history are retained locally for quick re-use until cleared through app controls, cleared by the consent/storage system where applicable, or removed when the app is uninstalled.

Preference data (display, board, speech, and behaviour settings): Retained on the device until the caretaker changes the setting manually, clears app data, or uninstalls the app.

Custom content and media: Custom symbols, categories, labels, photos, and voice recordings are retained on the device until individually removed in the app, app data is cleared, or the app is uninstalled.

TTS model files: Retained on the device until deleted via Settings, app data is cleared, or the app is uninstalled.

On-device language model files: Retained on the device until deleted via Settings > Smart Sentences, app data is cleared, or the app is uninstalled. No record of inputs supplied to the model, or outputs produced by it, is retained after the suggestion has been displayed.

Lesson cache (when the remote lessons backend is configured): Lesson manifests, lesson JSON, and scene images downloaded for offline replay are retained on the device until cleared through app controls, replaced by an updated version on next fetch, or removed when the App is uninstalled. Lesson progress (which lessons or scenes have been viewed) is retained on the device until cleared or uninstall.

Caretaker backup archives: A backup archive (.sonobkp) is created only on demand at the caretaker’s request and written to a location the caretaker chooses. The App does not retain a copy of the archive. Retention and deletion of the archive are entirely under the caretaker’s control.

To delete all app data: Uninstalling the app from your device removes locally stored files, including preferences, custom symbols, custom labels, custom photos, custom voice recordings, activity history, downloaded voice model files, downloaded on-device language model files, and the local lesson cache. Backup archives written outside the App’s sandbox (for example to the device’s Files app, Photos library, or a cloud sync folder) are not removed by uninstalling the App.

We do not receive or retain the App content described above through ordinary App use. Information you voluntarily send us in an enquiry is processed as described in Section 4.

Enquiries and rights requests: We keep information you send us directly for as long as reasonably needed to answer and handle follow-up, and longer where a legal obligation or claim requires it.

16. Data Security

All data stored by the app resides in the app’s private sandboxed container on your device, which is protected by your operating system’s built-in security mechanisms (file-system encryption, process isolation, app sandboxing). The app does not implement encryption layers beyond what the operating system provides.

The App does not transmit communication content to our infrastructure during ordinary use. This does not rule out a personal data breach involving information we control, such as correspondence sent to us, or a security issue affecting data stored on a user’s device. If a breach of personal data for which we are controller occurs, we will assess it and notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms (GDPR Article 33). We will inform affected individuals when Article 34 requires it.

17. Backup, Export, and Import

The App includes a backup feature that lets the caretaker save and restore the App’s customised data. The feature is initiated only by the caretaker, from Caretaker Settings, and is never triggered automatically.

What the backup contains. A backup archive (.sonobkp — a standard ZIP container) bundles:

• manifest.json — backup format version and the date the archive was created;
• data.json — caretaker-managed JSON entries such as the custom symbols index, custom categories, custom images index, voiceovers index, hidden symbols and categories, quick phrases, intent starters, grid size, display style, board layout, user gender preference, double-tap-to-add setting, kiosk mode setting, primary colour, and the selected TTS voice;
• files/ — every custom media file referenced by those entries, including custom symbol images, custom category images, custom photo files, and custom voice recordings.

It does not contain TTS voice model files, on-device language model files, or any data that did not originate from the caretaker’s own customisation.

Where the backup is stored. The archive is written to a temporary file inside the App’s sandbox and then offered to the caretaker through the platform share or save sheet. Once the caretaker chooses a destination (for example the device’s Files app, Photos library, a cloud sync folder, or another app), the privacy practices of that destination also apply to the copy stored there. The App does not retain a copy of the archive and does not transmit the archive to us.

Import behaviour. When a caretaker imports a .sonobkp archive, the App overwrites the corresponding caretaker-managed entries and replaces the matching custom media files on the device. Other settings (such as on-device language model files and TTS voice models) are not touched.

Caretaker responsibility. Because a backup contains custom photos and voice recordings — which may identify the user or third parties — the caretaker is responsible for:

• Protecting the backup file against unauthorised access (for example by storing it in a protected location);
• Confirming they have the rights or consents needed to export or import any media that identifies another person;
• Deleting backup files that are no longer needed.

The corresponding terms and caretaker obligations are set out in Section 7 of the Terms and Conditions.

18. Caretaker Settings Access

Settings (including the ability to change voice, board settings, custom symbols, custom photos, and custom recordings) are accessible via four taps within two seconds on the settings gear, followed by a simple two-digit addition. This mechanism is intended as a simple barrier to accidental changes, not as a strong access control system. If you require strict access control, we recommend using your device’s guided access or screen time features to restrict in-app navigation.

19. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in the app or in applicable law. When we do, the “Last updated” date at the top of this document will change. Where changes are material, we will notify you through an in-app notice or an app update.

Publishing an updated privacy policy does not itself provide a legal basis for new processing. Where a change requires consent or another notice under applicable law, we will address that requirement before the relevant processing begins.

20. Contact, Data Protection Officer, and Supervisory Authority

Contact for data protection enquiries:

Matan Ljubas 10A Ul. Joze Krstića, Zadar, Zadarska županija 23000, Croatia lj.matan@gmail.com

We aim to acknowledge data protection enquiries within seven (7) calendar days and to substantively respond within one (1) month from receipt of a complete request, in line with Article 12(3) GDPR. Where a request is particularly complex or where we receive a high volume of requests, this period may be extended by up to two further months, in which case we will inform you of the extension and the reasons for it within the initial month.

Caretakers and users who are unable to use email can contact us by post at the address above. If you require an alternative accessible contact channel (for example because of a disability), please indicate the channel you can use and we will do our best to accommodate the request.

Data Protection Officer (DPO): No Data Protection Officer has been appointed for this app at this time.

Right to lodge a complaint. If you believe that the processing of your personal data infringes GDPR or applicable national data protection law, you have the right to lodge a complaint with the supervisory authority in the EU member state of your habitual residence, place of work, or of the alleged infringement.

Because the data controller is established in Croatia, the competent supervisory authority is:

Agencija za zaštitu osobnih podataka (AZOP) — Croatian Personal Data Protection Agency Selska cesta 136, 10000 Zagreb, Croatia Email: azop@azop.hr Web: azop.hr

A list of all EU supervisory authorities, including their contact details, is available at edpb.europa.eu/about-edpb/about-edpb/members_en. You also retain the right to seek a judicial remedy under Article 79 GDPR.

This privacy policy applies to the Sono app. It does not apply to any third-party services linked or referenced herein, which have their own privacy policies and their own data controller responsibilities.