Privacy Policy - Tinh Tú

Operated by Soundica. Effective 2026-09-09. Version 1.3.

This policy explains what information the Tinh Tú application (the "App") processes, why, and your rights under applicable laws including Vietnam's Decree 13/2023/ND-CP on Personal Data Protection, the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Singapore PDPA, Brazil's Lei Geral de Proteção de Dados (LGPD), India's Digital Personal Data Protection Act, 2023 (DPDP Act), and the Australian Privacy Act.

1. Data we collect

The App is designed to work without a user account and without tracking identifiers. Specifically:

• No account, no login, no email. We do not require you to sign up.
• No advertising identifiers. We do not read the Android Advertising ID.
• No analytics SDKs, no crash-reporting SDKs by default. If a future version adds optional analytics, you will be asked for consent first.
• No contacts, no location, no microphone, no camera, no SMS, no call logs. The App does not request these permissions.

2. Data processed when you use the App

• News feed requests. When the App refreshes the feed it sends requests directly to Vietnamese publisher RSS feeds (VnExpress, Thanh Niên, Tuổi Trẻ, Dân Trí, Kenh14, and similar). Those requests contain only a generic app User-Agent and (inevitably at the transport layer) your device's public IP address, which the publishers may log under their own privacy policies.
• Discovery via Google News. The App may also discover headlines through Google News topic and region queries (public RSS). The same transport-level note applies: the request carries a generic app User-Agent and your device's public IP address. Google's own privacy practices apply to their servers. Social-media and user-generated-content sources are blocked.
• Publisher logos. Most publisher logos are bundled inside the App. Where a logo is not bundled, the App may request it from a Soundica logo service (img.soundica.app), which fetches the publisher's publicly available site icon, caches it on Soundica's edge network for up to 30 days, and serves it to the App. The request contains only the publisher's website address, never your identity, location, or reading history. Logos are shown unmodified and solely to identify the source of a headline.
• Images. When you view a story thumbnail, your device fetches the image from the publisher's CDN. The App does not embed or open the publisher's website: articles are presented as a headline plus a short attributed snippet only.
• Article image lookup (phone version). Many publisher feeds do not include a picture. To find one, the phone version of the App sends the web addresses of the articles currently on screen to a Soundica image-lookup service (a Cloudflare Worker at img.soundica.app). The service fetches the article's public page, reads its standard preview-image tag, and returns the picture's address; where a headline was discovered through Google News, the service first resolves the Google News link to the publisher's own address. The request contains only the article addresses, a generic app User-Agent, and your device's public IP address at the transport layer. No account, device identifier, or reading history is attached, and nothing ties a request to you. Resolved picture addresses are cached on the service for up to 30 days, keyed by the article address only; tracking parameters (utm, fbclid, gclid and similar) are stripped before caching. The image itself is still downloaded by your device directly from the publisher's CDN; Soundica does not relay or store the picture. The Android Automotive and FORVIA head-unit versions do not use this service.
• Text-to-Speech. Text is synthesized in Vietnamese (vi-VN) by the TextToSpeech engine installed on your device (typically Google Speech Services). We never receive or store the text or audio. Depending on your device's TTS settings, the engine vendor may process text on its own servers to provide higher-quality voices; that processing is governed by the engine vendor's privacy policy, not ours.
• Narration on FORVIA head units. The Appning by FORVIA head-unit version has no on-device speech engine. For that version only, Soundica pre-generates spoken audio of the public headlines and summaries on its servers and stores the audio files on Cloudflare R2 object storage; the App streams them like any other media file. This audio is generated from publisher content, not from anything you say or type, and the request carries only the file name, a generic app User-Agent, and your device's public IP address at the transport layer.
• Settings. Your in-app preferences (reading speed, autoplay and read-aloud toggles, selected category or language, one-time hint flags, appearance mode, and, on head units, the selected country or market) are stored locally in app-private storage and never leave your device.

3. Legal basis (EU/UK GDPR; Vietnam PDPD)

Under GDPR Art. 6(1)(b) and Vietnam Decree 13/2023 Art. 17, the limited processing described above is necessary to deliver the service you have asked for (showing entertainment news, reading it aloud). No consent banner is required because we do not set tracking cookies, we do not use the data for profiling, and we do not share it with advertising partners.

4. Data retention

Because the App stores nothing about you on our servers, we have nothing to retain. Local settings stay on your device until you uninstall the App.

5. International transfers

Publisher RSS endpoints are hosted on the publishers' own infrastructure inside Vietnam. The App itself does not operate a backend that holds personal data.

6. Your rights

Depending on your jurisdiction, you have the right to access, correct, erase, restrict, object to processing, and request portability of your personal data. Since we do not hold any personal data about you in the first place, requests to access or delete will usually be answered with "we have no data linked to you." You always have the unconditional right to delete the App from your device, which removes all locally-stored settings.

You may contact Soundica at admin@soundica.app to exercise these rights.

7. Children

The App is not directed to children under 13 (under 16 in some EU member states). We do not knowingly collect information from children.

8. Third-party content

News headlines, thumbnails and summaries displayed in the App are retrieved from publicly available RSS feeds published by independent Vietnamese outlets (VnExpress Giải trí, Thanh Niên Giải trí, Tuổi Trẻ Giải trí, Dân Trí Giải trí, Kenh14 Star, Kenh14 Musik, Ngôi Sao). Only the headline and a short attributed snippet are shown inside the App; tapping an article opens the publisher's own website in your device's browser, at which point that publisher's own privacy policy applies.

9. Security

All network traffic is encrypted with TLS (HTTPS). Clear-text traffic is blocked at the OS level via an Android Network Security Configuration. The App requests only the minimum permissions needed (Internet access, foreground-service playback, optional notifications).

10. Changes

If this policy changes materially, we will update the "Effective" date and, where required by law, prompt you in-app.

11. Contact

Soundica: admin@soundica.app