Controller: Ing. Marek Hrdina, Ph.D., Hředle 153, 267 51 Hředle, Czech Republic, Business ID (IČO) 29698642. Privacy contact: support@stringpitch.app.
1. Short version
- Live microphone audio is analysed locally on your device; ordinary use does not upload or retain raw recordings.
- Settings and practice data are stored locally and, for signed-in users, selected data may be synchronized to the backend.
- For Premium, Link acts as merchant of record and handles the transaction, tax, receipts and payment support; Donate uses standard Stripe payment processing. StringPitch does not store full card numbers.
- Donation and subscription payments/refunds are kept as separate private ledger entries and shown only as account totals.
- Account, trial and entitlement checks are partly automated, but you may request manual review.
- Protected account forms use Cloudflare Turnstile to reduce automated abuse; Cloudflare processes technical browser, device, network and challenge-interaction signals for that security purpose.
- StringPitch does not sell personal data and does not use advertising or marketing cookies in the current web release.
2. Scope
This Policy covers the public website and browser app at stringpitch.app. Native mobile editions are not currently released.
3. Sources of data
We receive data directly from you when you create an account, change settings, play, purchase, donate or contact support; automatically from your browser or device when the service is used; from enabled identity providers such as Google or Apple; from Cloudflare when Turnstile protects an authentication request; from Stripe in connection with checkout, donations and billing; and from internal calculations such as trial eligibility, discount stage, entitlement status and payment totals.
4. Data we process
| Category | Examples | Purpose | Required? |
|---|---|---|---|
| Microphone signal | Live audio frames, input level, detected pitch, confidence and tuning deviation. | Real-time tuning and pitch exercises. Raw recordings are not retained in ordinary use. | Only for microphone-based functions; alternative button/fretboard input may be available. |
| Local app data | Settings, notation, instruments, custom tunings, valid statistics, up to ten session summaries per mode, Live overall totals, personal MusicXML files and metadata, graph/tuner takes, trial and interface preferences. | Remember configuration and practice state on the device. | Functional storage is required for persistence but can be cleared. |
| Account data | Email, user ID, optional display name, authentication provider and session/security metadata. | Create and protect accounts, sign users in and associate synchronized data and purchases. | Email or provider identity is required for an account; display name is optional. |
| Synchronized practice data | Settings, custom tunings, valid game results and account-linked practice preferences for public scores where cloud sync is enabled. Local MusicXML files and the ten-session history are not included. | Restore data across signed-in sessions and provide operator-only aggregate usage counts. | Required only for requested cloud synchronization. |
| Trial and entitlement | Eligibility, remaining active time, discount stage, plan, contract start, withdrawal deadline, renewal/expiry and provider references. | Apply trial rules, prevent repeated first-time trials, display legal billing actions and unlock paid access. | Required for trial or paid access. |
| Web purchase data | Stripe customer/subscription references, selected plan, price, status, document versions, consent time, cancellation and withdrawal records. | Form and evidence the contract, verify access, stop renewal, process withdrawal/refunds and handle disputes. | Required for a web purchase. |
| Donation and payment-ledger data | Account ID, chosen amount and symbolic level, currency, Stripe checkout/payment/refund references, status, timestamps and gross/refunded/net donation and subscription totals. | Process and confirm the requested contribution, prevent duplicate charging/recording, show account totals, handle refunds, accounting, fraud, chargebacks and disputes. | Required only when a signed-in user chooses to donate or has a recorded payment/refund. |
| Feedback and support | Rating, message, signed-in account email where available, support emails and details voluntarily provided. | Deliver and answer feedback or support requests. | Optional. |
| Authentication anti-abuse data | A short-lived Turnstile challenge token and validation result supplied to Supabase Auth. To produce that result, Cloudflare processes technical browser, device, network and challenge-interaction signals, which can include the IP address and browser characteristics. | Protect sign-up, sign-in, current-password verification and password-recovery requests against automated abuse. | Required when a protected authentication action is requested. |
| Guest usage counters | A random receipt kept only in page memory, the full-app or Online Tools surface, and server receipt time. | When enabled, count signed-out interactions with playable tools, separately from account activity. No persistent visitor ID or fingerprint is created. | Optional deployment feature; no report is sent when Do Not Track or Global Privacy Control is enabled. |
| Technical and security data | Request time, IP/server logs, browser/device information, compatibility headers, errors and a short-lived pseudonymous feedback rate-limit token. | Security, troubleshooting, abuse prevention and reliable operation. | Some processing is necessary to operate the service securely. |
5. Microphone processing
Your browser requests microphone permission. You may refuse or revoke it in browser or operating-system settings. When permitted, StringPitch processes the live signal locally to estimate pitch and tuning deviation. The normal web app does not send raw microphone audio to StringPitch servers. Note-button and fretboard input remain available in Play a Sheet without a microphone. If cloud audio analysis is introduced later, it will not be enabled without an updated notice and any required choice.
6. Local storage, cookies and sessions
The app uses localStorage and IndexedDB for essential and functional data. Authentication may use session tokens or provider storage needed to keep you signed in. Stripe may use its own cookies or identifiers when you open checkout. Details are in the Cookie & Storage Notice.
Personal MusicXML and score preferences
The ordinary local importer reads the MusicXML on your device and stores the file, its title/composer and your local edits in IndexedDB where available. If durable storage cannot be used, the file may remain only in the current tab. The local importer does not upload these files or their editable metadata to StringPitch. Local imports belong to the browser storage context, not to a cloud account, and may remain accessible after sign-out or an account switch on the same browser. Remove them in Library or clear site data before sharing the device.
Public scores are downloaded from the administrator-managed catalogue. Signed-in users' per-score practice preferences, such as key, playable line or clef, may be stored with their account in Supabase; guests' preferences stay local. Selecting Library entries and changing your practice options does not edit the public score. Loading the catalogue or a score creates ordinary network requests to the hosting/storage provider. Opening an external source or license link visits that provider under its own privacy notice.
Recent sessions and public catalogue information
The Statistics menu keeps up to ten session summaries for each training mode in localStorage, separately for a guest and each signed-in account. They contain timestamps, mode, aggregate performance measures and, for a completed sheet exercise, its title and Live/Self-paced type. New sessions displace the oldest beyond ten. Live overall totals are also local; the ten-session limit does not erase the separate Overall aggregate. This history is not synchronized between devices. Reset statistics clears the selected mode's history and overall results; clearing site data removes local records. Signing out alone does not erase them.
Administrators store public score files and source/licensing metadata in the public catalogue. Composer, attribution, source, source/license URLs and review status are public in score details; internal review notes are restricted to administrators. These records are separate from users' private practice history. If source or attribution information identifies a living person, it is used to describe the score, credit its origin and manage rights, not for advertising. Contact the privacy address for correction or other applicable data requests.
7. Accounts and authentication
The account service uses Supabase Auth and may offer email/password, Google or Apple sign-in where enabled. The selected provider supplies identifiers necessary to authenticate you. Passwords and provider tokens are handled by the relevant secure authentication flow; StringPitch application code does not receive a readable password from an OAuth provider.
Protected email-authentication forms load Cloudflare Turnstile from challenges.cloudflare.com. Cloudflare processes technical browser, device, network and challenge-interaction signals to assess automated abuse and issue a short-lived, single-use challenge token. StringPitch sends that token with the requested authentication action to Supabase Auth for server-side validation. StringPitch does not use Turnstile for advertising or analytics. If the challenge cannot be completed or validated, the protected authentication action cannot proceed.
8. Feedback delivery
When you press Submit, the app sends the rating, message and signed-in account email (if available) to the same-origin feedback endpoint. The website emails that content to support. Feedback messages and unresolved feedback operations are not stored in browser local storage. If delivery cannot be confirmed, the form keeps the original text only in the currently open app session while a status-only check resolves whether the server accepted the message; reloading or closing the app discards that in-memory recovery state. A pseudonymous token derived from the request IP address is kept in temporary server storage for no more than approximately two hours to limit spam.
9. Purchases, donations, cancellation and withdrawal
For Premium subscriptions and Lifetime purchases, Link acts as merchant of record. Stripe and Link process checkout, payment methods, billing address, tax location, fraud controls, receipts or invoices, transaction support, cancellation and related transaction records under their own terms and privacy notices. StringPitch receives the identifiers, product/price information and status needed to provision the digital service, reconcile renewals, process supported cancellation or withdrawal actions, handle product support and meet legal record-keeping obligations.
Donate is not a Managed Payments purchase. It uses standard Stripe payment processing for a voluntary contribution to StringPitch. Stripe processes the payment data and StringPitch receives the verified payment/refund references needed for the private ledger and support.
The checkout request records the Terms and Privacy versions, acceptance time and the customer’s request for immediate performance. A withdrawal request records a unique operation identifier, statement version, receipt time, server-confirmed eligibility, resulting entitlement and refund status. Full card numbers are not stored by StringPitch.
A donation order records a random operation identifier, exact integer minor-unit amount, optional symbolic level, account ownership and Stripe references. Successful payment and refund events are appended to a private ledger. The Donate screen receives only aggregated EUR totals. Donation records do not activate Premium, and browser roles cannot read the underlying financial tables.
10. Legal bases
Where the GDPR applies, processing is based on performance of a contract or steps requested before a contract (accounts, synchronization, trial, purchases and paid access), carrying out the donor’s requested payment, legitimate interests (security, duplicate-payment prevention, abuse prevention, support, public catalogue provenance and attribution, service reliability and establishment or defence of claims), legal obligations (consumer, tax, accounting and regulatory records), and consent where it is the appropriate basis. Browser microphone permission controls device access but is not used to justify unrelated processing.
11. Automated checks and manual review
Automated rules may determine trial eligibility, discount stage, entitlement status, billing compatibility, rate limits and whether the backend currently identifies an online withdrawal option. These rules are not used for advertising profiling. If an automated check incorrectly refuses trial access, Premium access, cancellation or another account function, contact support and request manual review. The backend remains authoritative for payment status and statutory eligibility; a client-side indicator does not itself create or remove a legal right.
Cloudflare Turnstile may complete its assessment without user interaction or present an interactive challenge. Supabase Auth rejects the protected request if the resulting token cannot be validated. This assessment is used only to protect authentication workflows; it does not decide trial, billing or Premium entitlement.
12. Recipients and international transfers
Data may be processed by: the production web-hosting and email providers; Supabase for database, authentication and server functions; Cloudflare for Turnstile authentication abuse prevention; Stripe and Link as payment providers and, for Premium, Link as merchant of record for checkout, tax, receipts/invoices, fraud prevention and transaction support; Google or Apple when their sign-in is selected; and professional advisers, auditors, payment-dispute participants or authorities where necessary. Donate uses Stripe as a standard payment processor rather than Link Managed Payments. We do not authorize these providers to use StringPitch account data for StringPitch advertising.
Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, Standard Contractual Clauses or another legally recognized safeguard. Current provider details and available transfer information can be requested from the privacy contact.
13. Retention
- Local app data remains until removed through its relevant control or cleared from browser storage. Session history is additionally limited to ten summaries per mode; Overall is a separate aggregate.
- Personal MusicXML files remain locally until removed from Library or site data. A tab-only import ends when the tab is closed/reloaded. Account sign-out does not clear this browser-owned library.
- Public catalogue files and licensing records are retained while needed to provide and maintain the catalogue or document relevant rights. Archived/unpublished items are not publicly listed; administrators may retain restricted versions and review records for those purposes. Public-score practice preferences are account data and are removed with the account where applicable.
- Active account and synchronized data remains while the account exists and is needed to provide requested functions.
- After deletion of an account without paid history, restricted trial/anti-abuse identifiers and deletion evidence may be retained for up to five years where proportionate.
- Purchase, subscription, donation, consent, cancellation, withdrawal, refund and deleted-account billing history may be retained for up to ten years where needed for accounting, tax, consumer claims, chargebacks, fraud prevention or legal defence.
- Processed billing events may be retained for approximately 180 days and failed/dead-letter billing records for up to one year.
- Feedback and ordinary support correspondence is normally retained for up to 24 months after the request is resolved, unless a longer period is needed for an unresolved contract, security or legal issue.
- Temporary feedback rate-limit data is pruned after approximately two hours. Ordinary security and server logs are retained only for the period configured by the relevant provider and needed for security or troubleshooting.
- StringPitch does not create a separate local profile from Cloudflare’s underlying Turnstile challenge signals. Provider-side processing and retention of those signals are governed by the provider’s applicable service and privacy terms.
- Deleted data may remain temporarily in protected rolling backups until routine rotation. Backup copies are not used for ordinary operations and, if restored for disaster recovery, deletion controls must be reapplied.
Guest-counter receipts are eligible for deletion after 24 hours and are removed by the next successful scheduled maintenance run; daily surface totals remain without identifiers. They are separate from signed-in results and the browser-only ten-session history.
14. Your rights, access and export
Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability, and withdraw consent where processing relies on it. You may also request a machine-readable export of available profile, settings, custom tuning and practice data held by the service. Support cannot retrieve personal MusicXML or session summaries that exist only in your browser. Contact support@stringpitch.app. We may verify identity proportionately before acting.
Account deletion is described on the Data Deletion page. You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz, or another competent supervisory authority.
15. Aggregate administration data
The protected administration shows aggregate account, practice, entitlement and redeem-code counts. Where guest counters are enabled, it also shows signed-out usage of the full application and Online Tools separately. These are best-effort page-session counts, not unique people or proof that a person has no registered account.
After authentication initialization and the first direct interaction with a playable tool, a signed-out page may send a random receipt and one of two surface names to the StringPitch guest-usage endpoint operated through Supabase. The receipt is kept only in page memory and is not written to cookies, localStorage, sessionStorage or IndexedDB. It is not reused after reloading or in another tab. The payload contains no account ID, email, audio, notes, results, page URL, tool name or device fingerprint. Signing in stops new guest reports; development Premium never reports them.
The service deduplicates repeated delivery of the same receipt for up to 24 hours, then removes it through scheduled maintenance. Only daily UTC totals for the two surfaces are retained afterward. Those totals have no account or receipt identifier and are kept as operational history. No visitor list or cross-device identity is created. Normal network infrastructure still receives the IP address and request headers needed to deliver a request; those are not copied into the guest-counter database and remain subject to the technical/security processing and provider arrangements described above.
Do Not Track and Global Privacy Control suppress this reporting. Blocking it does not block a game or tuning function. Closing or reloading a page discards its in-memory receipt; clearing browser storage is not required. Guest counts cannot be reconstructed for use before deployment, and blockers, connection failures, repeat page loads and anti-abuse limits affect the totals.
16. Children and education
StringPitch is useful to musicians of different ages, but purchasing, donating and data-protection capacity varies by country. A person under 18 must not purchase a subscription or lifetime access or make a donation without valid adult authorization. Where a child cannot lawfully create an account or consent to the relevant processing independently, a parent, guardian or authorized school must provide the required authorization and supervision. Do not include unnecessary information about a child in feedback or support messages.
If we learn that a child’s account or purchase was created without required authorization, we may restrict the account while contacting the responsible adult and will delete or retain data according to legal obligations and the child’s interests.
17. Security and incidents
We use HTTPS, secure authentication flows, server-side entitlement verification, input validation, rate limiting, least-privilege access and limited production administration. No system is perfectly secure. Where a personal-data breach creates a legally reportable risk, we will notify the competent authority and affected individuals as required.
The current web release does not send a custom third-party analytics or crash-reporting feed and does not use advertising trackers.
18. Changes and document history
We may update this Policy when the product, providers, laws or data flows change. The effective date and internal version will be updated. Material changes will be communicated through the app or account email where required. A new Policy does not retroactively change the legal basis of processing already completed. The Policy version accepted during account creation or checkout is recorded where needed to identify the applicable notice.