Privacy Policy

Most of the app works without an account. In guest mode, your practice progress, achievements, curriculum progress, and preferences are stored only in your browser's local storage. We never see this data — it isn't sent to us at all. The pages you open are still counted in the cookieless statistics described in section 4.

Creating an account is optional. If you do, we store:

• Account credentials — your email and password, managed by our authentication provider (Supabase).
• Profile info — username, display name, bio, and your public/private setting.
• Practice data — progress, curriculum completion, spaced-repetition review state, and gamification data (XP, level, achievements), so it can sync across your devices.
• Social activity — follows, activity feed posts, comments, reactions, and challenge records, if you use those features.
• Uploaded files — any MIDI/Guitar Pro files you upload to Play Along.
• Support tickets — the subject, category, and messages of any ticket you open. An AI assistant gives new tickets a first read to sort them, reads new replies while a ticket is open, and may answer routine questions (see Anthropic in section 5).

If you subscribe to the newsletter, we store only your email address. It's used solely to send the newsletter. Clicking the unsubscribe link in any newsletter email deletes your email from our list immediately — there's no separate request needed.

We don't use analytics or advertising cookies, advertising trackers, or scripts that follow you from site to site, and we don't sell or share your data with advertisers. To see which pages get used, we count visits with Vercel Web Analytics, which sets no cookies and stores nothing on your device. Our Android apps show this same website, so the pages you open in them are counted too. For each page view it records the page's address — the page itself and which lesson, song, or view it was opened on, never a sign-in link, a token, or anything else in the address — plus the site you came from, your approximate location (country, region, and city, worked out from the request), and your browser, operating system, and device type. Visits are grouped by a hash of the request that is discarded after 24 hours, not by any identifier, so it cannot recognise you on another day or on another site. We only ever see the totals.

Crash reporting is separate from those statistics: when an error occurs, a diagnostic report is sent so the fault can be fixed. It describes what went wrong, not what you were doing, and it is never used to build a profile of you or shared with anyone else.

Depending on which features are enabled and which you use, a small number of service providers help run the app and process data on our behalf:

• Supabase — hosts our database, authentication, and file storage.
• Resend — delivers newsletter and account emails. Only the recipient email address and the message content are shared with it for that purpose.
• Stripe — processes card payments if you subscribe to a paid plan on the web. Your card details go directly to Stripe; we never see or store them.
• Google Play — processes payment and manages your subscription if you subscribe inside the Android app.
• Google / Firebase — in the Android app, delivers push notifications via a device token, and — if you connect Google Drive — stores the Play Along files you choose to save there.
• Sentry — receives crash and error diagnostics when error reporting is enabled, so we can fix problems.
• Anthropic (Claude) — an AI assistant made by Anthropic reads open support tickets (their subject, category, and messages, including new replies, plus the language you use the app in) to sort and prioritise them and to answer routine questions. A person reviews anything it passes on, and you can ask for a person to answer at any time.
• Vercel — hosts and serves the site and, like any web host, processes the standard request logs (including IP address) needed to deliver it. It also provides the cookieless usage statistics described in section 4.

Public profile info, public activity, and the leaderboard are visible to other users of the app if you set your profile to public — that's a feature you control, not data shared with a third party.

If you connect Google Drive, the app's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Drive access only to save and reopen the Play Along files you choose to store there, we never transfer that data to anyone else, and we never use it for advertising or read it for any other purpose.

Account data is kept for as long as your account exists. Newsletter subscriptions are hard-deleted (not just marked inactive) the moment you unsubscribe.

One thing outlives a deleted account, and we would rather say so plainly. The instruments come with a single five-day free trial per person, and deleting an account would otherwise reset it. So when a trial starts, we keep a one-way fingerprint (a SHA-256 hash) of the account's email address as it is at that moment (a trial started before we did this was given its fingerprint when the change came in), and when an account that started its trial is deleted we also keep the fingerprint of the address it has then, in case it was changed. Before it is hashed, the address is put in one standard form, so that one inbox counts as one person: spaces at either end are removed and capitals become lower-case; for Gmail (gmail.com and googlemail.com, treated as one service) the dots and anything after a "+" are left out; for outlook.com, hotmail.com, live.com, proton.me, protonmail.com, icloud.com and fastmail.com anything after a "+" is left out. Fingerprints made before this used an older form, which kept Gmail's dots, and they are still checked. The fingerprint is all we keep: no address, no name, no account number, and nothing about what you practised. It is kept while your account exists and after it is deleted. It cannot be turned back into your address, it is never used to contact anyone or for any other purpose, and its only effect is that the same address does not get a second free trial. We keep it under our legitimate interest in preventing abuse of the trial.

You can edit or delete most of your own content directly in the app — your profile, your public/private setting, your posts, comments, and uploaded files — and permanently delete your entire account and all of its data from the "Delete account" section of your profile page at any time. For a full data export, or any other GDPR data request, open a support ticket and we'll handle it.

The app isn't directed at children under 13, and we don't knowingly collect data from them.

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

This app is operated by OLTEAN F. I. ALEXANDRU-FLORIN PERSOANĂ FIZICĂ AUTORIZATĂ (OLTEAN F. I. ALEXANDRU-FLORIN PFA), a sole trader (persoană fizică autorizată) registered in Romania, which is the data controller for the purposes of the GDPR; registered office: Strada Maior Gheorghe Șonțu nr. 6, etaj 4, Sector 1, Bucharest, Romania; Trade Register no. F2026045398009; EUID ROONRC.F2026045398009; tax identification code (CUI) 55661530. Questions about this policy or your data? Email social@note-noodle.com or open a support ticket.