Privacy policy

Draft wording: requires attorney review before release. Items in [brackets] must be completed.

Who we are

PlayAlong Lab ("the app") is made by Kingsley Nwachukwu, 2525 Elm Street, Dallas, TX 75226. Questions: kvngzz10n@gmail.com.

Your music stays on your phone

Songs you import (MIDI, MusicXML, audio and video files), notes you create or correct, the fingering and practice data the app generates from them, your practice settings, and practice videos you record are stored only on your device. They are not uploaded to our servers or to anyone else, not synced, not linked to your account, not added to any catalog, and cannot be shared or published through the app.

The app uses no analytics or crash-reporting services and never deliberately sends song titles, file names or file contents to us or our providers. The only error information that leaves your device is the startup error report described under App updates; in rare cases an error message can include text the app was handling when it failed.

Signing out or deleting your account does not upload or delete the music on your phone. Temporary copies made while importing or processing a file are deleted when they are no longer needed.

Melody detection, Listen Mode pitch checking and the recording sound check run entirely on your device. Listen Mode analyses the microphone live and does not record or store audio.

Practice videos are kept in the app until you retake, discard or save them. "Save to Photos" copies a video into your Photos library, with "add only" access. Videos in Photos are managed in the Photos app.

Camera, microphone and Photos

Camera: to record practice videos. Microphone: for Listen Mode and the sound of practice videos. Photos: to choose videos whose sound you want to use, and to save practice videos you choose to keep. Each is asked for only when you use that feature, and can be turned off in Settings.

Your account (Supabase)

You need an account to use the app. Accounts are provided by Supabase (Supabase, Inc.), which stores your email address, a secure hash of your password (never the password itself), when the account was created and last signed in, and sign-in session data. Supabase may also log technical data such as IP address and request times for security. On our current Supabase plan, these logs are kept for 1 day.

Supabase project region: United States (US East, North Virginia). Supabase privacy policy: https://supabase.com/privacy

Emails we send: account confirmation and password-reset codes, sent through Supabase's built-in email service.

Subscriptions (Apple and RevenueCat)

Subscriptions are sold and billed by Apple through the App Store. We never see or store your payment card details.

We use RevenueCat (RevenueCat, Inc.) to check your subscription. The app identifies you to RevenueCat only by your account ID, a random identifier created by Supabase. RevenueCat does not receive your email address from the app; however, we can match this account ID to your account, including your email address, through our Supabase records, so your subscription information is linked to your account. RevenueCat also receives your App Store purchase and subscription history for this app and your device's locale and currency code. RevenueCat's iOS software automatically records whether app tracking is allowed on your device (Apple's tracking permission setting); the app never asks for that permission and does not use your advertising identifier. As with any internet connection, RevenueCat's servers also receive your device's IP address. The app does not send RevenueCat your name, email address or phone number, and does not connect RevenueCat to any analytics or advertising service. RevenueCat privacy policy: https://www.revenuecat.com/privacy

App updates (Expo)

The app checks Expo's update service (u.expo.dev, operated by 650 Industries, Inc., "Expo") for app fixes when it starts, and downloads any fix it finds. These requests send the platform (iOS), the app's runtime version (which identifies the app version an update must work with), the update channel the app was built for, the IDs of the update currently running and the update built into the app, the IDs of any recent updates that failed to start, technical values that Expo's service asks the app to send back, and a random installation ID generated by the app. The installation ID is not a hardware or advertising identifier and is not linked to your account. Expo uses these details to deliver the right update and to count how many installations download each update.

If the app failed to start after an update, the next check also sends a short error report: the time of the failure and the error's name, description and reason, which can include part of the app's internal program trace, limited to 1,024 characters. It is used to detect and withdraw faulty updates. Error messages describe what went wrong in the app's code; in rare cases they can include text the app was handling when it failed. As with any internet connection, Expo's servers also receive your device's IP address. Expo handles this data on our behalf as a data processor. Expo privacy policy: https://expo.dev/privacy

What we do not do

No advertising, no analytics or tracking SDKs, no separate crash-reporting service (only the startup error report described under App updates), no selling or sharing of personal data, and no tracking across other companies' apps or websites.

Sheet-music pages

Importing sheet-music pages (PDF or photo) is not available in this version, and pages are never uploaded. If page import or automatic recognition is ever offered, it will be optional, explained here first, and only used when you choose it.

Keeping and deleting your data

Delete your account any time in the app: Account › Delete account. This permanently deletes your Supabase account (email, password hash and sign-in data). Your subscription record at RevenueCat is kept under a random account ID, not your email, and is not deleted automatically; to have it removed, contact us at kvngzz10n@gmail.com. Apple keeps its own records of App Store purchases under Apple's policies.

Deleting your account does not cancel an Apple subscription. Cancel it in Settings › your name › Subscriptions.

Supabase keeps request logs for 1 day on our current plan, and our plan does not include Supabase's automatic database backups, so a deleted account is not kept in a Supabase backup. RevenueCat processes your subscription record as our service provider, under its published privacy policy and Data Processing Addendum. It keeps the record under its own retention policy and deletes it when we ask, within a reasonable time and subject to its standard backup and archival practices.

Music and recordings on your phone are removed by deleting them in the app, or by deleting the app.

Children

You must be at least 13 years old to create an account, and children under 13 may not use PlayAlong Lab. We do not knowingly collect personal information from children under 13. If we learn that an account belongs to a child under 13, we will delete it. If you believe a child under 13 has created an account, contact us at kvngzz10n@gmail.com and we will delete it.

Your rights

You can ask for a copy of your account data, or for it to be corrected or deleted, at kvngzz10n@gmail.com.

Depending on where you live, you may also have the right to receive your data in a portable format, to object to or restrict certain uses of it, and to withdraw any consent you have given. We will respond to requests as required by the law that applies to you, for example within one month under the GDPR and UK GDPR, and we may need to confirm your identity first.

If you are in the European Economic Area or the United Kingdom: we use your account data because it is needed to provide the app you signed up for (performance of a contract) and, for security logs and app update checks, for our legitimate interest in keeping the app secure and working. Our providers Supabase, RevenueCat and Expo process data in the United States. Supabase and RevenueCat do so under the European Commission's Standard Contractual Clauses and the UK addendum to them, and Expo states that it complies with the EU-U.S. Data Privacy Framework. You also have the right to complain to your local data protection authority.

If you are in the United States: we do not sell or share your personal information, or use it for targeted advertising, as those terms are defined under California and other US state privacy laws.

Changes

We will update this policy when the app's data handling changes, and show the date of the latest version here. [EFFECTIVE DATE]