Our commitment to your privacy

Data non sharing / LLM training policy

We never share your data. We never train LLMs on your data. We take this commitment seriously.

Any changes in the future will be announced. All old data will be grandfathered as exempt to sharing and AI use: whatever policy was in place on the day a thing was collected is the policy that governs it, for as long as we hold it.

Data collection

Everything we store, and nothing else:

• A random visitor id. Minted the first time you arrive and kept in a first-party cookie. It is a random string and nothing else; it is not derived from you, your address or your browser.
• Page views. Which page, when, and where you arrived from: the referring site’s host name, or one of our own paths, or nothing at all. Never the full referring URL.
• A campaign name, when you followed a link we tagged with one, so we can tell which of them worked.
• Mobile or desktop, worked out from the browser’s user agent. We do not store the user agent itself.
• What happened on the page: a lesson opened, a project created or opened, an account made or signed in to, how long a page was open and how far you scrolled down it, which example the front page showed you, and whether you played it and for how many seconds. Names and counts, never the contents.
• Roughly where the pointer went on the front page. Your browser divides that one page into a coarse grid — twelve columns by forty rows — counts how many moments the pointer spent in each cell and how many clicks landed there, and sends the totals once, when you leave. What reaches us is “this part of the page was busy”, never a trail: no coordinates, no times against them, and nothing that says what you moved towards or in what order. It tells us whether the thing below the fold is ever seen. No other page is measured this way.
• If you make an account: your email address, a hash of your password (never the password), and your lesson progress.
• If you save a project to the cloud: the document you saved, because that is what saving is. Projects saved in your browser instead never reach us at all.
• If you write to us or send feedback: your message, the address you gave, and for a rendering report the picture of the score you were looking at.
• Server logs: the request, the response, and how long it took.

What we never collect: your music, unless you explicitly save it to the cloud. Never a file you import. Never your IP address, stored against you. There is no third-party analytics, no advertising network and no fingerprinting.

Data retention

• Page views and events: kept for 24 months, then deleted.
• Visitor ids: kept as long as the events that reference them.
• Accounts, projects and progress: kept until you delete them or ask us to. Deleting an account deletes its projects and its progress with it.
• Sessions: 30 days, and removed the moment you sign out.
• Messages and feedback: kept for 24 months so we can answer you and act on it.
• Server logs: 30 days.

These periods are subject to change. Whatever they become, we will always honour the data non sharing and LLM training policy that was in place at the time of collection, for the lifetime of that data.

Asking us

Ask for a copy of what we hold about you, or ask us to delete it, using the contact form at the foot of this page. We will need the email address on the account.