Privacy Policy
Version draft-task-4-placeholder. Last updated 2026-07-09. This is a draft private-alpha policy and is not legal advice.
Who We Are
Controller: [Controller legal name pending]. Product: Guitar Practice Helper. Trading name: [Trading name pending]. Privacy contact: [Privacy mailbox pending]. Support contact: [Support mailbox pending]. Contact address: [Contact address or contact-address wording pending].
The privacy/support mailbox placeholders above are not functional inboxes yet. A real mailbox must be configured before alpha invites are sent.
Launch Scope
Current launch mode: Private unpaid alpha only. Geographic scope: Worldwide invite-only alpha, pending legal review. Product privacy controls are intended to apply globally by default; jurisdiction-specific notices, complaint routes, representative requirements, and transfer language remain pending human/legal review.
What We Collect And Why
| Category | Examples | Purpose | Draft lawful basis |
|---|---|---|---|
| Account/auth | Email address, auth user id, session state | Passwordless login and workspace access | Contract / legitimate interests |
| Practice workspace | Practice items, queue, sessions, resources, BPM, notes | Provide the practice workspace | Contract |
| Uploads | PDF and Guitar Pro files stored in Supabase Storage | Store private practice materials | Contract |
| Private alpha invites | Allowlisted email, invite type, responsible adult contact evidence if child tester | Control private-alpha access and child privacy defaults | Legitimate interests / consent depending final flow |
| Feedback | Message, type, severity, current route, optional contact email, optional browser telemetry | Support, bug fixing, product improvement | Legitimate interests / consent for follow-up contact |
| YouTube | Video URLs/IDs and metadata lookups; player load may share IP/device/cookie data with Google/YouTube | Practice resource support | Contract for saved URL; consent or deliberate action for third-party load |
| Deezer | Search query, track metadata, cover image URLs | Song metadata autofill | Consent or deliberate user action |
| Logs | Server/runtime logs from hosting and Supabase | Security, debugging, reliability | Legitimate interests |
Storage And Security
Supabase stores account and workspace data. Workspace access is protected by authentication, row-level security policies, and private storage paths for uploaded files. Hosting/runtime logs may be processed by Vercel and Supabase for security and debugging.
Third Parties
Current and planned third-party processors/providers include Supabase, Vercel, GitHub for feedback issues, Google/YouTube for optional video metadata/player loading, Deezer for optional catalog search, domain/DNS providers, and Stripe only if payments are added later.
Children
Child testers may participate only through a responsible-adult invite and with adult permission/supervision. The app does not currently verify age or guardian status.
Your Rights
Depending on where you live, you may have rights to access, correct, export, delete, restrict, object to processing, port data, withdraw consent, or complain to a regulator. Self-service export and account deletion are implemented in the signed-in Settings page, but remain controlled by release flags and require Task 6 review plus a real privacy contact/manual fallback before alpha invites are sent.
Retention
Practice data is retained until workspace reset or account deletion. Uploaded files are retained for the resource/workspace lifetime and purged during account deletion. Feedback retention, hosted logs, backups, and vendor retention settings require final human review before launch sign-off.
Automated Decisions
The app does not currently make legally significant automated decisions or perform user profiling.
Pending Decisions
- Replace placeholder controller legal name, trading name, contact address, and privacy/support mailbox.
- Confirm whether the worldwide invite-only alpha triggers EU/UK representative requirements or other local representative/contact obligations.
- Confirm vendor DPA, transfer, region, and subprocessor details for Supabase, Vercel, GitHub, YouTube/Google, Deezer, domain/DNS, and any email provider.
- Decide whether the UK ICO data protection fee applies.
- Review child-tester wording with a human privacy/legal reviewer before inviting child testers.
- Replace draft legal version IDs with launch-approved versions and record review evidence.