Privacy Policy
Version draft-task-13-provider-consent. Last updated 2026-09-19. This is a draft private-alpha policy and is not legal advice.
Who We Are
Controller: Yogev Sitton. Product: Guitar Practice Helper. Trading name: Guitar Ritual. Privacy contact: privacy@guitarritual.com. Support contact: support@guitarritual.com. Contact address: Contact via email at support@guitarritual.com.
The privacy and support mailboxes above are not functional yet. They will be activated before alpha invites are sent.
Launch Scope
Current launch mode: Private unpaid alpha only. Geographic scope: Worldwide invite-only alpha, pending legal review. Product privacy controls are intended to apply globally by default; jurisdiction-specific notices, complaint routes, representative requirements, and transfer language remain pending human/legal review.
What We Collect And Why
| Category | Examples | Purpose | Draft lawful basis |
|---|---|---|---|
| Account/auth | Email address, auth user id, session state | Passwordless login and workspace access | Contract / legitimate interests |
| Practice workspace | Practice items, queue, sessions, resources, BPM, notes | Provide the practice workspace | Contract |
| Uploads | PDF and Guitar Pro files stored in Supabase Storage | Store private practice materials | Contract |
| Private alpha invites | Allowlisted email, invite type | Control private-alpha access | Legitimate interests / consent depending final flow |
| Feedback | Message, type, current route, optional contact email, optional browser telemetry, optional image attachment you add and confirm (screenshots are sent as-is and cannot be redacted) | Support, bug fixing, product improvement | Legitimate interests / consent for follow-up contact and for any attachment |
| YouTube | Video URLs/IDs and metadata lookups; player load may share IP/device/cookie data with Google/YouTube | Practice resource support | Contract for saved URL; consent or deliberate action for third-party load |
| Deezer | Search query, track metadata, cover image URLs | Song metadata autofill | Consent or deliberate user action |
| Logs | Server/runtime logs from hosting and Supabase | Security, debugging, reliability | Legitimate interests |
Storage And Security
Supabase stores account and workspace data. Workspace access is protected by authentication, row-level security policies, and private storage paths for uploaded files. Hosting/runtime logs may be processed by Vercel and Supabase for security and debugging.
YouTube and Deezer are optional and require separate permission. YouTube title requests send video or playlist identifiers through our server; embedded players connect directly to YouTube/Google. Deezer searches send search text through our server; artwork and previews may connect directly to Deezer. Direct connections may share your IP address, browser/device information, and existing provider cookies. Load Once is limited to the resource or search interaction described at the point of choice. Always Allow applies only to the named provider until withdrawn in Settings. Withdrawal stops future app-initiated loading and does not undo requests already sent or delete data held by the provider.
Third Parties
Current and planned third-party processors/providers include Supabase, Vercel, Resend for sign-in and invitation emails, GitHub for feedback issues, Google/YouTube for optional video metadata/player loading, Deezer for optional catalog search, domain/DNS providers, and Stripe only if payments are added later.
Children
Guitar Ritual is not directed at children. You must be at least 16 years old to use it. We do not knowingly collect personal data from anyone under 16, and we do not verify age.
Your Rights
Depending on where you live, you may have rights to access, correct, export, delete, restrict, object to processing, port data, withdraw consent, or complain to a regulator. Self-service export and account deletion are implemented in the signed-in Settings page, but remain controlled by release flags and require Task 6 review plus a real privacy contact/manual fallback before alpha invites are sent.
Retention
Practice data is retained until workspace reset or account deletion. Uploaded files are retained for the resource/workspace lifetime and purged during account deletion. Feedback issues, and any image you chose to attach to one, are reviewed, deleted, or anonymised within 12 months of the report, or sooner on a verified privacy request; attachments are also purged when you delete your account. Feedback retention, hosted logs, backups, and vendor retention settings require final human review before launch sign-off.
Automated Decisions
The app does not currently make legally significant automated decisions or perform user profiling.
Pending Decisions
- Confirm whether the worldwide invite-only alpha triggers EU/UK representative requirements or other local representative/contact obligations.
- Confirm vendor DPA, transfer, region, and subprocessor details for Supabase, Vercel, GitHub, YouTube/Google, Deezer, domain/DNS, and any email provider.
- Decide whether the UK ICO data protection fee applies.
- Confirm the 16+ minimum-age posture and its Terms/Privacy wording with a human privacy/legal reviewer.
- Replace draft legal version IDs with launch-approved versions and record review evidence.