Privacy policy

Who is responsible

[operator name] (“we”) runs SingTuner and is the controller of your personal data. You can reach us at hello@singtuner.com, or by post at [postal address].

Your voice stays on your device

When you practise, the sound from your microphone is analysed in your browser to find the pitch. It is never sent to us, recorded or stored. Only the results of a run (how long each note was in tune) are saved, and only when you are logged in.

What we collect

• Account: your name, email address and password. The password is stored only as a salted hash, so we can’t read it.
• Logins: while you’re logged in, we keep a session record with your IP address and browser type, to keep you logged in and to spot misuse. It ends when you log out, or after 7 days without a visit.
• What you create: exercises, folders, practice results and scores, ratings, and workspace memberships and invitations.
• Uploaded scores: the MusicXML files you import and their file names. A file you upload but don’t import is deleted after 24 hours.
• Payments: if you subscribe, Stripe handles the payment. We receive a customer reference, your plan, its status and its renewal date. We never see your card details.
• Protection against abuse: to limit repeated login, sign-up, password reset and upload attempts, we count attempts per email address, IP address or account. These counters are deleted after about a day.
• Spam protection: the log-in, sign-up and forgot-password forms use Google reCAPTCHA. Google receives your IP address, information about your browser and how you use the check, and tells us only whether it passed.

Why we use it

• To provide the service you signed up for: your account, practice, workspaces and payments (performance of a contract, Article 6(1)(b) GDPR).
• To keep the service secure and prevent abuse: sessions, attempt counters and reCAPTCHA (our legitimate interest, Article 6(1)(f) GDPR).
• To keep accounting records of payments (legal obligation, Article 6(1)(c) GDPR).

We only send emails the service needs, such as the confirmation of your email address, or a password reset link when you ask for one. No newsletters, no marketing.

Who can see what

• Private exercises: only you.
• Workspace content: the members of that workspace. Members see each other’s names; only workspace admins see email addresses.
• Public exercises: anyone, including people without an account. They show the title, description, notes and your name as the author. Ratings count toward the average shown; nobody sees who gave which rating.
• Invitations: when you invite someone, we store their email address so the invitation appears when they log in.

Services we use

A few providers help us run SingTuner. They process data only on our instructions:

• Hosting and database: [hosting provider].
• Email delivery: [email provider].
• Payments: Stripe. Stripe also processes some data as an independent controller, for example to prevent fraud; see Stripe’s privacy policy.
• Spam protection: Google reCAPTCHA, on the log-in, sign-up and forgot-password forms only. Google also processes this data under its own terms; see Google’s privacy policy and terms.

Some of these providers may process data outside the European Economic Area. When they do, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses.

We don’t sell personal data, and we use no advertising or analytics trackers.

Cookies

SingTuner uses two cookies, and no tracking cookies:

• Session cookie: keeps you logged in. It is removed when you log out or the session expires.
• “lang”: remembers the language you chose on the home page, for one year.

On the log-in, sign-up and forgot-password forms, Google reCAPTCHA may also set a cookie (“_GRECAPTCHA”) to tell people from bots. It is used only for that security check.

All of these are needed for features you ask for or to keep the service secure, so there is no cookie banner.

How long we keep data

• Your account and what you created: until you delete your account.
• Sessions: until you log out, or 7 days without a visit.
• Attempt counters: about a day. Uploaded files you didn’t import: 24 hours.
• Payment records: as long as tax and accounting law requires. Stripe keeps its own records.

When you delete your account on the Account page, we immediately delete your profile, personal exercises, uploaded scores, practice history, ratings and sessions, and cancel any subscription. Exercises and scores you added to a workspace stay there for its other members, shown as written by “Former member”.

Your rights

Under the GDPR you can see the personal data we hold about you, correct it, have it deleted, receive it in a portable format, and object to or restrict its use. You can change your name and password and delete your account yourself on the Account page. For anything else, write to hello@singtuner.com; we reply within one month.

You can also complain to a data protection authority: the one where you live, or the CNPD (Comissão Nacional de Proteção de Dados).

Children

You must be at least 13 to create an account. Younger singers can use Quick Practice, which needs no account and saves no results.

Changes to this policy

If we change this policy, we update the date at the top. Before important changes apply, we tell account holders by email or in the app.