Privacy Policy

1. Information We Collect

When you create an account, we collect your email address, name (optional), and authentication credentials. When you use the platform, we collect exercise attempt data, practice session records, MIDI recordings, and usage analytics (with consent).

Date of birth: We ask for your date of birth during registration to verify you are at least 13 years old (COPPA compliance). This date is checked on your device only and is never transmitted to our servers or stored.

2. How We Use Your Data

We use your data to:

• Provide and improve the practice platform
• Track your learning progress and adapt exercise difficulty
• Process payments for paid subscriptions
• Send essential account notifications

3. Data Retention

• Account data: Retained for the lifetime of your account
• Exercise attempts and progress: Retained for the lifetime of your account
• MIDI recordings: Retained for the lifetime of your account
• Session cookies: Expire when you sign out or after 30 days of inactivity
• Analytics data: Retained for 12 months (if consent given)
• Deleted accounts: Permanently removed 30 days after deletion request

4. Data Storage and Security

Your data is stored securely on encrypted servers. Passwords are hashed using bcrypt. We use HTTPS for all data transmission. Payment processing is handled by Stripe — we never store your credit card details.

5. Third-Party Services

We use the following third-party services:

• Stripe — Payment processing
• Vercel — Hosting and deployment
• PostHog — Product analytics (only with your explicit consent)

6. Cookies

We use essential cookies for authentication and session management. These are required for the platform to function and cannot be disabled.

Analytics cookies (PostHog) are only enabled with your explicit consent via our cookie consent banner. You can change your preference at any time from the Privacy settings.

7. Your Rights (GDPR)

You have the right to:

• Access your personal data — Export your data
• Correct inaccurate data — Edit your profile
• Delete your account and all associated data — Delete your account
• Export your practice data in portable JSON format
• Withdraw consent for analytics cookies at any time

8. Age Restrictions (COPPA)

Double Sharp is not intended for children under 13. We verify age during registration and do not knowingly collect personal information from anyone under 13 years old. If we become aware that we have collected data from a child under 13, we will promptly delete it.

9. Account Deletion

You can request account deletion from your Account settings. When you request deletion:

• Your account is immediately deactivated
• Any active subscription is cancelled
• You have a 30-day grace period to cancel the deletion and reactivate your account
• After 30 days, all your data is permanently and irreversibly removed

10. Contact

For privacy-related inquiries, contact us at privacy@doublesharp.app.