Privacy Policy

Controller

The controller responsible for data processing on playclef.com and in the Clef app is:

The principles

• This website sets no cookies and loads no third-party trackers. It is a static site.
• The Clef app uses exactly one cookie — a first-party session cookie that keeps you logged in. Nothing else.
• Analytics run only if you opt in, via a switch in the app's settings. It is off by default.
• Your data lives in Germany. The app and its database are hosted on servers in Germany.

Visiting this website

playclef.com is served by Cloudflare, Inc. (Cloudflare Pages, USA; engaged via Cloudflare Germany GmbH / Cloudflare's EU establishment). When you load a page, Cloudflare technically processes your IP address and request metadata (browser, time, requested URL) to deliver the site and defend it against attacks.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in delivering the site securely and quickly. Transfers to the USA are safeguarded by Cloudflare's certification under the EU–US Data Privacy Framework and by standard contractual clauses. We do not receive or store these access logs ourselves.

Your Clef account and practice data

The Clef app and its database are hosted by Hetzner Online GmbH, Gunzenhausen, Germany, on servers in Germany, under a data processing agreement per Art. 28 GDPR. When you use Clef, we process:

• Account data — your email address and a hashed password (argon2; we never store the password itself).
• Practice data — which pieces and bars you practiced, the correctness of what you played as derived from your MIDI input, your review schedule, streaks, and session history. This is the product: it's how Clef knows what to test you on and when.
• Settings — language, MIDI device preference, and similar.

Legal basis: Art. 6(1)(b) GDPR — performance of the contract with you. Providing account data is required to use Clef; without it, an account cannot exist.

The session cookie

Logging in sets a single first-party cookie holding your session identifier. It is strictly necessary for the service you request (staying logged in), so it requires no consent (§25 Abs. 2 Nr. 2 TDDDG) — which is why Clef has no cookie banner. It is deleted when the session ends or expires.

Sign in with Google (optional)

If you choose "Continue with Google," Google confirms your identity to us and we receive your Google account's email address and basic profile name. We store the email as your account email — nothing more. Google Ireland Ltd. is an independent controller for its own processing during sign-in; see Google's privacy policy. Legal basis: Art. 6(1)(b) GDPR. Using Google sign-in is optional; email and password work without it.

Payments — Stripe

Subscriptions, the free trial, and refunds are processed by Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA). Stripe collects your payment details directly — your card number never reaches our servers. We receive and store your subscription status and billing history (amounts, dates, invoice records).

Legal bases: Art. 6(1)(b) GDPR (billing the contract) and Art. 6(1)(c) GDPR (statutory tax and commercial record-keeping, §147 AO). Transfers to the USA are safeguarded by Stripe's certification under the EU–US Data Privacy Framework and by standard contractual clauses. See Stripe's privacy policy.

Transactional email — Resend

Account and billing emails (such as email verification, the reminder before your trial converts, and receipts) are sent through Resend, Inc. (USA), which processes your email address and the message content for delivery. We send no marketing email without your separate, explicit consent. Legal basis: Art. 6(1)(b) GDPR; transfers are safeguarded by standard contractual clauses.

Analytics — PostHog, only with your consent

Clef can collect basic product diagnostics (which features are used, whether setup succeeded, error reports) through PostHog, hosted on PostHog's EU cloud in Frankfurt, Germany. This is strictly opt-in:

• It is off by default. Nothing is sent unless you enable "Share diagnostics" in the app's settings.
• You can withdraw consent at any time with the same switch (Art. 7(3) GDPR), and collection stops immediately.
• Events are limited to an explicit allowlist of properties. Page URLs, referrers, and session identifiers are deliberately excluded from what is sent.

Legal bases: Art. 6(1)(a) GDPR and §25 Abs. 1 TDDDG — your consent.

How long we keep data

• Account and practice data — for the life of your account; deleted when you delete your account or ask us to (email hello@playclef.com).
• Billing records — 10 years, as required by German tax law (§147 AO).
• Technical logs — short-lived and automatically rotated.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• withdraw any consent at any time, with effect for the future (Art. 7(3)).

You also have the right to object (Art. 21 GDPR): where we process your data based on legitimate interests, you may object at any time on grounds relating to your particular situation, and we will stop unless compelling legitimate grounds prevail.

To exercise any of these rights, email hello@playclef.com.

Right to complain

You may lodge a complaint with a supervisory authority (Art. 77 GDPR) — either the authority responsible for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, or the authority of your habitual residence.

No automated decision-making

We make no automated decisions with legal or similarly significant effects (Art. 22 GDPR). Clef's review scheduling — deciding when a bar comes back for practice — is a product feature that adapts to your playing, not a decision about you as a person.

Changes to this policy

We will update this policy when the product or its processors change, and the date at the top always reflects the current version. Material changes will be announced in the app.