Privacy Policy

Controller

The controller responsible for data processing on playclef.com and in the Clef app is:

The principles

• The public website is separate from the app. It is served by Cloudflare Pages and does not create Clef accounts, practice records, or app telemetry identities. Its cookieless audience measurement cannot be joined to an app account.
• The Clef app uses exactly one cookie — a first-party session cookie that keeps you logged in. Nothing else.
• Product diagnostics are on by default for new hosted beta accounts so we can understand whether setup, practice, memorization, billing, and errors are working. You can turn them off at any time in Settings → Privacy.
• Pre-account app measurement is separate and cookieless. When the hosted app confirms that no account is signed in, it counts one app open without browser storage, a person profile, or a link to any account created later.
• We keep analytics narrow. Diagnostics use a pseudonymous Clef id, not your email address. We do not use session recordings, heatmaps, ad tracking, or PostHog person profiles.
• Anonymous reliability reports are separate. When Clef replaces an internal failure with a generic error screen or failed operation, it sends a closed error class without account or practice data. These reports remain on when product diagnostics are off.

Visiting this website

playclef.com is served by Cloudflare, Inc. (Cloudflare Pages, USA; engaged via Cloudflare Germany GmbH / Cloudflare's EU establishment). When you load a page, Cloudflare technically processes your IP address and request metadata (browser, time, requested URL) to deliver the site and defend it against attacks. Cloudflare may also provide aggregate, cookie-free page analytics and bot/security checks for the public site. Clef's separate website analytics are described below; they do not use the app's product-telemetry identity or consent setting.

When you follow one of our short links from a social profile (playclef.com/ig, playclef.com/tt), our server counts that visit as a single anonymous event in PostHog (EU hosting) before redirecting you to the homepage. This uses no cookie and stores nothing on your device; the event contains only the link followed, your browser type, and a country code — never your IP address or any identifier that could recognize you across visits.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in delivering the site securely and quickly, and in measuring, in aggregate, how our social profiles are found. Transfers to the USA are safeguarded by Cloudflare's certification under the EU–US Data Privacy Framework and by standard contractual clauses. We do not receive or store these access logs ourselves.

Cookieless website analytics — PostHog

The public website uses PostHog Cloud EU, hosted in Frankfurt, Germany, to measure page visits, clicks on signup links and the App Store and Google Play badges, and which landing-page FAQ answers visitors open. FAQ measurement records when the section is reached and the first opening of each question per page load, using a fixed question identifier and its position. Page events include the visited URL and any UTM campaign tags, the referring site, standard browser/device context, and an approximate country code derived by Cloudflare. PostHog is not used here for advertising or to create person profiles.

This measurement uses PostHog's cookieless server-hash mode. It sets no cookies and writes nothing to local storage or session storage. PostHog derives a privacy-preserving visitor hash on its server from the IP address, browser user-agent, hostname, and a salt that changes daily; the IP address is not retained as an event property. PostHog location enrichment is disabled; Cloudflare supplies only the country code, without city, postal code, or coordinates. The changing salt means Clef cannot recognize the same visitor across different days. We do not use session recording or heatmaps on the website.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding, in aggregate, which public pages bring people to the Clef store listings, balanced by no device storage, no person profile, no cross-day tracking, and no advertising use. You may object by emailing us.

Opening the Clef app before signing in

When the hosted Clef app confirms that no account is signed in, it sends exactly onecookieless pre-account open to PostHog Cloud EU. This lets us measure, in aggregate, how often people reach the app before creating or entering an account. It is separate from both public-website analytics and account product diagnostics.

• The event contains only whether Clef is running in a browser or companion app, whether Web MIDI is available, the production-or-development environment, the app's host name, and coarse browser, operating-system, version, and device-class fields.
• It stores no URLs, paths, referrers, campaign tags, session ids, screen dimensions, raw user-agent strings, account details, practice data, or MIDI notes. Person profiles and location enrichment are disabled.
• It sets no cookie and writes nothing to local storage or session storage. PostHog's cookieless mode derives a privacy-preserving daily hash on its server from request metadata; the IP address and raw user-agent string are not retained as event properties, and the changing salt prevents cross-day recognition.
• Clef never identifies, aliases, or merges this event with an account. A later signup can be compared only as part of aggregate totals, not as the same person.

This measurement is not controlled by Settings → Privacy because it runs only before an account is authenticated and has no account identity. Legal basis where GDPR applies: Art. 6(1)(f) GDPR — our legitimate interest in understanding, in aggregate, whether people can reach the hosted app, balanced by one event, no device storage, daily-changing identity, no account linkage, and no advertising use. You may object by emailing us.

Your Clef account and practice data

The hosted Clef app and its database run on a Hetzner Online GmbH VPS in Ashburn, Virginia, United States, under a data processing agreement. That agreement permits processing in third countries only with the guarantees of Art. 44 ff. GDPR — in particular EU standard contractual clauses — and lists Hetzner's approved US subprocessors (Hetzner US LLC and its colocation providers). Clef is operated from Germany, but hosted beta app data is not stored on a German server. When you use Clef, we process:

• Account data — your email address and a hashed password (argon2; we never store the password itself).
• Signup source — at account creation, Clef records which tagged link or referring site brought you (UTM parameters or referring site hostname), plus the Clef page or app entry where signup began, and stores it with your account. When product diagnostics are active, Clef also sends PostHog a narrower signup-source record: token-shaped UTM source, medium, campaign, and content values, the referring hostname, and token-shaped Clef entry surface and placement. Search-term values and full referrer URLs are never sent to PostHog.
• Apple Ads install source is recorded only by the iPhone and iPad app. The app asks Apple's AdServices framework on your device whether an Apple Ads campaign in the App Store led to the install. This uses no advertising identifier (IDFA) and needs no tracking prompt. Apple answers with the Apple Ads organization, campaign, ad group, keyword, and ad ids, whether you tapped or saw the ad and when, the conversion type (such as download or redownload), the App Store placement, and a country or region. Apple's answer contains no name, email address, Apple Account, or device identifier. The app keeps the answer on your device, together with when it first asked Apple and when Apple answered. It sends them to Clef once, after you are signed in to the app. An install that never signs in sends nothing to Clef. Clef stores one record with your account and deletes it with your account. When product diagnostics are active, Clef also sends PostHog the ids, whether the ad was tapped or seen, the conversion type, and the placement. The dates and the country or region are never sent to PostHog. We use this only to learn which campaigns bring learners who keep practicing and subscribe. It never decides prices, credits, or access, and Clef sends nothing back to Apple. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing which ad campaigns bring learners, balanced by ids that name an ad rather than a person, one record per account, and no sharing with Apple or any ad network. You may object by emailing us.
• Practice data — which pieces and bars you practiced, the correctness of what you played as derived from your MIDI input, your review schedule, streaks, and session history. This is the product: it's how Clef knows what to test you on and when.
• Imported scores — score files you choose to import, the versions Clef converts them into, and what Clef reads from them (such as title, composer, key, and length). They are stored with your account and visible only to you. Conversion runs on the same server in an isolated process with no network access. If you ask for a reviewed version, only the title and composer go to our team as a piece request.
• Settings — language, MIDI device preference, and similar.

Legal basis: Art. 6(1)(b) GDPR — performance of the contract with you. Providing account data is required to use Clef; without it, an account cannot exist. The Apple Ads install source has its own legal basis, stated with it above.

Children

Clef is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, email hello@playclef.com and we will delete the account and its data. In the EEA, users under 16 need a parent or guardian to agree to the terms on their behalf.

The session cookie

Logging in sets a single first-party cookie holding your session identifier. It is strictly necessary for the service you request (staying logged in), so it requires no consent (§25 Abs. 2 Nr. 2 TDDDG) — which is why Clef has no cookie banner. It is deleted when the session ends or expires.

Deleting your account

You can permanently delete your hosted Clef account in Settings → Account. Clef emails a one-time link that must be confirmed while you are still signed in to the same account. Confirmation immediately ends access and cancels a web subscription; it cannot be undone. A subscription bought in the App Store or Google Play continues until you cancel it there. Clef then completes deletion from its own database, Stripe, and PostHog through a retryable background process. A temporary provider failure never restores access.

Product data, credentials, sessions, and account identifiers are erased. Apart from store purchase facts (next paragraph), we retain only the billing facts, deletion receipts, and provider tombstones needed for refunds, disputes, tax records, and protection against late billing events, for ten years. If a teacher referral created an ongoing payout obligation, the payout contact and attribution are held separately from the deleted product account while payouts may accrue and for ten years after final settlement. They are used only for payout administration. Stripe remains the authoritative invoice archive.

For a subscription bought in the App Store or Google Play, deletion removes the link between your account and the subscription and every copy of your app account token (see "In-app purchases" below). The purchase facts the store sent us stay, without any link to an account, so that a replayed store notification cannot restore a refunded subscription. We keep them without a fixed end date. A minimal snapshot of an App Store subscription (product, expiry, and revocation date) stays with the deletion record for ten years for refunds and disputes.

Sign in with Google (optional)

If you choose "Continue with Google," Google confirms your identity to us and we receive your Google account's email address and basic profile name. We store the email as your account email — nothing more. Google Ireland Ltd. is an independent controller for its own processing during sign-in; see Google's privacy policy. Legal basis: Art. 6(1)(b) GDPR. Using Google sign-in is optional; email and password work without it.

Payments — Stripe and Link

Web subscriptions, the free trial, and refunds are paid through Stripe. For subscriptions started in Stripe Checkout, Sold through Link, LLC (USA), a Stripe company that appears as "Link" at checkout and on your card statement, is the merchant of record for payment and tax. It charges your payment method, calculates and remits VAT or sales tax, sends receipts and payment reminders, and handles payment disputes. Payments are processed by Stripe Technology Europe, Limited (Ireland) and Stripe, LLC (USA). Stripe and Link collect your payment details directly, and your card number never reaches our servers. We receive and store your subscription status and billing history (amounts, dates, invoice and refund records).

Stripe processes payment data for us as our processor under a data processing agreement (Art. 28 GDPR). For their own duties as merchant of record (tax, receipts, disputes) and for fraud prevention and their legal obligations, Link and Stripe decide on the processing themselves and are responsible for it under their own privacy policy.

Legal bases: Art. 6(1)(b) GDPR (billing the contract) and Art. 6(1)(c) GDPR (statutory tax and commercial record-keeping, §147 AO). Transfers to the USA are safeguarded by Stripe's certification under the EU–US Data Privacy Framework and by standard contractual clauses. See Stripe's privacy policy, which also covers Link.

In-app purchases — Apple App Store and Google Play

If you subscribe in the iPhone or iPad app, you pay through Apple's in-app purchase; in the Android app, through Google Play's billing. Apple and Google run your store account, the payment, and refunds as independent controllers under their own privacy policies. In the EU, the seller is Apple Distribution International Ltd. (Ireland) or Google Commerce Limited (Ireland). Clef never receives your payment details. SeeApple's privacy policyand Google's privacy policy.

Clef generates one random identifier per account, the app account token, and passes it to the store with each purchase (as Apple's appAccountToken or Google's obfuscatedAccountId). It contains no personal data. The store sends us facts about the purchase, and the token lets us link them to your account. From Apple we receive signed transaction data: transaction ids, product, purchase and expiry dates, trial or offer, renewal and billing-retry state, refunds and revocations, and whether the purchase is family-shared. From Google we receive the purchase token, product and plan, expiry date, renewal state, order id, and the country of purchase. We use these facts to grant access and keep it correct, to handle refunds and disputes, and to stop a refunded or transferred subscription from granting access again.

Google delivers its purchase notifications to us through Google Cloud Pub/Sub, which Google Cloud EMEA Limited (Ireland) operates for us as our processor under Google's Cloud data processing addendum. A notification carries the purchase token and the kind of change, and Pub/Sub keeps an undelivered message for up to 7 days.

Legal bases: Art. 6(1)(b) GDPR (granting access under the contract) and Art. 6(1)(f) GDPR (our legitimate interest in keeping evidence for refunds and disputes and in preventing misuse). Where Google Cloud processes data in the USA, transfers are safeguarded by Google's certification under the EU–US Data Privacy Framework and by standard contractual clauses.

Transactional email — Resend

Account and billing emails (such as email verification, the reminder before your trial ends, and receipts) are sent through Resend, Inc. (USA), which processes your email address and the message content for delivery. We send no marketing email without your separate, explicit consent. Legal basis: Art. 6(1)(b) GDPR; transfers are safeguarded by standard contractual clauses.

Team notifications — Slack

Operational notifications — for example, that a new account was created — are sent to Clef's internal workspace at Slack Technologies LLC, a Salesforce company (USA). Signup and onboarding notifications can include your email address, Clef account id, signup source, instrument answer, and coarse self-reported client surface, operating system, and device class for operational triage. They do not include raw user-agent strings, hardware identifiers, or your practice history. Feedback or transcription reports can include your email address when it is needed to respond to the report. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating and supporting the service. Transfers to the USA are safeguarded by Salesforce's certification under the EU–US Data Privacy Framework and by standard contractual clauses.

Product diagnostics — PostHog

Clef collects limited product diagnostics through PostHog, hosted on PostHog's EU cloud in Frankfurt, Germany. For new hosted beta accounts, diagnostics are on by default. This helps us see whether the product works in the real world: for example whether MIDI setup succeeds, whether free-trial activation started or failed, which practice mode was launched, whether a later paid-checkout redirect failed, how long a practice session lasted, and whether an error report was generated.

• Events are keyed to a pseudonymous id that looks like clef_.... The id is generated by Clef's server and is not your email address.
• Person profiles are disabled in PostHog. Clef does not call identify(), and PostHog is not used for advertising.
• Events are limited to an explicit allowlist of product properties. We deliberately exclude account email, raw MIDI note streams, page URLs, full referrer URLs, session identifiers, sheet-music file paths, and free-form user content. A signup event may include the bounded signup-source fields described above. An install-source event may include the Apple Ads ids described above.
• One exception to that: when a library search finds nothing, or you tap the row to request a piece from a search, Clef sends the search text, up to 80 characters, so we can learn which pieces players look for and cannot find. We drop search text that looks like an email address or phone number. Other searches are never sent.
• Product events may include a generic browser-or-companion-app marker and PostHog's coarse browser, operating-system, version, and device-class fields. Clef does not send raw user-agent strings, hardware identifiers, or screen dimensions.
• Clef may derive an approximate country code from the connection address using a country database on its own server. The address is not stored by this lookup or sent to PostHog. Signup and browser product events may include the country code; unavailable countries are labeled Unknown. PostHog GeoIP enrichment remains disabled. Clef does not send precise location, city, postal code, or coordinates as product-diagnostic properties. Country reflects the network connection, which may differ from where you live, for example when using a VPN.
• Autocapture, pageview capture, session recording, heatmaps, surveys, product tours, and external dependency loading are disabled in the PostHog client.
• You can turn diagnostics off at any time in Settings → Privacy. The change takes effect immediately for future events. Turning diagnostics off also removes the active pseudonymous analytics id from your Clef account.

Legal basis where GDPR applies: Art. 6(1)(f) GDPR — our legitimate interest in understanding and improving the reliability and core product experience of an early hosted beta, balanced by data minimization, pseudonymous ids, no advertising use, and an immediate opt-out. You may object at any time by turning diagnostics off or by emailing us.

Anonymous operational exceptions — PostHog

Separately from product diagnostics, Clef sends an anonymous operational exception when an internal failure becomes a generic recovery screen, an internal-server error, or a score-session failure. This channel remains active when product diagnostics are turned off because its event payload contains no account or practice data and is not linked to a persistent analytics id.

• Each report uses a fresh random transport id and a stable error fingerprint. Clef sends only the app environment and release plus a closed source, operation, and error class.
• Reports never contain raw error text, stack contents, source context, URLs, user or session ids, piece titles or ids, MIDI data, or responses from another provider. Browser and operating-system context is also removed from this channel.
• Person profiles and GeoIP enrichment are disabled. Detailed causes stay in Clef's short-lived local technical logs and are not copied into PostHog.
• Operational reports cannot be selected by account deletion because they carry no account or pseudonymous analytics id. They are deleted automatically after the same 24-month maximum retention period as product diagnostics.

Legal basis where GDPR applies: Art. 6(1)(f) GDPR — our legitimate interest in finding and repairing failures that prevent Clef from providing the requested operation, balanced by an anonymous, closed, data-minimized payload.

United States and California privacy notice

Clef's hosted beta is launching in the United States first. The categories of personal information we may collect are:

• Identifiers — email address, account id, session id, and the pseudonymous diagnostics id if diagnostics are active.
• Account and commercial information — subscription status, trial status, billing history, refund records, and App Store and Google Play purchase records.
• Internet or electronic activity information — security/request metadata processed by hosting providers, cookieless public-site audience measurement, and limited in-app product diagnostic events.
• Product and practice information — pieces, bars, correctness derived from MIDI input, review schedules, streaks, settings, and session history.
• Signup source — UTM parameters or referring site hostname captured at account creation when present.
• Apple Ads install source in the iPhone and iPad app, the Apple Ads ids and related fields described above, when present.

Sources are you, your browser/device, Google if you choose Google sign-in, Stripe and Link for payment status, Apple and Google for in-app purchase status, Apple's AdServices framework on your iPhone or iPad for the Apple Ads install source, and Clef's own product systems. We use this information to provide the service, secure accounts, process billing, send transactional email, improve the product, respond to support requests, and comply with legal obligations.

We disclose personal information only to service providers/processors that help run Clef: hosting and security providers (Hetzner, Cloudflare), payments (Stripe and Link), Google Play purchase notifications (Google Cloud), transactional email (Resend), optional Google sign-in, cookieless website analytics and product diagnostics (PostHog), and internal team notifications (Slack). We do not sell personal information and do not share it for cross-context behavioral advertising.

Depending on where you live and which laws apply, you may have rights to know/access, correct, delete, and receive a copy of personal information; to opt out of sale or sharing; to limit certain uses of sensitive personal information; and not to be discriminated against for exercising privacy rights. Clef does not sell or share personal information and does not use sensitive personal information to infer characteristics. To exercise rights, email hello@playclef.com.

How long we keep data

• Account and practice data — for the life of your account; erased after you confirm deletion in Settings → Account. Imported scores are erased when you delete them, and with your account. A file you upload but do not keep is deleted within an hour. You can also contacthello@playclef.com to exercise your rights.
• Billing records — as long as German law requires for each kind: invoices and other booking vouchers 8 years, books and annual statements 10 years, and business letters 6 years (§147 AO, §257 HGB).
• Billing facts, deletion receipts, and late-event tombstones kept after an account is deleted — 10 years, for tax, refund, dispute, and reconciliation obligations.
• App Store and Google Play purchase facts — while the subscription exists, and after account deletion without a link to any account and without a fixed end date, as described under "Deleting your account".
• Product diagnostics — retained in PostHog for 24 months from collection, then deleted. Confirmed account deletion requests earlier erasure of diagnostics associated with the pseudonymous id and waits for provider completion.
• Cookieless website analytics — retained in PostHog for no more than 24 months. Daily visitor hashes do not link activity across days and cannot be associated with an app account or account-deletion request.
• Cookieless pre-account app opens — retained in PostHog for no more than 24 months. They use the same daily-changing identity boundary, are never linked to an account, and therefore cannot be associated with an account-deletion request.
• Anonymous operational exceptions — retained in PostHog for no more than 24 months, then deleted. They have no account or analytics id, so they cannot be associated with an account-deletion request.
• Technical logs — short-lived and automatically rotated.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• withdraw any consent at any time, with effect for the future (Art. 7(3)).

You also have the right to object (Art. 21 GDPR): where we process your data based on legitimate interests, you may object at any time on grounds relating to your particular situation, and we will stop unless compelling legitimate grounds prevail.

To exercise any of these rights, email hello@playclef.com.

Right to complain

You may lodge a complaint with a supervisory authority (Art. 77 GDPR) — either the authority responsible for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, or the authority of your habitual residence.

No automated decision-making

We make no automated decisions with legal or similarly significant effects (Art. 22 GDPR). Clef's review scheduling — deciding when a bar comes back for practice — is a product feature that adapts to your playing, not a decision about you as a person.

Changes to this policy

We will update this policy when the product or its processors change, and the date at the top always reflects the current version. Material changes will be announced in the app.