Privacy Policy

Controller

The controller responsible for data processing on playclef.com and in the Clef app is:

The principles

• The public website is separate from the app. It is served by Cloudflare Pages and does not create Clef accounts, practice records, or app telemetry identities.
• The Clef app uses exactly one cookie — a first-party session cookie that keeps you logged in. Nothing else.
• Product diagnostics are on by default for new hosted beta accounts so we can understand whether setup, practice, memorization, billing, and errors are working. You can turn them off at any time in Settings → Privacy.
• We keep analytics narrow. Diagnostics use a pseudonymous Clef id, not your email address. We do not use session recordings, heatmaps, ad tracking, or PostHog person profiles.

Visiting this website

playclef.com is served by Cloudflare, Inc. (Cloudflare Pages, USA; engaged via Cloudflare Germany GmbH / Cloudflare's EU establishment). When you load a page, Cloudflare technically processes your IP address and request metadata (browser, time, requested URL) to deliver the site and defend it against attacks. Cloudflare may also provide aggregate, cookie-free page analytics and bot/security checks for the public site. The public site does not load Clef's PostHog product telemetry.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in delivering the site securely and quickly. Transfers to the USA are safeguarded by Cloudflare's certification under the EU–US Data Privacy Framework and by standard contractual clauses. We do not receive or store these access logs ourselves.

Your Clef account and practice data

The hosted Clef app and its database run on a Hetzner Online GmbH VPS in Ashburn, Virginia, United States, under a data processing agreement. That agreement permits processing in third countries only with the guarantees of Art. 44 ff. GDPR — in particular EU standard contractual clauses — and lists Hetzner's approved US subprocessors (Hetzner US LLC and its colocation providers). Clef is operated from Germany, but hosted beta app data is not stored on a German server. When you use Clef, we process:

• Account data — your email address and a hashed password (argon2; we never store the password itself).
• Signup source — at account creation, Clef records which tagged link or referring site brought you (UTM parameters or referring site hostname), plus the Clef page or app entry where signup began, and stores it with your account. When product diagnostics are active, Clef also sends PostHog a narrower signup-source record: token-shaped UTM source, medium, campaign, and content values, the referring hostname, and token-shaped Clef entry surface and placement. Search-term values and full referrer URLs are never sent to PostHog.
• Practice data — which pieces and bars you practiced, the correctness of what you played as derived from your MIDI input, your review schedule, streaks, and session history. This is the product: it's how Clef knows what to test you on and when.
• Settings — language, MIDI device preference, and similar.

Legal basis: Art. 6(1)(b) GDPR — performance of the contract with you. Providing account data is required to use Clef; without it, an account cannot exist.

Children

Clef is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, email hello@playclef.com and we will delete the account and its data. In the EEA, users under 16 need a parent or guardian to agree to the terms on their behalf.

The session cookie

Logging in sets a single first-party cookie holding your session identifier. It is strictly necessary for the service you request (staying logged in), so it requires no consent (§25 Abs. 2 Nr. 2 TDDDG) — which is why Clef has no cookie banner. It is deleted when the session ends or expires.

Deleting your account

You can permanently delete your hosted Clef account in Settings → Account. Clef emails a one-time link that must be confirmed while you are still signed in to the same account. Confirmation immediately ends access and cancels the subscription; it cannot be undone. Clef then completes deletion from its own database, Stripe, and PostHog through a retryable background process. A temporary provider failure never restores access.

Product data, credentials, sessions, and account identifiers are erased. We retain only the billing facts, deletion receipts, and provider tombstones needed for refunds, disputes, tax records, and protection against late billing events, for ten years. If a teacher referral created an ongoing payout obligation, the payout contact and attribution are held separately from the deleted product account while payouts may accrue and for ten years after final settlement. They are used only for payout administration. Stripe remains the authoritative invoice archive.

Sign in with Google (optional)

If you choose "Continue with Google," Google confirms your identity to us and we receive your Google account's email address and basic profile name. We store the email as your account email — nothing more. Google Ireland Ltd. is an independent controller for its own processing during sign-in; see Google's privacy policy. Legal basis: Art. 6(1)(b) GDPR. Using Google sign-in is optional; email and password work without it.

Payments — Stripe

Subscriptions, the free trial, and refunds are processed by Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA). Stripe collects your payment details directly — your card number never reaches our servers. We receive and store your subscription status and billing history (amounts, dates, invoice records).

Legal bases: Art. 6(1)(b) GDPR (billing the contract) and Art. 6(1)(c) GDPR (statutory tax and commercial record-keeping, §147 AO). Transfers to the USA are safeguarded by Stripe's certification under the EU–US Data Privacy Framework and by standard contractual clauses. See Stripe's privacy policy.

Transactional email — Resend

Account and billing emails (such as email verification, the reminder before your trial ends, and receipts) are sent through Resend, Inc. (USA), which processes your email address and the message content for delivery. We send no marketing email without your separate, explicit consent. Legal basis: Art. 6(1)(b) GDPR; transfers are safeguarded by standard contractual clauses.

Team notifications — Slack

Operational notifications — for example, that a new account was created — are sent to Clef's internal workspace at Slack Technologies LLC, a Salesforce company (USA). Signup notifications contain no account identifier or email address. Feedback or transcription reports can include your email address when it is needed to respond to the report; they never include your practice history. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating and supporting the service. Transfers to the USA are safeguarded by Salesforce's certification under the EU–US Data Privacy Framework and by standard contractual clauses.

Product diagnostics — PostHog

Clef collects limited product diagnostics through PostHog, hosted on PostHog's EU cloud in Frankfurt, Germany. For new hosted beta accounts, diagnostics are on by default. This helps us see whether the product works in the real world: for example whether MIDI setup succeeds, whether free-trial activation started or failed, which practice mode was launched, whether a later paid-checkout redirect failed, how long a practice session lasted, and whether an error report was generated.

• Events are keyed to a pseudonymous id that looks like clef_.... The id is generated by Clef's server and is not your email address.
• Person profiles are disabled in PostHog. Clef does not call identify(), and PostHog is not used for advertising.
• Events are limited to an explicit allowlist of product properties. We deliberately exclude account email, raw MIDI note streams, page URLs, full referrer URLs, session identifiers, sheet-music file paths, search terms, and free-form user content. A signup event may include the bounded signup-source fields described above.
• Product events may include a generic browser-or-companion-app marker and PostHog's coarse browser, operating-system, version, and device-class fields. Clef does not send raw user-agent strings, hardware identifiers, or screen dimensions.
• GeoIP enrichment is disabled. Clef does not send precise location, city, postal code, or coordinates as product-diagnostic properties.
• Autocapture, pageview capture, session recording, heatmaps, surveys, product tours, and external dependency loading are disabled in the PostHog client.
• You can turn diagnostics off at any time in Settings → Privacy. The change takes effect immediately for future events. Turning diagnostics off also removes the active pseudonymous analytics id from your Clef account.

Legal basis where GDPR applies: Art. 6(1)(f) GDPR — our legitimate interest in understanding and improving the reliability and core product experience of an early hosted beta, balanced by data minimization, pseudonymous ids, no advertising use, and an immediate opt-out. You may object at any time by turning diagnostics off or by emailing us.

United States and California privacy notice

Clef's hosted beta is launching in the United States first. The categories of personal information we may collect are:

• Identifiers — email address, account id, session id, and the pseudonymous diagnostics id if diagnostics are active.
• Account and commercial information — subscription status, trial status, billing history, and refund records.
• Internet or electronic activity information — security/request metadata processed by hosting providers and limited in-app product diagnostic events.
• Product and practice information — pieces, bars, correctness derived from MIDI input, review schedules, streaks, settings, and session history.
• Signup source — UTM parameters or referring site hostname captured at account creation when present.

Sources are you, your browser/device, Google if you choose Google sign-in, Stripe for payment status, and Clef's own product systems. We use this information to provide the service, secure accounts, process billing, send transactional email, improve the product, respond to support requests, and comply with legal obligations.

We disclose personal information only to service providers/processors that help run Clef: hosting and security providers (Hetzner, Cloudflare), payments (Stripe), transactional email (Resend), optional Google sign-in, product diagnostics (PostHog), and internal team notifications (Slack). We do not sell personal information and do not share it for cross-context behavioral advertising.

Depending on where you live and which laws apply, you may have rights to know/access, correct, delete, and receive a copy of personal information; to opt out of sale or sharing; to limit certain uses of sensitive personal information; and not to be discriminated against for exercising privacy rights. Clef does not sell or share personal information and does not use sensitive personal information to infer characteristics. To exercise rights, email hello@playclef.com.

How long we keep data

• Account and practice data — for the life of your account; erased after you confirm deletion in Settings → Account. You can also contacthello@playclef.com to exercise your rights.
• Billing records, deletion receipts, and late-event tombstones — 10 years, as required for tax, refund, dispute, and reconciliation obligations.
• Product diagnostics — retained in PostHog for 24 months from collection, then deleted. Confirmed account deletion requests earlier erasure of diagnostics associated with the pseudonymous id and waits for provider completion.
• Technical logs — short-lived and automatically rotated.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• withdraw any consent at any time, with effect for the future (Art. 7(3)).

You also have the right to object (Art. 21 GDPR): where we process your data based on legitimate interests, you may object at any time on grounds relating to your particular situation, and we will stop unless compelling legitimate grounds prevail.

To exercise any of these rights, email hello@playclef.com.

Right to complain

You may lodge a complaint with a supervisory authority (Art. 77 GDPR) — either the authority responsible for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, or the authority of your habitual residence.

No automated decision-making

We make no automated decisions with legal or similarly significant effects (Art. 22 GDPR). Clef's review scheduling — deciding when a bar comes back for practice — is a product feature that adapts to your playing, not a decision about you as a person.

Changes to this policy

We will update this policy when the product or its processors change, and the date at the top always reflects the current version. Material changes will be announced in the app.