Privacy Policy

Controller

The controller responsible for data processing on playclef.com and in the Clef app is:

The principles

• The public website is separate from the app. It is served by Cloudflare Pages and does not create Clef accounts, practice records, or app telemetry identities. Its cookieless audience measurement cannot be joined to an app account.
• The Clef app uses exactly one cookie — a first-party session cookie that keeps you logged in. Nothing else.
• Product diagnostics are on by default for new hosted beta accounts so we can understand whether setup, practice, memorization, billing, and errors are working. You can turn them off at any time in Settings → Privacy.
• Pre-account app measurement is separate and cookieless. When the hosted app confirms that no account is signed in, it counts one app open without browser storage, a person profile, or a link to any account created later.
• We keep analytics narrow. Diagnostics use a pseudonymous Clef id, not your email address. We do not use session recordings, heatmaps, ad tracking, or PostHog person profiles.
• Anonymous reliability reports are separate. When Clef replaces an internal failure with a generic error screen or failed operation, it sends a closed error class without account or practice data. These reports remain on when product diagnostics are off.

Visiting this website

playclef.com is served by Cloudflare, Inc. (Cloudflare Pages, USA; engaged via Cloudflare Germany GmbH / Cloudflare's EU establishment). When you load a page, Cloudflare technically processes your IP address and request metadata (browser, time, requested URL) to deliver the site and defend it against attacks. Cloudflare may also provide aggregate, cookie-free page analytics and bot/security checks for the public site. Clef's separate website analytics are described below; they do not use the app's product-telemetry identity or consent setting.

When you follow one of our short links from a social profile (playclef.com/ig, playclef.com/tt), our server counts that visit as a single anonymous event in PostHog (EU hosting) before redirecting you to the homepage. This uses no cookie and stores nothing on your device; the event contains only the link followed, your browser type, and a country code — never your IP address or any identifier that could recognize you across visits.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in delivering the site securely and quickly, and in measuring, in aggregate, how our social profiles are found. Transfers to the USA are safeguarded by Cloudflare's certification under the EU–US Data Privacy Framework and by standard contractual clauses. We do not receive or store these access logs ourselves.

Cookieless website analytics — PostHog

The public website uses PostHog Cloud EU, hosted in Frankfurt, Germany, to measure page visits, clicks on signup links and the App Store and Google Play badges, and which landing-page FAQ answers visitors open. FAQ measurement records when the section is reached and the first opening of each question per page load, using a fixed question identifier and its position. Page events include the visited URL and any UTM campaign tags, the referring site, standard browser/device context, and an approximate country code derived by Cloudflare. PostHog is not used here for advertising or to create person profiles.

This measurement uses PostHog's cookieless server-hash mode. It sets no cookies and writes nothing to local storage or session storage. PostHog derives a privacy-preserving visitor hash on its server from the IP address, browser user-agent, hostname, and a salt that changes daily; the IP address is not retained as an event property. PostHog location enrichment is disabled; Cloudflare supplies only the country code, without city, postal code, or coordinates. The changing salt means Clef cannot recognize the same visitor across different days. We do not use session recording or heatmaps on the website.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding, in aggregate, which public pages bring people to the Clef store listings, balanced by no device storage, no person profile, no cross-day tracking, and no advertising use. You may object by emailing us.

Opening the Clef app before signing in

When the hosted Clef app confirms that no account is signed in, it sends exactly onecookieless pre-account open to PostHog Cloud EU. This lets us measure, in aggregate, how often people reach the app before creating or entering an account. It is separate from both public-website analytics and account product diagnostics.

• The event contains only whether Clef is running in a browser or companion app, whether Web MIDI is available, the production-or-development environment, and coarse browser, operating-system, version, and device-class fields.
• It excludes URLs, paths, referrers, campaign tags, session ids, screen dimensions, raw user-agent strings, account details, practice data, and MIDI notes. Person profiles and location enrichment are disabled.
• It sets no cookie and writes nothing to local storage or session storage. PostHog's cookieless mode derives a privacy-preserving daily hash on its server from request metadata; the IP address and raw user-agent string are not retained as event properties, and the changing salt prevents cross-day recognition.
• Clef never identifies, aliases, or merges this event with an account. A later signup can be compared only as part of aggregate totals, not as the same person.

This measurement is not controlled by Settings → Privacy because it runs only before an account is authenticated and has no account identity. Legal basis where GDPR applies: Art. 6(1)(f) GDPR — our legitimate interest in understanding, in aggregate, whether people can reach the hosted app, balanced by one event, no device storage, daily-changing identity, no account linkage, and no advertising use. You may object by emailing us.

Your Clef account and practice data

The hosted Clef app and its database run on a Hetzner Online GmbH VPS in Ashburn, Virginia, United States, under a data processing agreement. That agreement permits processing in third countries only with the guarantees of Art. 44 ff. GDPR — in particular EU standard contractual clauses — and lists Hetzner's approved US subprocessors (Hetzner US LLC and its colocation providers). Clef is operated from Germany, but hosted beta app data is not stored on a German server. When you use Clef, we process:

• Account data — your email address and a hashed password (argon2; we never store the password itself).
• Signup source — at account creation, Clef records which tagged link or referring site brought you (UTM parameters or referring site hostname), plus the Clef page or app entry where signup began, and stores it with your account. When product diagnostics are active, Clef also sends PostHog a narrower signup-source record: token-shaped UTM source, medium, campaign, and content values, the referring hostname, and token-shaped Clef entry surface and placement. Search-term values and full referrer URLs are never sent to PostHog.
• Practice data — which pieces and bars you practiced, the correctness of what you played as derived from your MIDI input, your review schedule, streaks, and session history. This is the product: it's how Clef knows what to test you on and when.
• Settings — language, MIDI device preference, and similar.

Legal basis: Art. 6(1)(b) GDPR — performance of the contract with you. Providing account data is required to use Clef; without it, an account cannot exist.

Children

Clef is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, email [email protected] and we will delete the account and its data. In the EEA, users under 16 need a parent or guardian to agree to the terms on their behalf.

The session cookie

Logging in sets a single first-party cookie holding your session identifier. It is strictly necessary for the service you request (staying logged in), so it requires no consent (§25 Abs. 2 Nr. 2 TDDDG) — which is why Clef has no cookie banner. It is deleted when the session ends or expires.

Deleting your account

You can permanently delete your hosted Clef account in Settings → Account. Clef emails a one-time link that must be confirmed while you are still signed in to the same account. Confirmation immediately ends access and cancels the subscription; it cannot be undone. Clef then completes deletion from its own database, Stripe, and PostHog through a retryable background process. A temporary provider failure never restores access.

Product data, credentials, sessions, and account identifiers are erased. We retain only the billing facts, deletion receipts, and provider tombstones needed for refunds, disputes, tax records, and protection against late billing events, for ten years. If a teacher referral created an ongoing payout obligation, the payout contact and attribution are held separately from the deleted product account while payouts may accrue and for ten years after final settlement. They are used only for payout administration. Stripe remains the authoritative invoice archive.

Sign in with Google (optional)

If you choose "Continue with Google," Google confirms your identity to us and we receive your Google account's email address and basic profile name. We store the email as your account email — nothing more. Google Ireland Ltd. is an independent controller for its own processing during sign-in; see Google's privacy policy. Legal basis: Art. 6(1)(b) GDPR. Using Google sign-in is optional; email and password work without it.

Payments — Stripe

Subscriptions, the free trial, and refunds are processed by Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA). Stripe collects your payment details directly — your card number never reaches our servers. We receive and store your subscription status and billing history (amounts, dates, invoice records).

Legal bases: Art. 6(1)(b) GDPR (billing the contract) and Art. 6(1)(c) GDPR (statutory tax and commercial record-keeping, §147 AO). Transfers to the USA are safeguarded by Stripe's certification under the EU–US Data Privacy Framework and by standard contractual clauses. See Stripe's privacy policy.

Transactional email — Resend

Account and billing emails (such as email verification, the reminder before your trial ends, and receipts) are sent through Resend, Inc. (USA), which processes your email address and the message content for delivery. We send no marketing email without your separate, explicit consent. Legal basis: Art. 6(1)(b) GDPR; transfers are safeguarded by standard contractual clauses.

Team notifications — Slack

Operational notifications — for example, that a new account was created — are sent to Clef's internal workspace at Slack Technologies LLC, a Salesforce company (USA). Signup and onboarding notifications can include your email address, Clef account id, signup source, instrument answer, and coarse self-reported client surface, operating system, and device class for operational triage. They do not include raw user-agent strings, hardware identifiers, or your practice history. Feedback or transcription reports can include your email address when it is needed to respond to the report. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating and supporting the service. Transfers to the USA are safeguarded by Salesforce's certification under the EU–US Data Privacy Framework and by standard contractual clauses.

Product diagnostics — PostHog

Clef collects limited product diagnostics through PostHog, hosted on PostHog's EU cloud in Frankfurt, Germany. For new hosted beta accounts, diagnostics are on by default. This helps us see whether the product works in the real world: for example whether MIDI setup succeeds, whether free-trial activation started or failed, which practice mode was launched, whether a later paid-checkout redirect failed, how long a practice session lasted, and whether an error report was generated.

• Events are keyed to a pseudonymous id that looks like clef_.... The id is generated by Clef's server and is not your email address.
• Person profiles are disabled in PostHog. Clef does not call identify(), and PostHog is not used for advertising.
• Events are limited to an explicit allowlist of product properties. We deliberately exclude account email, raw MIDI note streams, page URLs, full referrer URLs, session identifiers, sheet-music file paths, search terms, and free-form user content. A signup event may include the bounded signup-source fields described above.
• Product events may include a generic browser-or-companion-app marker and PostHog's coarse browser, operating-system, version, and device-class fields. Clef does not send raw user-agent strings, hardware identifiers, or screen dimensions.
• Clef may derive an approximate country code from the connection address using a country database on its own server. The address is not stored by this lookup or sent to PostHog. Signup and browser product events may include the country code; unavailable countries are labeled Unknown. PostHog GeoIP enrichment remains disabled. Clef does not send precise location, city, postal code, or coordinates as product-diagnostic properties. Country reflects the network connection, which may differ from where you live, for example when using a VPN.
• Autocapture, pageview capture, session recording, heatmaps, surveys, product tours, and external dependency loading are disabled in the PostHog client.
• You can turn diagnostics off at any time in Settings → Privacy. The change takes effect immediately for future events. Turning diagnostics off also removes the active pseudonymous analytics id from your Clef account.

Legal basis where GDPR applies: Art. 6(1)(f) GDPR — our legitimate interest in understanding and improving the reliability and core product experience of an early hosted beta, balanced by data minimization, pseudonymous ids, no advertising use, and an immediate opt-out. You may object at any time by turning diagnostics off or by emailing us.

Anonymous operational exceptions — PostHog

Separately from product diagnostics, Clef sends an anonymous operational exception when an internal failure becomes a generic recovery screen, an internal-server error, or a score-session failure. This channel remains active when product diagnostics are turned off because its event payload contains no account or practice data and is not linked to a persistent analytics id.

• Each report uses a fresh random transport id and a stable error fingerprint. Clef sends only the app environment and release plus a closed source, operation, and error class.
• Reports never contain raw error text, stack contents, source context, URLs, user or session ids, piece titles or ids, MIDI data, or responses from another provider. Browser and operating-system context is also removed from this channel.
• Person profiles and GeoIP enrichment are disabled. Detailed causes stay in Clef's short-lived local technical logs and are not copied into PostHog.
• Operational reports cannot be selected by account deletion because they carry no account or pseudonymous analytics id. They are deleted automatically after the same 24-month maximum retention period as product diagnostics.

Legal basis where GDPR applies: Art. 6(1)(f) GDPR — our legitimate interest in finding and repairing failures that prevent Clef from providing the requested operation, balanced by an anonymous, closed, data-minimized payload.

United States and California privacy notice

Clef's hosted beta is launching in the United States first. The categories of personal information we may collect are:

• Identifiers — email address, account id, session id, and the pseudonymous diagnostics id if diagnostics are active.
• Account and commercial information — subscription status, trial status, billing history, and refund records.
• Internet or electronic activity information — security/request metadata processed by hosting providers, cookieless public-site audience measurement, and limited in-app product diagnostic events.
• Product and practice information — pieces, bars, correctness derived from MIDI input, review schedules, streaks, settings, and session history.
• Signup source — UTM parameters or referring site hostname captured at account creation when present.

Sources are you, your browser/device, Google if you choose Google sign-in, Stripe for payment status, and Clef's own product systems. We use this information to provide the service, secure accounts, process billing, send transactional email, improve the product, respond to support requests, and comply with legal obligations.

We disclose personal information only to service providers/processors that help run Clef: hosting and security providers (Hetzner, Cloudflare), payments (Stripe), transactional email (Resend), optional Google sign-in, cookieless website analytics and product diagnostics (PostHog), and internal team notifications (Slack). We do not sell personal information and do not share it for cross-context behavioral advertising.

Depending on where you live and which laws apply, you may have rights to know/access, correct, delete, and receive a copy of personal information; to opt out of sale or sharing; to limit certain uses of sensitive personal information; and not to be discriminated against for exercising privacy rights. Clef does not sell or share personal information and does not use sensitive personal information to infer characteristics. To exercise rights, email [email protected].

How long we keep data

• Account and practice data — for the life of your account; erased after you confirm deletion in Settings → Account. You can also contact[email protected] to exercise your rights.
• Billing records, deletion receipts, and late-event tombstones — 10 years, as required for tax, refund, dispute, and reconciliation obligations.
• Product diagnostics — retained in PostHog for 24 months from collection, then deleted. Confirmed account deletion requests earlier erasure of diagnostics associated with the pseudonymous id and waits for provider completion.
• Cookieless website analytics — retained in PostHog for no more than 24 months. Daily visitor hashes do not link activity across days and cannot be associated with an app account or account-deletion request.
• Cookieless pre-account app opens — retained in PostHog for no more than 24 months. They use the same daily-changing identity boundary, are never linked to an account, and therefore cannot be associated with an account-deletion request.
• Anonymous operational exceptions — retained in PostHog for no more than 24 months, then deleted. They have no account or analytics id, so they cannot be associated with an account-deletion request.
• Technical logs — short-lived and automatically rotated.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• withdraw any consent at any time, with effect for the future (Art. 7(3)).

You also have the right to object (Art. 21 GDPR): where we process your data based on legitimate interests, you may object at any time on grounds relating to your particular situation, and we will stop unless compelling legitimate grounds prevail.

To exercise any of these rights, email [email protected].

Right to complain

You may lodge a complaint with a supervisory authority (Art. 77 GDPR) — either the authority responsible for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, or the authority of your habitual residence.

No automated decision-making

We make no automated decisions with legal or similarly significant effects (Art. 22 GDPR). Clef's review scheduling — deciding when a bar comes back for practice — is a product feature that adapts to your playing, not a decision about you as a person.

Changes to this policy

We will update this policy when the product or its processors change, and the date at the top always reflects the current version. Material changes will be announced in the app.