Privacy Policy

1. Information we collect

Information you provide

• Account information. We use passwordless sign-in, so the main thing we store is your email address. We do not store passwords.
• Content you submit. MIDI files you upload and any associated metadata, your favorites, and any reports you send us. Free-tool feedback stores the category, related tool, and message; if you are signed in it also links your account ID. Anonymous tool feedback has no contact field. Copyright/DMCA notices contain the name, email, and statement you provide.

Information collected automatically

• Usage and log data. To run the Service and keep it secure, we record events such as sign-ins and page visits, along with your IP address, browser/user-agent, and the pages or files accessed.
• File access counts. We keep aggregate view/play/download counts to rank and prioritize content.
• Free-tool analytics. We record the tool identifier, a small lifecycle state (such as viewed, used, started, succeeded, failed, or cancelled), a random operation ID, bounded duration, and a normalized error code. When you are signed in, the event also stores your account ID. These events do not contain filenames, file contents, MIDI or MusicXML data, detected notes, IP addresses, browser user-agent strings, or free-form exception messages.
• Cookies. See the next section.

2. Cookies

We use a small number of cookies. None of them are advertising cookies, and we do not use cookies to track you across other websites:

• Session cookie. Keeps you signed in. It is HTTP-only and set with SameSite=Lax, which also helps protect against cross-site request forgery.
• Theme cookie. Remembers your light/dark/system preference.
• Analytics cookies. We use Google Analytics to understand which pages and features people use. It sets first-party cookies (_ga and _ga_*) that store a randomly generated identifier so a returning browser can be recognized, and it reports to Google the pages you view, the site that referred you, your device and browser, and an approximate location derived from your IP address. Google's advertising features are not enabled, so this data is not used to profile you or to target ads. You can block these cookies with your browser settings or a content blocker; nothing else on the Service depends on them.

3. How we use information

• To provide and operate the Service, including authentication and your account features (uploads, favorites).
• To secure the Service — detecting and preventing abuse, scraping, fraud, and unauthorized access, and enforcing rate limits.
• To moderate content and respond to reports and copyright notices.
• To understand usage and improve and prioritize features and content.
• To comply with legal obligations and enforce our Terms.

4. How we share information

We do not sell your personal information. We share it only as needed:

• Service providers. Infrastructure, analytics, and email-delivery providers that process data on our behalf to run and measure the Service. This includes Google Analytics, which receives the usage data described in the Cookies section above.
• Legal and safety. When required by law, to respond to lawful requests, or to protect the rights, safety, and property of users, the public, or us.
• Copyright notices. Information in a copyright/DMCA notice or counter-notice may be forwarded to the other party as part of resolving the claim (see our DMCA / Copyright Policy).
• Business transfers. If the Service is involved in a merger, acquisition, or asset sale, information may transfer as part of that transaction.

5. Data retention

We keep personal information for as long as your account is active or as needed to provide the Service, and afterward as needed to comply with our legal obligations, resolve disputes, enforce our agreements, and maintain security. Log data may be retained for security and abuse-prevention purposes.

6. Your rights and choices

Depending on where you live (for example, under the GDPR or CCPA/CPRA), you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, or to delete your account, email [email protected]. We will respond as required by applicable law. We do not "sell" or "share" personal information for cross-context behavioral advertising.

7. Children's privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe someone under 16 has provided us information, contact us and we will delete it.

8. Security

We take reasonable technical and organizational measures to protect your information, but no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International users

The Service may be operated from, and your information processed in, countries other than the one in which you live. Those countries may have different data-protection laws. By using the Service you understand your information may be transferred and processed as described here.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date above. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

11. Contact

Questions or requests about your privacy? Email [email protected].