Privacy Policy

Name: Németh Gyula

Registered address: 9737 Bük, Honfoglalás utca 20, Hungary

Contact: eszallas@gmail.com

To operate and improve PianoChords, we process the following data:

• Account data: email address, password (stored as an encrypted hash), and username if you provide one. Required to identify you and protect your account.
• Activity data: playback history, favorite songs, personal playlists, and search terms (only the query text and result count, without IP address).
• AI Coach statistics: practice scores, accuracy metrics, timing indicators, the practiced song's title and artist, and the generated AI feedback.
• Device and browser info: generic technical data (e.g. screen resolution, browser type) to optimize the interface. We do not use third-party tracking or analytics services.
• Microphone / MIDI input: for real-time AI feedback, audio or MIDI data received in your browser is processed exclusively on your device. Raw audio streams or MIDI messages are not stored on our servers.

Processing is based on the following legal grounds under GDPR Article 6:

• Performance of contract: creating and authenticating your account and providing the service.
• Legitimate interest: ensuring the app operates, troubleshooting and preventing security incidents.
• Consent: processing your AI Coach practice data and AI-generated feedback. You may withdraw consent at any time via the contact email.

We use the following external providers to operate the app. They process data according to their own privacy policies:

• Lovable Cloud / Supabase: provides backend infrastructure and database. Data is stored in EU-based data centers.
• Paddle.com Market Ltd. (payment provider and Merchant of Record): sale of subscriptions, payment processing, VAT/tax handling, invoicing and refunds are carried out by Paddle as our Merchant of Record. Data required for the purchase (name, email, billing address, card details, transaction identifiers) is handled by Paddle under its own privacy policy. We do not see or store your card details.
• YouTube (Google LLC): the app embeds YouTube videos. YouTube applies its own privacy practices when videos are played.
• AI services: an external AI model is used to generate AI Coach feedback. Practice statistics and song metadata are transmitted in anonymized form, not as raw audio.

We do not sell user data to third parties and do not use it for advertising profiling.

The AI Coach performs an automated analysis of your practice statistics (accuracy, timing, missed chords) and generates personalized feedback and advice. This qualifies as profiling.

The AI feedback is informational and does not represent a legally or otherwise binding decision. The profiling result is used only to support your progress and is not automatically forwarded to other systems.

The app uses its own cookies and browser storage (localStorage / sessionStorage) strictly necessary for operation — for example login state, language preference and search history. There are no third-party tracking or marketing cookies on the site.

User data is transmitted over an encrypted connection (HTTPS), and passwords are stored hashed using standard methods. Access to the database is restricted by role-based security (RLS) and authentication.

Account data and activity history are retained while your account is active and for up to 1 year afterwards. Data of inactive accounts is deleted unless otherwise required by law.

Under GDPR you are entitled to:

• request information about the data we process about you (access);
• request rectification of your data;
• request erasure of your data ("right to be forgotten");
• restrict processing or object to processing;
• receive your data in a machine-readable format (portability);
• withdraw your consent at any time.

You may exercise your rights via the email below. We respond within 30 days of receiving your request. eszallas@gmail.com

If you believe your data protection rights have been violated, you may lodge a complaint with the competent supervisory authority (in Hungary: NAIH).