Privacy Policy

Last updated: 9 July 2026

This policy explains what personal data PianoKitty collects, why, how we protect it, and the choices and rights you have. We keep it short and honest. We never sell your data.

1. Who is responsible for your data

The data controller is:

2. The short version

• You can use PianoKitty without an account — then your data stays only in your browser, on your device, and never reaches our servers.
• If you sign in, we store what's needed to run your account and sync your progress across devices.
• We use data to run and improve the app, not to profile or advertise to you.
• We do not sell your data and we do not use advertising or tracking cookies.
• You can delete your account and data at any time — just ask us.

3. Using PianoKitty without an account

If you don't sign in, your settings, exercises and progress are stored only in your browser's local storage on your device (keys beginning pk2.), together with a locally-generated device identifier. This data is not sent to us. Clearing your browser data erases it.

4. What we collect when you sign in

When you create an account or sign in, we process:

• Account data — your e-mail address, display name, a securely hashed password (we never see your plain password), optional avatar/profile picture, language and account role. E-mail is optional for child accounts (see §7).
• Social sign-in data — if you use Google, Facebook or Apple, we receive basic profile info and authentication tokens from them. If you use Apple's "Hide My Email", we store the private relay address.
• Technical data — IP address and browser/user-agent, a session token (kept while you stay signed in), a device identifier, and rate-limiting data. We keep these to run and secure the Service.
• Your activity — the exercises you complete and your results, statistics, badges and level progress, so we can show your progress and sync it across devices.
• Content you create — notepads, your public profile (handle, display name, short bio), custom/shared exercises, and any bug reports you send (which may include an e-mail address and free text you write).
• Relationships — links you form with other users (parent, friend, teacher, student) and the invitations/shares you send, so those features work.

We do not collect microphone or audio recordings. The "recording" feature reads notes from a connected MIDI keyboard in your browser only and never uploads them. MIDI is used for note input only (no device system data).

5. Why we use your data, and our legal bases (GDPR)

Where we rely on consent, you can withdraw it at any time.

6. Cookies and similar storage

We use only what the app needs to work:

• a sign-in session cookie (httpOnly) so you stay logged in;
• a language cookie to remember your chosen language;
• local storage on your device for your settings and progress.

We do not use advertising or cross-site tracking cookies. We do not currently use Google Analytics or any analytics tool. If we add privacy-friendly analytics in the future to help improve the app, we will update this policy and, where the law requires it, ask for your consent first.

7. Children's privacy

PianoKitty is designed to be family-friendly. You must be at least 13 to create your own account. A child under 13 may use PianoKitty only through a child account created and supervised by their parent or legal guardian. When creating that account, the parent/guardian gives consent for us to process the child's data for the sole purpose of providing the learning features; an e-mail address for the child is optional. We do not knowingly collect more data from children than needed, do not show them behavioral advertising, and never sell their data. The parent/guardian can review, control and delete the child account and its data at any time by contacting us.

This reflects the EU GDPR rules on children's data and the US Children's Online Privacy Protection Act (COPPA). If you believe a child has given us data without the required parental consent, contact us and we will delete it.

8. Who we share data with

We do not sell your data. We share it only with:

• Service providers who help us run PianoKitty — our hosting/server infrastructure and a content-delivery/security proxy (Cloudflare), which may process your IP address to deliver and protect the site. E-mail is sent from our own mail server.
• Sign-in providers you choose (Google, Facebook, Apple) — only to authenticate you.
• Optional third parties you switch on — e.g. cat or dog image rewards (cataas.com, dog.ceo), a reward endpoint you configure, or a video you embed (YouTube/Vimeo). Data only leaves your device if you enable these.
• Other users you choose — when you share an exercise, send an invitation, or form a relationship.
• Authorities — where we are legally required to.

9. Where your data is stored (international transfers)

PianoKitty is operated from Poland and our servers are located in the European Union. Some providers (such as our security/CDN proxy or the sign-in providers) may process data outside the EU; where they do, appropriate safeguards apply. Because the app is available worldwide, using it from another country means your data is handled as described here.

10. How long we keep it

• Account data — until you delete your account (or ask us to).
• Sign-in sessions — up to about 30 days, then they expire.
• Detailed per-exercise play history — automatically removed after about a year.
• A minimal suppression record — kept if an e-mail bounced or you unsubscribed, so we don't contact you again.

11. How we protect your data

We hash passwords, use httpOnly session cookies, serve the site over encrypted connections, and rate-limit sensitive actions. However, no method of storage or transmission is 100% secure, and because PianoKitty is early-stage software we cannot guarantee absolute security. Please use a strong, unique password.

12. Your rights

If you are in the EU/EEA or UK (GDPR/UK GDPR), you have the right to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent. You may also lodge a complaint with your data-protection supervisory authority.

If you are in California (CCPA/CPRA) or another US state with a privacy law, you have the right to know what we collect, to access and delete it, to correct it, and to opt out of the "sale" or "sharing" of personal information — we do not sell or share it for advertising. We will not discriminate against you for exercising these rights.

Wherever you live, you can ask us to show you your data or delete it. To exercise any right, contact us (below) — we may need to verify your identity first.

13. Deleting your account and data

You can delete your account and associated data at any time. Contact us at the e-mail below or via the contact page and we will delete them. If you only used the app as a guest, simply clear your browser's storage.

14. Changes to this policy

As PianoKitty evolves, we may update this policy. We will change the date at the top and, for material changes, let you know in the app.