Privacy Policy
Draft version 2026-10-30-draft
Draft. This text is a general starting point and has not been reviewed by a lawyer. Highlighted [bracketed] items must be completed before launch.
This Privacy Policy explains what personal information Summerris Piano (the "Service") collects, why, who we share it with, and the choices you have. The Service is operated by [legal owner name] ("we", "us"). You can contact us at [contact email].
We do not sell your personal information. The Service has no advertising and no analytics or tracking tools.
1. What we collect
| Information | When | Why |
|---|---|---|
| Email address and display name | When you create an account | To create and identify your account, confirm your email, and send account emails such as password resets |
| Password | When you create an account or reset it | To sign you in. We store only a secure one-way hash (Argon2), never the password itself |
| Personal fingerings you save | When you use the fingering editor while signed in | To show your own fingerings on your songs |
| Security and activity records | When you sign in, fail to sign in, sign out, request or complete a password reset, or confirm your email | To protect accounts and the Service from abuse and to investigate problems. Email addresses in these records are stored as one-way hashes. An IP address is recorded only when we can determine it |
| Session cookie | When you sign in | To keep you signed in (see section 3) |
You can browse and play public songs without an account. We do not ask for payment details; if payments are added later, they will be handled by a payment provider and this policy will be updated.
2. How we use information
- To provide, secure, and improve the Service and your account.
- To send emails that are necessary for your account (confirmation and password reset). We do not send marketing emails without your consent.
- To detect and prevent abuse, such as repeated failed sign-in attempts.
- To meet legal obligations.
3. Cookies and data kept on your device
- Session cookie: an essential cookie that keeps you signed in, for up to 14 days. It is not used for tracking.
- Browser storage: the Service saves settings such as screen calibration and zoom, and your recent conversation on the home page, in your browser's local storage on your own device. This is not sent to us and you can clear it in your browser settings.
4. Who we share information with
We share information only with the service providers that help us run the Service:
- Render, our hosting and database provider (servers in Singapore).
- Resend, which delivers our account emails. It receives your email address and the email content.
- Google Fonts, which supplies fonts to our pages. Your browser requests them directly, so Google can see your IP address.
We may also disclose information if the law requires it, or to protect the rights and safety of users and the Service. Your information may be processed in countries other than your own, including Singapore and Japan.
5. How long we keep information
- Account details and saved fingerings: until you ask us to delete your account.
- Password-reset links expire after 30 minutes and email-confirmation links after 24 hours.
- Sign-in rate-limit records: about 1 day.
- Security and activity records: up to 365 days, and records of failed sign-ins up to 30 days.
6. Security
We protect your information with measures including encrypted connections (HTTPS), hashed passwords, limits on repeated sign-in attempts, and restricted administrator access. No system is completely secure, so we cannot guarantee absolute security.
7. Your choices and rights
You can ask us to give you a copy of the personal information we hold about you, correct it, or delete your account and the information linked to it, by contacting [contact email]. We may need to confirm your identity first. Depending on where you live, you may also have the right to complain to your local privacy regulator. [Name the regulator for your jurisdiction after legal review.]
8. Children
The Service is not directed at children under [16]. We do not knowingly create accounts for them. If you believe a child has given us personal information, please contact us and we will delete it.
9. Changes to this policy
We may update this policy. If a change is significant we will tell you, for example by email or a notice on the Service. The version number at the top shows which text applies.
10. Contact
Privacy questions or requests: [contact email].