Privacy Policy

MelodyLog is a practice logbook for musicians. For the purposes of applicable data protection laws, including the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA"), MelodyLog acts as the data controller for any Personal Data we collect directly through the Services.

When you use the Services, your practice sessions are stored and displayed back to you — in your history, statistics, and repertoire map. You remain responsible for the information you choose to record and how you use it.

We collect minimal information. Our guiding principle is to collect only what is necessary to provide and improve the Services.

2.1 Information You Provide Directly

• Account Information: To create an account, we collect your email address and a password (stored in securely hashed form).
• Practice Logs: When you log a practice session, we store the composer, work title, score section, minutes practiced, and the date you practiced.
• Favorites: We store the composers and works you mark as favorites so we can display them to you.
• Contact & Support: If you contact us via email, you may provide your name, email address, and any other information you choose to include.

2.2 Information Collected Automatically

• Technical Data: When you visit our website, our hosting infrastructure may temporarily process your IP address, browser type, operating system, referring URLs, and timestamps. This is standard for website delivery and security.
• Usage Data: We use Google Analytics, a third-party analytics service, to collect anonymized, aggregated information about how the Services are used, such as which pages are most popular and general performance metrics. This data does not include the content of your practice logs.
• Cookies & Similar Technologies: We use cookies and similar technologies for functional purposes and for analytics. See Section 8 for details.

We use the limited information we collect for the following purposes:

• To Provide the Services: Storing and displaying your practice logs and favorites, authenticating user accounts, and maintaining stability and security. Legal basis: performance of a contract and/or legitimate interest (Art. 6(1)(b) and (f) GDPR).
• To Communicate With You: Responding to your inquiries or support requests. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• To Improve the Services: Analyzing aggregated, anonymized usage patterns to understand which features are most valued and how we can enhance performance. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• To Ensure Security: Monitoring for and preventing abuse, fraud, and unauthorized access. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• To Comply With Legal Obligations: Meeting our obligations under applicable law, regulation, legal proceedings, or governmental requests. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

We do not use your Personal Data or practice logs for advertising, profiling, or any automated decision-making that produces legal effects concerning you.

This section describes how we handle the practice data you record.

4.1 Storage and Display

When you log a practice session or mark a favorite, the record is stored on our servers and displayed back to you in your history, statistics, and repertoire map. Your practice data is private to your account and is never shown to other users.

4.2 Your Control

You can delete individual practice logs at any time within the Services. To delete your account and all associated data, please contact us using the details in Section 12, and we will process your request.

We implement appropriate technical and organizational measures to protect any Personal Data we process:

• Encryption in Transit: All communication between your browser and our website is encrypted using TLS.
• Password Security: Passwords are stored only in securely hashed form; we never store or see plain-text passwords.
• Access Controls: Personal Data we hold is accessible only to authorized personnel bound by confidentiality obligations.

While we strive to protect your information, no method is 100% secure. We continuously work to improve our security posture.

We do not sell, rent, or trade your Personal Data. We may share limited Personal Data only in the following circumstances:

6.1 Service Providers

We engage trusted third parties to perform functions on our behalf:

• Hosting & Infrastructure: Website hosting and CDN services (including Cloudflare) may process IP addresses and technical data to deliver the site and protect it from abuse.
• Analytics: Google Analytics processes anonymized usage data on our behalf. Google's use of this data is governed by Google's Privacy Policy.

All providers are contractually bound to process data only on our instructions, in compliance with applicable data protection laws.

6.2 Legal Obligations

We may disclose Personal Data if required by law, court order, or valid governmental request.

6.3 Business Transfers

In the event of a merger or sale, Personal Data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

• Account Data and Practice Logs: Retained for the life of your account. You may delete individual logs at any time, and request deletion of your account and all associated data by contacting us.
• Support Emails: Retained for up to 24 months after resolution.
• Backups: Encrypted backups may retain data for a limited period and are purged in due course.

8.1 Strictly Necessary Cookies

Essential for website operation (security, authentication). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

8.2 Analytics Cookies

We use Google Analytics to understand which pages and features are most used. The data is aggregated and anonymized and does not include the content of your practice logs. You may opt out of Google Analytics across the web using Google's opt-out browser add-on, or by blocking analytics cookies in your browser settings.

8.3 Third-Party CDN Resources

Our website loads fonts and icons from Google Fonts and Font Awesome CDN, which may process your IP address. Please review their privacy policies: Google, Font Awesome.

8.4 Managing Cookies

You can control cookies through your browser settings. Disabling necessary cookies may affect website functionality.

Depending on your jurisdiction, you may have rights including access, rectification, erasure, restriction, portability, and objection. To exercise these rights, contact us using the details in Section 12.

CCPA Notice: California residents have the right to know what personal information is collected, to request deletion, and to opt out of the sale of personal information (we do not sell personal information). To exercise your CCPA rights, please contact us at the email below.

Our Services are not intended for individuals under 16, and we do not knowingly collect data from children. If we become aware that a child under 16 has provided us with Personal Data, we will delete it promptly.

We may update this policy from time to time. Material changes will be posted here with an updated "Last updated" date. Continued use after changes constitutes acceptance.

For any questions or requests regarding this Privacy Policy, please contact:

For formal privacy requests, please use the subject line "Privacy Request: MelodyLog."

This Privacy Policy was last updated on August 18, 2026, and is effective immediately. It replaces all prior versions.