Privacy Policy

1. Who we are

iPitch (the "App", "we", "us") is operated by Angela Ekstrom, registered at 555 North Star Crest Dr, Salt Lake City, UT 84116, USA. For privacy questions contact noetica@noeticaapps.com.

2. The short version

• Real-time microphone audio (tuner, coach) is processed on your device. We do not record, stream, or upload it.
• Voice recordings you save in the Backing Track Studio are stored privately in your account. They are never used to train AI models and are deleted when you remove them.
• Practice data (scores, range, sessions) is stored locally in your browser's localStorage.
• No advertising trackers, no third-party analytics are embedded in the app today.

2a. Categories of personal data we process

• Account data — email address, hashed password (or OAuth identifier), display name, and account creation date. Legal basis: contract performance.
• Voice recordings — audio files you explicitly save in features like the Backing Track Studio, stored in your private account storage bucket. We do not access the contents except to serve the file back to you. Legal basis: contract performance.
• Practice metadata — backing-track keys, tempos, moods, prompts, and clip durations (no audio analysis). Legal basis: contract performance.
• Subscription data — plan, status, renewal date, and Paddle customer / subscription IDs. Card details are held by Paddle, not by us. Legal basis: contract performance and legal obligation.
• Operational logs — IP address, user agent, and timestamps for security, abuse prevention, and debugging. Legal basis: legitimate interest.
• Support correspondence — messages you send to our support inboxes and our replies. Legal basis: legitimate interest.

We act as the data controller for everything listed above, except for payment data, where Paddle is an independent controller for the transactions it processes on our behalf.

3. Microphone access

When you open the tuner or a coaching lesson, your browser asks for microphone permission. The audio stream is read by an in-browser audio worklet, converted into pitch and stability values, and immediately discarded. The raw audio is never written to disk, sent over the network, or shared with any third party.

You can revoke microphone access at any time in your browser or system settings. Without it, the app will run but the tuner and coach cannot score your singing.

4. Information stored on your device

We use the browser's localStorage to remember your progress so the app feels personal. Specifically:

• Calibrated voice range (lowest, highest, center MIDI note plus a calibration timestamp).
• Session history (lesson id, score, per-note accuracy summary, timestamp). Capped at the most recent 200 sessions.
• UI preferences such as dismissed warnings.

This data lives only in your browser. Clearing your site data, using the in-app "Reset" controls, or switching browsers will remove it. We cannot recover it for you.

5. Information we do not collect

• We do not record or store your voice.
• We do not collect contact lists, location, or device identifiers.
• We do not run third-party advertising networks.
• We do not sell, rent, or trade personal information.

5a. Third-party processors (subprocessors)

We share a minimal amount of data with the following processors so the Service can run:

• Supabase (hosting, database, and account storage) — stores account email, hashed credentials, subscription status, your saved backing-track metadata, and the audio files you choose to save. Audio is held in a private bucket scoped to your user ID.
• ElevenLabs — used in two ways: (a) generating the spoken coach voice (short text prompts are sent and audio is returned), and (b) generating instrumental backing tracks from a short text prompt (key, mood, tempo). No microphone audio, voice recordings, or personal identifiers are sent to ElevenLabs in either case. See elevenlabs.io/privacy.
• Paddle.com Market Ltd — our Merchant of Record for paid plans. Paddle handles checkout, billing, tax, and invoicing, and acts as an independent data controller for payment data. See paddle.com/legal/privacy.
• Cloudflare (edge hosting and CDN) — serves the website and may keep short-lived request logs for security and performance.

5b. Data retention

• Account data: kept while your account is active, deleted within 30 days of account closure.
• Voice recordings: kept until you delete them; deleted recordings are removed from storage within 30 days.
• Subscription records: retained for 7 years to meet tax and accounting obligations.
• Operational logs: rotated within 30 days unless needed for an active security investigation.

5c. Security

We use industry-standard technical and organisational measures including TLS in transit, encryption at rest for stored audio, row- level security on user data, scoped service credentials, and the principle of least privilege for staff access. No system is perfectly secure; if we ever experience a breach affecting your data we will notify you and the appropriate authorities as required by law.

6. Hosting and logs

The website is served by our hosting provider, which may keep short-lived request logs (IP address, user agent, timestamp) for operational and security reasons. These logs are not used to profile you or build a marketing identity, and are retained only as long as needed for security and abuse prevention.

7. Cookies

The app does not use advertising cookies. We may use a small number of strictly necessary cookies or local storage entries to keep the app working (e.g. remembering you dismissed a warning). See our Cookies notice for details.

8. Children

iPitch is not directed to children under 13 (or under the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with information, please contact noetica@noeticaapps.com and we will delete it.

9. Your rights

Depending on where you live (EU/UK GDPR, California CCPA, and similar laws elsewhere), you may have rights to access, correct, delete, or port your personal data, and to object to certain processing. Because we do not collect personal data on our servers in this release, most of these rights are exercised directly inside the app — for example by using the in-app "Reset" controls or clearing site data in your browser. For anything else, email noetica@noeticaapps.com.

10. International transfers

Hosting providers may process operational logs in countries other than yours. Where required, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) for international transfers.

11. Changes to this policy

We will post any changes on this page and update the "Effective" date at the top. Material changes affecting how we handle personal data will be highlighted in-app where reasonable.

12. Contact

Questions or requests: noetica@noeticaapps.com. Postal: Angela Ekstrom, 555 North Star Crest Dr, Salt Lake City, UT 84116, USA.

Future changes once accounts and payments are added

When we introduce accounts and paid plans, this policy will be expanded to cover: account email and authentication metadata, subscription status (handled by our payments provider as merchant of record), and any optional cloud-sync of your practice history. We will notify you in-app before that change takes effect.