1. Who we are and what this policy covers
SightFlow Piano (“SightFlow,” “we,” “us,” or “our”) operates the piano sight-reading website and browser application available at sightflow.art (the “Service”). SightFlow is the controller of the website and analytics information described in this policy. This policy applies to the Service, but not to third-party websites that we link to.
You may use Guest Mode without an account or sign in with Google OAuth or an email magic link. Account creation gives us your account ID, email address, and, where provided by you or your sign-in provider, display name and avatar. We do not ask you to create a SightFlow password. SightFlow shows no advertising. If you subscribe to SightFlow Pro, Paddle handles the payment as described in Section 3.
2. On-device information and optional cloud sync
Guest Mode requires no account. Its practice progress and preferences stay in your browser and are not synced to a SightFlow account. Whether or not you sign in, the following content is processed locally and is not included in cloud sync:
- Detailed note-by-note practice records, including pitch and timing results.
- The contents of MusicXML, MXL, and MuseScore files that you choose to open.
- Raw MIDI note-on, note-off, and velocity messages from a connected MIDI device.
- Audio created by the Service. SightFlow does not request microphone access or record ambient audio.
Imported score contents are kept in browser storage, including IndexedDB. Detailed note records and unsynced guest progress remain in browser storage such as localStorage.
If you sign in, we sync your profile, current grade and practice totals, streaks and daily activity, lesson progress and stars, assessment results and item summaries, custom generator exercises, the Free plan’s daily practice time, and preferences such as theme, sound, metronome, and playback settings to Supabase. This lets you recover supported progress on another device. Imported score files and detailed note-by-note or raw MIDI data are not part of this sync.
3. Information sent when you use the Service
Accounts and cloud sync
If you sign in, Supabase processes your account email, account ID, session data, and the synced profile and practice data listed above. For Google sign-in, Google Identity Services processes the sign-in request and shares the account information needed to authenticate you. Email magic links are sent to the address you enter.
Payments and subscriptions
SightFlow Pro is sold through Paddle.com, which acts as the Merchant of Record. When you subscribe, Paddle collects and processes your name, email address, country and postal code, payment details, and tax information to take payment, calculate tax, prevent fraud, and send receipts and billing emails. Paddle handles this information under the Paddle Privacy Policy. We never receive your full card number.
When you open the checkout, your browser loads Paddle’s checkout script from Paddle’s servers, and we pass Paddle your account email and SightFlow account ID so the purchase is linked to your account. Paddle then sends us, and we store in Supabase, your Paddle customer ID and subscription ID, your plan and billing interval, the subscription status, the current billing period dates, the currency, and whether the subscription is set to cancel.
Website requests and hosting data
Like most websites, requests must pass through our hosting provider, Vercel. Vercel may process network and diagnostic information such as your IP address, request date and time, requested URL, referring page, browser and device information, and security or error data. This is used to deliver the Service, maintain reliability, prevent abuse, and investigate technical problems.
Vercel Web Analytics
We use Vercel Web Analytics to understand aggregate usage. It may receive a timestamp, page or route, referrer, filtered query parameters, approximate location derived from the request, operating system, browser, device type, and analytics script version. Vercel states that Web Analytics does not use third-party cookies, does not associate analytics with an IP address, and resets its visitor hash after 24 hours. See Vercel’s Web Analytics privacy information.
We also send the following product events to Vercel Web Analytics:
- When a custom score is imported: the file name, file extension, and number of bars. The score contents are not included.
- When a practice-data backup is exported: the number of note records exported.
- When a practice-data backup is imported: the number of valid note records imported.
A file name can contain personal information. Do not include personal or confidential information in a score’s file name if you do not want that information included in an analytics event. We do not send raw MIDI messages, note-level performance records, or imported score contents to Web Analytics.
Piano sound samples
When the piano audio engine is first loaded, your browser requests a soundfont file from gleitz.github.io, a GitHub Pages site used by the audio library. GitHub may receive ordinary web-request information such as your IP address, browser information, requested resource, date, time, and referrer. The request does not include your MIDI input, practice history, or imported score. GitHub describes its processing in the GitHub General Privacy Statement.
4. Why we process information
We process the information described above to:
- Provide, secure, and troubleshoot the Service.
- Authenticate optional accounts and sync requested progress and preferences across devices.
- Sell and manage Pro subscriptions, and give subscribers access to Pro features.
- Measure aggregate traffic, feature use, and technical performance.
- Improve the curriculum, exercises, compatibility, and user experience.
- Prevent fraud, abuse, and attacks, and comply with legal obligations.
Where the GDPR, UK GDPR, or a similar law applies, our legal bases are our legitimate interests in operating, securing, and improving the Service; performance of a contract when processing is necessary to provide a feature you request; compliance with legal obligations; and consent where the law requires it. You may object to processing based on legitimate interests as described below.
5. Browser storage, cookies, and controls
SightFlow uses browser storage, including localStorage and IndexedDB, to remember settings, progress, and imported scores. Signed-in sessions also use browser storage to keep you authenticated. Local storage is not sent with every web request like a cookie. Vercel Web Analytics is cookie-free, and SightFlow does not use advertising cookies or cross-site advertising trackers.
You can delete SightFlow’s local data through your browser’s site-data settings. Clearing browser data does not delete data already synced to your account; request cloud deletion as explained below. Files you exported as backups remain wherever you saved them and must be deleted separately.
6. When information is shared
We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We may disclose limited information:
- To Vercel, which provides hosting, delivery, security, and analytics services. Vercel’s own handling is described in its Privacy Notice.
- To Supabase for authentication, user sessions, and database hosting when you sign in.
- To Google Identity Services when you choose Google OAuth sign-in.
- To Paddle, our reseller and Merchant of Record, when you subscribe to Pro or manage your subscription.
- To GitHub when your browser downloads the piano soundfont from a GitHub Pages site.
- When reasonably necessary to comply with law, legal process, or a valid government request.
- To protect the rights, safety, and security of SightFlow, users, or the public.
- As part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice where required.
7. Retention
- Local practice data remains on your device until you clear it, the browser removes it, or the application overwrites older records under its storage limits.
- Account, synced practice data, and subscription records remain in Supabase while your account is active and are deleted when you delete your account, subject to applicable legal retention obligations.
- Paddle keeps payment, invoice, and tax records for as long as tax and financial laws require, including after you cancel or delete your account.
- Vercel’s analytics visitor hash resets after 24 hours. Aggregated analytics and custom-event data are retained according to our Vercel plan and settings.
- Hosting and security logs are retained by Vercel under its applicable service settings and legal obligations.
We retain information under our control only as long as reasonably necessary for the purposes described above, including security, dispute resolution, and legal compliance.
8. International processing
SightFlow and its service providers, including Vercel, Supabase, Paddle, and Google when used for sign-in, may process information in countries other than the one where you live, including the United States. Where required, service providers use recognized safeguards for international transfers. Details about Vercel’s transfer mechanisms are available in its Data Processing Addendum.
9. Your privacy rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or an objection to certain processing, and to withdraw consent. You may also have the right to complain to your local data-protection authority. SightFlow does not discriminate against users for exercising applicable privacy rights.
You can delete your account at any time in Preferences with Delete account. This cancels any Pro subscription immediately and deletes your profile, synced practice data, and subscription records from Supabase. Paddle keeps the records it is legally required to keep; to request deletion of other information Paddle holds, contact Paddle as described in its privacy policy.
To request access, correction, or deletion of your account and cloud-stored profile or practice history by email instead, email varnavsky06@gmail.com from your account email and tell us what you want deleted. We may verify your identity before acting. Signing out or clearing browser data does not delete your cloud account. Deleting the account removes its associated cloud records, subject to applicable legal exceptions; you can separately clear local data using your browser’s site-data controls. We cannot remotely delete data that exists only on your device.
Analytics is designed not to identify individuals, so we may be unable to connect an analytics record to a particular requester. We will explain if we cannot fulfill a request for that reason.
10. Children’s privacy
SightFlow is a general-audience music education tool. Optional accounts collect an email address and may receive a name or avatar from the sign-in provider. A child who is not old enough to consent under applicable law should use the Service only with a parent or guardian’s permission and supervision. If we learn that a child’s information was collected without required consent, contact us at the address above so we can investigate and take appropriate action.
11. Security and data loss
We use reasonable technical and organizational safeguards, including account-based access controls for cloud data, but no browser, network, or storage system is completely secure. Guest progress and imported score contents can be lost when local storage is cleared, so keep your own backups if needed. Please do not use file names or imported backup files to store sensitive personal information.
12. On-device AI and automated adaptation
SightFlow runs procedural exercise generation in your browser using ONNX WebAssembly. It may use practice results to adjust difficulty, tempo, and lesson progression on your device. We do not send your keystrokes, detailed practice history, or personal data to OpenAI or other external LLM APIs for this processing. If you sign in, the limited progress summaries described in Section 2 are synced to Supabase. Automated adaptation is for music practice and does not make decisions with legal or similarly significant effects.
13. Changes to this policy
We may revise this policy as the Service changes. We will post the updated version here and change the “last updated” date. If a change materially affects how we use personal information, we will provide additional notice where reasonably possible or legally required.