Privacy policy

What we keep, and why

Your account

• Your email address, name, handle, and optionally an avatar, a bio, and your X or Bluesky handle (so we can credit you if we post your harmony with your OK).
• How you sign in: a password (stored only as a secure hash), or an account id from Google, Apple or Event Schedule. For Apple, a token we use only to tell Apple when you delete your account (stored encrypted). One-time sign-in links we email you.
• The browsers and apps you're signed in on: for a browser, a random code and when it was last seen (so we can tell you about a sign-in from a new one); for an app, the device's name, model and system, the app's version, how you signed in, and when.
• Your time zone, language, the app's look you chose, and your notification settings.
• The month and year you were born (never the day). We use them only to tell whether you're 13, or 18, yet, and never show them to anyone. An account made before we asked for it may instead have told us it was 13 or over (and, for some features, 18 or over); it's asked for the month and year once.
• How you heard about Stackapella if you tell us, the link you came from (such as a shared harmony's), and an early-access link if you used one.
• Leaderboard scores: your best score on each part of each song (with how you sang it: on your own or recording, the key, the speed, whether the guide was off and your timing checked, and the per-note results), and the take it came from, which is kept while the score is: delete the take and the score goes with it. Your friends on the boards (people who accepted your challenge, or you theirs, sing on a song with you, or share a group with you) see your name and score on that song's board. If you choose to appear on the worldwide board (18 and over), anyone signed in sees your name and score there, and we may listen to that take to check the score. Under 18, you appear on friends' boards only, by your first name, and a challenge link never connects you to anyone.
• Your country, worked out from your connection when you sign up or sign in (our network provider, Cloudflare, tells us), to understand where people use Stackapella. We keep only the latest country, never your IP address with it or a precise location.
• An automatic trust level (0 to 3), worked out from things like whether your address is confirmed, how long you've had your account, your practice and payments, and reports we upheld. It sets some limits (how much a new account can share at first, for example), and isn't shown.

We use these to run your account, keep it secure and contact you about it.

Your singing and learning

• Your projects: their parts, your recordings (takes), each take's outline and settings, and your scores.
• Your practice: course progress, XP, badges, your weekly goal, and your league and its weekly XP.
• Templates you make, and harmonies you share (their mix, share card and share video).
• What you add for others: voices on a choir or an idea, parts you sing for an open part, likes, follows, blocks, comments, song requests and votes, ratings, and the notifications in your bell.

We use these to save your work across your devices, to show you your progress, and to share what you choose to share.

Coaching, teachers and groups

• What you send a coach or teacher (a take, its pitch track and scores, your question), their feedback, your messages, lessons you book (their times, your time zone and notes), problems you report, exercise packs you buy, and ratings you give.
• Your groups, and the parts assigned to you.
• If you coach: your application, your profile, your Stripe payout account, and the Event Schedule or Invoice Ninja account you connect.

Payments

• Stripe handles your card. We never see or store card numbers. We keep your plan, its dates and payments, the country your connection came from when you checked out (for tax and the EU and UK cooling-off rules) and whether you asked Plus to start at once, and a card fingerprint from Stripe (a code, not card details) so each card gets one free trial. Stripe may also tell us your card's brand and last four digits.
• Plus bought in an app: the App Store's or Google Play's purchase record (its token stored encrypted), linked to you by a random code.
• Any payment dispute.

Keeping Stackapella safe

• A record of sign-ups, sign-ins (and refused ones), password and email changes, account deletions, failed payments, refused trials, rate limits and blocks, with the IP address. After 30 days only a scrambled code (a keyed hash) is kept in place of the address, and the record goes after a year. Our rate limits only ever store that scrambled code.
• While you use the app, your session keeps your IP address and browser details (it ends after 4 hours without use).
• Reports you make, and any notice we've given your account and your appeal.
• A log of every change an admin makes.

Support

• Messages you send us, your email address, and our replies. If you leave Include device details on (it's on for problems with recording, and you see it before sending), the message also carries your app version, your browser's details, the device, the page you were on and your last timing check; the apps may add their last few audio errors.

Notifications (only if you turn them on)

• Practice reminders: your browser's push subscription, the days and time you chose, and your time zone.
• In the apps: your device's push token (stored encrypted), and which kinds of news you want and your quiet hours.
• Turn either off at any time, in Settings.

Beta singers (only if you're one)

• Your name, email, notes, credit, rate and payments, and your submissions: the recordings, your device and mic, and their scores.

Who can see what

• You, on every device you sign in on.
• Friends you invite to a project hear the parts on it. Their takes on your project count toward your storage, and are marked as theirs.
• Anyone with a share link can hear that harmony, and see its title, its card and video, and the names and pictures of the people who sang on it. The page can be embedded elsewhere.
• When you make something public (18 and over only): anyone can see your public profile (your name, handle, picture and bio, the harmonies you put in the gallery, and how many people you follow and follow you), your comments, and hear your public harmonies. Someone you follow is told it was you, as is someone whose harmony you like. Your league shows your name, picture and weekly XP to its members. A choir or an idea shows your voice with your name (or "a singer", if you chose that), and a library song is credited to you. A public harmony's parts may be used as guide voices for other singers (we listen to public harmonies to choose them, and may make one the voice a part plays first), or sung with as an open part, credited to your profile's name, and we may feature it on our accounts. A share link alone is never public. You can take any of it back at any time: turn featuring off, take a harmony out of the gallery, make your profile private, or delete it.
• People you block don't see your profile, harmonies or comments while signed in, and you don't see theirs.
• A coach or teacher sees your name and picture and what you send them, and a coach's access ends 90 days after the coaching ends.
• A group's director sees your name and picture, when you joined, and whether each assigned part is not started, started or recorded (and when that changed), never your recordings or contact details.
• Coach ratings you give are shown on the coach's profile, with your first name and initial.
• Our team can see what's needed to answer support and reports, and how much you use the app (how many songs and takes, lessons and stars, your streak, practice minutes, storage used, and when you last did something), but not what you made: not your recordings, the titles or contents of private songs, or your birth date (only whether you're 18 or over). Every change an admin makes is logged.

Services that handle your data for us

• DigitalOcean (App Platform, Managed MySQL, Spaces and its CDN): Everything we store: accounts, recordings, shared harmonies, backups; requests for public files. For hosting and storage.
• Cloudflare: Every request at the edge; the email we send (addresses and the emails) and bounces; Turnstile, with your IP address, only in shield mode. For protection, email, bot checks.
• Stripe: Your card, name, email and billing address; coaches' payout accounts (their email and country to start). For payments, tax and payouts.
• Google: Sign-in (an account id, a name, an address); Google Play purchases and their notices; Firebase Cloud Messaging, for the Android app's notifications (each notification's words, such as a singer's name or a harmony's title, and your device's push token). For signing in, Plus in the app, notifications.
• Apple: Sign in with Apple (an account id, an address); App Store purchases and their notices; Apple Push Notification service, for the iPhone and iPad app's notifications (the same as Google's). For signing in, Plus in the app, notifications.
• Your browser's push service (Google, Mozilla, Apple or Microsoft): An encrypted reminder, to the address your browser gave us, only if you turn practice reminders on. For practice reminders.
• Event Schedule (when you connect it, or sign in with it): Sign-in; a lesson's time, the singer's name, address and notes. For signing in, booking lessons.
• Invoice Ninja (when a coach or Stackapella connects it): A singer's name and address on a coach's invoice; a Plus buyer's name and address in Stackapella's own books; a coach's on our commission invoices. For bookkeeping.
• Sentry (when set up): Errors, with your account's id and browser type, never your name, address, IP or recordings. For fixing bugs.
• X, Bluesky: What we post: a song, or a harmony its singer said yes to, with the singer's name and their handle there. For our own accounts.
• jsDelivr: Your IP address, as the app's code libraries load. For delivering the app.
• Google Fonts: Your IP address, as the app's and the pages' fonts load. For the look of the app and pages.

No third-party analytics, no advertising, no tracking scripts.

Our storage is in DigitalOcean's New York region, so your data is held in the United States.

Cookies and storage on your device

• The session cookie, and XSRF-TOKEN: Keeps you signed in, and protects your requests from other sites. Set when the app starts, signed in or not. Kept 4 hours without use.
• The sign-in cookie (remember_web): Keeps you signed in on this device until you sign out, so closing the browser doesn't sign you out. Set whenever you sign in, kept up to five years and renewed when you come back (some browsers keep a cookie at most about a year). Signing out ends it on that device; "Sign out everywhere" ends it on every device.
• A device code (stackapella_device): Tells us a sign-in is from a browser you've used before, so we only email you about new ones. Kept up to two years.
• sa_pass (before launch only): Lets beta testers in. Kept until launch.
• sa_app: Remembers you've used the app, so the home address opens it. Kept a year.
• sa_theme: Remembers the look you chose. Kept a year.
• sa_mudeo: Remembers you came from mudeo, to show its welcome. Kept until you close the browser.
• sa_mudeo_used: Set once someone who came from mudeo starts singing, so our daily count of how many did counts them once. Holds nothing about you. Kept until you close the browser.
• Apple's sign-in check (stackapella_apple): Checks a Sign in with Apple came from you. Kept 10 minutes.

The app also keeps your songs, recordings, settings and its own files in your browser's storage, so it works offline; once you sign in, your projects and progress are also saved to your account. It remembers the link you came from until you sign up. Turnstile, Cloudflare's bot check, runs only while we're protecting the app from an attack.

Emails we send

Only about your account or something you did: confirming your address, a one-time sign-in link, resetting your password, a sign-in from a new browser or app, a change of email (to your old address too, with a way to undo it), a note if someone tries to sign up with your address, a trial ending, a failed payment, your data download being ready, answers to your support messages, and a notice if your account is suspended. If support moves your account to a new address, the old one is told. If you share a tune as an idea, we email you when people sing it (at most once a day for each idea); turn that off in Settings or with the link in each email. Stripe sends payment receipts.

Separately, we sent former mudeo users one email about Stackapella, with a one-click unsubscribe.

How long we keep it

• Your account and work: while your account is open.
• Deleted projects and replaced or deleted takes: in Recently deleted for 30 days, so you can restore them, then removed.
• Security records: the IP address 30 days, then the scrambled code; the record a year.
• Sessions: 4 hours without use. Browsers you've signed in on: a year after last seen. App sign-ins: 30 days after you sign out, or after they run out.
• One-time links: sign-in links a day; other email links a day after they're used or run out.
• Data downloads: 7 days. Share videos: 7 days. Unfinished uploads: a day.
• A handle you change away from: held for you for 30 days.
• Messages to support: two years after the last reply, or until you delete your account.
• Records of what admins change, reports and our posts: kept as a record for 7 years.
• Backups: database backups are kept for 30 days (daily) and 12 months (monthly), and earlier versions of stored files for 30 days. A deleted recording's copy in the file backups goes within six weeks of its deletion. Data downloads are never backed up.
• Payment records: 7 years, as tax and accounting law requires.

When you delete your account

• Your recordings are deleted from storage, and your shared harmonies are taken down, as are other people's shared harmonies with your voice in them.
• Your singing is taken out of other people's projects, and parts you made on them pass to their owners. Your voices on choirs and ideas go.
• Your comments and likes are deleted, and coaching ratings you gave stay without your name.
• Plus bought on the web is cancelled; Plus bought in an app is cancelled by you in the App Store or Google Play (we can't cancel it there). Open coaching is refunded, or the coach is paid for what they've delivered.
• Records of payments are kept without your name, as the law requires (invoices already sent keep it).
• Reports about you go; reports you made stay, without your name.
• Your connections to Event Schedule and Apple are ended.
• Your handle is held so nobody else can take it and pose as you.
• If you sang guides for the library, they're removed from the app.

Your rights

You can see, download, correct and delete your data:

• Download my data in Settings emails you a link to a file of your account, projects, harmonies, coaching and other records, with links to download your recordings (both valid for 7 days). It leaves out secrets (such as sign-in tokens) and our own security records.
• Correct your details in Settings.
• Delete my account in Settings.

You can also write to [email protected] to ask what we hold, to object to a use, or to ask us to limit it. Where the law gives you the right, you can complain to your data protection authority.

Children

You must be 13 or over to have an account. We ask when you were born (month and year). If someone under 13 signs up, the account isn't made and their answer isn't kept; if they signed in with Google or Apple first, the app deletes the account when they tell us. They can still sing without an account.

Under-18s can share by link but never make anything public: no public profile, gallery, comments, follows, featuring, choirs, ideas, open parts, library songs or public leagues. Coaching, teachers and choir groups are 18 and over too. We never ask for or store your precise location: we keep your time zone, the country you paid from, and IP addresses as above.

Keeping it safe

Recordings in your account are stored privately and reached only through links that expire within hours (your data download's, within 7 days). What you share is stored at an address nobody can guess, while it's shared. Passwords are stored only as secure hashes, and connections to other apps and the apps' push tokens are stored encrypted. Admin access needs a second factor. If you find a security problem, please see our security policy.

Changes

If we change this policy in a way that matters to you, we tell you in the app before it applies. Each version is numbered.