Privacy Policy

Last updated: 22 October 2026

1. Who is responsible

The data controller is AbcMusicStudio, 41 Rue Du Levain 44190 CLISSON.

For any question about your data, or to exercise the rights in section 8, write to contact@abcmusicstudio.org.

2. The short version

  • Local Free accounts keep their music in the browser. We cannot read it.
  • We ask for as little as possible: an email address is the only thing strictly required to have an account.
  • We never see your payment card. Paddle handles payments as merchant of record.
  • We do not run advertising, we do not profile you, and we do not sell or share your data with anyone for their own purposes.
  • We count visits with our own software on our own server, which sets no cookies and measures pages rather than people.

3. What we collect

Account data. Your email address and an encrypted form of your password. Optionally, if you fill them in: first and last name, an avatar, a phone number, a biography, the instruments you play, and a public profile slug. Everything beyond the email address is optional and can be removed at any time.

Your musical content. For Cloud accounts: your tunes in ABC notation, comments, tablature settings, the audio, image and PDF files you attach, and — because Cloud includes version history — previous versions of those tunes.

Preferences. Theme, language, instrument and display settings, stored partly on our servers and partly in your browser’s local storage.

Subscription data. For paying accounts: your plan, its status, the current billing period, and the customer and subscription identifiers issued by Paddle. Not your card details.

Technical data. Server logs recording requests, which may include IP addresses, kept for a short period for security and debugging.

Audience measurement. We count visits using Umami, which we run ourselves on our own server rather than sending anything to a third-party analytics service. It sets no cookies. For a visit it records the page you were on, the site that sent you to us if there was one, your browser, operating system and device type, and the country the visit came from. It is never linked to your account, and it is not used to identify you or to follow you onto other sites.

We do not collect your browsing history on other sites, advertising identifiers, or location data beyond the country described above.

4. Local Free accounts: stored in your browser

If you use the free tier, your tunes, attachments and folder structure are stored inside your browser (OPFS and a browser-local database) on the device you are using. They are not sent to us, and we have no way to read, recover or restore them.

If you connect a personal cloud provider (Google Drive, Dropbox, OneDrive) for backup, the copy goes directly from your browser to your own account with that provider, under their privacy policy. It does not pass through us.

5. Why we process your data, and on what basis

What Why Legal basis (GDPR)
Email, password Sign you in, secure your account Performance of a contract
Your musical content (Cloud) Provide the storage and versioning you paid for Performance of a contract
Profile fields Show them to you, and publicly only if you opt in Consent
Subscription data Bill you, manage renewals and cancellations Performance of a contract / legal obligation
Transactional emails Password resets, subscription and account notices Performance of a contract
Update emails Tell you about new features Consent — opt-in, withdrawable
Server logs Keep the Service secure and working Legitimate interests
Backups Protect your content against loss Legitimate interests

6. Who else is involved

We use a small number of processors and services. They receive only what they need:

  • Paddle.com Market Ltd — payments, as merchant of record. Receives your email and billing details; handles card data entirely. Paddle’s privacy notice
  • pCloud — encrypted server backups, stored on EU servers.
  • Resend — sending transactional email (password resets, confirmations, subscription notices).
  • Gandi — the server the Service runs on, located in France.
  • Gravatar and DiceBear — only if you choose one of those avatar options; your browser then contacts them directly.
  • thesession.org and iTunes — only when you search for tunes or media; the search terms you type are sent to them through our server.
  • YouTube — when you search for or watch videos. See “YouTube API Services” below.

The audience measurement in section 3 is deliberately not on this list. We run it on the same server as the Service, so those figures never reach anyone else.

We do not sell your data, and none of these parties may use it for their own purposes.

YouTube API Services

AbcMusicStudio uses the YouTube API Services to search YouTube for recordings of a tune, and it shows YouTube videos in embedded YouTube players. By using these features you agree to be bound by the YouTube Terms of Service. Google’s use of data is described in the Google Privacy Policy.

  • What we send to YouTube. A search starts only when you ask for it. Our server sends YouTube the search words (the tune title and its rhythm, which you can edit before searching). The request comes from our server, not your browser, and carries no name, email address or account identifier.
  • What we keep. Search results are kept in our server’s memory for up to six hours, so that the same search made again is answered without asking YouTube. That copy is shared by all users, records nobody’s identity or searches, and disappears when the server restarts. When you choose to attach a video to a tune, the tune stores that video’s link, title and thumbnail address: on our server for Cloud accounts, in your browser for Local Free accounts. They stay until you remove the video or the tune; section 7 says how long deleted items remain recoverable.
  • The embedded player. A video attached to a tune, or previewed from the search results, plays in a YouTube player loaded from www.youtube-nocookie.com, YouTube’s privacy-enhanced mode, straight into your browser when it is shown. In that mode YouTube does not store cookies for the video until you play it; once you do, it may place or read cookies and collect information about your device, under its own terms and the Google Privacy Policy. The demo videos in the in-app help use the same domain, and their player loads only once you press play.
  • No access to your Google or YouTube account. These features never ask you to sign in to Google or YouTube and never read your YouTube account, so there is no YouTube access to revoke. If you have connected Google Drive for backups (section 4), you can withdraw that permission at any time on Google’s security settings page.
  • Questions about this go to contact@abcmusicstudio.org.

7. How long we keep it

  • Account and content: for as long as your account exists.
  • Deleted tunes and folders: kept recoverable for about 30 days, then removed permanently.
  • Version history (Cloud): kept for the life of the account, since its purpose is to let you go back.
  • Closed accounts: the account record, database schema, stored files and version history are deleted. Backups already taken are overwritten as they rotate.
  • Server logs: a short period, typically 4 days.
  • Invoices: kept by Paddle for as long as tax law requires.

8. Your rights

If you are in the EU/EEA or the UK you have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, to withdraw consent, and to receive your data in a portable format.

Two of these are built into the Service: the Export function gives you your whole repository as a file at any time, and Cancel subscription on the Configuration page downloads a copy of your folders and tunes when you cancel.

For anything else, write to contact@abcmusicstudio.org; we will reply within one month. If you are unhappy with our response you can complain to your data protection authority — in France, the CNIL (cnil.fr).

9. Cookies and local storage

We use no advertising or analytics cookies. The audience measurement described in section 3 is cookieless; it is not absent, but it stores nothing in your browser.

  • A session cookie keeps you signed in. It is strictly necessary, cannot be read by JavaScript, and expires after an hour of inactivity.
  • YouTube players embedded in the page may set YouTube’s own cookies, as described under “YouTube API Services” in section 6.
  • Local storage in your browser holds your theme and language choice, a hint that you have signed in on this device before (used for offline mode), and — for free accounts — your actual music.

10. Security

Passwords are stored hashed, never in plain text. Traffic is encrypted with HTTPS. Passwords are additionally encrypted in transit between your browser and our server. Each Cloud account’s content is held in its own isolated database schema. Backups go to EU-based storage.

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authority as the law requires.

11. International transfers

Our servers and backups are in France and Switzerland. Some processors listed in section 6 may process data outside the EEA under the safeguards their own terms provide.

12. Children

The Service is not intended for children under 16. We do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

13. Changes

We will post any update here with a new date, and tell registered users by email if the change is material.

Questions about any of this? contact@abcmusicstudio.org