Effective September 29, 2026
This policy explains what personal information [LEGAL_NAME not set: your legal or business name] (“we”) collects through Score Transposer, why, and what control you have over it. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.
The short version
- Your score files are never uploaded. They are processed in your browser.
- We keep only what an account needs: your email address, a scrambled (hashed) version of your password, and your membership status.
- Card details go straight to Stripe, our payment processor. We never see them.
- No advertising, no analytics trackers, and we never sell your information.
Who is responsible
Our privacy officer (and, for Quebec, the person in charge of the protection of personal information) is [LEGAL_NAME not set: your legal or business name], reachable at [CONTACT_EMAIL not set: a contact email] or [BUSINESS_ADDRESS not set: a mailing address].
What we collect and why
| Information | Why we need it |
|---|---|
| Email address | To identify your account, let you log in, and contact you about your account, billing, or changes to our policies. |
| Password | To secure your account. We store only a one-way hash (scrypt), never the password itself. |
| Membership and billing status: plan, renewal date, a Stripe customer reference, and when you accepted our terms | To give you the features you paid for, handle renewals, cancellations and refunds, and keep records the law requires. |
| A session cookie | To keep you logged in. It is strictly necessary, lasts up to 30 days, and is not used for tracking. |
| IP address | Used briefly in memory to block repeated failed logins. Our hosting provider may also record it in routine server logs for security. |
We do not collect your score files, your name, your card number, or your location, and we do not use advertising or analytics cookies.
Consent
By creating an account you consent to the uses described here. You can withdraw consent at any time by asking us to delete your account; we then can no longer provide membership features.
Who we share it with
We share personal information only with service providers who help us run the Service, only as much as they need, and under their own privacy and security commitments:
- Stripe: payment processing. Receives your email and payment details. (Stripe's privacy policy)
- Render (United States): hosts our server and database.
- jsDelivr and GitHub Pages: deliver the open-source code libraries and piano sound samples the app uses. Like any website you load files from, they receive your IP address and browser details, but no account information.
We may also disclose information where the law requires it, for example in response to a valid court order. We never sell or rent personal information.
Information stored outside Canada
Some of these providers store or process information in the United States and other countries. While it is there, it is protected by contract and by the provider's security measures, but it may be accessible to courts, law enforcement and national security authorities of those countries under their laws.
How long we keep it
- Account information: until you ask us to delete your account.
- Login sessions: up to 30 days, or until you log out.
- Payment and tax records (kept by Stripe and by us): six years, as Canadian tax law requires, even after an account is deleted.
How we protect it
Passwords are hashed, connections are encrypted (HTTPS), login cookies cannot be read by scripts on the page, repeated login attempts are blocked, and access to account data is limited to the administrator. No system is perfectly secure; if a breach creates a real risk of significant harm to you, we will notify you and report it to the Office of the Privacy Commissioner of Canada (and any provincial regulator required) as the law requires.
Your rights
You can ask to see the personal information we hold about you, to correct it, or to delete your account. Email [CONTACT_EMAIL not set: a contact email] from the address on your account. We will respond within 30 days, free of charge. We may need to confirm it is really you first.
Children
The Service is not directed at children under 13, and we do not knowingly collect their information. Anyone under the age of majority needs a parent's or guardian's permission to create an account. If you believe a child has given us information, contact us and we will delete it.
Emails
We only email you about your account, purchases, and changes to our policies. If we ever want to send newsletters or promotions, we will ask first, as Canada's anti-spam law requires.
Complaints
Please contact our privacy officer first. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy commissioner (for example, the Commission d'accès à l'information in Quebec, or the Information and Privacy Commissioner in British Columbia or Alberta).
Changes
If we change this policy in a way that matters, we will email you before the change takes effect. The date at the top shows when it last changed.