The short version
Your recordings are not kept. Audio you submit is transcribed and then deleted from our servers, usually within seconds and always as soon as the job finishes. We keep the resulting notation, not the sound.
We do not sell your data, we do not run advertising, and we do not use your recordings or transcriptions to train machine-learning models.
Who we are
NoteFusion is provided by [LEGAL ENTITY NAME], a company registered in [COUNTRY] under number [REGISTRATION NUMBER], with its registered address at [REGISTERED ADDRESS] (“we”, “us”). We provide a mobile app that listens to music and writes it out as Tonic Solfa and staff notation. This policy explains what we collect, why, and what you can do about it.
Questions or requests: privacy@notefusion.studio.
What we collect
Account information
- Your name and email address.
- A phone number, only if you choose to add one.
- A password, stored only as a bcrypt hash. We never store, log, or transmit the password itself, and we cannot recover it.
If you sign in with Google
Google sends us your name, email address, profile picture URL, and a stable account identifier. We store these to create and recognise your account. We receive nothing else from your Google account, so no contacts, files or calendar. Google’s own handling of the sign-in is covered by Google’s Privacy Policy.
Accounts created this way have no password on our side.
Audio you record or upload
Audio is sent to our servers, passed to our transcription engine, and deleted once the job completes. It is not archived, not backed up, and not reviewed by a person. Transcription runs on our own infrastructure; your audio is not sent to a third-party AI service.
Transcriptions you save
When you save a result to your library we keep the musical data, which covers note events, detected key, tempo, time signature, solfa labels, MusicXML, and the title you gave it. This is what lets your library persist across devices.
Profile picture
If you upload one, the image file is stored with our media host, Cloudinary, and we keep the resulting URL against your account.
Device and technical data
- A push-notification token per device, if you allow notifications. It tells us where to send a “transcription ready” alert, and nothing more.
- Sign-in session tokens, so you stay logged in without re-entering credentials.
- Ordinary server logs, including IP address and error diagnostics, used to keep the service running and to investigate abuse.
Why we are allowed to hold it
Where the UK/EU GDPR applies, our lawful bases are:
- Performance of a contract, for account data, saved transcriptions, and the processing of audio you submit. Without these the app cannot do what you asked it to do.
- Consent, for push notifications, microphone access, and your profile picture. Each is optional and each can be withdrawn.
- Legitimate interests, for security logging and abuse prevention, balanced against your rights.
Who else sees it
We share data only with the providers that run the service:
- Heroku (Salesforce): application hosting and database.
- Cloudinary: profile picture storage.
- Expo: delivery of push notifications.
- Google: only if you choose Google sign-in.
Each processes data on our instructions. We do not sell personal data, and we do not share it for advertising. We may disclose data if the law requires it.
How long we keep it
- Audio recordings are deleted as soon as the transcription job finishes.
- Saved transcriptions and account data stay until you delete them or close your account.
- Session tokens last until they expire, you sign out, or you change your password.
- Server logs are kept for a short rolling window, for diagnostics only.
Your choices
In the app you can edit your profile, delete individual transcriptions, revoke microphone or notification permission at any time through your device settings, and close your account outright.
Closing your account erases your private library. Your profile, your sessions, your registered devices, and everything in your personal library are deleted. This cannot be undone. Because it is irreversible, we ask you to confirm it is really you first, by re-entering your password or by signing in with Google again if that is how you use NoteFusion.
One exception: transcriptions you published to the public African Tunes & Choruses library stay published under your credited name, so the people who saved them keep their copies. Write to privacy@notefusion.studio if you want one removed.
You can also delete your account through the app, or in a browser via our account deletion page. Depending on where you live you may have the right to access, correct, export, or restrict the processing of your data, and to complain to your data protection authority. Write to privacy@notefusion.studio and we will respond within 30 days.
Security
Traffic runs over HTTPS. Passwords are hashed with bcrypt. Access tokens are short-lived and refresh tokens rotate on every use, so a stolen token has a narrow window. Closing your account or changing your password invalidates existing sessions.
No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please tell us at security@notefusion.studio before disclosing it publicly.
Children
NoteFusion is not directed at children under 18. If you are 13 to 17, you may use it only with a parent or guardian’s permission, and we will treat that as your consent to our processing. If you are under 13, please do not use the app or give us any personal information.
If you believe a child has given us personal information without the right permission, contact us at privacy@notefusion.studio and we will delete it.
International transfers
Our providers may process data outside your country, including in the United States. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard.
Changes to this policy
If we make a material change we will update the date at the top of this page and, where the change is significant, notify you in the app. Continuing to use NoteFusion after a change means you accept the revised policy.