Privacy policy
Last updated: 18 October 2026
Root Note is an app for practising the piano. This page explains which data the app uses and what we do with it. In short: without an account, your practice data stays on your own device. With an account, we store your email address and what is needed to sign you in. With Pro (or as a beta tester), your progress syncs between your devices through your account.
On your own device
The app remembers your progress per item in your browser (your answers, how fast and how often, how long you practise) and your settings. Without an account this never leaves your device, and the app does not ask for your name, email address or any other personal data. If you clear your browser data, it is gone; under "More info" you can always make a backup file.
An account (optional)
You can sign in with a sign-in link by email or with Google; there is no password. We store in a database at Cloudflare, in the European Union:
- your email address, and when you sign in with Google also your (unique) Google user ID;
- whether you have Pro or are a beta tester, your language, and when your account was created and last used (for the retention period);
- whether you would like an email about the offer after the beta (see below);
- if you came in through a link with a source, that source as a single word, such as "forum" or "teacher", never a name. This shows us how people find Root Note (legitimate interest);
- a session for each signed-in device, with one strictly necessary cookie that keeps you signed in (up to 180 days, or until you sign out).
If you sign in with Google, Root Note only receives your email address, no access to your Google Drive or other data. Root Note's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We use this data to make your account work (legal basis: providing the service you ask for). We do not share or sell it.
Email about the offer after the beta
With a separate checkbox you can say that you would like an email after the beta about the early-bird discount on Root Note Pro. It is optional and only counts once you have clicked the sign-in link. You can unsubscribe at any time: in your account in the app, or through the link in every email. Without the checkbox you only receive messages about your account and the beta.
Syncing (Pro and beta)
When you are signed in with Pro, your progress and settings are also stored in our database, linked only to your account, so you see the same on all your devices. We use them only for that (legal basis: providing the service) and do not look at them. If you reset your progress while syncing, we keep a copy for 30 days as a safety net.
Feedback and error reports
Under "More info" you can send feedback; your email address is optional. If something goes wrong in the app, it sends a short technical report by itself. Both include technical details, such as the app version, the kind of device and browser, a random device number and, if you are signed in, your account. No practice data. Purpose: finding and fixing problems (legitimate interest).
Statistics
Cloudflare Web Analytics counts page visits in totals, without cookies, without a profile and without following you across other websites. The app also counts anonymously how Root Note is used, for example how many devices practise each day, which parts are opened and how people find Root Note. This shows us what works and what can be better. These are only daily totals, at most per country: no account, no device ID, no IP address and nothing per person. Apart from that the app loads nothing from outside: no ads and no trackers.
Security
To prevent abuse, when you request a sign-in link or send feedback we keep an unreadable version (hash) of your IP address for at most 2 days, never the address itself. Every night we make an encrypted backup of the database.
Who is involved
- Cloudflare: the site and the database (in the EU). When you request a sign-in link by email, Cloudflare Turnstile first checks that a person is signing in, not a script; usually you don't notice it.
- Resend: sends the sign-in email and your feedback, and keeps a sending log of them.
- Google: only if you sign in with Google, and for storing our encrypted backups (Google cannot read them).
Cloudflare and Resend are American companies. Whatever goes to the United States in this way falls under the EU-US Data Privacy Framework, with the EU standard contractual clauses as a safety net.
How long
Your account and your synced data until 12 months after you last used the app; after that we delete them automatically. Error reports 90 days; feedback until your question has been dealt with and then at most 12 months; the copy made before "reset progress" 30 days. In the restore history and the backups, deleted data can still be found for at most 40 days.
Your data and your rights
- In the app, under "More info", you can clear your settings or your progress; if you sync, also on your other devices. With the backup file you take all your data with you.
- Through the account icon → "Delete account" you delete your account, your sessions, your consent to email and your synced data, immediately (except in the backups, at most 40 days). You can also email us (see Contact).
You have the right to access your data, take it with you, have it corrected or deleted, and to ask us to restrict its use. You can object to what we do on the basis of legitimate interest (feedback, error reports, the source, the brake on abuse and the statistics). You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We answer a request by email within one month.
Children
Without an account you can simply practise; then nothing leaves your device. If you are under 16, ask a parent or guardian to look along before you create an account. We do not ask for your age.
Changes
If this policy changes, the date at the top is updated; major changes are also mentioned in the app.