Privacy

Privacy Policy

This policy describes data processing in the free BrassFlow beta. The app is under development, but your privacy rights still apply.

Your analytics choice

This choice applies to this browser. Declining does not prevent you from using BrassFlow. Withdrawal stops new events but does not automatically erase previously sent data; you can request deletion through the privacy contact.

Analytics not allowed: no choice saved.

Controller and contact

Victor Augusto Januário da Cruz is the personal data controller and operates BrassFlow as an individual. The project does not yet have a registered company. For questions or requests about your data, use the contact below.

Microphone and audio

With your browser permission, the microphone is used to analyze tuning and musical performance on your device. In this version, we do not send recordings of that sound to servers to perform the analysis. Derived results, such as notes, duration and scores, may be included in saved practice history. You can revoke permission in your browser; features that require the microphone will stop working.

Account, practice and necessary storage

We process email, account identifier, authentication data, language and instrument preferences, level and goals, plans, sessions, results, XP, badges and practice streaks. If you sign in with Google, we receive profile data made available for sign-in, which may include your name and image. Cookies, local storage and IndexedDB maintain your session, preferences, privacy choice and records awaiting offline synchronization. This necessary storage is separate from optional analytics.

Purposes and legal bases

Account, authentication, preferences and history: performance of the requested service. Usage analytics: your consent, which can be withdrawn. Optional reminders: your consent and browser permission. Requested support: assistance related to the service; voluntary suggestions: improvement analysis based on legitimate interest, limited to what is necessary. Security and abuse prevention: legitimate interest, respecting your rights. Legal duties: compliance with legal obligations. Accepting the Terms does not authorize analytics.

Optional analytics

Only after you allow it, PostHog receives visited pages, selected interactions, practice events and device and browser information. Events may be associated with your account identifier; we do not describe them as anonymous data. We do not enable session recording or automatic capture of all clicks. We do not keep a second beta event history in your browser. You can decline or withdraw permission below or in your profile without losing access to practice. This choice applies to this browser; withdrawal stops new events but does not erase earlier ones.

Feedback, support and waiting list

Feedback may include a message, category, source page, technical context and optional contact details. Support emails include sender, subject and content. The waiting list uses the information you provide to manage places and respond to your participation request, not as general marketing permission. Avoid sending sensitive information or third-party data. You can request removal from the list or deletion of these records through the privacy contact.

Study reminders

If enabled, we process push subscription and endpoint, time, time zone, language, basic browser information and delivery history. You can disable reminders in your profile or revoke browser permission. Revoking permission does not, by itself, delete all existing delivery records.

Providers and international transfers

Supabase provides authentication and the database, with the project hosted in the United States. PostHog provides optional analytics, configured for the United States. Amazon Web Services (AWS) hosts the site and runs server functions, with the primary infrastructure configured in the United States and content delivered through a global network. Netlify temporarily remains as a fallback environment during the migration. Resend processes authentication and support emails; Google is involved when you choose that sign-in method. Distribution infrastructure and subprocessors of these services may also involve other countries. Sharing serves the purposes described in this policy. Consult the providers below and contact us for information about destinations, duration and contractual safeguards applicable to transfers.

How long data is kept

Your account and practice history remain available while the account exists, until deletion. Feedback and support are kept for the time needed to handle the request and related improvement; waiting-list data, while the participation request remains active. Records needed for legal obligations, security or the exercise of rights have retention limited to the purpose that justifies it. Cookies and local data follow their function and can be removed in the browser. Provider logs, backups and events have their own lifecycles, which must not be confused with immediate account deletion. You can request the criteria and periods applicable to your case.

What account deletion does

The profile option removes the authentication account and primary profile, practice and account-linked feedback data from the application database. It does not automatically erase support emails, separate waiting-list entries or historical PostHog data. To include those records, send a request to the privacy contact, preferably before closing your account so we can identify the records. Provider deletion may be asynchronous. Backups and logs are not individually erased instantly. We will explain any necessary retention and its justification.

Your rights and how to request them

You may request confirmation of processing, access, correction, sharing information, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability where applicable, and deletion of consent-based data, subject to legal exceptions. You may withdraw consent, learn the consequences of not giving it, and object to processing in the cases provided by law. Requests are free. We may ask for minimal identity confirmation to protect your account; do not send passwords or identity documents unsolicited. You may also petition Brazil's data protection authority, ANPD.

Children and teenagers

The MVP is not directed at children. If a minor uses BrassFlow, a responsible adult should supervise use and contact us about any data request.

Security and changes

We use access controls, authentication and encrypted connections to reduce risks, without promising absolute security. Material changes to data use will be communicated in the app or through registered contact details, as appropriate; when a new purpose requires consent, we will request it before processing. The version and date of this policy will be updated.