Privacy notice

What we keep, and why.

RiffKeys is in development. This notice covers the early-access list, RiffKeys accounts, progress sync between your devices, the share links you can make, the practice coach, the parent dashboard and its weekly updates, teachers you share practice with, and the analytics on this website, in plain words. RiffKeys is run by Lion MGT LLC, trading as Lion Pro Dev (“we”), which is responsible for this data.

Early access

• Your email address, so we can write to you about early access.
• The song you want to learn and what you'll play on, if you choose to tell us. These shape what we teach first.
• When you signed up (a timestamp) and which page the form was on.
• A one-way hash of your IP address and your browser's user-agent string, only to stop automated abuse and rate-limit sign-ups. We never store your raw IP address.

Your RiffKeys account

You sign in with Apple or Google; there is no RiffKeys password. When you do, we receive and keep:

• An account id from Apple or Google that stays the same each time you sign in.
• Your email address and whether the provider has verified it. With Apple's “Hide My Email” this is a private relay address and we never see your real one.
• Your name, if the provider shares it (Apple only does so the first time).
• Sign-in sessions: when each started and expires, the browser or app version (user-agent), and a one-way hash of the IP address it came from.
• For Apple sign-in only, an encrypted Apple token, kept solely so we can disconnect RiffKeys from your Apple ID when you delete your account.
• An account history: when the account was created and when a sign-in method was linked to it, with a one-way hash of the IP address. It helps us spot an account being taken over.

Apple and Google sign-ins open the same account automatically only for addresses the provider runs itself (iCloud, Gmail, or your own Google Workspace domain); otherwise you link them yourself on the account page. We don't receive your contacts, photos or anything else from your Apple or Google account, and we don't keep Google tokens.

Profiles and progress sync

So your practice follows you between the app and this site, an account stores what the app syncs:

• Profiles: a nickname and an age band (adult, teen or kid aged 6 to 10) for each person who plays. Kids never sign in and we never ask a kid for an email; the account holder manages their profiles.
• Practice attempts: which piece and difficulty, which hands, when (including the calendar day on your device, for streaks), for how long, the practice mode and tempo, and the timing results (how many notes were on time, early, late, wrong or missed, and how far off on average).
• Progress: mastery level per piece and practice streaks, which we work out from your attempts. App settings such as your keyboard's latency offset stay on the device.

We don't record or upload audio or MIDI performances for sync. Deleting a profile in the app removes its attempts and progress from our servers at the next sync.

The practice coach

When you ask the coach about a session, the app sends our server the piece and difficulty, the profile's age band, the session's timing results (the same kind of numbers as a practice attempt: accuracy, how many notes were on time, early, late, wrong or missed, the weakest bars) and your question, if you typed one. Our server passes the piece, the age band, those numbers and your question to Anthropic, whose Claude model writes the reply. Anthropic does not receive your name, email, account or profile, and does not use what we send to train its models. Please don't type personal details into a question.

• We don't store your questions or the coach's replies.
• For each reply we keep a usage record: account and profile ids, the piece, the age band, whether there was a question, which model answered, how many tokens it used and how long it took. We use it to control cost and stop abuse, and delete it after 90 days or with your account.
• Without a connection, the app coaches from the numbers on the device and sends nothing.

Share links and public portfolios

Nothing about a profile is public until you choose to share it on the account page. There are two kinds of link, and you decide on each one:

• A portfolio link works only after you switch on “Public portfolio” for that profile. It shows the name you choose for public pages (or the profile's nickname), an optional short bio, the pieces mastered with the hands, best accuracy and date, the modules completed, the current and best streak, total practice time and number of sessions, and the last ten sessions as a date and an accuracy.
• A session link shows one practice run: the piece, hands, mode, tempo, date, accuracy, how many notes were on the beat, early, late, wrong or missed, where the timed notes landed, and the bars with the most mistakes. It names the player only if that profile also has a public portfolio; otherwise it says “a RiffKeys learner”.

A shared page never shows an email address, your Apple or Google name, a profile's age band, or any other profile. We refuse a public name or bio that contains an email address. Pages only name pieces from the RiffKeys catalogue.

• Who can see it: anyone who has the link. Each link is a long random address that cannot be guessed, so share it with the people or on the pages you mean to.
• Search engines: shared pages ask search engines not to list them, unless you turn on “Allow search engines” for a public portfolio. Kid profiles are never listed, whatever the setting.
• View counts: we count how often each link is opened, at most once per visitor per hour. To do that we keep a one-way hash made from the visitor's IP address and the link, for about an hour. Your own views, link previews and search engine crawlers are not counted. Shared pages set no cookies and carry no analytics.
• Freshness: the numbers on a shared page can be up to a minute behind your latest practice.

To stop sharing, choose “Revoke” next to the link on the account page: it stops working at once and shows “Wrong key” instead. Switching off the public portfolio revokes all of its links. Deleting a session in the app revokes its link, deleting a profile deletes its links and public settings, and deleting your account deletes everything. A chat app or social network that already showed a preview of a link (its title and picture) may keep that preview; preview pictures can be cached for up to a minute.

Parents, kids and weekly updates

The account holder is the parent. A kid plays on a profile inside the parent's account: kids never get their own sign-in, email address or notifications from us, and we never ask a kid for contact details.

• The parent dashboard (/dashboard) shows each profile's practice time per day, streak, pieces mastered, current module, accuracy and the hours practice happens. It is worked out on our server from the synced attempts above, nothing extra is collected for it, and only someone signed in to the account can see it.
• Parent settings: whether the weekly email and the weekly push are on, a daily practice goal, a daily screen-time limit, the day the update goes out and your time zone (so the dashboard's hours and the send day match your clock).
• Weekly email, off until you turn it on. It goes to the account holder's own address (the one Apple or Google gave us) and carries the same summary as the dashboard. We send it through Amazon Simple Email Service. It has no tracking pixels, tracked links or images from anyone else, so we don't know whether or when you open it.
• Weekly push, off until you turn it on. When you allow notifications in the app, it gives us a device token from Google Firebase Cloud Messaging (which also delivers to iPhones and iPads through Apple), with the platform, app version and when we last saw it. The app can mark a device a kid uses so it never shows the weekly summary.
• A delivery log: when each update was attempted, by email or push, and whether it was delivered, skipped or failed (with the service's error code). It never holds the message, your address or a device token.

To turn updates off: switch them off in the dashboard's settings, use the link at the bottom of any weekly email (it works without signing in), turn off RiffKeys notifications in your phone's settings, or delete the account. Signing out of the app removes that device's token.

Teachers and the coach portal

A music teacher can use RiffKeys to follow a student's practice between lessons. A teacher never sees anything about you until you say yes:

• Invites: the teacher gives you a code. You enter it on the account page, see who the teacher is (the name, bio, what they teach, their time zone and rates as they wrote them), pick one profile and accept, or decline. Entering a code shows the teacher nothing.
• Kid profiles: children never sign in. The account holder accepts for a kid profile and must confirm they are the child's parent or legal guardian. We record that confirmation with the time it was given. Teachers can't message children. Notes and assignments for a kid profile, and every teacher's name, bio and rates, may not contain email addresses, web links or social media handles. If a profile you shared as an adult or teen becomes a kid profile, the teacher stops seeing it until you accept a new invite as the parent.
• What a teacher sees, for the accepted profile only: its nickname and age band, the pieces practised with the hands, mode, tempo, accuracy, how many notes were on the beat, early, late, wrong or missed, the weakest bars, how long and on which days, mastery and streaks. Never your email, your Apple or Google name, your other profiles or your share links.
• What a teacher adds: assignments (a piece, the hands, a target tempo and accuracy, bars, a due date and a note) and notes on a session or on bars. You see them on the account page and in the app, with progress worked out from your practice.
• What we keep about teachers: the teacher profile above, their invite codes, and each link: who invited whom, which profile, when it was accepted, by whom (the account holder, or a parent for a kid), and when and why it ended.

To stop sharing, choose “Stop sharing” next to the teacher on the account page. The teacher loses access at once and their assignments and notes for that profile are deleted. The same happens when a teacher ends the link, when you delete the profile in the app, and when either of you deletes their account. Deleting a session in the app deletes the teacher's notes on it. We keep the record that a link existed and ended (no practice data) until one of the two accounts is deleted. Teacher pages carry no analytics.

RiffKeys does not handle lesson payments or live lessons yet. Arrangements and payments between you and a teacher are between you and them.

Website analytics

This website uses Google Analytics 4 to count visits and see which pages help. It records pages viewed, the referring site, approximate location (country or city, derived from your IP address by Google), device and browser type, and uses cookies to tell repeat visits apart. Advertising features, ad personalisation and advertising cookies are turned off.

• In the EEA, the UK and Switzerland, analytics stays off until you choose “Allow analytics” in the banner. Until then Google receives only cookieless signals that cannot identify you across visits (Google Analytics consent mode).
• Elsewhere, analytics is on by default.
• Your choice is remembered in your browser's local storage (not a cookie). Change it any time with “Cookie settings” at the bottom of every page.
• The admin area, the account page's contents and shared pages are never sent to analytics.

Why we use it (legal bases)

• Your account, sign-in, progress sync, the coach, the links you share and the teachers you accept: to provide the service you asked for (contract). For a kid profile shared with a teacher, also the parent's consent.
• Early-access emails: your request when you joined the list.
• Weekly email and push: your choice to turn them on, which you can undo at any time.
• Analytics in the EEA, UK and Switzerland: your consent, which you can withdraw at any time.
• Rate limiting, abuse prevention and security logs: our legitimate interest in keeping the service safe.

What we don't do

• We don't sell, rent or share your data with anyone for their own use.
• We don't add you to a marketing newsletter. We reply by hand. The weekly update is about your household's practice only, and only when you ask for it.
• We don't contact kids, and we don't show a kid's progress to anyone outside the account.
• We don't use advertising trackers or show ads.

Who processes it for us

Vercel hosts the website and API; a managed Postgres provider stores the database; Apple and Google handle sign-in; Anthropic writes the coach's replies; Google provides analytics; Amazon Web Services (Simple Email Service) sends the weekly email; and Google Firebase Cloud Messaging, with Apple's push service for iPhones and iPads, delivers push notifications. They process data only to run the service for us. Some of them are in the United States; transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.

How long we keep it

• Account, profiles and progress: until you delete your account.
• Share links and public-portfolio settings: until you delete the profile or the account. A revoked link stays recorded as revoked so its address is never used again. Visitor hashes for view counts: about an hour.
• Teacher links, assignments and notes: until the link ends (then assignments and notes are deleted at once), and the record of the link until either account is deleted. Unused invite codes stop working after 14 days.
• Sign-in sessions: 30 days on the web, 90 days in the app, or until you sign out.
• Early-access sign-ups: until RiffKeys launches and you've had the chance to try it, or until you ask.
• Parent settings: until you change them or delete the account.
• Device tokens: until you sign out of the app on that device, until the push service tells us the token no longer works (then 30 days), or after 270 days without the app checking in.
• Rate-limit counters: one day. Coach usage records and the weekly-update delivery log: 90 days. Analytics: Google's retention setting for the property.
• Coach requests at Anthropic: for the period its commercial API data-retention terms set, then deleted.
• Database backups roll over within days; deleted data is not restored from them.

Deleting your account

On the account page (or in the app's settings), choose “Delete account”. It takes effect immediately: the account, every profile, all synced progress, parent settings, device tokens, the delivery log and all sessions are deleted, and we disconnect RiffKeys from your Apple ID. Your early-access sign-up is a separate record; email us to remove it too.

Your choices and rights

Email phil@lionprodev.com to see what we hold about you, get a copy, correct it, or have it deleted. We'll do it by hand and confirm when it's done, normally within a week. If you are in the EEA or UK you can also complain to your data protection authority.

Cookies and local storage

• rk_session: keeps you signed in on this site (essential, 30 days).
• rk_oauth_apple / rk_oauth_google: protect a sign-in while it is in progress (essential, 10 minutes).
• rk_admin: staff sign-in to the admin area only.
• Google Analytics cookies (_ga, _ga_*): only as described above.
• Local storage remembers your light or dark theme and your analytics choice. Shared pages (/p/, /s/) set no cookies of their own.

Changes

When the app launches this notice will be replaced with a reviewed privacy policy. If anything changes before then, we'll update this page and the date above.