Privacy

Who holds your data

The trader behind Groove IO, trading as Groove IO, is the data controller — the person responsible for what follows. Write to hello@groove-io.com about any of it.

What we store

Your email address, your name if you gave one, and a bcrypt hash of your password — never the password itself. Alongside that: the sheet music, audio, cover art and videos you upload, and the annotations, loops, setlists, scores and lesson results you create. A student account created from a teacher’s invite also stores the date of birth and guardian email given at sign-up.

Why we are allowed to

Your account and everything in it is processed to give you the service you signed up for — that is the contract between us. Keeping the service secure and working, including rate limits and server logs, rests on our legitimate interest in it not being abused. Loading YouTube’s player rests on your consent, which is why you are asked before it happens and can take it back. We do not use your data to advertise to you, and we do not sell it.

Who can see it

Your library is yours, and other users cannot see it. Two deliberate exceptions: anything you explicitly share with a teacher or a student is visible to that one person until you take the share back, and an administrator can reach library tracks because someone has to be able to fix a broken account. Your scores and your videos have no administrator override.

Sharing with a teacher or student

A share is to one named person, never to a group. Notes written on a shared video are visible only to the two of you — a note to one student is not visible to another. Revoking a share, or unlinking the two accounts, ends that access immediately.

Your microphone

Practice scoring listens to your microphone in the browser, on your machine, while you play. The audio is not recorded, not uploaded and not stored — only the timing results are kept. Video is different: a video is a file you chose to upload, and it sits on our server until you delete it.

Cookies, and what is kept in your browser

There is one thing on this site that asks for your consent, and it is Google Analytics: a bar at the foot of the page asks once. Nothing is loaded from Google until you press Allow, and if you press No thanks nothing ever is. Your answer is kept in your browser’s local storage, which is why you are asked once rather than on every page. Beyond that the marketing site loads no fonts, scripts or images from anyone else. Four things can put something on your device, and this is all of them.

A sign-in cookie, once you have an account. It is what keeps you signed in and nothing else — no advertising identifier, no profile. It expires on its own, and signing out clears it.

Your own settings, kept in your browser’s local storage: which panels you left open, your metronome and volume preferences, your microphone calibration, and which score you last had open on a track. These never leave your machine and are not sent to us.

YouTube’s player, if you ask for it. Some tracks link to a video on YouTube. Loading that player means loading code from YouTube, and YouTube sets its own cookies when you do, under its own privacy policy rather than this one. Because that is not something Groove IO needs in order to work, the app asks first: a track with a YouTube video shows a button rather than a player, and nothing is fetched from YouTube until you press it. Your answer is remembered in your browser, and there is a link under the player to undo it, which stops YouTube being loaded again.

Google Analytics, if you allowed it. Pressing Allow loads a script from Google, and Google sets its _ga cookies so that one visit to this site can be told from the next. What that shows us is which pages were read, roughly where in the world that was, and on what kind of device — with IP addresses anonymised and Google’s advertising features switched off, so none of it feeds ad targeting or an advertising profile of you. Google processes what it collects under its own privacy policy rather than this one. If you allowed it, you can take that back here: Stop analytics on this device. That switches it off there and then and stops it loading again, but it cannot reach the _ga cookies Google has already set on your browser: clearing site data for this site is what removes those.

What we send elsewhere

When you add a track, its artist and title are sent to public music services — MusicBrainz, the Cover Art Archive, Spotify and YouTube — to fill in the album, artwork and matching links. Nothing about you goes with it: no account identifier, no email address. Where a cover image is hosted by Spotify, your browser loads it from Spotify, without a referrer telling them which page it was on.

The app itself runs no analytics. This marketing site loads Google Analytics only after you allow it in the bar at the foot of the page, and there are no advertising or tracking scripts anywhere else.

Where it lives, and who touches it

Everything is stored on servers in London, in Amazon Web Services’ London region, and backed up to the same region. Three other companies are involved, each doing one job: Amazon Web Services hosts it, Paddle sells and takes payment for paid plans as our merchant of record (we never see your card details), and our email provider delivers account emails such as password resets. Nobody else is given your data.

How long we keep it

Your account and library are kept for as long as the account exists. Delete something and it goes: deleting a video removes its file, its shares and its notes with it. When an account is closed, everything in it is deleted within 30 days, apart from what we have to keep — records of payments, which tax law requires us to hold for six years. Backups are overwritten on a rolling 90-day cycle, so a deleted item can persist in a backup for up to that long before it ages out.

Deleting your account

You can delete any video, score, setlist or track yourself, at any time, and deleting a video removes its file, its shares and its notes with it. For the account itself, email hello@groove-io.com and we will delete it and everything in it within 30 days. Self-serve account deletion is being built.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we are using it. Email hello@groove-io.com and we will answer within a month. If you are not satisfied with how we handle it, you can complain to the Information Commissioner’s Office at ico.org.uk.