Privacy Policy

Last updated: June 11, 2026

Introduction

Virtuosic LLC ("we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Virtuosic website (virtuosic.org), web application (app.virtuosic.org), and mobile applications (collectively, the "Services"). By using our Services, you agree to the practices described in this policy.

Age Requirements

Virtuosic is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13 years of age. If you are under 13, please do not create an account or submit any personal information. If we learn that we have collected personal information from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at privacy@virtuosic.org.

Microphone Access

Virtuosic uses your device's microphone for two on-device practice features:

  • Pitch detection (chromatic tuner): Audio frames are analyzed in real time to estimate the fundamental frequency you're playing. Only the resulting pitch values (note name, frequency in Hz, cents deviation) are ever stored or transmitted — the raw audio itself is processed in a rolling buffer that is discarded as soon as the next frame arrives.
  • Onset detection (accuracy-gated tempo trainer): The metronome can listen for the moment you play a note and check whether it lands within tolerance of each click. Only a per-bar “clean / not clean” verdict is ever stored locally — no audio leaves the device.

We do not record or transmit your audio.Microphone processing happens entirely on the device. We never upload waveforms, voice memos, or any acoustic content to our servers or to any third party. If you disable microphone permission in your device settings, the tuner and the accuracy gate simply stop functioning — the rest of the app continues to work normally.

Information We Collect

Information you provide

  • Account information: Email address, display name, and password when you create an account
  • Profile information: Primary instrument, years of playing experience, and birth year (optional)
  • Practice data: Pitch measurements, practice session durations, practice notes, and achievements recorded during use of the app
  • Rhythm training results: Timing accuracy scores, beat deviation measurements, exercise type, and difficulty level recorded during rhythm training exercises
  • Ear training scores: Interval identification results, correct/incorrect answers, streak data, and unlocked interval levels
  • Scale practice results: Per-note accuracy within scale exercises, scale type, key, and completion status
  • Pitch journey data: Aggregated pitch accuracy trends, improvement metrics, milestone achievements, and historical performance summaries derived from your tuner usage over time
  • Session reports: Weekly and monthly practice summaries including in-tune rates, practice day counts, per-note breakdowns, and instrument usage patterns
  • Contact information: Name, email, and message content when you submit a contact form
  • Payment information: Processed securely by Stripe; we do not store your credit card details

Information collected automatically

  • Usage data: Pages visited, features used, session duration, and interaction patterns via Google Analytics
  • Device information: Browser type, operating system, device type, and screen resolution
  • Log data: IP address (anonymized), access timestamps, and referring URLs
  • Device identifier (mobile apps): A randomly-generated per-install UUID stored locally on your device. We send this identifier to our backend on in-app purchase events so we can re-associate a subscription you bought without an account if you later sign up. The identifier is not used for advertising, profiling, or cross-app tracking, contains no personal information, and is reset by uninstalling the app.

Anonymous in-app purchases

To comply with App Store guideline 5.1.1(v), you can purchase a Premium subscription in our iOS app without creating a Virtuosic account. When you do, we receive and store the cryptographic purchase receipt issued by Apple (transaction ID, product ID, purchase date, expiration date) on our backend so we can validate your Premium access and respond to renewal or refund events from Apple. These records are stored with no user account attached, only with the per-install device identifier described above and the transaction ID. If you later create an account, we associate any anonymous purchases on this device with your account; if you never create an account, the records remain unattached and are pruned periodically after expiration. Subscription billing itself is handled by Apple — we do not see or store your payment-card details.

Third-party authentication credentials

If you sign in using Sign in with Apple, we store the Apple-provided authentication credentials necessary to: (a) verify your identity on subsequent sign-ins, and (b) revoke our authorization to access your Apple Account when you delete your Virtuosic account. Specifically, we store your Apple user identifier (a stable opaque value Apple provides) and a refresh token issued by Apple. The refresh token is used solely to call Apple's revocation endpoint during account deletion and is cleared immediately after a successful revocation. We do not use it to call any other Apple API and we do not share it with third parties.

Aggregated and anonymized data

We collect anonymized, aggregated pitch data to build and improve our instrument-specific intonation tendency database. This data cannot be used to identify individual users and is used to provide accurate pitch tendency guidance across 22 instruments.

Pitch data is collected from all users of the tuner feature, including those who have not created an account. This anonymous data contains only the note played, instrument type, and pitch deviation measurement — no personal identifiers are attached. You may opt out of contributing to this database by disabling the "Data Sharing" setting in the app.

Cookies and Tracking Technologies

We use the following cookies and tracking technologies:

  • Authentication cookie (auth_token): An HTTP-only, secure cookie used to maintain your login session on the website. This is a strictly necessary cookie and cannot be disabled.
  • Google Analytics (_ga, _ga_*): Used to understand how visitors interact with our website, including page views, traffic sources, and user engagement. Google Analytics data is processed by Google LLC in accordance with their privacy policy. You can opt out by installing the Google Analytics Opt-out Browser Add-on.
  • Local storage: The web application stores your settings, practice data, and authentication tokens in browser local storage to enable offline functionality and a seamless experience.

How We Use Your Information

  • Provide, maintain, and improve our Services
  • Authenticate your identity and manage your account
  • Process subscriptions and payments
  • Sync your practice data and settings across devices
  • Generate AI-powered coaching insights based on your practice performance data
  • Send transactional emails (password resets, email verification, account updates)
  • Respond to your contact form submissions and support requests
  • Send newsletter updates if you have opted in (you can unsubscribe at any time)
  • Analyze usage patterns to improve features and user experience
  • Build and maintain our aggregated intonation tendency database
  • Prevent fraud, abuse, and unauthorized access

Third-Party Service Providers

We share your information with the following third-party processors, each of which has its own privacy policy:

  • Stripe (stripe.com) — Payment processing for subscriptions. Stripe receives your email and payment details to process transactions. See Stripe's Privacy Policy.
  • Anthropic (anthropic.com) — AI-powered practice coaching. When you generate a session report, anonymized practice performance data (pitch accuracy rates, practice frequency, instrument type, and experience level) is sent to Anthropic's Claude API to generate personalized coaching tips. Your email address and full name are not included. See Anthropic's Privacy Policy.
  • Resend (resend.com) — Transactional email delivery (password resets, verification emails, contact form responses, newsletter). Resend receives your email address. See Resend's Privacy Policy.
  • Google Analytics (analytics.google.com) — Website analytics. Google receives anonymized usage data. See Google's Privacy Policy.
  • Vercel (vercel.com) — Website and web app hosting. See Vercel's Privacy Policy.
  • Railway (railway.app) — Backend API hosting. See Railway's Privacy Policy.
  • Apple / Google — In-app purchase verification for iOS and Android subscriptions, if applicable.

Data Sharing

We do not sell your personal information. We may share your information in the following circumstances:

  • With your consent: When you opt in to share data with a Studio instructor via the Studio feature
  • Virtuosic Scholarships: If you accept a scholarship from a Studio instructor, your email address and display name are visible to the instructor who issued the scholarship, alongside your enrollment in their studio. This is intrinsic to the scholarship program — the instructor selects a specific student to receive the grant — and you can decline a scholarship invite or leave the studio at any time to end this visibility. Scholarship recipients never have payment information collected, and no payment data is shared with the instructor.
  • Service providers: With the third-party processors listed above, solely to provide our Services
  • Aggregated data for research and industry partners: Anonymized, aggregated pitch tendency data may be shared with or licensed to instrument manufacturers, educational researchers, and other industry partners to improve instrument design and music education. This data is statistical in nature (e.g., "trumpets tend to play Concert Bb 3 cents sharp on average") and aggregated across a minimum sample size before release; it cannot identify individual users. No personal information, account details, or identifiable practice sessions are included in these exports. You can opt out at any time via the "Data Sharing" toggle in the app under Settings.
  • Legal requirements: When required by law, regulation, or legal process
  • Safety: To protect the rights, safety, or property of Virtuosic, our users, or the public

Data Retention

  • Account data: Retained for as long as your account is active. You can delete your account at any time from the Account page.
  • Practice data: Retained for as long as your account is active. Anonymous pitch data older than 90 days may be periodically cleaned up.
  • Session reports: Weekly and monthly practice reports are retained for as long as your account is active. AI-generated coaching tips are stored within these reports. To keep storage bounded, we retain up to the last 12 weekly reports and 6 monthly reports per user; older reports are automatically pruned.
  • Authentication tokens: Refresh tokens expire after 30 days and are periodically cleaned up. Apple Sign-in refresh tokens (stored solely for revocation on account deletion) are retained until you delete your account or sign out, whichever comes first.
  • Password reset tokens: Expire after 1 hour.
  • Email verification tokens: Expire after 24 hours.
  • Account-merge verification tokens: Expire after 1 hour and are single-use. When consumed or expired, the token row is retained for audit purposes for up to 30 days, after which it is purged.
  • Anonymous purchase records: Retained until associated with an account or until 30 days after the subscription expires, whichever comes first.
  • Account-merge audit log: When you initiate a merge, we retain a small audit record (timestamp, source account's email at the time of merge, source Apple user identifier if applicable, and which tables were touched) indefinitely for security and dispute-resolution purposes. The merged-away account itself is soft-deleted (its email is blanked, password hash cleared, and the row marked inactive); subsequent attempts to sign in with the merged-away email are blocked and the user is redirected to the surviving account.
  • Contact form submissions: Retained in our email system for support purposes.
  • Analytics data: Retained by Google Analytics per their standard retention policies.

Your Rights

You have the following rights regarding your personal information:

  • Access: View your data through the Account page or request a full export
  • Export: Download a complete copy of your data (GDPR data export) from the Account page
  • Deletion: Delete your account and all associated data from the Account page. Deletion is permanent and cannot be undone. When you delete your account, we (a) hard-delete your user record, practice data, notes, session reports, and purchase records from our database, (b) call Apple's authorization-revocation endpoint to invalidate any Sign-in-with-Apple grant tied to your account if applicable, and (c) retain only a minimal audit row if your account was the target of a prior account-merge operation. Subscription billing is managed separately by Apple or by Stripe — deleting your Virtuosic account does not automatically cancel an active App Store or Stripe subscription. To stop billing, cancel via your iOS Settings → Subscriptions or via the Virtuosic Account page on the web before deleting your account.
  • Account merge: If you accidentally created two Virtuosic accounts (for example, one with email + password and another via Sign in with Apple), you can merge them on the Account page. Your subscription, practice history, and notes from the source account move into the target account; the source account is then soft-deleted as described in the Data Retention section above.
  • Correction: Update your profile information at any time through the app or Account page
  • Opt out of pitch data contribution: Toggle the "Data Sharing" setting in the app to stop your pitch measurements from being included in the aggregated tendency database. Previously contributed anonymous data cannot be retroactively removed as it is not linked to your identity.
  • Opt out of analytics: Install the Google Analytics Opt-out Add-on
  • Unsubscribe: Opt out of newsletter emails at any time using the unsubscribe link in any email

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • Right to know: You may request details about the personal information we have collected about you in the past 12 months
  • Right to delete: You may request deletion of your personal information, subject to certain exceptions
  • Right to correct: You may request correction of inaccurate personal information we hold about you
  • Right to opt out of sharing: We do not sell personal information for cross-context behavioral advertising. We do share de-identified aggregate pitch measurements with instrument manufacturers for research purposes (no personal identifiers attached); some U.S. state laws still classify this as “sharing”. To opt out, either disable the “Data Sharing” toggle in the app under Settings, or use our Do Not Sell or Share My Personal Information form.
  • Right to non-discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights
  • No sale of personal information: We do not sell personal information as defined by the CCPA/CPRA

To exercise your CCPA/CPRA rights, contact us at privacy@virtuosic.org or use the account deletion and data export features on the Account page.

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encrypted data transmission (HTTPS/TLS), hashed passwords (bcrypt), HTTP-only secure authentication cookies, and rate limiting. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

International Data Transfers

Our Services are hosted in the United States. If you access our Services from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. Our backend services are hosted on Railway (US-based infrastructure). AI coaching features are processed by Anthropic (US-based). Website and web application hosting is provided by Vercel (US-based with global edge network).

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. For material changes that reduce your rights, we will provide at least 30 days' notice via email or in-app notification. Your continued use of the Services after changes are posted constitutes acceptance of the updated policy.

Contact Us

For privacy concerns, questions, or to exercise your rights, contact us at: privacy@virtuosic.org

Virtuosic LLC
Omaha, Nebraska, United States