Privacy Policy

Introduction

Virtuosic LLC ("we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Virtuosic website (virtuosic.org), web application (app.virtuosic.org), and mobile applications (collectively, the "Services"). By using our Services, you agree to the practices described in this policy.

Age Requirements

Virtuosic accounts are for people aged 13 and older; we ask for your birth year when you sign up to check this. We do not knowingly collect personal information from children under 13 years of age, except as described below for lessons a parent books for a child. If you are under 13, please do not create an account or submit any personal information. If we learn that we have collected personal information from a child under 13 in any other way, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at privacy@virtuosic.org.

Lessons booked for a child (when available): When the lessons marketplace offers it, a parent or legal guardian with a Premium account can book lessons for a child under 18, including a child under 13. The child does not get a Virtuosic account. We collect only the child's first name (shown in the lesson room) and an age range (under 13, or 13–17), with the parent's consent to the terms shown at that time, and use them only to run those lessons. Lessons booked for a child are always recorded for the child's safety (see “Video lessons and recordings” under Data Sharing). The parent can withdraw consent at any time under Account → Minors, which deletes the child's first name and the recordings of that child's lessons.

Microphone Access

Virtuosic uses your device's microphone for three on-device practice features:

• Pitch detection (chromatic tuner): Audio frames are analyzed in real time to estimate the fundamental frequency you're playing. Only the resulting pitch values (note name, frequency in Hz, cents deviation) are ever stored or transmitted — the raw audio itself is processed in a rolling buffer that is discarded as soon as the next frame arrives.
• Onset detection (accuracy-gated tempo trainer): The metronome can listen for the moment you play a note and check whether it lands within tolerance of each click. Only a per-bar “clean / not clean” verdict is ever stored locally — no audio leaves the device.
• Audio Recording (optional, Premium): You can choose to record a practice take so the app can overlay its pitch trace on the waveform. Recordings you make are saved only in the app's local storage on your device and are never uploaded or transmitted to our servers or to any third party. Deleting a recording in the app — or deleting the app — permanently removes it.

In these practice features, your audio never leaves your device. Microphone processing for them happens entirely on the device, and practice recordings you choose to make are stored only on the device. We never upload their waveforms, recordings, or any other acoustic content to our servers or to any third party. If you disable microphone permission in your device settings, the tuner, the accuracy gate, and audio recording simply stop functioning — the rest of the app continues to work normally.

Video lessons are different. When the lessons marketplace is available, a lesson booked through it is a live video call, and some lessons are recorded; see “Video lessons and recordings” under Data Sharing.

Calendar Access and Sync (Studio instructors)

On iOS and Android, the Studio scheduling tab offers an optional, read-only calendar sync so generated lesson slots avoid your existing commitments. It runs only when you tap “Sync calendar” and grant the system permission. Only busy intervals — start and end times — are extracted; event titles, locations, attendees, and all other details are not accessed and never leave your device. The extracted intervals are sent to our servers transiently, solely to compute conflict-free candidate lesson slots for the month you are viewing, and are not stored. If you decline calendar permission, you can still enter blocked times manually.

Google Calendar (web): From your Studio dashboard settings you can also connect a Google Calendar. If you do, we store an authorization token from Google and the Google account's email address so we can (a) add each booked lesson to your calendar (titled “Lesson with” the student's name, with its time, length and studio name) and (b) read only your free/busy times, so students can't book over your commitments. We never read your events' titles or details. Disconnecting in the same settings deletes the token and asks Google to revoke it.

Calendar feed link: You can also create a private calendar-feed address that lists your confirmed and pending lessons, with student names and times, for Google Calendar, Apple Calendar or Outlook. Anyone you give the address to can read it; you can replace or turn off the address at any time.

Information We Collect

Information you provide

• Account information: Email address, display name, and password when you create an account
• Birth year: Required when you create an account (including with Sign in with Apple or Google). We use it to confirm you are at least 13 and to apply extra safety protections to accounts of people under 18, such as stricter checks on messages they receive. It is not used for research.
• Profile information: Primary instrument and, if you choose to add it, years of playing experience, which we use only to tailor your practice coaching
• Practice data: Pitch measurements, practice session durations, practice notes, and achievements recorded during use of the app
• Practice journal: Entries you write in the practice journal, where available
• Studio content: Messages you exchange with your teacher or students, assignments and the work you hand in, lesson notes your teacher shares with you, and studio announcements
• Ensemble directory: Listings you post (adults only) and messages you send to a listing's owner
• Instructor applications (when available): If you apply to teach on the lessons marketplace, your bio, headshot, credentials, rates, availability and the names and email addresses of the references you list (their assessments of your application stay confidential to our review team)
• Rhythm training results: Timing accuracy scores, beat deviation measurements, exercise type, and difficulty level recorded during rhythm training exercises
• Ear training scores: Interval identification results, correct/incorrect answers, streak data, and unlocked interval levels
• Scale practice results: Per-note accuracy within scale exercises, scale type, key, and completion status
• Pitch journey data: Aggregated pitch accuracy trends, improvement metrics, milestone achievements, and historical performance summaries derived from your tuner usage over time
• Session reports: Weekly and monthly practice summaries including in-tune rates, practice day counts, per-note breakdowns, and instrument usage patterns
• Contact information: Name, email, and message content when you submit a contact form
• Payment information: Processed securely by Stripe; we do not store your credit card details
• Invites (when available): If you invite friends, we keep your invite code and, for each person who signs up through your link, that their account came from your invite, whether and when they subscribed, and the free months you earned. If you join through someone's invite, we keep that link between the two accounts, and the App Store or Google Play offer code if you claim one.

Information collected automatically

• Usage data: On the website, pages visited and sign-up, checkout, purchase and studio events via Google Analytics, only after you accept analytics cookies in the banner, plus anonymous, cookieless page-view and performance statistics via Vercel Web Analytics and Speed Insights. In the apps, product events (for example finishing onboarding, choosing an instrument, starting a trial, viewing an upgrade screen or completing a purchase), including four first-run steps (starting and finishing or skipping the welcome tour, the first tool opened and the first pitch reading), are counted as anonymous daily totals on our own servers, whether or not you are signed in. These counts carry no identifier of any kind (no account, device identifier or IP address), and nothing from the apps is sent to Google Analytics. On the website, reading a blog post for a few seconds adds one to that post's anonymous daily read count, which orders the blog's “Most read” list; it carries no identifier either and sets no cookie. Each share from the app adds one to an anonymous daily count of shares by what was shared (your progress, a report, a recording and so on), and each first opening of a shared practice report on the website in a browser session adds one to an anonymous daily count of opens; neither carries an identifier. A link you share says it came from a share and what kind (in its tracking parameters), never who shared it. When the iOS or Android app opens or comes back to the foreground, it asks our servers whether newer app content is available, sending the app's version and build, the platform and its version, and a random identifier the update component creates; we use them only to choose an update and don't store them.
• Error reports: When something breaks in the apps, the website or our servers, a report (error details, stack trace, device model, operating system, browser and app version) is sent to Sentry. We remove passwords, tokens and cookies before sending.
• Device information: Browser type, operating system, device type, and screen resolution
• Log data: IP address (anonymized), access timestamps, and referring URLs
• Device identifier (apps): A randomly-generated per-install UUID stored locally on your device (in the web app, in your browser's storage). We use it on in-app purchase events, so we can re-associate a subscription you bought without an account if you later sign up, and to limit how often one device can send events to our servers. The identifier is not used for advertising, profiling, or cross-app tracking, contains no personal information, and is reset by uninstalling the app.

Anonymous in-app purchases

To comply with App Store guideline 5.1.1(v), you can purchase a Premium subscription in our iOS app without creating a Virtuosic account. When you do, we receive and store the cryptographic purchase receipt issued by Apple (transaction ID, product ID, purchase date, expiration date) on our backend so we can validate your Premium access and respond to renewal or refund events from Apple. These records are stored with no user account attached, only with the per-install device identifier described above and the transaction ID. If you later create an account, we associate any anonymous purchases on this device with your account; if you never create an account, the records remain unattached and are pruned periodically after expiration. Subscription billing itself is handled by Apple — we do not see or store your payment-card details.

Third-party authentication credentials

If you sign in using Sign in with Apple, we store the Apple-provided authentication credentials necessary to: (a) verify your identity on subsequent sign-ins, and (b) revoke our authorization to access your Apple Account when you delete your Virtuosic account. Specifically, we store your Apple user identifier (a stable opaque value Apple provides) and a refresh token issued by Apple. The refresh token is used solely to call Apple's revocation endpoint during account deletion and is cleared immediately after a successful revocation. We do not use it to call any other Apple API and we do not share it with third parties.

If you sign in using Sign in with Google, we store your Google account identifier (a stable opaque value Google provides) and use the email address Google shares with us and, for a new account, your name as your display name. We do not ask for ongoing access to your Google account and store no Google token for signing in. You can unlink Apple or Google from the Account page.

Pitch data and aggregated research data

We use pitch data to build and improve our instrument-specific intonation tendency database, which provides pitch tendency guidance across 27 instruments. For research we release only aggregated figures, and released aggregates cannot be used to identify individual users.

When you are signed in, the pitch measurements the tuner makes are saved to your account so we can build your practice reports, coaching and progress and, while you share practice data with a studio, your instructor's view. Each record holds the note played and its measured deviation, the instrument (and its brand and model, if you entered them), timing and steadiness measurements, the skill level set in the app, and a session identifier.

Contributing to research is opt-in. Your measurements are added to the tendency database and the research dataset only if you turn on the "Share Pitch Data" setting in the app, which stays off until you do. The app asks once, after a practice session, and you can change your answer at any time in the app's Account tab, under Data Privacy. Without it, your measurements are used only for your own account, and if you use the tuner without an account we keep none of them. For research we keep a pseudonymous copy keyed by a one-way code in place of your account, and we release only aggregates that combine at least 30 players. Turning the setting off stops your future measurements from being added; to also withdraw measurements already added, see Your Rights. We are deleting the measurements added before October 20, 2026, while the setting was on by default, from the research dataset and the tendency statistics; this does not affect your own practice history.

Cookies and Tracking Technologies

We use the following cookies and tracking technologies:

• Authentication cookies (auth_token, refresh_token): HTTP-only, secure cookies used to maintain your login session on the website. Signing in with Apple or Google also sets short-lived cookies (a few minutes) that protect that sign-in from forgery, and opening the website from the app sets one that holds that sign-in for up to 5 minutes until you confirm it. These are strictly necessary cookies and cannot be disabled.
• Google Analytics (_ga, _ga_*): Used to understand how visitors interact with our website, including page views, traffic sources, and user engagement. Google Analytics loads only if you accept analytics cookies in our cookie banner; to change your choice later, use the Cookie settings link at the bottom of any page. Google Analytics data is processed by Google LLC in accordance with their privacy policy. You can also opt out by installing the Google Analytics Opt-out Browser Add-on.
• Vercel Web Analytics and Speed Insights: Aggregate page-view and performance statistics that use no cookies.
• Local storage: The web application stores your settings, practice data, and authentication tokens in browser local storage to enable offline functionality and a seamless experience.

How We Use Your Information

• Provide, maintain, and improve our Services
• Authenticate your identity and manage your account
• Process subscriptions and payments
• Sync your practice data and settings across devices
• Generate AI coaching from your practice data, your practice journal, and your teacher's assignments, shared notes and announcements (see Anthropic below)
• Screen messages, journal entries, teacher feedback, shared notes and announcements, directory listings and reviews for harmful content
• Send push notifications you have enabled
• Send transactional emails (password resets, email verification, account updates)
• Respond to your contact form submissions and support requests
• Send newsletter updates if you have opted in (you can unsubscribe at any time)
• Analyze usage patterns to improve features and user experience
• Build and maintain our aggregated intonation tendency database, from the measurements of people who turned on Share Pitch Data
• Prevent fraud, abuse, and unauthorized access

Legal Bases for Processing (EEA, UK and Switzerland)

If you are in the European Economic Area, the United Kingdom or Switzerland, we process your personal information on these legal bases:

• Performance of our contract with you: creating and running your account, signing you in, syncing your data across your devices, the practice features you use (the tuner, practice reports, coaching, progress and the features listed under "Information you provide"), studios, lessons and scholarships you join, subscriptions and payments, and the emails needed to provide them.
• Consent: adding your pitch measurements to the tendency database and the research dataset (the "Share Pitch Data" setting, off until you turn it on), Google Analytics on the website (the cookie banner), newsletter emails, push notifications and calendar access. You can withdraw consent at any time with the same setting, the cookie choice, the unsubscribe link or your device settings; withdrawing does not affect processing that took place before.
• Legitimate interests: keeping the Services secure and preventing fraud and abuse (including screening messages, journal entries, listings and reviews for harmful content), error reporting, and improving the Services from the anonymous counts described above. You can object to processing based on legitimate interests by contacting us.
• Legal obligations: keeping purchase and tax records and responding to lawful requests.

You also have the rights to access, correct, delete, export and restrict the processing of your personal information (see Your Rights), and to lodge a complaint with your local data protection authority.

Third-Party Service Providers

We share your information with the following third-party processors, each of which has its own privacy policy:

• Stripe (stripe.com) — Payment processing for subscriptions. Stripe receives your email and payment details to process transactions. When the lessons marketplace is available, Stripe also processes lesson payments and instructor payouts, and collects instructors' identity and bank details directly. See Stripe's Privacy Policy.
• Anthropic (anthropic.com) — AI features, through Anthropic's Claude API. (1) Practice coaching: when a practice report is created — on request, automatically in the app, or on a weekly schedule — we send your instrument (and its make and model, if you entered them), experience level, practice statistics and trends, the tips from your last coaching, recent practice-journal entries you have not marked private (your own words, if you keep a journal), your teacher's assignment titles, the notes they have shared with you and studio announcements, and your progress in learning paths and etudes. A short preview after your first practice session sends only your instrument and a few measurements from it. (2) Teachers can ask for a draft of feedback on an assignment, which sends the student's first name, the assignment, what the student handed in, and their practice statistics for it. (3) Screening of ensemble-directory listings and, when the lessons marketplace is available, lesson reviews and instructor bios. (4) When available, personalised practice etudes built from your weakest notes and any instructions you type. Apart from the student's first name in a feedback draft, we do not add names, email addresses or account ids; text a teacher writes (assignment titles, shared notes, announcements) is sent as written, so it includes any name they put in it. See Anthropic's Privacy Policy.
• OpenAI (openai.com) — Content-safety moderation. Text you submit as studio messages, practice-journal entries, teacher feedback, shared lesson notes and studio announcements (and, when available, lesson messages and etude instructions) is screened by OpenAI's Moderation API to detect harmful content before it is delivered or stored. See OpenAI's Privacy Policy.
• Resend (resend.com) — Email delivery (password resets, verification emails, notifications, practice summaries, lesson invitations, contact form messages, newsletter). Resend receives your email address and the content of the emails we send you, which can include practice statistics, coaching, lesson details and previews of messages from your teacher or students. See Resend's Privacy Policy.
• Google (google.com) — Google Analytics (website only, with your consent), Sign in with Google, Google Calendar sync for instructors who connect it, Google Play purchase verification, and Firebase Cloud Messaging for Android notifications. When the lessons marketplace is available, Google Cloud Vision also checks instructor headshots. See Google's Privacy Policy.
• Sentry (sentry.io) — Error and crash reporting for the apps, the website and our servers.
• Vercel (vercel.com) — Website and web app hosting, cookieless web analytics and performance monitoring, and short-lived rate-limiting counters keyed by IP address (stored with Upstash). See Vercel's Privacy Policy.
• Railway (railway.app) — Backend API hosting. See Railway's Privacy Policy.
• Apple — Sign in with Apple, App Store purchase verification, and push notifications on Apple devices.
• When the lessons marketplace is available: Daily (daily.co) runs live video lessons and makes lesson recordings; Cloudflare (cloudflare.com) stores lesson recordings and instructor application files; Checkr (checkr.com, through its GoodHire service) runs instructor background checks, receiving the applicant's name and email and collecting anything else it needs directly from the applicant.

Data Sharing

We do not sell your personal information. We may share your information in the following circumstances:

• Studio instructors: When you join a studio, its instructor sees your display name and email address, the work you hand in for their assignments, and the messages you exchange. Your practice statistics from the day you joined are shared with the instructor only while practice-data sharing is on for that studio; it starts on when you join, and you can turn it off at any time in the app or on your Studio page. While it is on, your name and level can also appear on that studio's leaderboard, which its other students can see.
• Virtuosic Scholarships: If you accept a scholarship from a Studio instructor, your email address and display name are visible to the instructor who issued the scholarship, alongside your enrollment in their studio. This is intrinsic to the scholarship program — the instructor selects a specific student to receive the grant — and you can decline a scholarship invite or leave the studio at any time to end this visibility. Scholarship recipients never have payment information collected, and no payment data is shared with the instructor.
• Invites (when available): If you join through a friend's invite link, we show you their first name. We never tell them who you are: they see only how many of their invites joined and the free months they earned.
• Ensemble directory: Listings you post are public, except your email address. If you contact an ensemble through the directory, we email your message, display name and email address to the person who posted the listing so they can reply.
• Shared practice reports: If you share a practice report, anyone with its link can open that report: your instrument, the period's figures, the notes you played and its coaching, which can mention what your teacher assigned or shared with you. It does not show your name, email address or account. A link works for 90 days unless you revoke it from the report on the web, where the report also shows whether it has a working link.
• Push notifications: Notifications are delivered through Apple, Google or your browser's push service and can show the sender's name and the start of a message.
• Video lessons and recordings (when available): Lessons booked through the lessons marketplace are live video calls run by Daily. A lesson booked for a minor is always recorded; an adult student can choose at booking to have a lesson recorded, and everyone in the lesson sees a notice when it is. Recordings are stored on Cloudflare R2 and are available to the student (or the parent who booked), the instructor, and our team for safety and dispute review. They are deleted after 90 days (longer while a dispute about that lesson is open), when a parent withdraws consent for the child, or when the student or the instructor deletes their account.
• Service providers: With the third-party processors listed above, solely to provide our Services
• Aggregated data for research and industry partners: Anonymized, aggregated pitch tendency data may be shared with or licensed to instrument manufacturers, educational researchers, and other industry partners to improve instrument design and music education. This data is statistical in nature (e.g., "trumpets tend to play Concert Bb 3 cents sharp on average") and aggregated across a minimum sample size before release; it cannot identify individual users. No personal information, account details, or identifiable practice sessions are included in these exports. It is built only from the measurements of people who turned on the "Share Pitch Data" setting in the app (off unless you turn it on), and you can turn it off at any time in the app's Account tab.
• Legal requirements: When required by law, regulation, or legal process
• Safety: To protect the rights, safety, or property of Virtuosic, our users, or the public

Data Retention

• Account data: Retained for as long as your account is active. You can delete your account at any time from the Account page.
• Practice data: Raw pitch measurements linked to your account are deleted 180 days after we receive them; anonymous pitch measurements (kept only with Share Pitch Data on, and not linked to an account) are deleted after 90 days. Your practice session durations, practice notes and achievements, and the summaries and reports built from your measurements, are retained for as long as your account is active (session reports within the limits below). The pseudonymous research copy described under "Pitch data and aggregated research data" is kept separately and is not deleted on this schedule.
• Session reports: Weekly and monthly practice reports are retained for as long as your account is active. AI-generated coaching tips are stored within these reports. To keep storage bounded, we retain up to the last 12 weekly reports, plus up to 4 older weekly reports that hold AI coaching, and the last 6 monthly reports per user; older reports are automatically pruned. A report with a working share link is kept until the link expires or you revoke it.
• Authentication tokens: Refresh tokens expire after 30 days and are periodically cleaned up. Apple Sign-in refresh tokens (stored solely for revocation on account deletion) are retained until you delete your account or sign out, whichever comes first.
• Password reset tokens: Expire after 1 hour.
• Email verification tokens: Expire after 24 hours.
• Push notification registrations: A device's push token or browser endpoint is kept while that device can receive notifications; once it stops (you sign out, turn notifications off, or the token expires) it is deleted after 30 days.
• In-app notifications: Items in the notification bell, which can show the start of a message, are deleted 180 days after they were sent.
• Account-merge verification tokens: Expire after 1 hour and are single-use. When consumed or expired, the token row is retained for audit purposes for up to 30 days, after which it is purged.
• Anonymous purchase records: Retained until associated with an account or until 30 days after the subscription expires, whichever comes first.
• Account-merge audit log: When you initiate a merge, we retain a small audit record (timestamp, source account's email at the time of merge, source Apple user identifier if applicable, and which tables were touched) indefinitely for security and dispute-resolution purposes. The merged-away account itself is soft-deleted (its email is blanked, password hash cleared, and the row marked inactive); subsequent attempts to sign in with the merged-away email are blocked.
• Practice-journal entries, studio messages and lesson notes: Retained for as long as your account is active.
• Invite records: Retained for as long as your account is active. When you delete your account, your invite code and the free months you earned are deleted, and so is the link to an invite you joined through; for invites you sent, only the other person's side is kept, with no link to you.
• Google Calendar connection (instructors): Retained until you disconnect it or delete your account.
• Lesson recordings (when available): Deleted 90 days after the lesson (longer while a dispute about it is open), or sooner as described under Data Sharing.
• Parental consent records (when available): If a parent withdraws consent, we delete the child's first name and recordings but keep a record of the consent (the age range, a fingerprint of the consent text, and its dates) as proof of what was agreed.
• Contact form submissions: Retained in our email system for support purposes.
• Analytics data: Retained by Google Analytics per their standard retention policies.
• Error reports: Retained by Sentry for a limited period under our retention settings.

Your Rights

You have the following rights regarding your personal information:

• Access: View your data through the Account page or request a full export
• Export: Download a copy of your data (GDPR data export) from the Account page. If you applied to teach, what your references told us is kept confidential to protect them and isn't included; you can ask for it at privacy@virtuosic.org and we'll review the request.
• Deletion: Delete your account and all associated data from the Account page. Deletion is permanent and cannot be undone. When you delete your account, we (a) hard-delete your user record, practice data, notes, session reports, and purchase records (and, when available, recordings of lessons you took or taught) from our database, (b) call Apple's authorization-revocation endpoint to invalidate any Sign-in-with-Apple grant tied to your account if applicable, (c) cancel any subscription you pay for on the web through Stripe, refund the unused, already-paid part of its current billing period to your original payment method, and then delete your Stripe customer record, and (d) retain only a minimal audit row if your account was the target of a prior account-merge operation. App Store and Google Play subscriptions are billed by Apple or Google, and deleting your Virtuosic account does not cancel them: to stop billing, cancel in your device's subscription settings (on iOS, Settings → your name → Subscriptions; on Android, Google Play → Payments & subscriptions).
• Account merge: If you accidentally created two Virtuosic accounts (for example, one with email + password and another via Sign in with Apple), you can merge them on the Account page. To merge, you must be signed in to one account and prove you control the other. Your subscription, practice history, and notes from the source account move into the target account; the source account is then soft-deleted as described in the Data Retention section above. A merge cannot be undone automatically; if you did not ask for one, contact us right away.
• Correction: Update your profile information at any time through the app or Account page
• Withdraw research consent: Turn off the "Share Pitch Data" setting in the app to stop your future pitch measurements from being included in the aggregated tendency database and the research dataset. To also withdraw measurements you have already contributed, sign in and use the withdraw button on our Do Not Sell or Share My Personal Information page — it takes effect immediately and removes your measurements from the research dataset without touching your own practice history, reports, or streaks. Aggregate figures already published to research partners are blended across many players and cannot be un-mixed for a single person; they stop reflecting your data at the next rebuild, within the 45-day window.
• Opt out of analytics: On the website, decline analytics cookies in the cookie banner or install the Google Analytics Opt-out Add-on. The apps send nothing to Google Analytics; they keep only the anonymous daily counts described above.
• Unsubscribe: Opt out of newsletter emails at any time using the unsubscribe link in any email

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: You may request details about the personal information we have collected about you in the past 12 months
• Right to delete: You may request deletion of your personal information, subject to certain exceptions
• Right to correct: You may request correction of inaccurate personal information we hold about you
• Right to opt out of sharing: We do not sell personal information for cross-context behavioral advertising. We do share de-identified aggregate pitch measurements with instrument manufacturers for research purposes (no personal identifiers attached), built only from the measurements of people who turned on the “Share Pitch Data” setting; some U.S. state laws still classify this as “sharing”. To stop future sharing, turn off the “Share Pitch Data” toggle in the app's Account tab. To withdraw measurements already contributed, use the withdraw button on our Do Not Sell or Share My Personal Information page while signed in — it is immediate. If you do not have account access, the form on that page reaches us and we process the request within the 45-day CCPA window. Global Privacy Control: if your browser sends the GPC signal, we treat it as a request to stop sharing, and when you use Virtuosic signed in on our website or web app your account stops contributing pitch measurements from then on (measurements already contributed stay until you withdraw them). If you later turn “Share Pitch Data” back on yourself, that choice stands for your account.
• Consumers under 16: We do not sell or share the personal information of anyone under 16 without their affirmative authorization: “Share Pitch Data” is off until you turn it on yourself.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights. Your practice reports, coaching and history work the same whether or not you share pitch data.
• No sale of personal information: We do not sell personal information as defined by the CCPA/CPRA

To exercise your CCPA/CPRA rights, contact us at privacy@virtuosic.org or use the account deletion and data export features on the Account page.

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encrypted data transmission (HTTPS/TLS), hashed passwords (bcrypt), HTTP-only secure authentication cookies, and rate limiting. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

International Data Transfers

Our Services are hosted in the United States. If you access our Services from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. Our backend services are hosted on Railway (US-based infrastructure). AI features are processed by Anthropic and content moderation by OpenAI (both US-based). Error reports are processed by Sentry, email by Resend, payments by Stripe, and analytics by Google (all US-based). Website and web application hosting is provided by Vercel (US-based with global edge network).

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. For material changes that reduce your rights, we will provide at least 30 days' notice via email or in-app notification. Your continued use of the Services after changes are posted constitutes acceptance of the updated policy.

Contact Us

For privacy concerns, questions, or to exercise your rights, contact us at: privacy@virtuosic.org

Virtuosic LLC
Omaha, Nebraska, United States