Legal

Privacy Policy

Last updated: 19 September 2026

This policy says what Scoreflection does with data about you, why it is allowed to, and what you can tell us to do instead. It is written to be read, not to be survived.

1. The short version

Much of the app needs no account: the library, playback, the tuner and the two games that only ask you to listen all work without one. The features that listen to you play are the paid Practice plan, and a plan is tied to an account.
Listening to you play happens on your own device. The sound is not sent anywhere.
Reading a photo of sheet music does not. That picture is sent to our server, read there, and thrown away — see section 4, which explains exactly what happens to it.
There are no adverts and no profile of you.
Nothing you have to consent to is switched on by default.

2. Who is responsible

Scoreflection
Laura Steffan
Quellenstr. 7a
70376 Stuttgart
Germany

For privacy matters: privacy@scoreflection.com · Imprint

We have not appointed a data protection officer, because the legal conditions for one (Section 38 BDSG) are not met here. The competent supervisory authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Germany

https://www.baden-wuerttemberg.datenschutz.de

3. What we collect, why, and what allows us to

Each row is a purpose. If a purpose does not apply to you — you have no account, you never turned contributions on — then nothing in that row exists for you.

Your account: Email address, a password we only ever store hashed, an age band, and your real name if you joined the forum. Needed to give you the account you asked for — Art. 6 (1) (b) GDPR.
Keeping the account yours: Sign-ins and failed sign-in attempts, with the IP address and a description of the device. This is how a break-in is noticed at all, and it is our legitimate interest in a service that is not quietly taken over — Art. 6 (1) (f) GDPR. The identifying parts are erased after 30 days (section 7).
Paid plans: Your email address, what you subscribed to and when. Card details are entered at Stripe and never reach us. Necessary for the contract — Art. 6 (1) (b) — and, for invoices, a legal obligation we cannot waive even if you ask — Art. 6 (1) (c) with sec. 147 AO.
Reading a photo of sheet music: The image you send, for as long as the transcription takes. You asked for the transcription, so the basis is the contract — Art. 6 (1) (b). Section 4 says what is and is not kept.
Practice statistics and practice recordings: Only if you switch contributions on, and only ever on that basis — your consent, Art. 6 (1) (a). They are not linked to your account; they carry a random installation number instead. You can withdraw at any time in the app's privacy settings, which also erases what was already sent and still carries that number. Withdrawing does not undo what was lawful before you did.
The community forum: Your nickname, your posts, and — held privately, never shown — your real name, so that there is somebody behind every post. The forum itself is the contract — Art. 6 (1) (b); holding the name is our legitimate interest in a community that can be held to account — Art. 6 (1) (f).
Writing to us: Your message, your address, and our answer. The enquiry form on the page for music schools is the same thing: what you type there reaches us as an email and is kept like any other correspondence, and nowhere else. Handling your request — Art. 6 (1) (b) and (f); where you are exercising a data protection right, answering it is itself a legal obligation — Art. 6 (1) (c).
The app waitlist: If you ask on the waitlist page to be told when the app is available, we keep your email address, whether you asked about Android or iOS, the language of the page and when you signed up — nothing else, not your IP address. We use it for one thing: a single email when the app can be downloaded for your phone. No newsletter, and it is never passed on. The basis is your consent — Art. 6 (1) (a); to withdraw it, write to support@scoreflection.com and the address is deleted. The list is stored with Cloudflare, in a database held in the EU (section 5); section 7 says how long.
This website: Server logs kept briefly to keep the site up and to see attacks — Art. 6 (1) (f). Your light/dark and language choices are stored in your own browser and never sent to us.
The tuner and the metronome on this website: The tuner opens your microphone only when you press Start, and the sound is worked out inside the page: nothing is recorded, nothing is sent to us, and no server is involved at any point. Press Stop, switch tabs or leave the page and the microphone is released again. Both tools remember their settings — the reference A, the tuning you picked, the tempo, the beats in a bar — in your own browser, which is the setting you asked for by changing it; nothing else is kept, and none of it reaches us.
Which pages and buttons on this website get used: A counter goes up: for the page, for the button, for the day, and for the language it happened in. Nothing is stored on your device for it, and the count carries no identifier, no IP address and no clock time — there is no record here that is about you. That is why it does not ask your permission, and it is also why there is nothing in it we could hand back to you or delete on request: we would not know which of the numbers was yours. We want to know which pages explain the app and which ones lose people — Art. 6 (1) (f).
Which version of a page you were shown: We sometimes show two versions of a page to find out which one explains things better. This stores which one you were shown, so the page does not change under you on the next visit. It is not shared with anyone, and no profile is built from it. Because it is stored on your device it happens only if you say yes — Art. 6 (1) (a), and sec. 25 (1) TDDDG, which asks separately about storage whatever else allows it. Privacy choices at the foot of every page takes that back as easily as it was given, and refusing changes nothing about how the site works.

We do not profile you, and no decision with a legal or similarly significant effect on you is made automatically — Art. 22 GDPR.

4. The two models

Two things in Scoreflection are machine-learning models we trained ourselves. They matter to your privacy because they differ in one respect: where they run.

Scoreflection Listening Model — runs on your device: Input: the sound of you playing. Output: the notes it believes it heard, and how they line up with the score. The sound does not leave your device to make this happen.
Scoreflection Score Reader — runs on our server: Input: a photograph or scan of printed sheet music. Output: a machine-readable score (MusicXML). The image is held only for as long as the transcription runs and is never written to our database. A result waiting to be collected is held in memory for at most 30 minutes and does not survive a restart.

So the sound of your playing never leaves your phone, and a photograph of a printed page does — it has to, because that model is far too large to run on a phone. What the page shows is printed music, and we never keep the picture. It is not stored in our database, not used to train anything, and not shown to anyone. A finished transcription is also emailed to your own account address, so it reaches your mailbox as well as your app.

Both models can be wrong, and a score they produce is marked as machine-read where the app shows it — that mark is required of us by Art. 50 of the EU AI Act, and it is also just honest. Check anything a model tells you before you trust it.

5. Who else touches any of this

Every company below is bound by a data processing agreement, or is named because it decides something itself and you should know.

Hetzner Online GmbH: Hosting for the API, the community forum, the database and the score reader. Located in: Germany. Privacy policy.
Cloudflare, Inc.: Delivery of this website, protection against attacks, and storing the app waitlist. Located in: USA, with EU edge locations. Transfer to a third country on the basis of EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Privacy policy.
Stripe Payments Europe, Ltd. (acting on its own responsibility, not on our instructions): Payment processing for paid plans. Located in: Ireland, with transfers to the USA. Transfer to a third country on the basis of EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Card details are entered at Stripe and never reach our servers. Privacy policy.
DeepL SE: Translating forum posts and support correspondence on request. Located in: Germany. The paid Pro tier, which does not use submitted text for training. Privacy policy.

What we do not use:

No advertising network, and no adverts of any kind
No automated decision-making with legal effect

We measure two things about this website, and they are not the same kind of thing. The first is a count of how often a page was opened and its buttons used: it stores nothing on your device, carries no identifier, no address and no timestamp finer than the day, and there is nothing in it that could be traced back to you — so it rests on our legitimate interest in knowing which pages actually explain the app, Art. 6 (1) (f). The second is A/B testing: we sometimes show two versions of a page, and remembering which one you saw does store something on your device, so it happens only if you agree to it and only for as long as you do. That is what the banner asks about, and the link in the footer takes the answer back. We use no third-party analytics service, neither is shared with anyone, and no profile of you is built from either. That describes what is running now rather than promising anything about later; if it changes, this section changes with it, and it changes before the new thing starts.

The app can show you other pieces like the one you are looking at. Those suggestions are worked out from the music: who wrote it, when they lived, what instrument it is written for, and how it sits under the hands. They are not worked out from you — not from which scores you have opened, downloaded or rated, and not from what anybody else has done either. Asking for suggestions records nothing and builds no profile of you, and two people looking at the same piece are shown the same thing. That describes what runs today rather than promising anything about later; if it changes, this section changes with it, and it changes before the new thing starts.

If Scoreflection passes to a company

Scoreflection is run today as a sole proprietorship and is meant to continue in a GmbH later on. If your contract passes to that company, the data needed to perform it goes with it: your account, your subscription and the billing. The legal basis is Art. 6 (1) (b) GDPR — it is the same contract, only with a different counterparty — and, for anything passing beyond that, our legitimate interest in the service continuing, Art. 6 (1) (f) GDPR.

From that point the company taking over is the controller within the meaning of the GDPR and is bound by this policy. We tell you about the change in text form at least four weeks beforehand, naming the company, and you can then terminate the contract with effect from the date of the change — section 14 of the terms sets out the detail. An account without a paid subscription passes over the same way; if you would rather it did not, you can delete it at any time (section 8).

This does not mean, and does not permit, a sale to an unrelated third party. Were that ever to happen, we would tell you beforehand and you would decide whether your account goes along.

6. Children

Scoreflection is used by children, and most of it is built so that it does not need to know anything about you at all: the sheet-music library, playback, the tuner and the games that only ask you to listen work without an account. Having the app listen to you play and mark your notes is part of the paid plan, and a paid plan belongs to an account. If you are a child, a grown-up in your family sets that up. Even then, the listening happens on your phone.

Age. If you make an account we ask how old you are. You can answer with your date of birth, or just your age, or a parent can simply say the account belongs to a child. We store an age band — such as "under 13" or "16 or over" — because that is all we ever need to act on. A date of birth is optional.
The community forum is for members aged 16 and over. Nothing else in the app is affected by your age.
If you join the forum we also ask for your real name and keep it private, so that there is somebody behind every post. It is never shown on the forum and never shared — the forum shows only the nickname you choose.
The sound of you playing is listened to on your own phone, and is not sent to us.
A photo of sheet music is sent to us to be read, and thrown away straight afterwards. Take pictures of the music, not of yourself or anybody else.
We show no adverts and use no advertising or tracking services, so nobody is building a profile of you here. We do count how often each page and button gets used, but the count only says that it happened once more — never who it was.

Parents and guardians: you can ask us what we hold about your child and ask us to delete it — write to the address below. Our child safety standards page explains how to report a concern and lists independent advice services.

7. How long we keep things

Every period below is enforced by a scheduled job, not by a promise to get round to it. Most categories are deleted when their period is up. The two you contribute on purpose — practice statistics and practice recordings — are not: what expires there is the connection between the contribution and your device, and once that is gone the contribution stays as part of what the listening model learns from. There is then nothing left in it that points at you, which is also why it can no longer be found and taken back. The period is how long you have to change your mind.

Your account: for as long as the account exists
IP address and device description in sign-in records: 30 days
The record that a sign-in or failed attempt happened, with nothing in it that points at a person: 13 months
Practice and feature statistics, if you turn contributions on: connected to your device for 13 months, then anonymised and kept
Practice recordings, if you choose to contribute them: connected to your device for 24 months — that is how long you have to take them back. After that the connection is removed and the recording stays in the training set, with nothing in it that points at you
Which steps of setting up and using the app you reached, if you turn contributions on: connected to your device for 13 months, then anonymised and kept
Counts of which pages of this website were opened and which buttons were used: 13 months, and never connected to you at any point — there is no record here that is about a person
Which version of a page you were shown, if you agreed to that: on your own device until you withdraw or clear it; what reaches us is the name of the variant in the counts above, and nothing that says it was you
Signed-in sessions: 30 days after you last used the app, then you sign in again
Email confirmation links: 24 hours, and they work only once
A photograph of sheet music you send to be read: the duration of the transcription; a result waiting to be collected, at most 30 minutes
Support correspondence: 36 months
Your email address on the app waitlist: until we have sent the one email telling you the app is available, and never longer than 6 months
Invoices and the records tax law requires us to keep: up to 10 years, held at Stripe and by our tax adviser, and outside the reach of a deletion request

You can delete your account yourself, in the app under Account → Delete account, or from this page; it takes effect as soon as you confirm by email, and it cancels any subscription first. Three things outlive the account, and none of them names you afterwards: a score you donated stays in the shared library with the donation no longer attributed to you, a moderation report you filed stays with the report no longer naming you, and the security records keep that the account existed with your address removed. Invoices stay because tax law says so.

Contributed statistics and recordings are not linked to your account — they carry a random installation number instead. You can erase everything under that number at any time from the app's privacy settings, without waiting for the periods above. Once a contribution has passed its period and lost that number, it can no longer be found — not by you and not by us. And a model that has already learned from a recording cannot be made to unlearn it; what we can delete is the recording.

8. What you can require of us

Under the GDPR you have the right to:

a copy of what we hold about you, and to know where it came from (Art. 15);
have anything wrong about you corrected (Art. 16);
have it deleted (Art. 17) — the account page does this immediately;
have its use restricted while a dispute is settled (Art. 18);
get it in a portable, machine-readable form (Art. 20);
object to anything we do on the basis of legitimate interest, for reasons arising from your particular situation (Art. 21);
withdraw any consent at any time, with effect from then on (Art. 7 (3));
complain to a supervisory authority — the one for us is named in section 2 (Art. 77).

Write to the privacy address below. We answer within a month, and we say so if a request needs longer. We will not charge you for it and we will not make you explain yourself.

9. Contact

Privacy: privacy@scoreflection.com
Child safety: childsafety@scoreflection.com
Everything else: support@scoreflection.com

10. Changes to this policy

If we change how any of this works, the policy changes with it and the date at the top moves. If a change matters to you — a new purpose, a new company handling your data, a longer period — we tell you in the app or by email before it takes effect, rather than letting you find it here.