Privacy policy
Last updated: 3 November 2026
Root Note helps you practice the skills behind playing the piano: reading, playing, hearing and understanding music. This page explains which data the app uses and what we do with it. In short: without an account, your practice data stays on your own device. With an account, we store your email address and what is needed to sign you in. With Pro (or as a beta tester), your progress syncs between your devices through your account.
Who is responsible
Root Note, based in the Netherlands, is responsible for your data. Questions or a request about your data: privacy@root-note.nl.
On your own device
The app remembers your progress per item in your browser (your answers, how fast and how often, how long you practice) and your settings. Without an account this never leaves your device. Root Note never asks for your name; an account only needs your email address. If you clear your browser data, it is gone; under "More info" you can always make a backup file.
An account (optional)
You can sign in with a sign-in link by email, with Apple or with Google; there is no password. We store in a database at Cloudflare, in the European Union:
- your email address, and when you sign in with Apple or Google also your (unique) user ID and your email address with that service;
- when you sign in with Apple, also a key from Apple, only to revoke Root Note's access when you delete your account;
- whether you have Pro or are a beta tester, your language, and when your account was created and last used (for the retention period);
- whether you would like an email about the offer after the beta (see below);
- if you came in through a link with a source, that source as a single word, such as "forum" or "teacher", never a name. This shows us how people find Root Note (legitimate interest);
- a session for each signed-in device, with one strictly necessary cookie that keeps you signed in (up to 180 days, or until you sign out).
If you sign in with Google, Root Note only receives your email address, no access to your Google Drive or other data. Root Note's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
If you sign in with Apple, Root Note only receives your email address, or a hidden address from Apple if you choose one. Apple forwards email sent to a hidden address to you. We do not ask for your name.
We use this data to make your account work (legal basis: providing the service you ask for). We do not share or sell it.
Email about the offer after the beta
With a separate checkbox you can say that you would like an email after the beta about the early-bird discount on Root Note Pro. It is optional and only counts once you have clicked the sign-in link. You can withdraw your consent at any time by unsubscribing: in your account in the app, or through the link in every email. Withdrawing does not apply retroactively. Without the checkbox you only receive messages about your account and the beta.
Syncing (Pro and beta)
When you are signed in with Pro, your progress and settings are also stored in our database, linked only to your account, so you see the same on all your devices. We use them only for that (legal basis: providing the service) and do not look at them. If you reset your progress while syncing, we keep a copy for 30 days as a safety net.
Feedback and error reports
Under "More info" you can send feedback; your email address is optional. If something goes wrong in the app, it sends a short technical report by itself. Both include technical details, such as the app version, the kind of device and browser, a random device number and, if you are signed in, your account. No practice data. Purpose: finding and fixing problems (legitimate interest). We keep your feedback and its attachments (a screenshot, for example) at Cloudflare in the EU, not public, and only we read them.
Statistics
Cloudflare Web Analytics counts page visits in totals, without cookies, without a profile and without following you across other websites. The app also counts anonymously how Root Note is used, for example how many devices practice each day, which parts are opened and how people find Root Note. This shows us what works and what can be better. These are only daily totals, at most per country: no account, no device ID, no IP address and nothing per person. Apart from that the app loads nothing from outside: no ads and no trackers.
Automated decisions
We do not make decisions about you that are taken by a computer alone and that affect you in the sense of the GDPR (Article 22). The app does adapt the exercises to your answers, for example with smart review: what you often get wrong comes back more often. That only changes what you practice.
Security
To prevent abuse, when you sign in, send feedback or an error report, and for the anonymous counts, we keep an unreadable version (hash) of your IP address for at most 2 days, never the address itself. Every night we make an encrypted backup of the database.
Who is involved
- Cloudflare: the site, the database and feedback attachments (in the EU), and the check that a person is signing in.
- Google: only if you sign in with Google, for storing our encrypted backups (Google cannot read them), and if you join the test of the Android app: you sign up through a Google Group, and as its administrators we can see your email address.
- An email service: sends the sign-in email and your feedback, and keeps a sending log of them.
- Apple: only if you sign in with Apple, and for email to a hidden Apple address.
Cloudflare, Google and the email service are American companies. Whatever goes to the United States in this way falls under the EU-US Data Privacy Framework. With Cloudflare and the email service a data processing agreement is also in place, with the EU standard contractual clauses as a safety net. Signing in with Apple is also covered by Apple's own privacy policy.
How long
Your account and your synced data until 12 months after you last used Root Note while signed in; after that we delete them automatically. Error reports 90 days; feedback until your question has been dealt with and then at most 12 months, its attachments 90 days; the copy made before "reset progress" 30 days. In the restore history and the backups, deleted data can still be found for at most 40 days.
Your data and your rights
- In the app, under "More info", you can clear your settings or your progress; if you sync, also on your other devices. With the backup file you take all your data with you.
- Through the account icon → "Delete account" you delete your account, your sessions, your consent to email, your synced data and the feedback you sent while signed in, immediately (except in the backups, at most 40 days). If you signed in with Apple, we also disconnect Root Note from your Apple Account. You can also email us (see Contact).
You have the right to access your data, take it with you, have it corrected or deleted, and to ask us to restrict its use. You can object to what we do on the basis of legitimate interest (feedback, error reports, the source, the brake on abuse and the statistics). You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We answer a request by email within one month.
Children
Root Note is for children too. Without an account nothing leaves your device. An account is possible at any age; under 16? Then ask a parent or guardian to look along. For the email about the offer you need to be 16 or older.
Changes
If this policy changes, the date at the top is updated; major changes are also mentioned in the app.