Privacy policy

Effective date: November 7, 2026 · Last updated: November 7, 2026

Draft, pending legal review. This policy is a draft and may change before the app launches. Items in [yellow brackets] are still to be filled in.

Musikal shows the chords to songs, in time with the music. This policy explains what information the Musikal iPhone and iPad app and this website (musikal.io) collect, why, who sees it, and what choices you have. It applies together with our terms of use. In short: we show no ads, we use no analytics or tracking SDKs, and we never sell or share your personal data.

Who we are

Musikal is run by [BUSINESS NAME], [MAILING ADDRESS]. We are the controller of the personal data described here. We have not appointed a data protection officer. For any privacy question or request, write to [email protected].

What we collect

Account data (optional). Musikal works without an account. If you create one with Sign in with Apple, Google, or your email and a one-time code, we store your email address (which may be an Apple private relay address) and a user id.
Synced library data. If you have an account, your favorites, playlists, play history and the details of your imported songs ("My songs") are stored so they follow you between devices.
Imported audio files. See "Songs you import" below.
Chord corrections. See "Chord corrections" below.
Song identifiers and charts. Ids such as YouTube or SoundCloud ids and ISRC codes, used to match songs to chord charts, and the charts themselves.
Purchase status. Whether your Musikal Pro subscription is active. Apple handles the payment, and we never receive your card or Apple ID details.
Technical data. Our servers keep ordinary logs, including your IP address, device type and the requests made, for security and troubleshooting.

Microphone

Musikal asks for microphone access for Listen mode, which recognizes the song playing around you, and for the tuner. Audio is processed on your device. We never record, store or upload microphone audio. To identify a song, Listen mode uses Apple's ShazamKit, which sends Apple a short audio signature (a compact fingerprint, not a recording). Apple handles that under its privacy policy. If you decline microphone access, Listen mode and the tuner will not work, but the rest of Musikal does.

Songs you import (My songs)

If you add your own audio file, it is uploaded once to our server so we can work out its chords. The file is deleted as soon as the analysis ends, whether it succeeds or fails. We keep only the resulting chord chart and a file fingerprint (a SHA-256 hash, which cannot be turned back into audio) so we can recognize the same file later. The audio is used only to make the chart. It is not shared with anyone else and not used for any other purpose. If you choose to have lyrics transcribed automatically, they are created from the audio during that same analysis.

Chord corrections

When you correct a chord, your correction is shared. Once enough people agree on a fix, the chart improves for everyone. Corrections are stored with an id rather than your name and are not shown to other users as yours. If you delete your account, the corrections you made stay, with any link to you removed, because other people's charts now depend on them. You give us a license to use them, as described in the terms.

Why we use your data

To provide the app: show charts, run analysis, sync your library.
To sign you in and keep your account secure.
To check your subscription status and unlock Pro features.
To answer support requests.
To prevent abuse and keep the service secure.
To improve chart quality from corrections.
To meet legal obligations.

Legal bases (EU and UK users)

Where the GDPR applies, we rely on: contract (providing the service you asked for, such as your account and synced library); legitimate interests (security, abuse prevention, and improving charts from corrections, balanced against your rights); consent (microphone access, which you can withdraw at any time in iOS Settings); and legal obligation where the law requires us to keep or disclose something.

Who we share data with

We do not sell your personal data, and we do not share it for advertising. We use these service providers, who process data only to provide their service to us or to you:

Apple. Sign in with Apple, ShazamKit song recognition, MusicKit playback of Apple Music, and StoreKit purchases. See Apple's privacy policy.
Google. Sign in with Google, and the YouTube embedded player.
Fly.io. Hosts our servers, in the United States.
Supabase. Hosts our database and sign-in service, in the United States.

We may also disclose information if the law, a court order or a valid legal request requires it, or to protect the rights and safety of our users and ourselves.

Embedded players and links

Songs can play in embedded players. When a player loads, the provider may collect data from your device under its own policy.

YouTube. Musikal uses YouTube API Services. The player is subject to the YouTube Terms of Service and the Google Privacy Policy.
SoundCloud. The SoundCloud player is subject to SoundCloud's terms and privacy policy.
Apple Music. Playback needs your own Apple Music subscription and is handled by Apple.

We are not responsible for other sites or services we link to.

Payments

Musikal Pro is billed by Apple through the App Store. We receive only your subscription status and the transaction identifiers Apple sends us, never your payment details.

Where your data is stored, and international transfers

Our servers and database are in the United States. If you use Musikal from outside the US, including from the EU, the UK or Switzerland, your data is transferred to and processed in the US, where privacy law may differ from yours. Where required, we rely on safeguards such as the Standard Contractual Clauses in our providers' data processing terms, or a provider's certification under the Data Privacy Framework. You can ask us about these safeguards at the address below.

How long we keep data

Imported audio files: deleted when the analysis ends.
Analysis jobs: kept until the chart exists.
Server logs: about 30 days.
Account data and synced library: until you delete your account.
Chord charts and file fingerprints: kept, because they are not tied to your identity.
Chord corrections: kept, de-identified after you delete your account.
Backups: the provider's routine database backups expire on their normal cycle after deletion.

Security

We use encrypted connections and access controls on our servers and database. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your data, we will notify you as the law requires.

Deleting your account

In the app, go to Settings, then Account, then Delete account. This removes your email, user id, favorites, playlists, history and My songs details from our systems, and revokes the Sign in with Apple token if you used it. Corrections you made stay, de-identified. Deleting your account does not cancel a subscription. Cancel in iOS Settings, under your name and then Subscriptions. If you cannot reach the app, email us from the address on your account and we will delete it for you.

Your rights

Everyone. You can ask to see, correct, export or delete your data by emailing us. Most of this can be done in the app.

California (CCPA/CPRA). You have the right to know what personal information we collect and how we use it, to delete it, to correct it, to opt out of the sale or sharing of personal information, and to not be treated differently for using these rights. We do not sell or share personal information as those terms are defined in California law. You may use an authorized agent to make a request, and we may need to verify your identity. We will respond within 45 days.

EU and UK (GDPR). You have the rights of access, rectification, erasure, restriction, objection, data portability and withdrawal of consent, and the right to lodge a complaint with your local supervisory authority. We will respond within one month.

Residents of other US states with privacy laws can use the same rights by contacting us.

Children

Musikal is not directed to children under 13, and we do not knowingly collect personal information from them. You must be at least [MINIMUM AGE] to have an account. If you are in the EU, the minimum age is 16 unless your country sets a lower one. If you believe a child has given us personal information, email us and we will delete it.

Ads, tracking and cookies

The app has no ads, no tracking, and no analytics or advertising SDKs, and it does not ask to track you across other companies' apps. This website sets no cookies of its own. Google Fonts loads the typeface for these pages, which sends your IP address to Google.

Changes to this policy

If we change this policy, we will update the date above. For material changes we will also tell you in the app or by email before they take effect.

Contact

Privacy questions and requests: [email protected]
[BUSINESS NAME], [MAILING ADDRESS]