Privacy Policy

The controller responsible for data processing on this website within the meaning of the GDPR is:

We have not appointed a Data Protection Officer, as we are not legally required to do so. For any privacy request, contact us at the email address above. Full provider details are in our Imprint.

Under the GDPR you have the right to:

• ›access the personal data we hold about you (Art. 15);
• ›have inaccurate data corrected (Art. 16);
• ›have your data erased (Art. 17);
• ›restrict processing (Art. 18);
• ›data portability, meaning you can receive your data in a machine-readable format (Art. 20);
• ›object to processing based on our legitimate interests (Art. 21);
• ›withdraw any consent you have given, at any time, with effect for the future (Art. 7 (3)).

To exercise any of these rights, email us at info@neural-fretboard.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77), for example the data protection authority of your German federal state or the authority responsible for the controller’s location.

Account data. When you create an account we store your email address and an encrypted (hashed) password through our authentication provider. This is necessary to provide your account, log you in, and keep your saved songs and progress. Legal basis: performance of a contract, Art. 6 (1)(b) GDPR.

Content and usage data. Songs you save to your library (MIDI files and metadata), your practice statistics, level / XP / streak, achievements, and an optional display name. Legal basis: Art. 6 (1)(b) GDPR. Display names are checked by an automated profanity filter before they are saved.

Payment data. If you purchase the Creator subscription, payment is handled by our payment provider (Stripe) on their own hosted checkout page. We do not receive or store your full card details; we only receive confirmation of a completed payment and set your account to the paid tier. Legal basis: Art. 6 (1)(b) GDPR and, for record-keeping, Art. 6 (1)(c) GDPR.

Server and log data. When you visit the site, our hosting provider automatically processes technical data such as your IP address, browser type, referring page, date/time and requested resource. This is required to deliver the site securely and prevent abuse. Legal basis: legitimate interest, Art. 6 (1)(f) GDPR.

Audio and MIDI you process in the app. When you upload or record audio (MP3, WAV, microphone input) or MIDI to visualise, transcribe, split into stems, tune, or practise, that audio is processed entirely inside your browser. It is never uploaded to us or to any third party. The raw audio buffer is discarded after processing (separated stems may be cached locally on your device so the same file does not need to be split twice); only the resulting MIDI file is stored in your library, and only if you choose to save it. Microphone access (tuner, practice, recording) runs locally and is not recorded to any server.

Neural-Fretboard uses only strictly necessary cookies and does not use any advertising or tracking cookies. Under the ePrivacy Directive and § 25 (2) TDDDG, strictly necessary cookies do not require consent, which is why we do not show a cookie consent banner.

Web analytics (Vercel Web Analytics). We use Vercel Web Analytics to understand how many people visit the site and which pages they use. It works without cookies and without cross-site tracking: visitors are counted using a short-lived hash generated from the incoming request, which is automatically discarded and cannot be used to follow you across other websites. We only see aggregated numbers such as page views, referrers, country, and browser type. The service is provided by Vercel Inc. (USA); see section 6 for transfer safeguards. Legal basis: our legitimate interest in measuring and improving the service, Art. 6 (1)(f) GDPR.

We also store small amounts of data in your browser’s local storage for functional purposes only. This data stays on your device and is never transmitted to us:

• ›your view preference, sharp/flat and finger-display settings;
• ›favourited songs and which achievement unlocks you have already seen;
• ›an unsaved-work autosave for the Composer (crash / refresh recovery);
• ›free-tier counters (e.g. guest upload count, practice taster used).

We use the following service providers, who process data on our behalf under data processing agreements:

• ›Supabase: authentication, database and file storage (hosting region: Frankfurt, EU).
• ›Stripe: payment processing for the Creator subscription.
• ›Vercel Inc.: hosting and content delivery of the website, server logs, and the cookieless web analytics described in section 4.
• ›Content delivery network (GitHub Pages): only when you use the Guitar sound, your browser downloads the acoustic-guitar sample files from this host. This exposes your IP address to it, but no personal content is sent. The audio-to-notes models are served from our own domain. Legal basis: Art. 6 (1)(f) GDPR.
• ›Content delivery network (Hugging Face): only when you use the full-song stem split in the Composer for the first time, your browser downloads the separation model file (about 170 MB) from this host and caches it on your device. This exposes your IP address to it, but none of your audio or personal content is sent - the separation itself runs entirely in your browser. Legal basis: Art. 6 (1)(f) GDPR.

Web fonts (Outfit, Orbitron, JetBrains Mono) are self-hosted from our own domain; no request is made to Google Fonts, and no data is shared with Google when you load a page.

Some of the providers above (e.g. Stripe, Vercel, and the content delivery networks) may process data on servers located in the United States or route requests there. Where this happens, transfers are safeguarded by the EU Standard Contractual Clauses (Art. 46 GDPR) and/or the provider’s certification under the EU-US Data Privacy Framework. You can request a copy of the relevant safeguards from us.

We keep account and content data for as long as your account exists. When you delete your account or ask us to erase your data, we delete it without undue delay, unless we are legally required to retain certain records (for example, invoicing and tax records, which German law requires us to keep for up to 10 years). Server logs are kept only as long as needed for security and are then deleted or anonymised.

The site may contain affiliate links to third-party retailers (for example Thomann). If you click such a link, the destination site is operated by that third party under its own privacy policy; we have no influence over its data processing. We may earn a commission at no extra cost to you.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. The service is not directed at children under 16; if you are under 16, please do not create an account without the consent of a parent or guardian.

We may update this privacy policy to reflect changes to the service or the law. The current version is always available on this page with its “last updated” date.