Privacy Policy

The controller responsible for data processing on this website within the meaning of the GDPR is:

We have not appointed a Data Protection Officer, as we are not legally required to do so. For any privacy request, contact us at the email address above. Full provider details are in our Imprint.

Under the GDPR you have the right to:

• ›access the personal data we hold about you (Art. 15);
• ›have inaccurate data corrected (Art. 16);
• ›have your data erased (Art. 17);
• ›restrict processing (Art. 18);
• ›data portability, meaning you can receive your data in a machine-readable format (Art. 20);
• ›object to processing based on our legitimate interests (Art. 21);
• ›withdraw any consent you have given, at any time, with effect for the future (Art. 7 (3)).

To exercise any of these rights, email us at info@neural-fretboard.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77), for example the data protection authority of your German federal state or the authority responsible for the controller’s location.

Account data. When you create an account we store your email address and an encrypted (hashed) password through our authentication provider. This is necessary to provide your account, log you in, and keep your saved songs and progress. Legal basis: performance of a contract, Art. 6 (1)(b) GDPR.

Sign in with Google. Instead of a password you can sign in with a Google account. If you do, Google tells us only the basic profile information covered by the scopes we request: your email address, your name and your profile picture, plus the identifier Google uses for your account. We store that data in the same account record described above and use it for nothing else: no advertising, no profiling, no sale, and it is never passed to a third party beyond the processors listed in section 5. We do not receive your Google password, and we get no access to Gmail, Drive, contacts, calendar or any other Google service. Google processes the sign-in itself as its own controller under its own privacy policy. Legal basis: performance of a contract, Art. 6 (1)(b) GDPR. You can revoke our access at any time in your Google account settings, and you can delete the Neural-Fretboard account entirely by writing to the address in section 1.

Content and usage data. Songs in your library (Guitar Pro, MusicXML and MIDI files and their metadata), your practice statistics, level / XP / streak, achievements, and an optional display name. Legal basis: Art. 6 (1)(b) GDPR. Display names are checked by an automated profanity filter before they are saved.

Song files you open. Opening a song file of your own (Guitar Pro, MusicXML or MIDI) requires an account; the bundled demo songs do not, and they are never stored. When you open a file of your own while signed in, it is automatically saved to your private library so that you can reopen it later, on any device: the file and its name are stored with our database and file storage provider (Supabase, hosting region Frankfurt, see section 5) and only your account can access them. On the free plan the library holds 3 songs; once it is full, a file you open still plays but is not saved. You can delete any song from your library at any time, which also deletes the stored file. Legal basis: performance of a contract, Art. 6 (1)(b) GDPR.

Payment data. If you purchase the Creator subscription, payment is handled by our payment provider (Stripe) on their own hosted checkout page. We do not receive or store your full card details; we only receive confirmation of a completed payment and set your account to the paid tier. Legal basis: Art. 6 (1)(b) GDPR and, for record-keeping, Art. 6 (1)(c) GDPR.

Server and log data. When you visit the site, our hosting provider automatically processes technical data such as your IP address, browser type, referring page, date/time and requested resource. This is required to deliver the site securely and prevent abuse. Legal basis: legitimate interest, Art. 6 (1)(f) GDPR.

Audio you process in the app. When you open or record audio (MP3, WAV, microphone input) to transcribe, split into stems, tune, or practise, that audio is processed entirely inside your browser. It is never uploaded to us or to any third party. The raw audio buffer is discarded after processing (separated stems may be cached locally on your device so the same file does not need to be split twice); only the resulting MIDI file is stored in your library, and only if you choose to save it. Microphone access (tuner, practice, recording) runs locally and is not recorded to any server.

Neural-Fretboard uses only strictly necessary cookies and does not use any advertising or tracking cookies. Under the ePrivacy Directive and § 25 (2) TDDDG, strictly necessary cookies do not require consent, which is why we do not show a cookie consent banner.

Web analytics (Vercel Web Analytics). We use Vercel Web Analytics to understand how many people visit the site and which pages they use. It works without cookies and without cross-site tracking: visitors are counted using a short-lived hash generated from the incoming request, which is automatically discarded and cannot be used to follow you across other websites. We only see aggregated numbers such as page views, referrers, country, and browser type. The service is provided by Vercel Inc. (USA); see section 6 for transfer safeguards. Legal basis: our legitimate interest in measuring and improving the service, Art. 6 (1)(f) GDPR.

Product event counts (our own). When you meet certain moments in the app, for example the sign-up prompt before uploading a song, a feature that is part of the Creator plan, the pricing page, the first time you press play, or an export, your browser sends the name of that moment to our server together with a few plain details about it (such as which page or which feature). We store the event name, those details, the time, the page, the kind of device (phone, tablet or desktop) and the kind of site you arrived from (for example “Instagram” or “Google”, never the full address). If you are signed in, the event is linked to your account; if you are not, it is stored without any identifier. We do not store your IP address or browser details with it, and nothing is saved on your device for this purpose. The data is kept in our database (Supabase, EU region) for at most 400 days and is used only to understand which parts of the service work and where people get stuck. Legal basis: our legitimate interest in measuring and improving the service, Art. 6 (1)(f) GDPR. You can object at any time by writing to us.

Where a new account came from. Some of our own links carry a short campaign label in the address, for example that you came from our Instagram profile. If you create an account after arriving through such a link, we store that label (for example “instagram/bio”) once with your account, and it is added to the event details described above. It is read from the address only, never from a cookie or anything saved on your device, and it is never shared. Legal basis: our legitimate interest in knowing which of our own channels work, Art. 6 (1)(f) GDPR. You can object at any time by writing to us.

We also store small amounts of data in your browser’s local storage for functional purposes only. This data stays on your device and is never transmitted to us:

• ›your view preference, sharp/flat and finger-display settings;
• ›favourited songs and which achievement unlocks you have already seen;
• ›a song file you picked before signing in, kept in this browser tab’s session storage for at most 30 minutes so it can open by itself once you are signed in (deleted as soon as it opens, or when you close the tab; it only reaches our server if you then save it to your library like any other upload);
• ›an unsaved-work autosave for the Composer (crash / refresh recovery);
• ›free-tier counters (e.g. guest upload count, practice taster used).

We use the following service providers, who process data on our behalf under data processing agreements:

• ›Supabase: authentication, database and file storage (hosting region: Frankfurt, EU).
• ›Stripe: payment processing for the Creator subscription.
• ›Google Ireland Ltd. / Google LLC: only if you choose “Sign in with Google”. Google carries out the sign-in as its own controller and passes us your email address, name, profile picture and account identifier, as described in section 3. We request no other Google data.
• ›Vercel Inc.: hosting and content delivery of the website, server logs, and the cookieless web analytics described in section 4.
• ›Content delivery network (GitHub Pages): only when you use the Guitar sound, your browser downloads the acoustic-guitar sample files from this host. This exposes your IP address to it, but no personal content is sent. The audio-to-notes models are served from our own domain. Legal basis: Art. 6 (1)(f) GDPR.
• ›Content delivery network (Hugging Face): only when you use the full-song stem split in the Composer for the first time, your browser downloads the separation model file (about 170 MB) from this host and caches it on your device. This exposes your IP address to it, but none of your audio or personal content is sent - the separation itself runs entirely in your browser. Legal basis: Art. 6 (1)(f) GDPR.

Web fonts (Outfit, Orbitron, JetBrains Mono) are self-hosted from our own domain; no request is made to Google Fonts, and no data is shared with Google when you load a page.

Some of the providers above (e.g. Stripe, Vercel, and the content delivery networks) may process data on servers located in the United States or route requests there. Where this happens, transfers are safeguarded by the EU Standard Contractual Clauses (Art. 46 GDPR) and/or the provider’s certification under the EU-US Data Privacy Framework. You can request a copy of the relevant safeguards from us.

We keep account and content data for as long as your account exists. When you delete your account or ask us to erase your data, we delete it without undue delay, unless we are legally required to retain certain records (for example, invoicing and tax records, which German law requires us to keep for up to 10 years). Server logs are kept only as long as needed for security and are then deleted or anonymised.

The site may contain affiliate links to third-party retailers (for example Thomann). If you click such a link, the destination site is operated by that third party under its own privacy policy; we have no influence over its data processing. We may earn a commission at no extra cost to you.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. The service is not directed at children under 16; if you are under 16, please do not create an account without the consent of a parent or guardian.

We may update this privacy policy to reflect changes to the service or the law. The current version is always available on this page with its “last updated” date.