Privacy Policy

Introduction

Logato (“we,” “our,” or “us”) is a music practice optimization application. This Privacy Policy describes the information we collect when you use Logato, how we use that information, and your rights with respect to it. By creating an account or using Logato, you agree to the practices described in this policy.

Information we collect

Account information

• Email address
• Display name
• Password (stored as a cryptographic hash; we never store your plaintext password)

Library and practice data

The core purpose of Logato is to plan your practice and measure what happened. To do this, we store:

• Your library: items, parts, variants, folders, tags, courses, setlists, notes, and the reference links you attach
• Recordings, photos, clips and imported files you add, within your plan’s storage allowance
• Practice sessions, entries and reps: which items and variants you practiced, in what order, at what tempo, for how long, and whether each rep was clean or missed
• Optional self-ratings you add after a set
• Progress state: tempo history, spaced-repetition scheduling data (ease, interval, next due date) and mastery values
• Targets and due dates you set, and the plans you build: session templates, weekly plans and programs

Preferences

• Instruments you play and your skill level on each
• Default session length and other practice settings
• Reminder frequency, preferred hour and timezone

Teacher links

If you accept a teacher’s invitation, that teacher can see your library, plans and practice for as long as the link is active, and can send you material that you choose whether to accept. You can disconnect at any time in Settings; access ends immediately.

Connected apps

If you connect Claude or another app, we store the connection and an encrypted access token so the app can read and edit your library on your behalf with the permissions you approved. You can revoke a connection at any time in Settings.

Email reminders

If you opt in to email reminders, we store your reminder frequency, preferred hour, timezone and the time of the last reminder sent, and we use a summary of your recent progress to write each reminder.

Billing information

If you subscribe to a paid plan, we store limited billing metadata needed to manage your subscription: your Stripe customer ID, subscription status (for example active, past due or canceled) and plan. We do not store your card number, expiration date or CVC; that information is collected and stored directly by Stripe. See Payment Processing below.

Technical information

Like most web applications, our hosting infrastructure may automatically log standard request metadata such as IP address, browser type and the pages you visit. This data is used solely for security, debugging and performance monitoring. We do not use third-party advertising networks or behavioral trackers. We may use a privacy-respecting, cookie-free analytics tool that counts page views and sign-ups in aggregate.

How we use your information

• Providing the service: generating practice sessions, scheduling items via spaced repetition, tracking your progress over time, and showing your mastery and targets
• Email reminders: sending practice reminders only when you have opted in; each email includes a one-click unsubscribe link
• Account management: authenticating you, managing your session, and letting you update your details and preferences
• Billing: processing subscription payments, maintaining your subscription status, and applying the limits of your plan
• Security and integrity: detecting and preventing unauthorized access, abuse or other harmful activity
• Improving Logato: understanding aggregate usage patterns to guide product decisions; we do not sell or share individual usage data with third parties for this purpose

We do not sell your personal information. We do not use your data for advertising or share it with ad networks.

Third-party service providers

We use the following third-party services to operate Logato. Each acts as a data processor on our behalf and is contractually bound to handle your data only as directed by us.

• Supabase provides our database, file storage and authentication. Your account credentials, library, practice data and files are stored on Supabase-managed servers. Row Level Security policies enforce that each user can only access their own records (and, for a teacher, those of students who accepted the invitation).
• Resend delivers transactional email. Your email address is shared with Resend only when we send you an email (for example account verification or a practice reminder).
• Vercel hosts the Logato web application and runs server-side logic, including the daily scheduled job.
• Stripe processes payments for paid plans. If you subscribe, your payment card details are collected and stored directly by Stripe; Logato never receives your full card number. Stripe shares back with us only the billing metadata needed to manage your subscription. See Stripe’s Privacy Policy.

We do not integrate with advertising platforms, social media trackers or data brokers.

Payment processing

Paid plans are subscriptions billed monthly or annually. All payment processing is handled by Stripe, a PCI-compliant payment processor. When you subscribe:

• Your card details are entered directly into Stripe’s secure checkout and never pass through Logato’s servers
• We store only your Stripe customer ID, subscription status and plan
• You can view invoices, update payment methods and cancel at any time in the Stripe-hosted customer portal, linked from Settings

For details on how Stripe handles payment information, see stripe.com/privacy.

Cookies and sessions

Logato uses HTTP-only cookies to keep you signed in. These cookies are strictly necessary for the application to function and do not track you across other websites. We do not use advertising cookies or third-party tracking cookies.

Data retention

We keep your data for as long as your account is active. You can delete your account and its data yourself in Settings, and you can export everything at any time. After deletion, we remove your personal information from our active systems within a reasonable time. Supabase and Vercel may retain infrastructure-level logs for a limited period under their own retention policies.

Your rights

You have the following rights with respect to your data:

• Access and export: you can view your library and practice history in the application at any time, and export everything as a file
• Correction: you can update your display name and preferences in Settings
• Deletion: you can delete your account and all associated data in Settings, or ask us to
• Email opt-out: you can unsubscribe from reminder emails using the one-click link in any reminder email, or by turning reminders off in Settings

Depending on your location, you may have additional rights under applicable privacy laws (such as GDPR or CCPA). To use any of these rights, contact us at the address below.

Data security

We implement appropriate technical and organizational measures to protect your data, including:

• Row Level Security policies on all database tables
• Cryptographic password hashing via Supabase Auth
• HTTPS encryption for all data in transit
• Encryption of connected-app tokens before they are stored
• Signed, time-limited tokens for email unsubscribe links
• Server-side validation of all inputs

No system is perfectly secure. If you believe your account has been compromised, please contact us immediately.

Children’s privacy

Logato is not directed at children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with their information, please contact us and we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of Logato after a change means you accept the revised policy. For material changes, we will make reasonable efforts to notify you, for example by email.

Contact us

If you have questions about this Privacy Policy, want to use your data rights, or need to report a privacy concern, contact us at waltz-fidgety-cut@duck.com.