Privacy Policy

Introduction

Logato ("we," "our," or "us") is a music practice optimization application. This Privacy Policy describes the information we collect when you use Logato, how we use that information, and your rights with respect to it. By creating an account or using Logato, you agree to the practices described in this policy.

Information We Collect

We collect the following categories of information:

Account Information

• Email address
• Display name
• Password (stored as a cryptographic hash — we never store your plaintext password)

Practice Data

The core purpose of Logato is to track your musical progress. To do this, we store:

• Practice sessions — session type, duration, self-reported energy and focus levels, and status
• Exercise sessions — which exercises you practiced, in what order, and at what tempo
• Self-assessments — your 1–5 ratings across four dimensions after each exercise: technical accuracy, rhythm accuracy, comfort and ease, and overall satisfaction
• Progress state — spaced-repetition scheduling data (ease factor, interval, next due date), BPM history, unified mastery scores, and manual learning-progress values
• Goals — BPM targets and progress goals you create for specific exercises
• Focus areas — the focus areas you have selected to steer your sessions

Preferences

• Preferred instrument (Guitar or Piano)
• Self-reported skill level
• Default session duration
• Practice interleaving preference

Email Reminder Preferences

If you opt in to email reminders (a Pro feature), we store your reminder frequency, preferred hour, timezone, preferred day of week, and the timestamp of the last reminder sent. We also store a mastery snapshot used to personalize each reminder email with your recent progress.

Billing Information

If you subscribe to Logato Pro, we store limited billing metadata needed to manage your subscription: your Stripe customer ID, subscription status (e.g. active, past due, canceled), and subscription tier. We do not store your card number, expiration date, or CVC — that information is collected and stored directly by Stripe. See Payment Processing below for details.

Technical Information

Like most web applications, our hosting infrastructure may automatically log standard request metadata such as IP address, browser type, and the pages you visit. This data is used solely for security, debugging, and performance monitoring. We do not use third-party advertising networks or behavioral analytics trackers.

How We Use Your Information

• Providing the service — generating personalized practice sessions, scheduling exercises via spaced repetition, tracking your progress over time, and displaying your mastery and goal status
• Email reminders — sending personalized practice reminder emails only when you have opted in; each email includes a one-click unsubscribe link
• Account management — authenticating you, managing your session, and allowing you to update your account details and preferences
• Billing — processing Pro subscription payments, maintaining your subscription status, and enforcing feature limits based on your plan
• Security and integrity — detecting and preventing unauthorized access, abuse, or other harmful activity
• Improving Logato — understanding aggregate usage patterns to guide product decisions; we do not sell or share individual usage data with third parties for this purpose

We do not sell your personal information. We do not use your data for advertising or share it with ad networks.

Third-Party Service Providers

We use the following third-party services to operate Logato. Each acts as a data processor on our behalf and is contractually bound to handle your data only as directed by us.

• Supabase — provides our database and authentication infrastructure. Your account credentials, practice data, and preferences are stored on Supabase-managed servers. All data is protected by Row Level Security policies that enforce that each user can only access their own records.
• Resend — transactional email delivery service. Your email address is shared with Resend only when we send you a transactional email (e.g., account verification, practice reminders).
• Vercel — hosts the Logato web application and executes server-side logic including the daily reminder cron job.
• Stripe — processes payments for Logato Pro subscriptions. If you subscribe, your payment card details are collected and stored directly by Stripe — Logato never receives or stores your full card number. Stripe shares back with us only the billing metadata needed to manage your subscription (customer ID, subscription status, plan). See Stripe's Privacy Policy for how Stripe handles your payment data.

We do not integrate with advertising platforms, social media trackers, or data brokers.

Payment Processing

Logato Pro is a paid subscription billed monthly or annually. All payment processing is handled by Stripe, a PCI-compliant third-party payment processor. When you subscribe:

• Your card details are entered directly into Stripe's secure checkout — they never pass through Logato's servers
• We store only your Stripe customer ID, subscription status, and subscription tier
• You can view invoices, update payment methods, and cancel your subscription at any time via the Stripe-hosted customer portal, linked from your account settings

For details on how Stripe handles your payment information, see stripe.com/privacy.

Cookies and Sessions

Logato uses HTTP-only cookies to maintain your authenticated session. These cookies are strictly necessary for the application to function and do not track you across other websites. We do not use advertising cookies, third-party tracking cookies, or analytics cookies.

Data Retention

We retain your data for as long as your account is active. If you wish to delete your account and associated data, please contact us at the email address below. Upon a verified deletion request, we will remove your personal information from our active systems within a reasonable time. Note that Supabase and Vercel may retain infrastructure-level logs for a limited period per their own retention policies.

Your Rights

You have the following rights with respect to your data:

• Access — you can view your practice history, progress data, and account settings directly within the application at any time
• Correction — you can update your display name, email address, and preferences from your account settings page
• Deletion — you may request deletion of your account and all associated data by contacting us
• Email opt-out— you can unsubscribe from reminder emails at any time using the one-click unsubscribe link in any reminder email, or by setting your reminder frequency to "None" in your account settings

Depending on your location, you may have additional rights under applicable privacy laws (such as GDPR or CCPA). To exercise any right, contact us at the address below.

Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Row Level Security (RLS) policies on all database tables
• Cryptographic password hashing via Supabase Auth
• HTTPS encryption for all data in transit
• Signed, time-limited tokens for email unsubscribe links
• Server-side validation of all inputs using Zod schema parsing

No system is perfectly secure. If you believe your account has been compromised, please contact us immediately.

Children's Privacy

Logato is not directed at children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with their information, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date below. Continued use of Logato after a policy change constitutes acceptance of the revised policy. For material changes, we will make reasonable efforts to notify you (for example, via the email address associated with your account).

Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, please contact us at waltz-fidgety-cut@duck.com.