1. Who We Are
This privacy policy applies to the website the-ultimate-piano.com and the web application Ultimate Piano (the "App"), operated by:
Kay Talmi / The Ultimate Piano
Nimrodstr. 11
13469 Berlin, Germany
Email: [email protected]
Website: https://the-ultimate-piano.com
We take your privacy seriously. This policy explains what data we collect, why we collect it, and how you can control it.
2. What Data We Collect
2.1 Account Data
When you create an account, we store:
- Email address — for authentication and account recovery
- Password — stored as a cryptographic hash (we never see your plain-text password)
- Account preferences — language, display settings, keyboard configuration
2.2 Usage Data (App)
When you use the App, we may store:
- Practice results — scores, exercise type, duration, performance metrics. Saved to your account while you are signed in, so your progress is available across devices; if you are not signed in, results stay on your device only. This is part of the service and does not depend on your analytics choice.
2.3 Payment Data
When you purchase a subscription or license, the following data is processed by our payment provider Paddle:
- Email address
- Subscription status and plan type
- Payment amounts and currency
- Transaction and customer identifiers
We do not store your credit card number, bank details, or billing address. All payment processing is handled by Paddle. See Paddle's Privacy Policy.
2.4 Analytics Data
We use Matomo, a self-hosted analytics platform, to understand how our App and website are used. We measure usage either way — what your choice decides is whether we may recognise your device and connect your visits over time:
| Without consent (including before you decide) | With consent | |
|---|---|---|
| Stored on your device | Nothing for analytics — no cookie, no identifier | Analytics cookies (_pk_id, _pk_ses) and an App identifier |
| App identifier | Not created | A random number that lets us see that several visits belong to the same device |
| IP address | Always anonymised before storage — the last bytes are removed, for everyone, with or without consent. We never store your full IP for analytics. | |
| What we record | Page views and events (which features are opened, how long a module is used) — without any identifier that would link them to you or to your other visits | The same, plus the connection between your visits |
Even without consent, our analytics server derives a short-lived technical identifier so that the parts of a single visit can be counted as one visit; see section 2.7.
If you decline, the App also deletes any identifier and analytics cookies that may already be on your device, and it asks your browser's "Do Not Track" setting to be respected.
You can change your analytics preference at any time in the App under Settings → License. Our analytics server is self-hosted — the analytics data described here is not shared with any third party. The advertising measurement in sections 3.7 to 3.9 is a separate matter with its own, separate consent.
2.5 Practice Coach (AI Assistant)
The App includes an optional Practice Coach — a chat assistant that answers questions about practising and opens the matching module for you. It only processes data when you actively send it a question.
When you ask a question, the following is transmitted to our AI provider Anthropic (see section 3.6) to generate the answer:
- Your question (limited to 300 characters)
- The recent messages of the current conversation, so the assistant can follow the context
We store each question and answer in our own database (in the EU) together with the time, the AI model used, technical measurements (processing time, token counts), your optional 👍/👎 rating, your account ID if you are signed in, and — if you consented to analytics — the App identifier described in section 2.4. We use these records to improve the assistant's answers and to enforce a daily usage limit.
To enforce that daily limit for everyone, including people who did not consent to analytics and therefore have no App identifier, we store a salted cryptographic hash of your IP address alongside each question. The hash cannot be turned back into your IP address, and we do not store the address itself. It is used for nothing but counting requests per day.
Because your questions are stored and sent to a third-party provider, please do not enter personal or sensitive information into the Coach — it is meant for questions about music and practising.
You can switch the Practice Coach off in the App at any time; if it is off, no data is sent to Anthropic.
2.6 Feedback You Send Us
Every module header in the App has a Feedback link. It opens a small form with one text field. Nothing is sent unless you write a message and press Send.
When you send feedback, we store:
- Your message — up to 2,000 characters
- Your email address — only if you choose to enter it, and only so that we can reply. The field is optional and may be left empty.
- Technical context — which module you wrote from, your App language, the App version, and whether you hold a licence. None of this identifies you.
- A salted cryptographic hash of your IP address — to limit how many messages can be sent per day. As in section 2.5, the hash cannot be turned back into your IP address, and we do not store the address itself.
- The App identifier from section 2.4 — only if you tick the box "Attach my current session".
That checkbox is not pre-ticked and never required. Leave it empty and no identifier is sent — this also applies if you have consented to analytics. Ticking it covers that one message and changes nothing about your analytics preference from section 2.4.
If you have not consented to analytics and still tick the box, we create a one-time number for your current visit only. It is never stored on your device and disappears when you close the tab. It lets us see what you were doing in the App just before you wrote — it cannot connect your message to earlier or later visits, because for you no such identifier exists.
Your message reaches us both as a stored record and as an email notification to our own address. Please do not enter personal or sensitive information — the form is meant for describing problems, ideas and things you are missing.
2.7 What We Do Not Do — and What We Do
- We do not sell your data
- We do not build advertising profiles about you, and our analytics data is never handed to anyone to build one
- We do not use your data for automated decisions that have legal effects for you
What we do: we advertise this service on Google, on Facebook and inside ChatGPT, and we measure whether those advertisements work. If you consent to marketing storage, a click identifier supplied by the advertising platform is kept in your browser and reported back to that platform when you reach a milestone that matters to us — for example opening the pricing window or completing a purchase. That tells us which advertisement led to which outcome. It also means the advertising platform can recognise you as someone who arrived through one of its ads, and can use that within its own services. Sections 3.7 to 3.9 describe each provider in detail. Without your consent to marketing storage none of this happens, and no data reaches either platform.
For the sake of accuracy, one more thing we do: our analytics server derives a technical identifier from ordinary connection data (the shortened IP address and browser information your browser sends with every request, such as screen size and browser version). It exists so that the separate requests of one visit can be counted as one visit instead of many. It changes every day, so it cannot connect what you did yesterday with what you do today, and it is never combined with your name, email or payment data. With your consent, the App identifier from section 2.4 takes over that role across visits — that is exactly what the consent question is about.
3. Third-Party Services
3.1 Supabase (Authentication & Database)
We use Supabase for user authentication and data storage. Your data is stored on servers in the European Union. See Supabase Privacy Policy.
3.2 Paddle (Payment Processing)
Subscription payments are processed by Paddle, which acts as the Merchant of Record. Paddle processes your payment data in accordance with PCI-DSS standards. See Paddle Privacy Policy.
3.3 Google Fonts
We load fonts (Inter, Playfair Display) from Google Fonts. When the page loads, your browser connects to Google servers to download font files. Google may log your IP address. See Google Privacy Policy.
3.4 YouTube (Video Embedding)
The App allows loading YouTube videos for practice purposes. When you load a YouTube video, content is embedded via YouTube's IFrame API. YouTube may set cookies and collect data according to Google's Privacy Policy. Videos are only loaded when you actively choose to play one.
3.5 Matomo (Self-Hosted Analytics)
Our own analytics server is fully under our control, and the data described in section 2.4 stays there — it is never passed to anyone else. Matomo runs without cookies. The advertising measurement in sections 3.7 to 3.9 is separate from it, runs only with your consent, and its data is never combined with what Matomo records.
3.6 Anthropic (AI Assistant)
The Practice Coach described in section 2.5 is powered by Anthropic. When you send a question to the Coach, that question and the recent messages of the conversation are transmitted to Anthropic's servers in the United States to generate the answer. This transfer to a third country is safeguarded by the EU Standard Contractual Clauses under Anthropic's data processing terms. Anthropic processes the data on our behalf and does not use it to train its models. See Anthropic Privacy Policy.
No data is sent to Anthropic unless you actively ask the Coach a question.
3.7 Google Ads (Advertising Measurement)
We advertise this service on Google Search. To learn which advertisements actually lead to people trying and buying the App, we use Google Ads conversion measurement, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Only after you consent to marketing storage is Google's measurement script loaded at all. Until then it is withheld and your browser contacts Google's advertising servers not at all. (Font files are a separate matter — see section 3.3.) In addition the page declares Google Consent Mode v2, which sets every storage category to denied by default — a second safeguard beneath the first.
Once loaded, the script stores identifiers in cookies whose names start with _gcl and reports to Google: the click identifier of the advertisement you arrived through, which milestone you reached, when that happened, and — for a purchase — the amount. Your name, email address and payment details are never part of this transmission.
Google may process this data on servers in the United States. The transfer is safeguarded by the EU–U.S. Data Privacy Framework, in which Google participates, and additionally by the EU Standard Contractual Clauses. See the Google Privacy Policy and How Google uses data from sites that use its services.
If you decline, or have not yet decided, the script is never loaded and nothing reaches Google.
3.8 Meta Pixel (Advertising Measurement)
We also advertise on Facebook and Instagram. The Meta pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, tells us which of those advertisements lead to visits.
Only after you consent to marketing storage is the pixel loaded. It then reports to Meta that you reached a particular page or milestone, together with the identifier of the advertisement you clicked. If you hold a Meta account, Meta can connect this to it.
Meta may process this data in the United States, safeguarded by the EU–U.S. Data Privacy Framework and the EU Standard Contractual Clauses. For the collection and transmission of this data Meta and we act as joint controllers; see the Controller Addendum and the Meta Privacy Policy.
If you decline, or have not yet decided, the pixel is not loaded.
3.9 OpenAI Ads (Advertising Measurement)
We also advertise this service inside ChatGPT. To learn which of those advertisements lead to people trying the App, we use the OpenAI measurement pixel, provided by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.
Only after you consent to marketing storage is OpenAI's measurement script loaded at all. Until then it is withheld and your browser contacts OpenAI's advertising servers not at all. A second safeguard sits beneath the first: before the script is initialised we set its own consent flag to denied, and release it only once your consent is on record.
Once loaded, the script stores identifiers in the cookies __oppref (the identifier of the advertisement you arrived through), __obref (a browser reference generated by OpenAI) and __oaiq_consent (your consent state), and reports to OpenAI: which milestone you reached, when that happened, the value we assign to that step, and the address of the page you were on. Your name, email address and payment details are never part of this transmission.
OpenAI may process this data outside the European Economic Area, including in the United States. The transfer is governed by OpenAI's Ad Tools Data Processing Addendum, under which OpenAI Ireland Limited processes European data, together with the EU Standard Contractual Clauses it incorporates. See also the OpenAI Europe Privacy Policy.
If you decline, or have not yet decided, the script is never loaded and nothing reaches OpenAI.
4. How We Use Your Data
We use your data for:
- Providing the service — authentication, saving your settings and practice progress
- Processing payments — managing subscriptions and licenses
- Improving the App — understanding which features are used (via anonymous analytics) and acting on the feedback you send us
- Customer support — responding to your inquiries
- Measuring our advertising — only with your consent to marketing storage, to see which advertisement led someone to the App (sections 3.7 to 3.9)
With your consent to marketing storage, we additionally measure which advertisement led you here (sections 3.7 to 3.9). Beyond that we do not use your data for profiling or for automated decision-making that has legal effects for you, and we never sell it.
5. Legal Basis for Processing (Art. 6 GDPR)
| Processing Activity | Legal Basis |
|---|---|
| Account data, app settings, practice results | Contract performance (Art. 6(1)(b)) |
| Payment processing via Paddle | Contract performance (Art. 6(1)(b)) |
| Analytics without consent — nothing stored on your device, IP anonymised, no recognition across visits | Legitimate interest (Art. 6(1)(f)) — improving the App |
| Analytics with consent — cookies and App identifier on your device, visits connected | Consent (Art. 6(1)(a)) |
| Identifier created when you start a checkout, so a completed payment can be matched to the purchase attempt | Contract performance (Art. 6(1)(b)) |
| Practice Coach — answering your question | Contract performance (Art. 6(1)(b)) — the Coach is part of the service you use |
| Practice Coach — storing questions for quality and usage limits | Legitimate interest (Art. 6(1)(f)) — improving the assistant and preventing abuse |
| Practice Coach — salted hash of the IP address for the daily limit | Legitimate interest (Art. 6(1)(f)) — preventing abuse and runaway costs |
| Feedback — your message and the technical context sent with it | Legitimate interest (Art. 6(1)(f)) — improving the App and acting on what you tell us |
| Feedback — email address, if you choose to enter one | Consent (Art. 6(1)(a)) — you provide it so that we may reply |
| Feedback — session identifier attached via the checkbox in the form | Consent (Art. 6(1)(a)) — separate from your analytics choice and given per message |
| Feedback — salted hash of the IP address for the daily limit | Legitimate interest (Art. 6(1)(f)) — preventing abuse of the form |
| Advertising measurement — Google Ads, Meta pixel and OpenAI pixel, click identifier and the milestone you reached | Consent (Art. 6(1)(a)) — given separately from the analytics choice; without it none of these scripts is loaded |
| Retention of payment records | Legal obligation (Art. 6(1)(c)) — tax and accounting law |
6. Data Storage & Security
- Database: Hosted in the EU. Users can only access their own data.
- Authentication: Passwords are securely hashed (we never store or see your plain-text password).
- Transport: All connections are encrypted (HTTPS).
- Analytics: Self-hosted on our own server. The data our Matomo server records is not shared with third parties; the separate advertising measurement of sections 3.7 to 3.9 runs only with your consent.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until you delete your account |
| Practice results | Until you delete your account |
| App settings | Until you delete your account |
| Practice Coach questions and answers | Deleted automatically after 12 months |
| Feedback messages (including an email address you entered) | Deleted automatically after 24 months |
| Payment records | Retained for legal/tax compliance (typically 7–10 years) |
| Analytics data | Anonymized, retained for up to 12 months |
8. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Right of Access — You can request a copy of all data we store about you.
- Right to Rectification — You can update your email address and settings at any time.
- Right to Erasure — You can delete your account in the App under Settings → License → Delete Account. This removes all your personal data except payment records required by law.
- Right to Data Portability — You can request an export of your data by contacting us.
- Right to Object — You can opt out at any time via the consent window or in Settings. The App asks once, and that single answer covers both the analytics described in section 2.4 and the advertising measurement in sections 3.7 to 3.9; declining or withdrawing stops both.
- Right to Withdraw Consent — You can withdraw your consent at any time in Settings → License inside the App. This one setting covers both purposes: withdrawing removes the App identifier and the advertising click identifier from your device, and no further conversion is reported to the advertising platform. The cookie banner on the website is a separate consent for the website itself and is withdrawn there. A feedback message you have already sent cannot be recalled by either, because it was a separate, one-off consent — but you can ask us to delete it at any time using the address below.
- Right to Lodge a Complaint — You have the right to lodge a complaint with a data protection supervisory authority. Our responsible authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (www.datenschutz-berlin.de).
To exercise any of these rights, contact us at [email protected].
9. Cookies
Essential Cookies
We use essential cookies/storage for the App to function:
- Authentication tokens — to keep you logged in (Supabase session)
- App settings — stored in localStorage (never sent to third parties)
- Consent preference — remembers your single answer, which covers both analytics and marketing storage
Analytics Storage (Optional)
If you accept via the consent window, we store the following so that returning visits can be recognised:
- _pk_id — Matomo visitor cookie (13 months)
- _pk_ses — Matomo session cookie (30 minutes)
- up_client_id — the App identifier from section 2.4, a random number kept in your browser's local storage until you withdraw consent or clear your browser data
None of these are created if you decline or have not decided yet. You can opt out at any time in Settings → License; withdrawing your consent deletes all three.
Marketing Storage (Optional)
Separately from analytics, you can consent to marketing storage. Only then do we load the measurement scripts of the advertising platforms described in sections 3.7 to 3.9, which store:
- _gcl_* — Google Ads click identifiers, so that a purchase can be attributed to the advertisement it came from (up to 90 days)
- _fbp — Meta pixel identifier (up to 90 days)
- __oppref — OpenAI Ads click identifier, for the same purpose
- __obref — browser reference generated by OpenAI
- __oaiq_consent — your consent state, so that the OpenAI script knows whether it may measure at all
Declining marketing storage does not restrict any function of the App. If you decline or have not decided yet, none of these scripts is loaded and none of these cookies is created. You can change this decision at any time in the cookie banner on the website.
Third-Party Cookies
YouTube may set cookies when you load a video. We have no control over these cookies. See Google's Cookie Policy.
10. Children's Privacy
Our service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to This Policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated date. For significant changes, we will notify registered users by email.
Last updated: September 4, 2026
12. Contact
If you have questions about this privacy policy or your data, contact us at:
Kay Talmi
Nimrodstr. 11
13469 Berlin, Germany
[email protected]
