Privacy policy

Axel Londas, publisher of the site, reachable at londasaxel@gmail.com.

Your account. Your email address and, if you use Google, your name and your Google account ID. With a password, we only keep a hash of it (scrypt): nobody can read it back. Purpose: giving you access to the studio and your projects. Legal basis: performance of the terms of use (article 6.1.b GDPR). Retention: as long as your account exists.

Your session. A random token kept in your browser; the database only keeps its hash. It expires after 30 days, or as soon as you sign out. Legal basis: performance of the terms of use.

Your songs and projects. The uploaded audio file, its name, the computed tracks (isolated guitar, playback) and the analysis (chords, tempo, chart, fingerings). Purpose: giving you the result. Legal basis: performance of the terms of use. Retention: 30 days for audio tracks, deleted automatically; the analysis and file name until you delete the project or your account.

Technical data. Your IP address and what your browser sends, to serve the site, protect it and limit abuse (number of analyses and sign-ins per address). Legal basis: our legitimate interest in securing the service (article 6.1.f). Anti-abuse counters live in memory and reset at every restart; technical logs are rotated continuously and kept for one year at most.

Your messages. If you write to us: your address and your message, for as long as it takes to answer and follow up.

Your donations. They go through Ko-fi, which collects the payment (with Stripe or PayPal). We receive your name or nickname, the amount, your message if any and your email address if you choose to share it; never your bank details. Legal basis: our legitimate interest in thanking you, and our accounting and tax obligations, which set the retention period.

No automated decision is made about you: the automatic analysis is about the music, not about you.

Only the publisher runs the service. These providers process data on its behalf:

• OVH SAS (France): the application server, the database and the audio files.
• Cloudflare, Inc. (United States): delivery of the site's pages, which sees your IP address.
• Modal Labs, Inc. (United States): the compute servers that isolate the guitar. The song is sent there for the time of the computation and not kept.
• Google: if you choose "Continue with Google", Google identifies you and sends us your email and name, under its privacy policy.
• Ko-fi Labs Ltd (United Kingdom): if you donate, under its privacy policy.

We don't sell, rent or share any data with anyone else, except where required by law (a request from a judicial authority).

Cloudflare, Modal and Google are based in the United States, Ko-fi in the United Kingdom. These transfers rely on the safeguards provided by the GDPR: an adequacy decision of the European Commission (EU–US Data Privacy Framework for certified companies, United Kingdom) or standard contractual clauses.

findyourchords uses no advertising or analytics cookies. It only keeps in your browser what the site needs to work:

• fyc-session (local storage): your session, while you are signed in, 30 days at most;
• fyc-locale (local storage): the language you picked;
• sidebar_state (cookie, 7 days): whether the studio's projects sidebar is open or closed.

These are strictly necessary for the service you ask for: the law does not require your consent for them (article 82 of the French Data Protection Act), which is why no banner is shown. On the sign-in screen, the "Continue with Google" button is loaded from Google's servers, which may use their own cookies. Fonts are served by the site itself.

You can at any time access your data, correct it, delete it, restrict its use, object to processing based on legitimate interest, and get the data you gave us in a readable format (portability). You can also set instructions for what happens to your data after your death.

To do so, write to londasaxel@gmail.com from your account's address: we answer within one month. You can also erase your data yourself in the studio: one project, all your projects, or your whole account (your account menu, top right), which immediately erases your account, your sessions, your projects and their tracks.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (cnil.fr), or with the data protection authority of your country.

All traffic goes over HTTPS. Passwords are never stored in clear text (scrypt), nor are sessions (only their hash is kept), and sign-in attempts are rate-limited. No system is infallible: in the event of a data breach that puts you at risk, you would be informed, as would the CNIL, as the law requires.

The service is meant for people aged 15 or over. Younger users need the consent of a parent or guardian to sign up, who can exercise the rights above on the child's behalf.

This policy may change along with the service. The update date is at the top of the page.