Draft: some details about who runs Fretudes are still missing (config/legal.yml). Fill them in, and have this text reviewed, before launch.

Privacy policy

Last updated October 13, 2026.

Fretudes is an app for learning scales, modes and music theory on the guitar. This policy explains what personal data it keeps, why, for how long, and what you can do about it. It's written to meet the EU General Data Protection Regulation (GDPR).

Who is responsible

The controller of your data is TODO: your full name, trading as (business name), TODO: business address, Poland, tax ID TODO: NIP. For anything about your data, write to TODO: contact email for privacy and support.

What Fretudes keeps

• Your account: email address, a hash of your password (never the password itself), an optional display name, your time zone and your settings (note naming, left-handed, frets shown, sound, theme, reminder time).
• Email confirmation: when you sign up we email you a 6-digit code; only a hash of it is kept, until you've used it, and then when your address was confirmed.
• Your practice: every exercise you finish (answers, score, time taken), your progress through lessons and modules, your review schedule, and the tool set-ups you save.
• Sign-in sessions: for each device you're signed in on, its browser name (user agent) and IP address, so you stay signed in and misuse can be spotted.
• Notifications: if you turn on reminders for a device, the address your browser's push service gives for it. Turning them off deletes it.
• Your plan: whether you have Pro, from when and until when, and your customer ID at Paddle (below).

Fretudes doesn't use advertising, analytics or tracking cookies, and doesn't sell or share your data for marketing.

Why, and on what legal basis

• To provide the service you signed up for (Art. 6(1)(b) GDPR, performing our contract): your account, practice history, progress and settings, on every device you use.
• To keep the service secure (Art. 6(1)(f), our legitimate interest): sign-in sessions and server logs, and checks that sign-ups and sign-ins come from people, to prevent abuse and fix problems. The check on the sign-up, sign-in and password forms (ALTCHA) runs on our own server: your browser solves a small calculation, nothing is sent to anyone else and nothing tracks you.
• To remind you to practise (Art. 6(1)(a), your consent): only if you turn reminders on, and you can turn them off at any time in Settings or in your browser.
• To meet legal obligations (Art. 6(1)(c)), such as keeping records the law requires.

Payments

Fretudes Pro is sold through Paddle (Paddle.com Market Limited), which acts as the merchant of record: Paddle is the seller, handles payment, invoices, taxes and refunds, and is the controller of the payment data you give it under its own privacy policy. Fretudes never sees your card details; it receives from Paddle only what's needed to give you Pro (your customer ID, the plan, its status and dates).

Who else processes your data

• Hosting: TODO: hosting provider and where the servers are (e.g. a data centre in the EU), which stores the app and its database on our behalf.
• Resend (Resend, Inc., USA) sends the app's emails on our behalf: sign-up codes and password resets. It receives your email address and the message.
• Push services of your browser's maker (e.g. Apple, Google, Mozilla) deliver reminders, if you turn them on.
• Paddle, as above.

Where a provider is outside the European Economic Area, data is transferred under the safeguards the GDPR allows, such as the European Commission's standard contractual clauses or an adequacy decision.

On your device

Fretudes sets one cookie, to keep you signed in; it's strictly necessary, so it doesn't need consent. The app also stores some things in your browser itself: pages for offline use, results finished offline until they're sent, and conveniences like the drone's volume. Signing out clears the saved pages.

How long it's kept

Your account and practice data are kept for as long as you have an account. When you delete your account, they're deleted straight away from the live database, and from backups when those expire (within 30 days). Records the law requires us to keep are kept only as long as it requires. Paddle keeps its own records as its privacy policy says.

Your rights

You can ask to see the data we hold about you, have it corrected, deleted or its use restricted, object to its use, and receive it in a portable format. You can change most of it yourself in Settings, and delete your account there at any time (Settings → Delete account). For anything else write to TODO: contact email for privacy and support; we answer within a month. Where something is based on your consent, you can withdraw it at any time.

You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority where you live.

Children

Fretudes is meant for people aged 16 and over. If you're younger, please use it with a parent's or guardian's consent.

Changes

If this policy changes in a way that matters, we'll say so in the app before the change takes effect. The date at the top shows the latest version.