Privacy policy

Last updated October 20, 2026.

Fretudes is an app for learning scales, modes and music theory on the guitar. This policy explains what personal data it keeps, why, for how long, and what you can do about it. It's written to meet the EU General Data Protection Regulation (GDPR).

Who is responsible

The controller of your data is PROAPI Michał Pawelski, Stawowa 92, 85-323 Bydgoszcz, tax ID PL9671166494. For anything about your data, write to support@fretudes.app.

What Fretudes keeps

• Your account: email address, a hash of your password (never the password itself), an optional display name, your time zone and your settings (note naming, left-handed, frets shown, sound, theme, reminder time).
• Signing in with Google (if you choose it): Google tells us your email address, your name and an ID for your Google account, and confirms the address is yours. We get nothing else from Google, and Google doesn't learn what you do in Fretudes.
• Email confirmation: when you sign up we email you a 6-digit code; only a hash of it is kept, until you've used it, and then when your address was confirmed.
• Your practice: every exercise you finish (answers, score, time taken), your progress through lessons and modules, your review schedule, and the tool set-ups you save.
• Sign-in sessions: for each device you're signed in on, its browser name (user agent) and IP address, so you stay signed in and misuse can be spotted.
• Notifications: if you turn on reminders for a device, the address your browser's push service gives for it. Turning them off deletes it.
• Feedback you send: your message, the page you were on, your browser, screen size and the app version, to answer you and fix what's wrong. A screenshot you attach is emailed to us and not kept on the server.
• Your plan: whether you have Pro, from when and until when, and your customer ID at Paddle (below).

Fretudes doesn't use advertising or tracking cookies, and doesn't sell or share your data for marketing.

Visitor statistics

To see how people find and use Fretudes (how many visit, which pages, where sign-up gets stuck), we count page views and a few steps such as signing up, with Umami, which runs on our own server. It sets no cookies and stores no personal data: no IP addresses and nothing that identifies you or follows you to other sites; a visit is recognised only within the day. Your browser's "Do Not Track" setting turns it off. Pages whose address contains a private link (password reset, email settings) aren't counted. This is in our legitimate interest in improving Fretudes (Art. 6(1)(f) GDPR).

Why, and on what legal basis

• To provide the service you signed up for (Art. 6(1)(b) GDPR, performing our contract): your account, practice history, progress and settings, on every device you use.
• To keep the service secure (Art. 6(1)(f), our legitimate interest): sign-in sessions and server logs, and checks that sign-ups and sign-ins come from people, to prevent abuse and fix problems. The check on the sign-up, sign-in and password forms (ALTCHA) runs on our own server: your browser solves a small calculation, nothing is sent to anyone else and nothing tracks you.
• To keep you going (Art. 6(1)(f), our legitimate interest in helping you learn what you signed up for): a weekly summary of your own practice and, in the evening, a reminder when a streak would end. Both are about your progress, never advertising, and you can turn them off in Settings or with one click in any of them.
• To remind you to practise (Art. 6(1)(a), your consent): only if you turn reminders on, and you can turn them off at any time in Settings or in your browser.
• To meet legal obligations (Art. 6(1)(c)), such as keeping records the law requires.

Payments

Fretudes Pro is sold through Paddle (Paddle.com Market Limited), which acts as the merchant of record: Paddle is the seller, handles payment, invoices, taxes and refunds, and is the controller of the payment data you give it under its own privacy policy. Fretudes never sees your card details; it receives from Paddle only what's needed to give you Pro (your customer ID, the plan, its status and dates).

Who else processes your data

• Hosting: Contabo GmbH (Munich, Germany), on servers in a data centre in Germany, which stores the app and its database on our behalf.
• Backups: Hetzner Online GmbH (Gunzenhausen, Germany) stores encrypted copies of the database, made every night and kept for about four weeks. They're encrypted before they leave our server, so Hetzner can't read them.
• Resend (Resend, Inc., USA) sends the app's emails on our behalf: sign-up codes and password resets. It receives your email address and the message.
• Push services of your browser's maker (e.g. Apple, Google, Mozilla) deliver reminders, if you turn them on.
• Paddle, as above.

Where a provider is outside the European Economic Area, data is transferred under the safeguards the GDPR allows, such as the European Commission's standard contractual clauses or an adequacy decision.

On your device

Fretudes sets one cookie, to keep you signed in; it's strictly necessary, so it doesn't need consent. The app also stores some things in your browser itself: pages for offline use, results finished offline until they're sent, and conveniences like the drone's volume or whether you answer exercises with your guitar. Signing out clears the saved pages.

The microphone

The tuner, and answering exercises by playing your guitar, use your device's microphone, only after you tap to start and your browser asks your permission. The sound is analysed on your device to find the note being played, and nothing else: it's never recorded, stored or sent anywhere, not even to us. Listening stops when you tap stop or leave the page; you can withdraw the permission at any time in your browser's settings.

How long it's kept

Your account and practice data are kept for as long as you have an account. When you delete your account, they're deleted straight away from the live database, and from backups when those expire (within 30 days). Records the law requires us to keep are kept only as long as it requires. Paddle keeps its own records as its privacy policy says.

Your rights

You can ask to see the data we hold about you, have it corrected, deleted or its use restricted, object to its use, and receive it in a portable format. You can change most of it yourself in Settings, and delete your account there at any time (Settings → Delete account). For anything else write to support@fretudes.app; we answer within a month. Where something is based on your consent, you can withdraw it at any time.

You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority where you live.

Children

Fretudes is meant for people aged 16 and over. If you're younger, please use it with a parent's or guardian's consent.

Changes

If this policy changes in a way that matters, we'll say so in the app before the change takes effect. The date at the top shows the latest version.