Privacy Policy

1. Data Controller

Guitar Mind ("we", "us", "our") is an interactive fretboard learning app available at guitar-mind.com. The controller of your personal data (administrator danych osobowych) is:

Adam Mieczysław Węgrzyn
os. Złota Podkowa 10
31-352 Kraków
Poland
Email: adam@guitar-mind.com

The controller is a natural person carrying out unregistered business activity (działalność nierejestrowana) — see Section 2 of our Terms of Service. We have not appointed a Data Protection Officer; for any privacy matter, contact us at the email address above.

2. Data We Collect

We collect only the data necessary to provide and secure the service:

• Account data. When you register or sign in, Firebase Authentication processes your email address and authentication credentials. Password handling is managed by Firebase; we do not store plaintext passwords. You can also sign in with a Google account, in which case Google shares your name, email, and profile photo with us.
• Profile & learning progress data. Once signed in, we store your practice progress in Firebase Firestore — for example: which onboarding/tutorial flows you've completed, shape/interval unlock state, practice statistics and streaks, and fretboard preferences — associated with your account user ID. During onboarding you choose a username and handle (these can be anything — we don't ask for your real name) and tell us how long you've been playing guitar; both are saved to your account. (Some older accounts may still have a display name or birthday saved from an earlier version of onboarding that no longer collects this information.)
• Detailed practice history. In addition to Firestore, we store granular practice data — individual practice sessions, rounds, and clicks (timing, correctness, and the fretboard positions involved) — in a Google Cloud SQL database (hosted in the EU) via Firebase Data Connect. The same database holds your account profile — your username and handle (plus your previous ones during the change cooldown) — linked to your Firebase user ID. Practice records are linked to the user ID, not your email, and power your practice statistics and unlock progress.
• Product analytics. We use PostHog to understand how our website and the app are used: pages and features visited, clicks and other interactions (autocapture), approximate device/browser information, and error or crash reports (unhandled exceptions and rejections). If you are signed in, we link analytics to your account using your account ID only — PostHog does not receive your email address, name, or password — and we record the guitar experience you enter during onboarding. The website and the app share one anonymous identifier, so activity on the website before you sign up can be linked to your account once you sign in. Analytics runs only if you allow it (see Section 3).
• Billing data. If you subscribe, Stripe processes your payment details and shares limited billing metadata with us (subscription status, renewal dates) so we can grant access — we never see or store your full card number.
• Technical and security data. Firebase Hosting and related Google infrastructure may process IP address, request metadata, and timestamps for reliability, abuse prevention, and security monitoring.
• Newsletter (optional). If you tick the newsletter box when signing up, or turn it on in Settings, we use your account email address to send you occasional updates about Guitar Mind. We record whether you agreed, where, and when. You can turn it off at any time in Settings; deleting your account also turns it off.
• Practice reminders (optional). If you turn on reminders, we save a notification token for your device, the hour you chose and your time zone, so that Firebase Cloud Messaging (Google) can send you one reminder a day; you can turn them off at any time in Settings or from the notification, and signing out or deleting your account removes them.
• Correspondence. If you email us — for example with a question, a complaint, or a withdrawal statement — we keep that correspondence and the details needed to handle it.
• Local device data. Sign-in state and some preferences are cached in your browser's local storage / IndexedDB, then synced to Firestore when you are authenticated. See our Cookie Policy for details.

Is providing data required? Your email address (or Google account) is required to create an account — without it we cannot provide the Service. Payment details are required only to buy a paid plan. Allowing analytics is entirely optional.

3. How We Use Your Data

We use the data we collect to:

• Create and manage your account and authenticate sign-ins.
• Save and sync your practice progress across devices.
• Operate your subscription — billing and access.
• Understand aggregate usage patterns and diagnose errors to improve the app.
• Detect, investigate, and prevent fraudulent or abusive activity.
• Comply with applicable legal obligations.

Legal bases for processing (GDPR Art. 6):

• Performance of a contract (Art. 6(1)(b)) — processing your account, progress, and billing data is necessary to provide the Service you signed up for.
• Consent (Art. 6(1)(a)) — product analytics and error reporting through PostHog, and the storage technologies they use, run only if you allow the Analytics category in our cookie preferences. You can withdraw consent at any time (see our Cookie Policy). The optional newsletter is also based on your consent, which you can withdraw at any time in Settings. So are practice reminders, which you can turn off at any time in Settings or from the notification.
• Legitimate interests (Art. 6(1)(f)) — security logging and abuse prevention, and establishing or defending legal claims.
• Legal obligation (Art. 6(1)(c)) — keeping billing records required by tax law, and handling withdrawal statements and complaints under consumer law.

We do not use your data for automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Third-Party Services

Guitar Mind relies on the following processors, each of which has its own privacy terms:

• Firebase Authentication (Google) — manages user sign-up, sign-in, and authentication, including Google Sign-In. Firebase Privacy Policy
• Firebase Firestore & Hosting (Google) — stores your progress data and serves the web app via Google's global CDN. Firebase Privacy Policy
• Google Cloud SQL (via Firebase Data Connect) — stores detailed practice session, round, and click-level history in a managed database hosted in the EU, linked to your Firebase user ID. Firebase Privacy Policy
• Firebase Cloud Messaging (Google) — delivers practice reminders to the devices where you turned them on. Firebase Privacy Policy
• PostHog — our analytics and error-reporting tool, used on our website and in the app to understand how they are used and fix bugs. PostHog Privacy Policy
• Stripe — processes subscription payments, billing, and related transaction records. Stripe Privacy Policy

5. International Transfers

We keep data in the EU where we can: the practice database (Cloud SQL) is hosted in the EU, and PostHog analytics uses PostHog's EU cloud. Some of our providers — Google (Firebase Authentication and Hosting) and Stripe — may process data in the United States or other countries outside the EEA. Where that happens, the transfer is protected by the EU–US Data Privacy Framework (for certified providers) and/or the European Commission's Standard Contractual Clauses included in the providers' data processing terms. You can ask us for more information about these safeguards at adam@guitar-mind.com.

6. Data Retention

We retain your account and progress data for as long as your account is active. You can delete your account at any time from Settings in the app: this permanently removes your sign-in and cancels any active subscription, and replaces identifying details — your username, handle, and email — with a neutral placeholder. Your practice history (sessions, statistics, and unlocks) is kept in this anonymised form rather than deleted, so we can maintain aggregate product statistics without it being linked back to you, except where further retention is required by law (for example, billing records for tax purposes).

• Billing records are kept for 5 years from the end of the calendar year in which the related tax became due, as required by Polish tax law.
• Withdrawal statements, complaints, and related correspondence are kept until any claims arising from them become time-barred.

Analytics events in PostHog are retained per our PostHog plan settings and are periodically purged; error reports are kept only as long as useful for debugging.

7. Your Rights

Under the GDPR (RODO) and, where applicable, other data protection laws, you have the following rights:

• Access (Art. 15 GDPR) — request a copy of the personal data we hold about you.
• Correction (Art. 16 GDPR) — ask us to correct inaccurate or incomplete data.
• Erasure (Art. 17 GDPR) — request deletion of your personal data ("right to be forgotten").
• Restriction (Art. 18 GDPR) — ask us to restrict how we process your data.
• Portability (Art. 20 GDPR) — receive your data in a structured, machine-readable format.
• Objection (Art. 21 GDPR) — object to processing based on our legitimate interests.
• Withdraw consent (Art. 7(3) GDPR) — where processing relies on consent, withdraw it at any time without affecting the lawfulness of prior processing.

Getting a copy of your data. To use your right of access or portability, email adam@guitar-mind.com from the address linked to your account. We will send you a copy of your account details, learning progress, and practice history in a structured, machine-readable format (JSON) within the time limit below. Billing records held by Stripe can also be downloaded from the Stripe customer portal, available from Settings in the app.

California residents (CCPA/CPRA): You have the right to know what personal information is collected, to delete it, and to opt out of its sale. We do not sell personal information.

To exercise any of these rights, email adam@guitar-mind.com. We will respond within one month of receiving your request (Art. 12(3) GDPR); for complex requests this may be extended by up to two further months, in which case we will tell you why.

If you are located in the EU/EEA and are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority. In Poland the competent authority is the Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa — uodo.gov.pl. You may also contact the supervisory authority in your own country of residence.

8. Children's Privacy

Guitar Mind is not directed at children under 16 years of age, and you must confirm you are at least 16 when you create an account. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will delete it promptly. Contact us at adam@guitar-mind.com if you believe a child has provided us with personal information.

9. Security

We use industry-standard safeguards including HTTPS/TLS in transit, Firebase's built-in encryption at rest, and Google's infrastructure security. No system is completely secure; we cannot guarantee absolute security of your data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date at the top of this page and notify registered users by email.

11. Contact

For privacy-related questions or to exercise your rights, contact us at:
adam@guitar-mind.com

If you are in the EU/EEA and are not satisfied with our response, you may lodge a complaint with the UODO or the supervisory authority in your country of residence — see §7 (Your Rights) above for details.