Version privacy-r2-2026-10-25 · Effective from 2026-10-25Download

Privacy notice

This notice explains what personal data the Hearhood creative-tools beta (the app at hearhood.com) processes, why, who receives it and what you can do about it. Reading it is not consent to anything; it is information.

1. Who is responsible

Francesca Piscopo, a sole trader (eenmanszaak), trading as Scopra and Hearhood, at Kraanspoor 7 C 4, 1033 SC Amsterdam, Netherlands, is the controller for personal data processed to operate Hearhood. Contact: info@hearhood.com. This notice covers the beta and the optional interest form for a future artist and listener pilot. It covers the existing accounts, sync, community member pages, messages and Produce song links described below. A paid listening catalogue and artist payouts are not available.

2. Most of your work never leaves your device

Songs, patterns, Studio recordings, DJ library and cue points, equipment settings and preferences are saved in your browser on your device (localStorage and IndexedDB; see the Cookies and device storage page). A recording of your voice can be personal data. Studio takes stay on your device unless you deliberately use a separate upload feature; uploaded recordings are described in section 3b. Nothing is uploaded because you create an account, except what section 3a describes: a copy of your songs that your account keeps for your other devices (never recordings). Data leaves your device only in the cases below, and the app says so at the point of use.

3. Account information

When you create a tester account we process: the name you type (a nickname is fine), what you say you do (a role chosen from a short list), your email address where ordinary self-sign-up requires one (supervised accounts instead use the parent link and an account access code, without a child email address), a password if you set one (stored only as a salted hash, never readable), the internal code that identifies the account, the date it was created, which version of the terms you accepted and when, the age/eligibility result or adult terms confirmation used by the account flow, and whether you opted in to news email and when. We also keep counts: how many AI messages the account has used, totals of tokens and an estimated cost, messages per day, and short labels of what the assistant was used for (topics, kinds of change, equipment named, parts of the app used). The AI service does not store your conversation text or the assistant's replies in its usage records. Separate account-sync and song-sharing features keep the editable musical data described in sections 3a and 3b; recorded takes are excluded.

Purpose and legal basis: creating and managing access, applying the message allowance, replying to your feedback, understanding which parts of the beta are used; performance of our agreement with you (the terms), and our legitimate interest in running and improving a small free beta without collecting more than that. If you choose "Continue with Google", Google confirms to us your email address, your name and a Google account identifier; we store the identifier, use the name to fill in the form, and treat the address as verified. What Google itself records about that sign-in is covered by Google's privacy policy. Accounts made before 24 October 2026 may have no email address; they keep working with their code. We send email to the address only for what you ask for: a sign-in link when you request one (valid once, 15 minutes), a welcome email with such a link when the account is created, the optional weekly summary (section 3c), and the optional news email.

Family accounts: eligible 13–17-year-olds use parent-led setup where it is offered. We process the entered age to determine eligibility, but do not save the numeric age or a birth date in the account. We store country, adult-confirmation or supervised status, and the link to the parent account.

To arrange setup we send an invitation to the supplied parent email. The invitation record includes the child’s name or nickname, country, token and time. The link expires after 48 hours. Used or expired invitation records are cleared when another invitation is created. Setup uses a confirmed-email adult account, agreement and a typed parent declaration; it does not independently verify guardianship.

We keep the family link, permission settings, consent name, version, time and source network address as evidence of the setup. Parents can see family activity, pending approvals and permissions. Messages, public visibility, unrestricted posting, uploads, ticket links and AI start off. These controls apply to the account, rather than the whole device.

We use account information to provide the supervised service under the applicable agreement and proportionate security information for our legitimate interests in protecting the service. Where consent is required for a particular use, we ask separately. Family setup does not opt anyone into optional analytics or marketing.

Parents can close supervised accounts from the family page. Closure removes the active account, family approvals and activity log. We retain only the consent evidence reasonably needed to demonstrate permission, resolve a dispute or meet a legal obligation, restrict access to it, and review it for deletion when that need ends. You or your parent can contact info@hearhood.com about access, correction, withdrawal or deletion.

3a. The copy of your work in your account

When you are signed in, the app keeps a copy of your work in your account on our server so it is there on your other devices and after a browser clears its storage: your songs and their versions, your progress, the Studio's songs (without the recordings), the DJ library's cue points and playlists (without the music files). Recordings, music files and photos are never included. The app checks for changed work every two minutes and when it goes out of view; is 4 MB at most, and is replaced by the newer one (the previous one is kept beside it until the next). Purpose and legal basis: providing the account's core feature (performance of our agreement). Deleting the account deletes the copy.

3b. Community, member pages, messages and share links

Collections (named lists of shared songs) are visible to anyone with their link, under your display name; comments you leave on songs, and your entries and votes in the weekly challenge, are shown under your display name too (a vote shows only as a count). In the Community (hearhood.com/community/) we store what you post there under the display name you choose: threads, replies, wall posts, uploaded pictures, who you follow, and the private messages you exchange with other members. A private message is visible to the two members in the conversation; the team sees a conversation's last messages only when one of the two reports it. We keep notifications for you (a reply, a new follower, an approval, a new message; the last 200) so the app can show them. A share link for a song stores that song's notes and settings (never recordings) under a short code, signed with your display name; anyone with the link can open it. When you change a song you opened from someone's link, that person is told once that it was remixed, under your display name (or as "someone" when you have no account; a hashed form of your network address then keeps that count to one per link), and a song you share onward carries the name of the song and person it was based on. Songs you share are listed on your member page with how often they were played and remixed, unless you hide one there ("Hide from my page"); a play in the community player is counted once per listener and hour, for which a hashed form of the listener's network address is kept in memory for an hour and never stored. If you turn on notifications on a device, your browser gives us an address at its push service (Google, Apple or Mozilla, depending on the browser) which we keep with your account until you turn them off; what we send there carries no content at all (a fixed "something new" notice is shown by the app on your device), the payload does not contain message, song or account content. The push provider still processes the subscription endpoint and delivery-request information needed to deliver the notification. When you create an account with an email address and password, we email you a link that confirms the address; the account is yours to use once you press it (an account whose address is never confirmed and that is never used may be replaced by a later sign-up with that address). Your personal invite link holds a random key for your account; we record which accounts were created through it, so both sides can be given the extra Assistant messages and you can see how many friends joined. Purpose and legal basis: providing the features you use (performance of our agreement) and keeping the community safe (legitimate interest). The community and copyright policy has the rules. Deleting the account removes your posts from view, your conversations, notifications and share links.

Moderation and reviews: when the team hides or removes something you posted, mutes your account or hides your member page, you get a notification with the reason the team gave, and you can ask for a review. What you write in that request, the team's written answer, who answered and when are stored with your account and shown only to you and the team; they go when your account is deleted. Changes made by the team from the owner page are recorded in an audit log (who did what, when) kept for 400 days; it holds no secret values.

Events: saving an event stores the event and the time with your account (shown only to you; the event page shows how many people saved it, not who). "Near me" uses your browser's position only to ask our server for events within the chosen distance; the position is rounded to about 100 metres, is not stored on the server beyond the request log's hash, and stays in your browser tab until you close it. Ticket links go to the sellers' own sites, which have their own notices.

Tracks you upload (your own recordings, from your member page): the audio file, the title, genre and text you give, the rights you tick and the moment you confirmed them are stored with your account and shown publicly under your display name; ordinary successful uploads are publicly listed immediately; supervised uploads await the applicable approval, and the file plays through links that expire, is played through the service rather than offered with a download button, and is not used by Hearhood to train AI. Public playback cannot guarantee that nobody captures a copy. Plays are counted once per listener an hour under a scrambled form of their account or, for visitors, of their network address and the day; a listener's page may also report how many seconds played. You can edit, hide or delete a track at any time; deleting it or your account removes the file. The team can take a track down after a report; the person who reports it gives a reason and, if they want an answer, a way to reach them, and that request is kept as feedback (section 5).

Promotional cards in the events section (Hearhood's own, or a sponsor's, labelled as such) count how often they were shown and clicked, per day, as totals only: no cookie, no identifier and no profile is involved, and the counts are capped per network address.

3c. The weekly email

If you switch it on (at sign-up or in Account settings), we send you one email a week at most with what happened for you: replies, new followers, messages, likes, song plays, remixes, posts by people you follow, or a short reminder when you have not opened Hearhood for a while. It is off unless you ask for it, every email has a one-click link to stop it, and we send nothing when nothing happened. Legal basis: your consent, which you can withdraw at any time.

4. The AI assistant

When you send a message to the assistant, the app sends to the Hearhood server: your messages in that conversation; a description of the open song (notes, settings, section and track names, the names and lengths of recordings; from the DJ area the deck and mixer state and the titles and artists of the tracks listed; from the Studio the song structure, chords and lyrics text); the names of connected MIDI and audio devices and the last controls touched; your invite code if you have one. The assistant request does not upload recordings, music files or photos: it sends text about your song, not the sound. Separate member-upload features can send audio or images when you choose them. The server adds its own instructions and forwards the request to the AI provider, Anthropic PBC (the Anthropic API), which generates the reply.

Our server does not store the message text or the reply. For each request it writes one log line: the time, a short salted hash of the network address (not the address itself; the salt changes every time the service restarts), the HTTP status, the token counts the provider reports and, when the provider refuses a request, its error type. It adds the short labels described in section 3 to the account's counts. Nothing about you other than the message and the song description is sent to the provider: no account code, no email address, no network address. Anthropic acts as our processor under its Data Processing Addendum. Under its commercial API terms it does not use this data to train its models, and its standard API retention policy deletes inputs and outputs within 30 days, with exceptions for applicable law, agreed retention arrangements, usage-policy enforcement and any applicable covered-model safety retention/review. Flagged inputs and outputs may be kept for up to two years, and trust-and-safety classification scores for up to seven years; legal requirements can require longer retention. Anthropic may process the request in the United States or other regions; there is no European-only option, and the transfer is covered by the EU Standard Contractual Clauses in that addendum. We do not claim zero retention or that the data never leaves Europe.

Purpose and legal basis: providing the feature you ask for (performance of our agreement) and keeping the service secure (legitimate interest). The assistant is labelled as AI in the app, and you are told what is sent before your first message.

5. Feedback, reports and the interest form

Feedback you send with the Feedback button (including a report of content or a problem, and the optional artist or listener interest form) is stored on our server: the text, its category, the optional 1 to 5 rating, your account or the name you typed, and, while the box is ticked, the technical details listed under "Show what is sent" (app version, the browser's identification string, screen size, the area open, the names of connected equipment, DJ engine numbers, library counts, the last errors the page caught). The operator reads it on a private page and can reply inside the app. The operator's phone receives a short notice that feedback or an artist sign-up arrived, as a count only (for example: new feedback, 2 unread), through ntfy.sh (ntfy LLC, United States); the notice never contains your text, name or address.

Purpose and legal basis: handling your message and fixing faults (performance of our agreement and our legitimate interest in a working beta). An interest form entry is used only to handle that request; it is not a subscription, not a licence of any music, and promises nothing. Marketing email requires a separate, unticked opt-in at sign-up; you can withdraw it at any time by writing to us or by deleting the account, without losing access to the beta.

5a. Artist and listener interest form

The page at hearhood.com/artists/ has a form for artists, DJs, producers and listeners who want to hear about a future pilot. It needs no account. When you send it, the Hearhood server stores: your name if you typed one, your email address, what best describes you (artist, DJ, producer, listener or other), what you make if you wrote it, a link to your music if you gave one, your answer to "Are you a Buma/Stemra member?" (yes, no or not sure), whether you ticked the news box, the time, and a short salted hash of the network address (see section 4). The Buma/Stemra question helps identify what permissions a possible pilot may need. A membership answer is not a licence or a determination of which rights a particular member can grant; that depends on their repertoire and agreements. Sending the form again with the same email address updates your entry instead of adding a second one.

Purpose and legal basis: contacting you about the pilot, on the basis of your consent given by ticking "You may contact me about the pilot"; without that tick the form is refused and nothing is stored. News email is a separate, unticked box and a separate consent. You can withdraw either consent at any time by emailing info@hearhood.com from the address you used; we then delete the entry or the news tick and confirm by reply. The form is not a licence of any music, not a subscription and not a promise of a place, a launch or earnings.

Retention and recipients: the entry is kept until the pilot decision is made or until you ask for its removal, whichever comes first, and the operator reads it on a private page. The only recipient is the Hearhood server; no mailing-list or form service is involved. If the operator exports the list to a file to work with it, that file stays with the operator and is deleted when it is no longer needed.

6. Technical information, the server log and anonymous usage counts

The Hearhood service logs, for each request, the line described in section 4 (time, a salted hash of the network address, status, token counts, error type). The log exists for security, rate limiting and troubleshooting (legitimate interest). The service also keeps, in memory only, per-address counts used for rate limits, which disappear when it restarts. The web server in front of it (nginx) keeps its own access log with the network address and the browser's identification string of each request: each line holds the time, the network address, the request path, the status and the browser identification string; the log is rotated daily and copies older than 14 days are deleted.

Anonymous usage counts are collected by default. While the app is open it sends to the Hearhood server, every ten minutes and when the page is put away, plain numbers only: which controls and areas of the app were used (the app's own control names, such as "play" or "tempo", never what you typed or chose in them), how long the page was in use, which area it was in when it was put away, which first steps were reached (for example a pattern played, a track loaded, an export completed), the workspace, and whether the device is a phone, a tablet or a computer. The counts contain no content, no names and no identifiers: no cookie, no invite code and no network address goes with them, and the server keeps them only as daily totals for everyone together, for 90 days. Page views of the public pages are counted once a night from the web server's own log (section 4 describes that log; this count keeps the number of requests per page and an approximate number of distinct visitors per day, nothing else). None of this is shared with anyone. Legal basis: our legitimate interest in understanding and improving the beta. You can object by switching the counts off at any time: the switch "Share anonymous usage counts" is under My account and at the foot of this notice and of the Cookies and device storage page when they are opened inside the app. Nothing is sent while the switch is off.

There are no advertising trackers. Optional Google Analytics is described below and stays off unless you allow it. We do not make decisions with legal or similarly significant effects about you by automated means.

6a. Optional Google Analytics

If you choose Allow analytics, we load Google Analytics 4 to understand which pages and guides are visited, which campaigns bring visits, and whether people open a workspace, reach a first creative step or export a draft. The purpose is to improve Hearhood. Legal basis: your consent. Reject analytics is equally available and the creative tools work without it. Analytics choices, at the bottom of the page, lets you withdraw or change that consent. We do not replay actions taken before you consent.

Google receives technical information including your network address, browser and device information, approximate location derived from the connection, page paths, supported campaign tags, referring website and fixed action names. Google states that GA4 does not log or store individual IP addresses. Analytics cookies provide pseudonymous browser and session identifiers; this is not anonymous data. We do not send lyric text, song or track names, recordings, file names, chat messages, email addresses, invite codes or account identifiers. URL fragments and unrecognised query parameters are excluded from the page information we send. Automatic form, search, outbound-link and video measurement is disabled.

Google signals and advertising personalisation are disabled. Google Analytics is provided by Google Ireland Limited under the Analytics terms and the data-processing terms accepted for this account; international processing may occur under Google's documented transfer safeguards. See Google's partner-site information and Google Analytics data safeguards. The Analytics account and its reports are accessed by the Hearhood operator. We have disabled optional account data sharing.

Our analytics cookies are configured to expire within 180 days. Your consent choice is kept on your device for up to 180 days, then we ask again. Withdrawing consent stops future optional collection and removes the Analytics cookies we can access on this site; it does not automatically erase reports already received by Google. Contact info@hearhood.com for data-rights requests. The existing first-party aggregate usage switch is separate and remains described in section 6.

7. Recipients and international processing

The operator and authorised team members can access server data within the permissions of their role, including support and moderation where authorised. Providers that process data to deliver the beta:

Where a provider processes data outside the European Economic Area, we rely on the adequacy decision or the Standard Contractual Clauses in that provider's terms; write to us for information about the safeguards.

8. How long we keep information

We do not keep every category for the longest period that applies to any one of them. Records we must keep for tax or other legal duties are kept for the statutory period with restricted access.

9. Your rights and choices

You can ask for access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. You can withdraw consent to marketing at any time. Ordinary members can download the supported subset of account information (My account, Download my data); this is not a complete export of all service records, and other access requests, including family records, can be made to info@hearhood.com. Ordinary account holders can use My account, Delete my account. Supervised accounts are closed through the parent family controls; a young person can also contact us to exercise their own rights. The separate handling of consent evidence is described in section 3. For anything else, write to info@hearhood.com. We respond within one month, or explain within that month if a lawful extension is needed, and we ask only for what is needed to confirm that the request comes from the account holder (normally, that you can use the invite code).

Deleting the server account does not clear the songs, recordings and settings stored in your browser on each device. The app's "Clear this device's Hearhood data" button does that for the device you are on; the Cookies and device storage page explains it.

10. Complaints

You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the supervisory authority of the country where you live. We would rather hear from you first at info@hearhood.com.

11. Security and changes to this notice

The site is served over HTTPS. The AI provider's key is kept on the server in a file only the system administrator can read and never reaches a browser. The service runs as its own restricted system user; the operator's page uses owner or authorised team access controls, and requests from other websites are not accepted. The account database is on the server with access controlled for the operator and authorised team roles; administrative changes are audited as described above. Backups are kept on the same server, readable only by the system administrator. No service can promise perfect security; we assess incidents and notify affected people and authorities when the law requires it.

We show the version and effective date of this notice and explain material changes in the app. Features not yet enabled, including payments, commercial-catalogue listening history, artist identity verification and any future under-13 account service, require an appropriate updated notice and implemented safeguards before collecting data.

12. Courses and young learners

Course progress, practice choices and lyric-practice notes stay in this browser and are separate from account song sync. The lesson catalogue comes from the server. Use invented words if you do not want to write anything personal. Read-aloud uses an available on-device voice.

Loading a page or lesson still creates a website request. The technical logs, aggregate counts and optional analytics are described above. Optional analytics follows the browser’s saved choice, including on a shared device; it is not automatically changed by supervised-account status. Supervised accounts start with account marketing off. Browser analytics and anonymous forms are separate from account permissions.

Our short privacy explanation helps young learners understand these choices. A parent can help with a request, and young people can also contact us about their own information and rights.