Privacy Policy
Cellopedia Practice Room
Kozlov Cello Studio LLC, Maryland, USA
Last updated: 3 November 2026
Effective: 11 September 2026
The short version
I built this app to help adult cellists practice better. I collect as little about you as I can. I do not sell your information, I do not share it for advertising, and your recordings never leave your own device. I never receive them.
You can delete your account and everything in it at any time, from your account page, without asking me.
Questions, requests, or complaints: hello@cellopedia.org.
The rest of this document says all of that precisely, because some of you live in places whose laws require precision, and because you deserve it either way.
1. Who is responsible for your data
Kozlov Cello Studio LLC (“I”, “me”, “the business”) operates Cellopedia Practice Room at practice.cellopedia.org. The business is registered in Maryland, United States.
For the purposes of the UK and EU General Data Protection Regulation, I am the data controller for the information described here.
Contact for all privacy matters: hello@cellopedia.org.
I do not have a Data Protection Officer. At this size the law does not require one, and adding a layer between you and me would not serve you.
2. Who may use this service
You must be 18 or older to create an account. This service is not directed to children, and I do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us at hello@cellopedia.org and I will delete it promptly.
The free practice tools (metronome, tuner, drone, and slow-downer) work with no account and collect nothing about you.
3. What I collect, why, and on what legal basis
The table below covers everything. “Legal basis” is a GDPR concept; if you are not in the UK or EU it does not affect your rights here, all of which I offer to everyone.
| What | Why | Legal basis |
|---|---|---|
| Email address | To sign you in (there is no password), to create your account when you subscribe before signing in, and to contact you about your account | Performance of a contract |
| Newsletter choice and its timestamp | To honor your choice and to show when you made it | Consent, and legal obligation to evidence it |
| Practice sessions: your written goal, the obstacle you named, passage labels, reflections | To show your own practice history back to you | Performance of a contract |
| Session measurements: timers, repetition counts, tempo settings | The same | Performance of a contract |
| Feedback you choose to send: bug reports and suggestions, and the piece they concern | So I can read them, fix what they report, and follow up if needed | Legitimate interests |
| A reference video link you save for a piece | To show you the same video next time | Performance of a contract |
| Stripe customer and subscription identifiers, plan and status | To run your subscription | Performance of a contract |
| A Stripe identifier of the card used to start a free trial (not the card number) | To keep the free trial to one per person | Legitimate interests |
| A PDF page of music you choose to scan | To turn it into a score you can practice; read on my own server in the EU, and kept there in memory for up to 24 hours when the AI clean-up runs (sections 4a and 4b) | Performance of a contract |
| For the AI clean-up: pictures of the lines of a scanned page that the automatic checks flag, the notes the scanner read in them, the title you gave the piece, and any note you write to the AI | To correct the scan with an AI model; the pictures, the notes and your note are sent to Anthropic, and the notes, the answer and the title are kept by me for a short time so the result can reach your devices (section 4b) | Performance of a contract |
| A question you ask the help assistant on the Help page, with the last two questions and answers of the same visit | To answer it with an AI model; the question is sent to Anthropic, and the question and the answer are kept by me for 30 days with the kind of plan only, nothing that identifies you (section 4c) | Performance of a contract |
| The number of help assistant questions asked by your account each day | To keep to the daily limit (section 4c) | Legitimate interests |
| A record of each AI clean-up: which lines were sent, what it cost, whether it succeeded, and the key signature and meter read from the page | To keep to the monthly limits and to find faults | Performance of a contract |
| Billing records: invoices with the name, email and address you gave | Tax and accounting law requires me to keep them | Legal obligation |
| Your agreement to the auto-renewal terms, what you were shown, and when | To evidence that the terms were disclosed and agreed before any charge | Legal obligation |
| Server logs, including IP addresses | Security, and keeping the service running | Legitimate interests |
Audio recordings of your playing, and everything your microphone hears, are deliberately absent from this table: they never leave your device. Section 4 explains. Scores you add yourself are absent for the same reason.
PDF pages you scan are different: a page image does leave your device, once, to be read, and sections 4a and 4b say exactly what happens to it and to the notes read from it.
I never see or store your card number. Stripe handles payment details directly.
I do not use automated decision-making or profiling that produces legal or similarly significant effects.
4. Your recordings and your microphone
Your recordings are audio of you playing. I want to be direct about them.
Your recordings never leave your device. They are stored only in your own browser, on the device you recorded them with. They are not uploaded, not synced, and not stored on my servers. I could not listen to them if I wanted to. I do not have them.
Two consequences worth stating plainly:
- A recording exists only on the device that made it. If you want a take on another device, or want to keep it safely, use the download button: every take has one.
- Clearing your browser’s site data deletes your recordings, and browsers may clear rarely-used site data on their own. Download the takes that matter to you. The app says this in the recording library too, because it is the kind of thing that should not live only in a policy.
The microphone. The tuner and the mic test listen through your microphone while you use them. That audio is analyzed in your browser in the moment, to show you a pitch or a level, and is not stored, not sent anywhere, and never reaches me. Your browser asks for microphone permission the first time a tool needs it, and you can withdraw that permission in your browser’s settings at any time.
4a. Scanning a page
When you scan a page, the page you ticked is drawn from your PDF on your device and prepared there (straightened, cropped to the page, turned to black and white), and that prepared page image is sent to my own scanning server, which runs in the European Union (Germany) on a machine I rent from Hetzner. The server reads the music and sends the result back to your device, where it is kept like any score you add yourself. No third-party recognition service reads the page, and the server’s log records only that a scan happened and how long it took: never the image, the result, or who sent it. The PDF you choose is opened and drawn on your device only; the file itself is never sent anywhere.
When the AI clean-up is not running for your scan (it is not on for your account, or your month’s cost limit is reached), the image is held only in the server’s memory while it is being read and is deleted the moment the scan returns, whether or not it succeeded, and the server keeps no copy. When the AI clean-up runs, the server keeps the prepared page image in its memory, never on a disk, under the scan’s random number, so that pictures of single lines can be cut from it for the AI and so that you can ask about bars afterwards. It is deleted 24 hours after the scan at the latest, and sooner when the clean-up cannot start.
The request that carries the page image is signed with a short-lived code that names no account. The number of pages you have scanned this month is counted in my database against your account; the scanning server never learns which account a page belonged to.
4b. The AI clean-up of a scanned page
After the scan, your device sends my server (the app’s server, hosted by Vercel in the United States) the notes the scanner read for that page, the title you gave the piece, and the clef, key and meter you confirmed. Free automatic checks run there and flag the lines that look wrong: a bar that does not add up to the meter, a line the scanner lost or left empty, a note outside the cello’s range, a line of nothing but rests, or a sign that a clef change was missed. A page with no flagged line is never sent to the AI; it is finished at once.
For each flagged line, my server fetches the kept page image from the scanning server, cuts out a picture of that line (with the edges of the lines above and below it), and sends that picture, the notes the scanner read for the line, the clef, key and meter you confirmed, and the instructions for the correction to Anthropic, the company behind the Claude models, through its API. The model used is Claude Opus 5.5. When you use “Tell the AI what’s wrong”, the picture of the line with the bars you named outlined in red, the notes of that line as your score has them now, and your note of up to 300 characters are sent the same way. A line whose first answer cannot be used is sent once more, with that answer, so the model can correct it. A line the batch has not answered about an hour after the page was sent is sent again as an immediate request, with the same picture, notes and instructions and nothing more.
What is not sent. No name, email address, account identifier or anything else about you goes to Anthropic: each request carries the picture, the notes, the instructions and a number for the line, and nothing more. Write your notes to the AI about the music, because whatever you type in one is sent as it is. Anthropic processes what it receives on my instructions as my service provider, under its Commercial Terms and Data Processing Addendum, which do not allow it to train its models on what I send or on its answers. Anthropic is in the United States; section 5 covers the transfer.
What I keep, and for how long. The notes the scanner read, the AI’s answer, which bars it changed, and the title you gave the piece are stored in my database (Supabase, United States) so that the result can reach whichever of your devices you open next and so that you can ask about bars afterwards; the page image stays on the scanning server for the same reason. The page image is deleted 24 hours after the scan. The notes, the answer and the title are kept until one of your devices has taken the result, and no longer than 24 hours after that, and in any case no longer than 7 days. Your notes to the AI are not stored by me at all. What remains is a record of the clean-up: which lines were sent, the number of tokens it used and what it cost, whether it succeeded, and the key signature and meter read from the page. I keep that record to keep to the monthly limits and to find faults, and it is deleted with your account. My server’s logs record that a clean-up ran and whether it succeeded, never the music or the image.
4c. The help assistant
The Help page has a box where a signed-in account can ask a question about using the app. Your question, and the last two questions and answers of the same visit, are sent to Anthropic through its API, together with the app’s own reference text and the instructions for answering. The model used is Claude Haiku 4.5. Nothing about you is sent: no name, email address, account identifier or plan. Anthropic processes what it receives on my instructions as my service provider, under its Commercial Terms and Data Processing Addendum, which do not allow it to train its models on what I send or on its answers. Write your question about the app, because whatever you type is sent as it is.
What I keep, and for how long. I keep each question and its answer for 30 days, with the kind of plan (free or paid) and what the answer cost, and no account identifier, email address or IP address, so that I can see what people ask and improve the Help page. They are deleted automatically after 30 days. I count the questions asked by each account per day, to keep to the daily limit; that count holds no question text and is deleted after 30 days. Nothing is kept on your device.
5. Who else handles your data
These companies process data on my instructions, under contract, and may not use it for their own purposes:
| Who | What they handle | Where |
|---|---|---|
| Supabase | Your account and practice sessions, and the notes and answers of an AI clean-up while they are kept (section 4b) | United States |
| Stripe | Payment processing and billing records | United States and worldwide |
| Vercel | Hosting for the app, including the server that prepares the AI clean-up | United States |
| Mailchimp | The newsletter, if you opt in, and the launch waiting list | United States |
| Resend | Sending account and billing email | United States |
| Hetzner Online GmbH | Runs the scanning server (the image is processed in memory, and kept there for up to 24 hours when the AI clean-up runs; Hetzner has no access to it) | Germany (EU) |
| Anthropic | The AI clean-up: pictures of the flagged lines of a scanned page, the notes read from them, your notes to the AI, and the corrections it returns. The help assistant: the questions you ask it and its answers (section 4c) | United States |
YouTube videos are embedded on some piece pages. When one loads, YouTube may set cookies and receive your IP address, under Google’s privacy policy rather than mine. Nothing is sent to YouTube until you choose to play a video. That choice is remembered on this device, and you can turn it off on your account page.
International transfers. If you are in the UK or EU, your data is processed in the United States. Each of the companies above relies on the European Commission’s Standard Contractual Clauses, or an equivalent approved mechanism, for that transfer. You may ask me for details.
6. What I do not do
- I do not sell your personal information, and I have not in the past twelve months.
- I do not share it for cross-context behavioral advertising.
- I do not use it to train machine learning models. The AI clean-up and the help assistant use a model; they do not train one, and Anthropic’s terms do not allow what I send to be used to train theirs.
- I do not send marketing email unless you asked for it.
Under California law, the terms “sell” and “share” have specific technical meanings. Neither applies to anything I do. There is no “Do Not Sell or Share My Personal Information” link on this site because there is nothing to opt out of.
Email about your account (a sign-in code, a receipt, a notice that your trial is ending) is not marketing. You will receive it whether or not you subscribed to the newsletter, because it is part of the service.
7. How long I keep things
| What | How long |
|---|---|
| Your account and practice history | Until you delete them. On the free plan the app shows you the sessions from the last 7 days; older sessions are kept, and Premium shows your whole history |
| Feedback and saved reference links | Until you delete your account, then deleted with it |
| Your recordings | Never held by me. They exist only on your own device, until you delete them or your browser's data is cleared |
| Newsletter consent records | While your account exists, then deleted with it |
| Billing records and invoices | Retained by Stripe and by me for the period tax and accounting law requires, currently up to seven years, and used for nothing else |
| Checkout consent records for a checkout that was never completed | The email is removed after thirty days |
| PDF pages you scan | Deleted from the scanning server the moment the scan returns when the AI clean-up is not running; otherwise kept in its memory for up to 24 hours after the scan (section 4b) |
| AI clean-up: the notes read from a page, the AI's answer and the title you gave the piece | Until one of your devices has taken the result, and no longer than 24 hours after that, and in any case no longer than 7 days |
| Your notes to the AI | Not stored by me; sent to Anthropic with the request |
| AI clean-up records: which lines were sent, cost, outcome, and the page's key signature and meter | Until you delete your account, then deleted with it |
| Help assistant questions and answers, with the kind of plan and the cost only | 30 days, then deleted automatically (section 4c) |
| The number of help assistant questions per account and day | 30 days |
| The identifier of the card that started a free trial | Kept after your account is deleted, so that the same card cannot start a second free trial; it holds no name or email (section 9) |
| Server logs | Retained by my hosting provider for a short period, typically about thirty days |
| Backups | Overwritten on a rolling basis; deleted data disappears from backups within about thirty days |
Section 9 explains what survives account deletion, and why.
8. Your rights
Whoever you are and wherever you live, you can:
- Know what I hold about you, the categories, the sources, why I have it, and who else handles it. Much of it is in this document; contact us at hello@cellopedia.org for the rest.
- Get a copy, in a portable format.
- Correct anything that is wrong.
- Delete it. You do not need to ask: there is a delete option on your account page. See section 9.
- Restrict or object to processing, including processing based on legitimate interests.
- Withdraw consent to the newsletter at any time, from your account page or any newsletter email. Withdrawing does not affect what was done before.
- Not be discriminated against for exercising any of these. The service works the same either way.
How to ask. Contact us at hello@cellopedia.org. I will confirm within ten business days and answer within thirty days, or within one month for UK and EU requests, extendable by two further months for complex requests, in which case I will tell you why.
Verification. I will ask you to write from the email address on the account. That is normally enough. For deletion I may ask you to confirm the request a second time, because deletion cannot be undone.
Authorized agents. If someone makes a request on your behalf, I will ask for written proof that you authorized them, and may still ask you to confirm directly.
Complaints. Contact us at hello@cellopedia.org first. If you are not satisfied: in the UK, the Information Commissioner’s Office; in the EU, your national supervisory authority; in California, the California Privacy Protection Agency or the Attorney General.
9. Deleting your account
You can delete your account yourself, from your account page. It is permanent.
When you do:
- Your practice sessions and account details are removed from my live database at once, and age out of rolling backups within about thirty days (section 7).
- The local copies on the device you delete from are cleared, recordings included, and any scores you added yourself with them.
- Any active paid subscription is set to end when the current period does, and is never charged again. Nothing is refunded, and because the account is gone the remaining time cannot be used. To use what you have paid for, cancel first and delete when the period ends. If you are on a free trial, the trial is canceled at once and the card on file is never charged.
- Your name, email and address are removed from your Stripe customer record.
- The records of your AI clean-ups, AI requests and scanned-page counts are removed with the rest, and any page image or notes still kept for a clean-up are gone within 24 hours as section 4b says.
What survives, and why. Invoices for payments already made remain in Stripe. Tax and accounting law requires records of transactions, and under both GDPR and California law that obligation takes precedence over erasure. Those invoices contain the billing name, email and address you gave at the time. I keep them for the statutory period and use them for nothing else.
The record of your agreement to the auto-renewal terms (what you were shown, what you ticked, and when) survives for the same reason and for the same period: it evidences consent to charges already made, and a dispute can arrive months after deletion. It contains no name, email or address; after deletion it is tied only to an internal identifier that no longer points to any account. I use it for nothing else.
The identifier of the card that started a free trial also survives: Stripe’s own identifier of the card (never the card number), the subscription it started, and when. It exists so that a card which has already had a free trial is recognized if a new account is created with it, so that the same card cannot start a second free trial. It holds no name, email or address, and after deletion the account identifier on it points to nothing. I keep it for as long as I offer free trials and use it for nothing else.
Recordings on your other devices are not touched: they never passed through me, so deleting your account cannot reach them. Delete them from each device yourself if you want them gone. Practice sessions cached on other devices clear themselves when each next connects.
10. Security
Sign-in uses a code sent to your email rather than a password, so there is no password of yours for anyone to steal from me. Data is encrypted in transit. Recordings never reach my servers, so there are no recording files here to breach. Database access is restricted so that your data is reachable only by your account. The key for Anthropic’s API lives only on my server and never reaches your device.
No system is perfectly secure and I will not pretend otherwise. If a breach occurs that is likely to affect your rights, I will notify you and the relevant authorities within the time the law requires, which is 72 hours to a supervisory authority under GDPR.
11. Cookies and what is stored on your device
No advertising or tracking cookies. No third-party analytics.
The app stores the following on your device because it cannot work otherwise:
| What | Purpose |
|---|---|
| Your sign-in session | To keep you signed in |
| Your practice sessions and recordings | So the app works offline and your takes are not lost |
| Scores you add yourself | So you can practice them; they never leave your device |
| Scores you scanned, and the number of each one's AI clean-up | So you can practice them, and so you can ask the AI about bars later; once the clean-up is done, the score lives only on your device (section 4b) |
| Display and sound preferences | To remember your choices |
| Your choice to load YouTube videos without asking | So the question is not asked again (section 5); you can turn it off on your account page |
| A copy of the piece index and cached music files | So the library works offline |
| A marker of which account this device last synced | To keep one person's data from appearing under another's account on a shared device |
None of it is used to track you, and none is shared.
Embedded YouTube videos may set their own cookies when a video loads, as described in section 5.
Do Not Track. Browsers send this signal inconsistently and there is no agreed standard for honoring it. Since I do no tracking, there is nothing for it to disable.
12. Changes
If I change this policy in a way that meaningfully affects you, I will tell you by email or in the app before it takes effect. The dates at the top show when it was last revised.
13. Contact
Kozlov Cello Studio LLC
Maryland, United States
hello@cellopedia.org