Privacy Policy

1. Data Controller

Guitar Mind ("we", "us", "our") is an interactive fretboard learning app available at guitar-mind.com. The controller of your personal data (administrator danych osobowych) is:

Adam Mieczysław Węgrzyn
Poland
Email: adam@guitar-mind.com

The controller is a natural person carrying out unregistered business activity (działalność nierejestrowana) — see Section 2 of our Terms of Service. We have not appointed a Data Protection Officer; for any privacy matter, contact us at the email address above.

2. Data We Collect

We collect only the data necessary to provide and secure the service:

• Account data. When you register or sign in, Firebase Authentication processes your email address and authentication credentials. Password handling is managed by Firebase; we do not store plaintext passwords. You can also sign in with a Google account, in which case Google shares your name, email, and profile photo with us.
• Profile & learning progress data. Once signed in, we store your practice progress in Firebase Firestore — for example: which onboarding/tutorial flows you've completed, shape/interval unlock state, practice statistics and streaks, and fretboard preferences — associated with your account user ID. (Some older accounts may still have optional profile details such as a display name, birthday, or experience level saved from an earlier version of onboarding that no longer collects this information.)
• Detailed practice history. In addition to Firestore, we store granular practice data — individual practice sessions, rounds, and clicks (timing, correctness, and the fretboard positions involved) — in a Google Cloud SQL database (hosted in the EU) via Firebase Data Connect. The same database holds your account profile — your username and handle (plus your previous ones during the change cooldown) — linked to your Firebase user ID. Practice records are linked to the user ID, not your email, and power your practice statistics and unlock progress.
• Product analytics. We use PostHog to understand how the app is used: pages and features visited, in-app interactions (autocapture), approximate device/browser information, and error or crash reports (unhandled exceptions and rejections). If you are signed in, we identify you to PostHog using your account ID, email address, and display name (if set), so activity can be linked to your account, and we record the guitar experience you enter during onboarding. PostHog does not receive your password. Analytics runs only if you allow it (see Section 3).
• Billing data. If you subscribe, Stripe processes your payment details and shares limited billing metadata with us (subscription status, renewal dates) so we can grant access — we never see or store your full card number.
• Technical and security data. Firebase Hosting and related Google infrastructure may process IP address, request metadata, and timestamps for reliability, abuse prevention, and security monitoring.
• Correspondence. If you email us — for example with a question, a complaint, or a withdrawal statement — we keep that correspondence and the details needed to handle it.
• Local device data. Sign-in state and some preferences are cached in your browser's local storage / IndexedDB, then synced to Firestore when you are authenticated. See our Cookie Policy for details.

Is providing data required? Your email address (or Google account) is required to create an account — without it we cannot provide the Service. Payment details are required only to buy a paid plan. Allowing analytics is entirely optional.

3. How We Use Your Data

We use the data we collect to:

• Create and manage your account and authenticate sign-ins.
• Save and sync your practice progress across devices.
• Operate your subscription — billing and access.
• Understand aggregate usage patterns and diagnose errors to improve the app.
• Detect, investigate, and prevent fraudulent or abusive activity.
• Comply with applicable legal obligations.

Legal bases for processing (GDPR Art. 6):

• Performance of a contract (Art. 6(1)(b)) — processing your account, progress, and billing data is necessary to provide the Service you signed up for.
• Consent (Art. 6(1)(a)) — product analytics and error reporting through PostHog, and the storage technologies they use, run only if you allow the Analytics category in our cookie preferences. You can withdraw consent at any time (see our Cookie Policy).
• Legitimate interests (Art. 6(1)(f)) — security logging and abuse prevention, and establishing or defending legal claims.
• Legal obligation (Art. 6(1)(c)) — keeping billing records required by tax law, and handling withdrawal statements and complaints under consumer law.

We do not use your data for automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Third-Party Services

Guitar Mind relies on the following processors, each of which has its own privacy terms:

• Firebase Authentication (Google) — manages user sign-up, sign-in, and authentication, including Google Sign-In. Firebase Privacy Policy
• Firebase Firestore & Hosting (Google) — stores your progress data and serves the web app via Google's global CDN. Firebase Privacy Policy
• Google Cloud SQL (via Firebase Data Connect) — stores detailed practice session, round, and click-level history in a managed database hosted in the EU, linked to your Firebase user ID. Firebase Privacy Policy
• PostHog — our product analytics and error-reporting tool, used to understand feature usage and fix bugs. PostHog Privacy Policy
• Stripe — processes subscription payments, billing, and related transaction records. Stripe Privacy Policy
• Google Fonts — typefaces are loaded from Google's font CDN, which may log request IPs. Google Fonts Privacy FAQ

5. International Transfers

We keep data in the EU where we can: the practice database (Cloud SQL) is hosted in the EU, and PostHog analytics uses PostHog's EU cloud. Some of our providers — Google (Firebase Authentication, Hosting, Google Fonts) and Stripe — may process data in the United States or other countries outside the EEA. Where that happens, the transfer is protected by the EU–US Data Privacy Framework (for certified providers) and/or the European Commission's Standard Contractual Clauses included in the providers' data processing terms. You can ask us for more information about these safeguards at adam@guitar-mind.com.

6. Data Retention

We retain your account and progress data for as long as your account is active. You can delete your account at any time from Settings in the app: this permanently removes your sign-in and cancels any active subscription, and replaces identifying details — your username, handle, and email — with a neutral placeholder. Your practice history (sessions, statistics, and unlocks) is kept in this anonymised form rather than deleted, so we can maintain aggregate product statistics without it being linked back to you, except where further retention is required by law (for example, billing records for tax purposes).

• Billing records are kept for 5 years from the end of the calendar year in which the related tax became due, as required by Polish tax law.
• Withdrawal statements, complaints, and related correspondence are kept until any claims arising from them become time-barred.

Analytics events in PostHog are retained per our PostHog plan settings and are periodically purged; error reports are kept only as long as useful for debugging.

7. Your Rights

Under the GDPR (RODO) and, where applicable, other data protection laws, you have the following rights:

• Access (Art. 15 GDPR) — request a copy of the personal data we hold about you.
• Correction (Art. 16 GDPR) — ask us to correct inaccurate or incomplete data.
• Erasure (Art. 17 GDPR) — request deletion of your personal data ("right to be forgotten").
• Restriction (Art. 18 GDPR) — ask us to restrict how we process your data.
• Portability (Art. 20 GDPR) — receive your data in a structured, machine-readable format.
• Objection (Art. 21 GDPR) — object to processing based on our legitimate interests.
• Withdraw consent (Art. 7(3) GDPR) — where processing relies on consent, withdraw it at any time without affecting the lawfulness of prior processing.

California residents (CCPA/CPRA): You have the right to know what personal information is collected, to delete it, and to opt out of its sale. We do not sell personal information.

To exercise any of these rights, email adam@guitar-mind.com. We will respond within one month of receiving your request (Art. 12(3) GDPR); for complex requests this may be extended by up to two further months, in which case we will tell you why.

If you are located in the EU/EEA and are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority. In Poland the competent authority is the Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa — uodo.gov.pl. You may also contact the supervisory authority in your own country of residence.

8. Children's Privacy

Guitar Mind is not directed at children under 13 years of age (or 16 in the EU/EEA where applicable). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will delete it promptly. Contact us at adam@guitar-mind.com if you believe a child has provided us with personal information.

9. Security

We use industry-standard safeguards including HTTPS/TLS in transit, Firebase's built-in encryption at rest, and Google's infrastructure security. No system is completely secure; we cannot guarantee absolute security of your data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date at the top of this page and notify registered users by email.

11. Contact

For privacy-related questions or to exercise your rights, contact us at:
adam@guitar-mind.com

If you are in the EU/EEA and are not satisfied with our response, you may lodge a complaint with the UODO or the supervisory authority in your country of residence — see §7 (Your Rights) above for details.