Orphia
Privacy policy
Last updated 9 October 2026. Effective [Effective date].
Draft — this document is awaiting legal review and may change before Orphia launches.
Orphia helps you practise piano from your own sheet music. To do that we keep your scores and your practice history. We don't sell your data, we don't show ads, and the microphone never records you.
Who we are
Orphia is provided by [Company legal name], [Registered address] ("we", "us"). We are the data controller for the information described here. Questions or requests: privacy@orphia.app.
What we collect and why
| Data | Why | Legal basis (GDPR / KVKK) |
|---|---|---|
| Account: email address, display name, password (stored only as a salted hash), and your Google or Apple account ID if you sign in with them. A guest account has none of these — only a random ID. | To give you an account and keep it secure. | Performance of our contract with you. |
| Sheet music you scan or upload: the photos or PDF files, and the digital score (MusicXML) we produce from them, plus any corrections you make. | To turn your pages into a score you can practise. | Performance of contract. |
| Practice data: the notes you play on a connected keyboard (pitch, timing, velocity), sessions, drills, streaks and the insights we calculate from them. | Feedback, progress history, insights and reminders. | Performance of contract. |
| Purchases: which plan you have and when it renews. Payment itself is handled entirely by Apple or Google; we never see your card details. | To unlock Pro features. | Performance of contract. |
| Crash reports: device model, operating system and app version, and what the app was doing when it crashed. No name, email or score content. | To find and fix bugs. You can turn this off in Settings. | Legitimate interest in a working app. |
| Usage analytics (optional): anonymous counts of which features are used, tied to a random ID. | To decide what to improve. | Your consent — off until you turn it on in Settings. |
| Emails: password-reset codes, and the weekly practice report if you opt in. | Account security and features you asked for. | Contract; consent for the weekly report. |
The microphone
If you use microphone mode, the sound is analysed on your device to recognise the notes you play. Nothing is recorded, and no sound leaves your device — only the recognised notes, like notes from a keyboard.
What we don't do
- We don't sell or rent your personal data.
- We don't use advertising SDKs or track you across other apps and websites.
- Your scores are private to you. We never publish them or share them with other users.
Who processes it for us
We use a small number of service providers, each bound by a data processing agreement:
- Amazon Web Services — hosting, database, file storage and email, in [AWS region, e.g. Frankfurt, Germany].
- Sentry — crash reports.
- PostHog (EU hosting) — usage analytics, only with your consent.
- RevenueCat, Apple and Google — in-app purchases and subscription status.
- Apple and Google — sign-in, if you choose to use them.
Where a provider processes data outside your country (for example in the United States), we rely on the European Commission's standard contractual clauses or an equivalent safeguard, and on your explicit consent where Turkish law (KVKK) requires it.
How long we keep it
- Your account data, for as long as you have an account.
- When you delete your account, everything is erased 7 days later. Signing in during those days cancels the deletion.
- Guest accounts that haven't been opened for 90 days are erased automatically.
- Crash reports, 90 days. Analytics events, at most 12 months.
Your rights
Wherever you live, you can ask to access, correct, export or delete your data, object to how we use it, or withdraw consent. Under the GDPR and KVKK these are legal rights.
- Export: Settings → Privacy & account → Download my data gives you a ZIP of your scores and practice history.
- Delete: Settings → Privacy & account → Delete account, or see how to delete your account.
- Anything else: email privacy@orphia.app. We answer within 30 days.
You can also complain to your data protection authority — in Turkey the KVKK Authority (Kişisel Verileri Koruma Kurumu), in the EU the authority of your country.
Children
Orphia is for people aged 13 and over. A household account lets a parent create learner profiles for their children; the parent manages those profiles and can delete them at any time. We don't knowingly collect data from children under 13 outside such a profile — if you think we have, email us and we'll delete it.
Security
Data is encrypted in transit (HTTPS) and at rest. Passwords are hashed, never stored in readable form. Access to production systems is limited to the people who run Orphia.
Changes
If we change this policy in a way that matters, we'll tell you in the app before the change takes effect.