Privacy Policy

1. Introduction

GigPerfect at https://gigperfect.app is operated by Jeremy Browne, a sole proprietor based in California ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a positive experience using our music practice application, which includes a tuner, metronome, practice tracker, recording features, and collaborative group tools. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application and services.

You can use the core practice tools without signing in. Signing in, connecting Google Drive, and uploading recordings are separate choices. This policy applies to both visitors and account holders and describes the data handled when you use each feature.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide to us when you:

• Register for an account (email address, display name, and authentication information; passwords for email/password sign-in are handled by Firebase Authentication)
• Create or join groups
• Make purchases
• Contact our support team
• Customize your profile and theme preferences

2.2 Automatically Collected Information

When you access our services, we automatically collect certain information, including:

• Usage Data: Information about how you use our application, including metronome settings, tempo preferences, and feature usage
• Device Information: Browser type, device type, operating system, and unique device identifiers
• Log Data: IP address, access times, pages viewed, and the page you visited before navigating to our services
• Cookies and Browser Storage: We use cookies, local storage, and IndexedDB for authentication, preferences, recordings, and caching (see Section 4)

2.3 Information from Third Parties

We use Firebase Authentication (a Google service) for user account management. Depending on the sign-in method you choose (email/password, Google, or Facebook), this may include:

• Authentication tokens
• OAuth provider information when you sign in with Google or Facebook (your name, email address, and profile image)
• Session data

For Google Sign-In, we access basic profile information: your name, email address, profile image URL, Google/Firebase account identifier, and email verification status. Firebase processes the sign-in credentials; our backend verifies the Firebase ID token and stores your account identifier, email, display name, and profile image URL in our account database. Authentication state and app session tokens are also stored in your browser so you can stay signed in.

We use this information to authenticate you, maintain your account, display your profile, and associate your saved settings and practice progress with your account. Your profile information may appear in groups and chartboards you participate in, subject to the available profile visibility settings. Google Sign-In does not grant access to your Gmail, contacts, calendar, or Drive files.

2.4 Practice Recordings

GigPerfect lets you record audio and video of your practice sessions. By default, these recordings are stored locally on your own device (in your browser's storage) and are not uploaded to our servers. Recordings leave your device only when you explicitly choose to:

• Share a recording with a group you belong to, in which case it is uploaded to our storage provider (Cloudflare R2) and becomes visible to members of that group; or
• Back up a recording to your own Google Drive (see Section 5.3).

3. How We Use Your Information

We use the information we collect to:

• Provide and Maintain Services: Operate, maintain, and improve our music practice application and features
• User Accounts: Create and manage your user account, authenticate your identity, and provide access to your settings
• Personalization: Remember your preferences, theme choices, and metronome settings
• Group Functionality: Facilitate collaboration in groups and synchronized practice sessions
• Purchases: Process transactions, and provide access to premium content
• Communications: Send you service-related announcements, updates, and support responses
• Analytics and Improvements: Analyze usage patterns to improve our services and develop new features
• Legal Compliance: Comply with legal obligations and enforce our Terms of Service
• Security: Detect, prevent, and address technical issues, fraud, and security vulnerabilities

4. Cookies and Tracking Technologies

4.1 What Are Cookies

Cookies are small data files placed on your device. We also use local storage and IndexedDB to persist sign-in state, settings, locally recorded media, Drive file IDs and metadata, and cached application assets. Local recordings remain on that device unless you choose to upload them; clearing browser storage can remove local copies.

4.2 Types of Cookies We Use

• Essential Cookies: Required for authentication and basic service functionality
• Preference Cookies: Remember your settings, theme choices, and metronome preferences
• Analytics Cookies: Help us understand how you use our application

4.3 Managing Cookies

You can instruct your browser to refuse all cookies or indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our service. Most browsers allow you to manage cookies through their settings preferences.

5. Data Sharing and Disclosure

5.1 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5.2 Service Providers

We share your information with third-party service providers who perform services on our behalf:

• Firebase (Google): Authentication and account management
• Facebook (Meta): Authentication, only if you choose to sign in with Facebook
• Stripe: To process token purchases (card details are handled directly by Stripe; we do not handle, transmit or store card numbers)
• Cloudflare: Content delivery, security (Turnstile), and object storage (R2) for shared recordings
• Google Analytics: Aggregate usage analytics

5.3 Google Drive: Access, Use, and Storage

GigPerfect offers an optional feature that lets you save your own practice recordings to your own Google Drive. You can connect Drive from your recordings list or when saving a recording to Drive. After you authorize access, the recordings list can retrieve the metadata of your app-accessible backups while that authorization remains valid. When you do, we request the https://www.googleapis.com/auth/drive.file OAuth scope.

This is a per-file permission, not permission to read your entire Drive. It covers files created by GigPerfect or otherwise explicitly authorized for this app. GigPerfect uses it to:

• Create a folder named "GigPerfect Recordings" in your Google Drive
• Upload the specific recordings you choose to save, into that folder
• Read the file IDs, names, types, sizes, links, and recording metadata of accessible backups so they can be displayed alongside local recordings
• Read your Drive storage quota (used and available space) to show storage availability
• Delete an accessible backup when you request deletion from the recordings list

Selected recordings and their metadata (recording ID, duration, resolution, camera status, and timestamp) are sent directly from your browser to Google Drive over HTTPS. The Drive access token, its expiry and scope, and the recordings folder ID are stored locally in IndexedDB. Backup file IDs and associated recording information are also kept locally; the backup itself is stored in your Google Drive, not our recording storage. Drive access tokens are not sent to GigPerfect's backend. Token validity is set by Google, typically around one hour; further access may require authorization again.

Saving to Drive does not automatically share a backup with a group or make it public. Google processes the uploaded files as your Drive provider. Group sharing is a separate action that uploads a recording to our Cloudflare storage.

You can revoke GigPerfect's access from your Google Account permissions page. Revoking access stops future authorized access; it does not delete existing backups. You can delete those in Google Drive, or through the recordings list while authorized. Deleting your GigPerfect account does not automatically delete files in your Google Drive or recordings in your browser storage.

5.4 Google API Services Limited Use Disclosure

GigPerfect's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google-derived account data is used for the account features described in Section 2.3. Drive data is used only for the user-facing recording-backup and management features described above. We do not sell Google user data, use it for advertising, or use Google user data or recordings to train AI or machine-learning models. We do not transfer Google user data to others except as necessary to provide or improve these user-facing features, for security, or to comply with applicable law. We do not allow humans to read Google API user data except with your affirmative agreement for specific data, as necessary for security or legal compliance, or for internal operations using aggregated and anonymized data, as permitted by the Limited Use requirements.

5.5 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal process (court orders, subpoenas, search warrants)
• Requests from law enforcement or government agencies
• Legal claims or investigations
• Protection of our rights, property, or safety, or that of our users

5.6 Group Sharing

When you join a group, certain information (name, profile information) may be visible to other group members to facilitate collaboration and synchronized practice sessions.

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using HTTPS/SSL
• Firebase Authentication with secure password hashing
• Access controls and authentication requirements
• Secure database configurations

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

7. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy. We will retain and use your information to the extent necessary to:

• Comply with legal obligations
• Resolve disputes
• Enforce our agreements
• Maintain security and prevent fraud

Self-service deletion starts a seven-day pending period during which you can cancel the request. After that period, our nightly deletion process anonymizes the account, locks access, unlinks Discord, and removes shared recordings. Firebase identity deletion is scheduled after 90 days. Transaction, fraud-prevention, and other records may be retained for legal, accounting, security, or dispute-resolution purposes.

Local browser recordings and Google Drive backups remain under your control and must be deleted separately if you no longer want them. You can clear GigPerfect's browser storage in your browser settings to remove locally stored tokens, cached metadata, and local recordings. Revoking access does not remove the files already saved in Drive.

8. Your Privacy Rights

8.1 Access and Portability

You can view your account information and preferences through your Profile settings. To request a copy of the personal information we hold about you, contact support using the email in Section 13 and we will provide it in a portable format.

8.2 Correction and Update

You can update your account information, preferences, and settings at any time through your Profile page.

8.3 Deletion

You have the right to request deletion of your personal information. You can delete your account through Profile > Account. You do not need to email support to start self-service deletion. Contact us if you need help accessing your account or exercising your rights.

8.4 Opt-Out Rights

• Marketing Communications: Opt out of promotional emails (we currently don't send marketing emails)
• Personalized Ads: We do not currently display ads or use your data for advertising
• Cookies: Manage through your browser settings

8.5 California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect and how it's used
• Right to delete your personal information
• Right to opt-out of the sale of personal information (we don't sell data)
• Right to non-discrimination for exercising your privacy rights

8.6 European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

9. Children's Privacy

GigPerfect is an independent supplementary music practice tool for students of all ages, including children under 13. It is not affiliated with school districts or teachers. Core practice tools can be used without signing in, purchasing tokens, or sharing user-created content. Local recordings stay on your device unless you choose to upload them.

Optional Chartboards, token purchases, and sharing user-created content with other users require acceptance of their separate Terms of Service. Users under 18 need a parent or legal guardian's consent or supervision for these optional features. This requirement does not restrict access to the core practice tools.

Legal requirements for collecting children's personal information, including any required verifiable parental consent, apply separately. Accepting feature terms is not, by itself, verification of parental consent. GigPerfect does not rely on a teacher or school district to give parental consent on a family's behalf. The information collected by each feature, including automatic usage and device data, is described above.

For Parents and Guardians: If you believe your child has provided personal information to us without your consent, please contact us immediately, and we will take steps to remove that information from our systems.

Advertising: GigPerfect does not currently display third-party advertisements. Should we introduce advertising in the future, we will ensure any ads shown are appropriate for all audiences, with content rated no higher than PG, and we will update this policy accordingly.

10. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ.

GigPerfect is operated in the United States. Our providers, including Google and Cloudflare, may process information in the United States and other countries in accordance with their service arrangements and privacy policies.

11. Third-Party Links

Our application may contain links to third-party websites, services, or advertisements that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

We strongly advise you to review the privacy policy of every site you visit.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date at the top

You are advised to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page. Your continued use of our services after changes are posted constitutes acceptance of those changes.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

14. Additional Resources

• Google Privacy Policy
• Google Advertising Policies
• Firebase Privacy Information
• Google Ads Settings