Privacy Policy
Effective 22 October 2026. ChordPen collects as little as it can: your email address to sign you in, and the charts you write so they come back on every device. No advertising, no analytics, no tracking, and nothing is sold.
1. Who is responsible
[to be completed], a sole proprietor registered in Israel (business number [to be completed]), [to be completed], is responsible for your information as its controller. Write to us at [email protected] about anything in this policy.
2. What we collect, why, and on what basis
| What | Why | Legal basis (in the EU and the UK) |
|---|---|---|
| Your email address, and the one-time codes we send it | To create your account and sign you in | Performing our contract with you |
| Your charts, recovery drafts, Live Sets and settings, and the link to a YouTube video you attach to a chart | To keep your library in your account and bring it to every device you sign in on | Performing our contract with you |
| Your plan, and what Paddle tells us about your purchase: a customer number, the plan, its status and its dates - never your card details | To give you Pro and show you your plan | Performing our contract with you |
| The version of these terms you agreed to, and when | To be able to show that you agreed | Our legitimate interest in keeping a record of the agreement |
| Technical records our server provider keeps: IP address, browser, times of requests | To keep ChordPen secure and working, and to stop abuse | Our legitimate interest in security |
| What you write to us | To answer you | Our legitimate interest, or our contract with you |
Giving your email address is voluntary, but without it we cannot sign you in, so ChordPen cannot be used. Everything else is optional: it exists only if you write it.
Recordings never reach us. An audio file you add stays in your browser on your own device.
3. What stays on your device
ChordPen keeps these in your browser's own storage, because it cannot work without them: a working copy of your library (so it works without a connection), the recordings you add, your sign-in session, and small conveniences such as where you last placed the YouTube window. There are no advertising or analytics cookies, so there is nothing to consent to. Signing out removes your library from the device; clearing your browser's data removes everything, recordings included.
4. YouTube
ChordPen uses YouTube API Services. When a chart with a YouTube video opens, YouTube's player, provided by Google, loads in ChordPen in its privacy-enhanced mode, and Google receives information such as your IP address and may store information on your device, as its own Privacy Policy describes. The player may show content and advertisements from YouTube. ChordPen keeps only the video's link with your chart. See also the YouTube Terms of Service.
5. Who receives your information
- Supabase hosts our server and database, where your account and library are stored, in the European Union (Frankfurt, Germany). It acts on our instructions.
- Resend, Inc. (United States) delivers the emails that carry your sign-in codes. It acts on our instructions.
- Paddle (Paddle.com Market Limited and its group) sells Pro as our reseller and merchant of record. It receives your name, email address, country and payment details when you buy, and handles them as an independent controller under its own privacy notice.
- Google, when you play a YouTube video (section 4).
- Authorities or advisers, only when the law requires it or to protect our rights.
We never sell your information, and we never use it for advertising.
6. Where your information goes
Your account and library are stored in the European Union (Frankfurt, Germany). ChordPen is run from Israel, which the European Commission recognises as protecting personal data adequately. Some of our providers may handle information in other countries, such as the United States; where they do, they are bound by the European Commission's standard contractual clauses or an equivalent safeguard, and by written undertakings that meet Israel's rules on transfers abroad. You may ask us for a copy of these safeguards.
7. How long we keep it
- Your account and library: for as long as you keep your account. When you delete it, it is removed from our database at once and from our backups within 30 days.
- The record of your agreement to these terms: for as long as your account exists, and afterwards only as long as we may need it to answer a claim.
- Technical records: only as long as they are needed to keep ChordPen secure and working.
- Purchase records: Paddle keeps them for as long as tax law requires.
8. Your rights
You may ask to see the information we hold about you, to have it corrected or deleted, to receive it in a portable form, to restrict how we use it, and to object to our use of it based on legitimate interests. Much of this you can do yourself: your charts are in front of you, Settings exports a full backup, and Account deletes your account. For anything else, write to [email protected]; we answer within one month and free of charge.
You may also complain to a data protection authority: in Israel, the Privacy Protection Authority; in the European Union, the authority of the country where you live; in the United Kingdom, the Information Commissioner's Office. We would be glad to hear from you first.
9. Children
ChordPen is not for children under 13. If we learn that a child under 13 has an account, we delete it. A parent who believes this has happened can write to us.
10. Keeping it safe
Information travels encrypted. Each person's library is separated from everyone else's by the database itself, not only by the application. Access to our systems is limited and protected, and we keep a record of security incidents. No system is perfectly secure; if a breach puts you at risk, we will tell you and the authorities as the law requires.
11. Emails from us
We send only the emails the service needs: your sign-in codes and important notices about your account or these terms. Paddle sends your receipts and payment notices. We will not send you news or offers unless you ask to receive them, and you can stop them at any time.
12. Automated decisions
We make no decisions about you by automated means alone, and we do not build profiles of you.
13. Changes to this policy
If we change this policy in a way that matters, we will tell you before the change applies, by email or in ChordPen. The date at the top shows when it last changed.