Legal

Privacy Policy

Last updated: July 20, 2026

This Privacy Policy explains what information KeyCraft ("KeyCraft", "we", "us") collects when you use our practice application and website at keycraft.pro (the "Service"), how we use it, and the choices and rights you have. By using the Service you agree to the practices described here.

1Information we collect

We collect only what we need to run the Service:

Account information. Your email address, an optional display name, and a password. Passwords are never stored in plain text — we keep only a securely hashed version.
Google sign-in (optional). If you choose "Continue with Google", Google shares your basic profile (name and email) so we can create or link your account. We do not receive your Google password.
Practice data. Scores, timing measurements, evenness and skill statistics, session duration, streaks, and your progress through the learning journey. This is the core of what makes the Service useful to you.
Preferences. Settings such as your keyboard size and whether you have completed onboarding.
Technical data. A single essential session cookie to keep you signed in, and standard server logs (such as IP address and request time) generated by our hosting provider for security and reliability.

We do not collect payment card details ourselves; if paid plans are offered, payments are handled by a third-party payment processor.

2How we use your information

To create and secure your account and sign you in.
To provide the Service — record your practice, compute scores and statistics, and track your journey progress.
To send essential account emails, such as email verification and, where applicable, security notices.
To maintain, debug, and improve the Service and keep it secure.
To comply with our legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising or behavioural tracking.

3Legal bases (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your data under these legal bases: performance of a contract (to provide the Service you sign up for), consent (which you may withdraw at any time), legitimate interests (to keep the Service secure and working), and legal obligation where the law requires it.

4MIDI & audio data

KeyCraft reads input from a connected MIDI keyboard through your browser's Web MIDI feature, and produces sound in your browser. The raw MIDI stream and audio are processed locally on your device in real time. We do not record or transmit your raw playing; we only store the derived results (for example, a score or timing statistics) that you generate while practicing.

5Cookies

We use one strictly necessary cookie to hold your sign-in session. It is required for the Service to function and cannot be switched off through the app. We do not use advertising, marketing, or analytics cookies.

We share data only with service providers who process it on our behalf, under contracts that require them to protect it:

Google — authentication, if you sign in with Google.
Email delivery — to send verification and account emails.
Hosting & database — to run the application and store your account and practice data.
Payment processor — only if and when you purchase a paid plan.

We may also disclose information if required by law, or as part of a merger, acquisition, or sale of assets (in which case we will notify you).

7Data retention

We keep your account and practice data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain it to meet legal obligations.

8Security

We protect your data with measures including password hashing (bcrypt) and encryption of data in transit (HTTPS). No method of transmission or storage is completely secure, but we work to safeguard your information and to respond promptly to any incident.

9Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. You also have the right to lodge a complaint with your local data protection authority. To exercise any of these rights, email us at hello@keycraft.pro. We will not discriminate against you for exercising them.

10Children

The Service is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect their data. If you believe a child has provided us personal information, contact us and we will remove it.

11International transfers

Your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses) to protect it when it is transferred internationally.

12Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above and, for material changes, take reasonable steps to notify you.

13Contact

Questions about this policy or your data? Email hello@keycraft.pro.