Note Universe — Privacy Policy

Effective date: 11 October 2026

Note Universe is a music-education app that helps you learn to read and play music on a MIDI keyboard. This policy explains, in plain English, exactly what the app does and does not collect, who else can see it, and how you stay in control.

Note Universe is published by JINDOSH TECHNOLOGIES LIMITED, a company registered in England and Wales (company number 17321094). The company is the data controller for the small amount of data described below. If anything here is unclear, email [email protected] and we will answer.

The short version

• There are no accounts. You never sign in, and we never ask for your name, email address, or any other contact detail.
• Your practice history stays on your device. Every exercise attempt, score, and setting is stored in a database on your phone or tablet. Android’s own backup can carry it to your next device; we never have access to that copy.
• Anonymous usage analytics and crash reports are strictly opt-in. You are asked once during setup. If you decline — or simply never answer — nothing is sent. You can change your mind at any time in Settings.
• There is no advertising, no ad identifier, no cross-app tracking, no data broker, and nothing is ever sold.
• The only company that receives any data at all is Google, as the provider of Firebase Analytics and Firebase Crashlytics, and only if you opt in.
• Emailing us is always your choice. The app can open your email app with a message to us already addressed, but nothing is sent unless you send it.

What is stored on your device

The app keeps a local database on your device. Nothing in it is uploaded to us, and none of it is transmitted anywhere by the app itself. It contains:

• Practice history — which exercises you attempted, when, how long you took, how many notes you got right, your tempo, response times, and the experience points and mastery levels derived from them.
• Your settings — theme, note-naming system, experience level, keyboard colour scheme, practice-reminder schedule, and your analytics choice.
• Keyboard information — the calibration (lowest and highest key) of your MIDI keyboard, and the Bluetooth address of the last keyboard you connected, so the app can reconnect automatically next time.

Moving to a new device

So that changing phone doesn’t mean starting over, the app lets Android’s own backup service carry this database — and nothing else the app stores — to your next device. It travels in one of two ways:

• In your Google Account’s device backup. If your device has a screen lock (PIN, pattern, or password), Android encrypts this backup end to end with it, so neither we nor Google can read it. Without a screen lock, the backup is still kept in your Google Account, protected by your account’s security rather than by end-to-end encryption. Either way, we never have access to it.
• In a direct device-to-device transfer, when you set up a new phone or tablet from your old one.

The app itself never uploads the database. Android’s backup service does, under your device’s backup settings, where you can also turn it off. Nothing from Firebase is included, so a restored device does not inherit the old one’s analytics identifiers.

Uninstalling the app, or clearing its storage from Android’s app settings, permanently deletes the copy on your device. A backup copy in your Google Account remains until you delete it there or Google expires it, and if you reinstall the app on a device signed in to that account, Android restores it.

What leaves your device — only if you opt in

During setup the app shows a consent screen offering usage analytics and crash reporting. Both are off until you tap Accept, and a single choice governs both. If you decline, the Firebase SDKs are told not to collect anything, and no analytics events or crash reports are sent.

If you opt in: usage analytics

Analytics tell us which parts of the app people use, where they get stuck, and whether it runs well, so we can improve it. Events describe what happened in the app, never what you typed or a note-by-note recording of your playing. They fall into these categories:

• Practice results — for each exercise or freestyle session you start, finish or leave: which exercise it was, its settings (such as tempo and difficulty), how accurately and how quickly you played, how long it took, and the experience points, mastery and completion ranks it earned.
• Theory lessons — your answers to lesson quizzes and drills (whether you were right, and how many tries it took), how well you tapped along to rhythms, as summary figures rather than individual tap times, and how far through a lesson you got.
• Navigation and feature use — which screens you open, how long the app is in use, and which features you use, such as the guided tour, favourites, links between lessons and exercises, the skill tree, in-app hints, practice tips and the practice-reminder offer. This includes your progress through the app’s rewards (meeting the daily practice goal, the Consistency Points earned and what they unlocked), and whether a practice reminder was shown and you opened the app from it. Where the app tries a few fixed wordings for a hint, the one you were shown is recorded.
• Setup choices and settings — the answers you give during setup (experience level, note-naming system, theme) and any later change to a setting, as fixed option names, never free text. The time you choose for practice reminders is not sent.
• Keyboard connections — whether you play on a USB or Bluetooth MIDI keyboard or the on-screen keyboard, how connecting went (how long it took, and whether it worked or the kind of failure), and your keyboard’s range from calibration (its lowest and highest key). This includes the name your keyboard advertises (for example “Roland FP-30X”) and its manufacturer, and for a USB keyboard the vendor and product numbers its USB connection reports, which identify the model. It also includes counts of how your keyboard’s messages arrived (how many notes it sent, and how many were doubled, never released or outside its calibrated range), so we can find keyboards the app handles badly. The keyboard name is ordinarily just a model name, but Bluetooth devices can be renamed by their owner, so if you have given your keyboard (or the device you connect through) a personal name, that name would be included. If you would rather it were not, decline analytics or rename the device.
• App and device performance — how long the app takes to start and to draw music, whether animation stays smooth, and a coarse profile of your device: the performance tier it declares to Android, roughly how much memory it has (as a band such as “4-6 GB”, never an exact figure), whether Android considers it a low-memory device, its screen’s refresh rate, its make and model, and whether it is a phone or a tablet, along with the app’s version and whether it is a test build. These describe the hardware and the app, not you.
• The “How’s it going?” rating — once you have practised for about half an hour, over at least two days, the app may ask you to rate it from 1 to 5 stars. It is only asked if you have opted into analytics, because analytics is the only place your answer is recorded. We record your answer (or that you skipped it), your total practice time and number of practice days, and whether you tapped “Tell us more” afterwards, but never what you write. The rating is our own survey: it is not a Google Play review and is never published.

A few summary values (your input method, your keyboard’s name and manufacturer, your experience level, how many exercises you have completed, the device profile, the app version and your star rating) are also attached to your app installation, so we can see whether different groups of people use the app differently.

What analytics never include: your name or contact details, any free-typed text, the audio from your microphone (the app does not use the microphone at all), your location, your contacts, or a note-by-note recording of your playing.

What Google adds automatically. Firebase Analytics attaches its own technical information to every event: a randomly generated app instance ID (a pseudonymous identifier for your installation, not tied to you or to your Google account), your device model, operating system version, app version, language, and an approximate country derived from your IP address. Google does not store the full IP address with the analytics data. The app instance ID is reset if you reinstall the app or clear its data.

Where you found the app. The links we share to Google Play — in a Reddit post, on our website, in one of our ads, or given to a reviewer — carry a short tag naming where they were posted, such as reddit / organic / pianolearning_launch. If you install the app from one of those links, Google Play hands that tag to the app, and Firebase Analytics records it with your first analytics event. Like the rest of analytics, this is only sent if you opt in. The tag describes the link, not you. It tells us which places and ads actually bring people to the app, so we know where it is worth spending time and money. If you installed the app without following a tagged link, all that is recorded is that it came from Google Play.

If you opt in: crash and error reports

If the app crashes or hits an unexpected error, Firebase Crashlytics sends a report so it can be fixed. A report contains the stack trace, the app version, the device model and OS version, the state of the device (such as free memory and whether the app was in the foreground), and a Crashlytics installation identifier. The only custom detail the app attaches is the catalogue ID of the exercise being displayed when a music-notation rendering error occurred. No personal information is attached.

Crash reporting follows exactly the same consent switch as analytics, and is additionally disabled entirely in development builds.

If you email us

Writing to us is separate from analytics and always up to you. After you rate the app, “Tell us more” opens your own email app with a message to [email protected] already addressed. It has a short footer giving the app version, your operating system version and device model, and the rating you just gave, so we can reproduce any problem you describe. You can read, change or delete any of it before sending, and nothing reaches us unless you send it.

If you do, we receive your email address and whatever your message contains. We use it only to reply to you and to improve the app, and we never add you to a mailing list. Our legal basis for this is our legitimate interest in answering the people who write to us.

How your choice works, and how to change it

• The consent screen appears once, during onboarding. Declining is a real decline — the app stores that answer and keeps collection switched off.
• You can change your answer at any time: Settings → Usage Analytics. Turning it off stops both analytics and crash reporting.
• Turning it off stops any further collection. It does not retroactively delete data already sent to Google; to request that, email us (see below).
• Every feature of the app works the same whether or not you opt in.
• Under the UK GDPR, our legal basis for analytics and crash reporting is your consent, which you may withdraw at any time using that switch.

Who else receives data

Google (Firebase Analytics and Firebase Crashlytics) is the only third party that receives anything, and only when you have opted in. Google processes this data on our behalf as a service provider, on servers that may be located outside your country, including in the United States. Google’s handling of it is governed by the Firebase Privacy and Security policy and the Google Privacy Policy. Google LLC is certified under the EU–U.S. Data Privacy Framework and its UK Extension (the UK–US “data bridge”), which UK law recognises as giving adequate protection to data transferred to the United States, and Google’s data processing terms for Firebase also include the standard contractual clauses approved for such transfers.

There are no other integrations. The app contains no advertising SDK, no attribution or marketing SDK (the install source described above is recorded by Firebase Analytics itself), no social-network SDK, no analytics provider other than Firebase, no in-app purchases or payment processing, and no server of our own — we do not operate a backend, and the app makes no network requests other than those made internally by the two Firebase SDKs above.

We do not sell, rent, or share your data with anyone for advertising or any other purpose. The app also marks its analytics data as not to be used for personalised advertising, so Google does not use it to target ads at you.

About the permissions the app requests

• Bluetooth (scan and connect) — required to find and connect to a Bluetooth MIDI keyboard.
• Location (Android 11 and older only) — older versions of Android required apps to hold a location permission in order to scan for Bluetooth devices at all. The app uses it for that reason alone. It never requests, collects, stores, or transmits your location, and the permission is not requested on Android 12 or newer.
• Notifications — used only for the practice reminders you schedule yourself. The reminders are generated on your device; no reminder data leaves it.

How long data is kept

• On your device: until you delete the app or clear its data.
• In your Google Account’s device backup (if you use it): until you delete the backup or Google expires it. We have no access to it, so we cannot read or delete it for you.
• Analytics events at Google: retained for the retention window configured in the Firebase project, which is Google’s default of 2 months for event-level data. Aggregated, non-identifying reports may persist beyond that.
• Analytics data about your installation at Google (the app instance ID and the summary values attached to your installation, described above): retained for 14 months after the app last sent analytics data, so the period restarts each time the app is used with analytics switched on.
• Our analysis copy of analytics events: Google also copies the analytics events once a day into a database in our own Google Cloud project (BigQuery, stored in London), so we can analyse them ourselves. It is not shared with anyone, and each day’s copy is deleted automatically after 60 days.
• Crash reports at Google: retained by Crashlytics for up to 90 days.
• Emails you send us: kept in our support mailbox for as long as we need them to answer you and follow up, and deleted sooner if you ask.

Children

Note Universe is a general-audience music-education app. It is not directed at children under 13, and it is not enrolled in Google Play’s Designed for Families programme. The app has no accounts, no chat, no user-generated content, no advertising, and no in-app purchases.

That said, learners of any age may well use it. If a child is using the app, please decline analytics on the consent screen — the app then transmits nothing at all. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the app, email us and we will delete what we can.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), you have the right to:

• access the personal data we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• restrict or object to how it is processed;
• receive it in a portable format; and
• withdraw your consent at any time, without affecting what was processed before you withdrew it.

People in the European Union and elsewhere have similar rights under their own laws. In practice:

• To stop all collection — turn off Usage Analytics in Settings.
• To delete everything held locally — uninstall the app or clear its storage. If your device backs up to your Google Account, delete that backup too, or reinstalling will restore your progress.
• For anything else, including data already sent to Google — email us at [email protected]. Because the data is pseudonymous and there are no accounts, we may need you to tell us roughly when and on which device you used the app in order to locate it, and in some cases it may not be possible to isolate your records.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live outside the UK, you can also complain to the data protection authority where you live.

Security

Data sent to Firebase is transmitted over encrypted connections (HTTPS/TLS) and stored under Google’s security controls. Data on your device is protected by your device’s own security, so keeping a screen lock and up-to-date OS is the most effective protection for your practice history. A screen lock is also what lets Android end-to-end encrypt the device backup described above.

No system is perfectly secure, but because the app holds no account credentials and no contact details, there is very little of value to lose.

Changes to this policy

If the app starts collecting something new, this page will be updated and the effective date at the top changed before that collection begins.

Contact

Questions, corrections, or requests: [email protected]

JINDOSH TECHNOLOGIES LIMITED, registered in England and Wales, company number 17321094. Registered office: Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset BH16 6FA, United Kingdom.