Privacy Policy

Last updated: March 2026

1. Information We Collect

We collect different types of information depending on how you use Root Notes: Account Information — When you create an account, we collect your email address and password. If you sign in with Google, we also receive your name and profile photo from your Google account. We also store a username (auto-generated from your email), your app preferences and settings, and device sync information (device name, platform, last sync time) for cross-device access. Billing Information — If you subscribe to a paid plan, payment is processed by Stripe. We store your subscription status and plan tier in our database. We do not store your payment card details — these are handled entirely by Stripe. Musical Content — Projects, chord progressions, audio recordings, lyrics, and ideas you create within Root Notes. Community Content — If you submit feedback or feature requests, your display name, submission title, and description are stored and visible to other signed-in users. Usage Data — We collect analytics events such as page views, feature usage, and user interactions to understand how the app is used. This data is collected via Firebase Analytics. Technical Data — Error reports, performance metrics, and session replay data (on error sessions only) are collected via Sentry to help us identify and fix issues.

2. How We Use Your Information

We use the information we collect to: • Provide and operate the Root Notes service • Sync your projects and content across devices when you are signed in • Process payments and manage subscriptions via Stripe • Improve the app through aggregated usage analytics • Identify and fix errors and performance issues via Sentry • Communicate important service updates

3. Data Storage

Root Notes follows a local-first approach. Your musical content is always stored locally on your device using IndexedDB. When you sign in, your content is also synced to the cloud using Google Firestore and Firebase Storage. This allows you to access your projects across devices. When you sign in on multiple devices, we store device sync information (device name, platform, last sync time) to manage cross-device access. Items you delete are moved to trash. Trashed items are permanently deleted after 30 days, including any associated audio files stored in the cloud. If you use Root Notes without an account, your data remains entirely on your device and is never transmitted to our servers.

4. Third-Party Services

We use the following third-party services: Firebase (by Google) — Authentication, Analytics, Firestore database, and Storage. See Google's Privacy Policy. Sentry — Error tracking, performance monitoring, and session replay on error sessions. See Sentry's Privacy Policy. Google Sign-In — OAuth-based authentication. Governed by Google's Privacy Policy. Stripe — Payment processing for paid plans (when available). We share your email address with Stripe to create a billing account. Stripe handles all payment card information directly. See Stripe's Privacy Policy. We do not sell or share your personal information with third parties for advertising purposes.

5. Cookies & Tracking

Root Notes and its third-party services use cookies and similar technologies for authentication, analytics, and error monitoring. For full details on the cookies we use, see our Cookie Policy.

6. Your Rights

You have the right to: • Delete your account and associated cloud data at any time from your account settings • Export individual projects and chord progressions as MIDI, WAV, or audio stems • Clear local data through your browser's storage settings • Opt out of analytics by using browser-level cookie controls or Google's opt-out tools

7. International Users

European Economic Area (GDPR) If you are located in the EEA, we process your personal data under the following legal bases: • Consent — for analytics and usage tracking via Firebase Analytics • Contractual necessity — for account creation, content storage, and providing the Root Notes service • Legitimate interest — for error monitoring and performance improvement via Sentry Under the GDPR, you have additional rights including: the right to access your data, the right to rectification, the right to erasure, the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local supervisory authority. To exercise these rights, contact us at privacy@rootnotes.me. California Residents (CCPA) We do not sell your personal information. California residents have the right to know what personal data we collect, to request deletion of their data, and to opt out of any future sale of personal information. To exercise these rights, contact us at privacy@rootnotes.me.

8. Children's Privacy

Root Notes is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

9. Changes to This Policy

We may update this policy from time to time. We will notify users of significant changes through the application or, where possible, via email. The "Last updated" date at the top of this page indicates when the policy was last revised.

10. Contact