Effective date: 2026-03-19

Last updated: 2026-03-21

—

1. Who we are

Controller: Austris Music (“MusicGym”, “we”, “us”).

Address: Noordewierweg 4e 3812DK Amersfoort, The Netherlands

Contact email: info@musicgym.nl

MusicGym currently uses:

Supabase for app authentication and database services;
MusicGym-operated AI gateway and related services hosted on a VPS provided by Hostinger in The Netherlands.

—

2. What this policy covers

This policy explains how we process personal data when you:

use the MusicGym mobile app (Android/iOS),
create an account or sign in,
use our AI coaching features (“Nemo”),
practice exercises, routines, and sessions,
use teacher/student messaging or related learning tools,
manage privacy settings, export your data, or delete your account,
use a parent-managed account for a child under 16.

—

3. The data we process

We aim to collect the minimum data needed to operate the app.

3.1 Account and identity data

Account identifiers (for example, user ID)
Email address
Sign-in method and authentication status
Display name / profile name
Role and level selections (for example, student, teacher, administrator; training level)
Instrument and onboarding/profile selections

3.2 Age confirmation and parent verification data

If the account is marked for a user under 16, we may process:

age confirmation status (for example, “16+” or “parent/guardian-managed under 16”),
parent or guardian full name,
parent contact email,
parent verification method and status,
timestamps showing when parent verification was recorded, checked, approved, or updated,
manual review status and a user-facing review note if administrator review is needed.

3.3 Practice and learning data

Routine completions, exercise completions, and timestamps
Session summaries and per-note evaluation results (for example, timing error, pitch error in cents, grade)
Streak, XP, level, and related gamification progress
Instrument selection, tuning, and difficulty settings
Teacher/student assignment and progress relationship data
Generator/training feedback you provide (for example, “too easy”, “too hard”, range notes)

3.4 Audio and microphone data

MusicGym uses the device microphone to provide tuner and performance feedback.

We do not intend to store raw microphone recordings as part of normal app operation.
Audio is analyzed to compute derived features such as pitch, confidence, timing markers, and related practice feedback.
We may store non-audio derived results, such as note evaluations and summaries, as part of your practice history.

3.5 AI coaching data ( “Nemo”)

If you use the AI assistant, we may process:

your prompts and messages,
AI responses,
limited context needed to answer (for example, selected settings, practice summaries, and relevant app state),
AI privacy settings, such as whether chat history saving is enabled,
anonymized improvement or dataset feedback if you choose to enable those features.

If chat history saving is turned on, chat history may be stored until deleted by you or removed through account deletion. If chat history saving is turned off, MusicGym will still process the current request and necessary context to generate a response, but ongoing chat history is not stored as saved chat history for that feature.

MusicGym currently operates its AI service on its own infrastructure. We do not intend to send your AI prompts to third-party hosted LLM providers as part of the current production setup.

3.6 Teacher/student communication data

Teacher/student messages
Relationship and assignment metadata needed to deliver the messaging feature

3.7 Device and technical data

App version
Device model and OS version where provided by the operating system
Diagnostics and performance data
Network and connectivity information required to operate features

3.8 Privacy settings and rights controls

Privacy preference settings
Consent and withdrawal records
Private data export actions
Account deletion actions

3.9 No general user upload feature

The consumer app does not currently provide a general user file upload or import feature for end users. If that changes, we will update this policy.

—

4. Where we get your data

We collect data:

directly from you (for example, account details, messages, settings, age confirmation),
from your practice activity and app usage,
from your device sensors (microphone) for real-time analysis,
from authentication providers if you choose them (for example, Google or Apple sign-in),
from a parent or guardian where an under-16 account is created or managed by them.

—

5. Why we process your data

We process personal data to:

provide core app features, including practice, tuner, routines, messaging, and AI coaching;
create and display feedback summaries and progress history;
maintain your profile, streaks, XP, level, and related progression rules;
operate privacy controls, including in-app data export and account deletion;
support parent-managed under-16 accounts and verify parent or guardian involvement where required;
prevent abuse, secure accounts, and review suspicious or disputed parent verification cases;
improve reliability, fix bugs, and improve user experience;
comply with legal obligations.

—

6. Legal bases for processing (GDPR)

Depending on the feature and context, we rely on one or more of:

Contract (GDPR Art. 6(1)(b)): to provide the service you requested.
Legitimate interests (GDPR Art. 6(1)(f)): to secure the app, prevent abuse, review doubtful parent verification cases, improve reliability, and maintain the service.
Consent (GDPR Art. 6(1)(a)): where consent is appropriate for optional processing, such as optional dataset sharing or other optional features.
Legal obligation (GDPR Art. 6(1)(c)): where required by law.

If we rely on consent, you can withdraw it at any time without affecting processing already carried out before withdrawal.

—

7. How we share data (recipients)

We do not sell your personal data.

We may share data with:

Supabase for authentication and database services;
Hostinger for hosting the MusicGym-operated VPS and related AI gateway infrastructure;
authentication providers such as Google or Apple, if you choose those sign-in methods;
app stores and payment platforms such as Apple App Store or Google Play, if you purchase subscriptions or in-app items;
other service providers under contract where needed to operate the service lawfully and securely.

Where required, we enter into data processing agreements and restrict processing to the minimum necessary.

—

8. International data transfers

Our MusicGym-operated AI gateway currently runs in The Netherlands. Some supporting providers, such as authentication providers or app stores, may process data in other countries.

If personal data is transferred outside the EEA, we will use lawful transfer mechanisms, such as EU Standard Contractual Clauses where appropriate, and keep our subprocessor disclosures up to date.

—

9. Retention

We keep personal data only as long as necessary.

Profile and account data: retained until the account is deleted, unless law requires longer retention.
Practice data and summaries: retained for up to 1 year, unless deleted earlier by the user or removed through account deletion.
AI chat history: retained indefinitely unless deleted by the user or removed through account deletion, if chat history saving is enabled.
Teacher/student messages: retained indefinitely unless deleted by the user or removed through account deletion.
Parent verification records for under-16 parent-managed accounts: retained until account deletion.
Diagnostics and technical logs: retained for a limited period unless needed longer for security or incident handling.

—

10. Your GDPR rights

Depending on your location, you may have rights to:

access your personal data,
correct inaccurate data,
delete data,
restrict processing,
data portability,
object to processing based on legitimate interests,
withdraw consent where processing is based on consent.

MusicGym may provide some of these controls directly in the app, including private data export and account deletion for the signed-in account. You can also contact us at info@musicgym.nl. We may verify your identity before fulfilling requests.

—

11. Children and student users

MusicGym accounts are intended for users aged 16 or older unless a parent or legal guardian creates and manages the account for a child under 16.

For under-16 parent-managed accounts:

the parent or legal guardian must create or manage the account where required by law;
we may record the parent or guardian name, contact email, verification method, timestamps, and manual review status;
we may pause access until parent verification is completed;
we may require administrator review if the verification record is incomplete, inconsistent, or disputed.

We do not intend for children under 16 to create and manage their own accounts without the required parent or guardian involvement.

—

12. Security

We use appropriate technical and organizational measures to protect personal data, such as:

access controls,
encryption in transit (HTTPS),
least-privilege access,
audit or logging for sensitive administrative actions.

No system is 100% secure. If a breach occurs, we will act in line with GDPR requirements.

—

13. Complaints

If you are in the EU/EEA, you have the right to lodge a complaint with your supervisory authority.

In The Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens.

—

14. Changes to this policy

We may update this policy as the app evolves, for example when we add new features, new subprocessors, or new data controls. We will post changes in-app or on our website and update the “Last updated” date.

—

15. Contact

For privacy questions or requests, contact: info@musicgym.nl

MusicGym Privacy Policy