Privacy Policy

In effect from September 30, 2026

Who we are

Keystair is an online resource for piano learners: the first stage is free, and paid plans open the rest. It’s run by Jude Hilgendorf, an individual who lives in Michigan in the United States (“we” and “us” here). This document outlines what information Keystair gathers and why, as well as your options regarding it.

The short version

We gather what the lessons and your account need to work, and nothing for ads.
There are no advertisements or tracking tools, nor do we use any analytics services.
Your info isn’t sold or shared for advertising purposes.
The sound from your microphone is processed on your device and never sent to us.
You can download or delete everything in Settings, Account.

What we collect, and why

Your account

We keep your email address and username. Your password is stored only as a scrambled (hashed) code, so nobody can read it, us included. We also note when you joined and your language, that you confirmed you’re 13 or older, and which version of the terms you accepted and when. We need this information to run your account and to send the emails that come with it, like confirming your address or resetting your password.

If you sign in with Google

Google gives our sign-in service your Google account ID and email address when you sign in, and passes along your name and profile picture too. We use the email and ID to sign you in. The name and picture are kept with your account, but they aren’t displayed or used.

If you add a passkey

Only its public part and the kind of device that made it, plus when it was added and last used. Your fingerprint, face, or PIN stays on your device.

Your progress

The lessons you’ve completed, the stars you’ve earned, the notes you get right and how fast, plus how long you practice each day. There’s also a log of recent tries: the step, how accurate and on time you were, the tempo, whether hints showed up, and what hour it was. Your settings are saved too, including your practice time. This is how Keystair picks your next step and keeps old skills fresh before they fade.

Signing in

Every time you sign in, our sign-in service notes the time alongside your IP address and what kind of browser you’re using, and it keeps these details with each active sign-in. This helps protect your account, for example by letting you sign out from all devices at once.

Security

To prevent spam, the contact form and error reports use temporary counters linked to a jumbled version of your IP address. The sign-in service also limits repeated tries from the same address.

Reminders, if you turn them on

Your practice time, your time zone, your daily goal, and the reminders you’ve selected. For notifications, we also keep the address and keys your browser’s push service provides so we can deliver them.

Messages you send us

What you type in the contact form and your language, along with any name or email address you choose to give. If you’re signed in, we keep track of which account sent the message.

Error reports

When something breaks, the app sends a brief report describing the problem and the page it happened on, plus your browser type and version. The report isn’t linked to your account.

If you buy a plan

Stripe handles the payment, so your card details go to Stripe and never reach us. We keep which plan you have, its status, when it renews or ends, and the Stripe customer and subscription numbers that link your account to your payments.

What we don’t collect

Your card details, which Stripe handles. Recordings or sound of any kind, since the microphone is processed on your device. The notes you play are evaluated on your device as well, and only the results are stored.

Stored on your device

Keystair saves a copy of your progress and settings in your web browser, so it opens quickly and nothing is lost if the internet connection fails. Your sign-in is stored there as well, along with settings specific to this device: theme, language, keyboard size, motion, music size, whether to keep the screen on, the piano and microphone you selected, and your timing correction. If you choose not to stay signed in, your sign-in ends when you close the tab. When Keystair is installed as an app, your browser keeps its files locally so it can work offline.

To remove this computer’s copy of your progress when you sign out, turn on Clear this computer when I sign out under Settings, Privacy. You can also clear all of it from your browser’s settings menu.

Cookies

Keystair doesn’t set cookies, and the data it requires stays in your browser’s storage as mentioned earlier. When you sign in with Google, Google’s pages use its own cookies under Google’s policies.

Who else handles your data

Netlify hosts the website in the United States and runs jobs that send reminders and check if the site is up.
Supabase stores accounts, progress, settings, reminders, messages, and error reports in the United States. It also handles sign-ins and sends the sign-in emails, like address confirmations and password resets.
Google handles your sign-in only if you choose to sign in with Google.
Your browser’s push service, from Google, Apple, Mozilla, or Microsoft depending on your browser, delivers reminder notifications, but only if you turn notification reminders on.
Stripe processes payments, in the United States. It receives your email address, your card details, and the billing details needed for tax, and it keeps its own payment records under its privacy policy.

Netlify and Supabase keep routine technical logs, including IP addresses, for a limited time, for security and to fix problems. We don’t sell your data, share it for advertising, or use it to train AI.

How long we keep it

Your account and progress: until you delete your account.
Backups: made daily, and each is kept for 7 days. Deleted data disappears from all backups within that time.
Sign-in records: kept for 90 days.
Sign-ins: they last until you sign out, or end after 6 months without use.
A Google sign-up that never completes (no username chosen and terms not agreed to): removed after 7 days.
Security counters: kept for about a day.
Error reports: stored for 30 days.
Contact messages: retained up to one year.
Billing records: your plan’s details stay with your account until you delete it. Stripe keeps its records of your payments for as long as tax and financial rules require, even after you delete your Keystair account.
Links in emails expire after a short time, or as soon as they’re used.

Your choices

See and download everything: use Download my data in Settings, Account.
Change your username, email or password: Settings, Account.
Delete your account: use Delete account in Settings, Account. It’s removed right away, then from backups within 7 days.
Turn reminders off at any time: Settings, Practice.

We use your information to offer the service you signed up for and to keep it secure. For reminders, we rely on it because you requested them. Depending on where you live, you might have more rights over your data, such as objecting to how it’s used or complaining to your data protection authority, so contact us and we’ll assist.

Children

Keystair is meant for people who are 13 or older. Should we discover that someone younger than 13 has an account, we will remove it. If you suspect a child under 13 might be using Keystair, let us know.

Security

Passwords are saved as hashes, meaning nobody, not even us, can read them. The database itself makes sure each account can reach only its own data. Connections are encrypted, and our providers also encrypt stored data. We back up daily. No system is entirely secure; if a breach impacts your info, we’ll notify you.

Where your data is

Keystair stores its data in the United States. Should you access the service from another country, your info is transferred to the United States.

Changes to this policy

When the policy changes, the date at the top gets updated. If the change is big enough, we’ll let you know through the app before it goes into effect.

Contact

Questions about your privacy, or a request about your data: