notavia-privacy

Notavia Privacy Policy

Effective: 2026-05-11 Last updated: 2026-05-11

Notavia is a music-theory practice app. This policy explains what data we collect, why, and how it is used. Plain English, no boilerplate — if anything is unclear, contact us at the address at the bottom.

What we collect

When you sign in, we collect the minimum needed to identify your account:

Email address. Used as your account identifier and to deliver magic-link sign-in emails.
Display name. Provided by your sign-in provider (Google, Apple). Used to personalize the app — for example, addressing you by name.
Provider account ID. A unique identifier issued by Google or Apple that links your sign-in to your Notavia account. Not visible to you.

We also store authentication tokens issued by our server on your device’s secure storage (Keychain on iOS, Keystore on Android) so you stay signed in between sessions. These are not transmitted to any third party.

We do not collect:

Your contacts, location, photos, or files outside the app
Analytics or behavioral tracking data
Advertising identifiers (the app has no ads and no third-party analytics SDKs)

Microphone (future)

Notavia will eventually offer features that use your device’s microphone — for example, pitch detection during ear-training exercises. When this is implemented:

The app will request microphone permission before any audio is captured
Audio will be processed on-device only and will not be transmitted to our servers, stored on disk, or shared with any third party
This policy will be updated to describe any change in audio handling before the feature ships

How we use your data

To create and maintain your account
To deliver magic-link sign-in emails (for the email/passwordless option)
To verify your identity with Google or Apple on subsequent sign-ins
To respond to support requests you send us

We do not sell your data, share it for advertising, or use it for any purpose other than operating the app.

We use the following service providers, each of which receives only the minimum data needed to do its job:

Google Sign-In — verifies your Google identity when you tap “Continue with Google.” Subject to Google’s privacy policy.
Apple Sign-In — verifies your Apple identity when you tap “Continue with Apple.” Subject to Apple’s privacy policy.
Brevo (formerly Sendinblue) — delivers magic-link sign-in emails. Receives only your email address. Subject to Brevo’s privacy policy.

We do not share data with any other third party.

Security

Account data is stored on servers we operate. Authentication tokens use industry-standard signing (JWT with a server-side secret). Authentication tokens stored on your device are kept in the platform’s secure storage (Keychain / Android Keystore).

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you within a reasonable timeframe.

Data retention and deletion

We retain your account data for as long as your account is active.

To delete your account and all associated data, email us at the address below with the subject line “Delete my account” from the email address associated with your Notavia account. We will delete your account and all associated data within 30 days and confirm by reply.

In-app account deletion is on our roadmap and will replace this manual process when shipped.

Children’s privacy

Notavia is intended for users aged 13 and older. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be announced in the app before they take effect.

Contact

Questions, concerns, or account deletion requests: n.joshua.hasty@gmail.com