String AI is an AI-powered practice app for violin, viola, and cello. This policy explains what we collect, what we never collect, and the rights you have. Questions: stringaiapp@gmail.com.
1. How we keep your data safe
Your phone does the heavy lifting. Pitch, rhythm, tone, dynamics, and posture are analyzed locally on your device. Only derived practice metrics and the limited optional content described below leave your phone. No raw audio or video is uploaded to our servers — ever. Your music stays yours.
2. What we collect
Account: email and a display name you choose (a nickname is perfectly fine). Practice metrics: scores for pitch, rhythm, dynamics, tone, and posture; mission attempts; session duration; instrument; and level. Schedule preferences: pieces you picked and how long you plan to practice. Optional server content: score markings you draw and a short musical teaching note entered by a linked teacher. Device-only content: Practice Room videos are created only when you explicitly record and save them; they stay in this account’s private folder on this device and are never uploaded. Crash diagnostics: if the app stops unexpectedly, an anonymous crash report (device model, OS version, app version, and the technical error trace) is sent so we can fix it. It is not linked to your account or email, is never used for tracking or advertising, and contains no practice data, audio, or video.
3. What we never collect
We never collect or upload raw audio or video. The only persistent raw video is a Practice Room recording you explicitly choose to save in this account’s private folder on your own device; it is never sent to us and is removed when you delete the account. We also never collect your address, phone number, school, or identity documents. The display name you pick can be a nickname — we never require or verify your legal name. We do not sell or rent any data to third parties — ever.
4. AI coaching (OpenAI)
We use OpenAI's API to give you coaching. We send derived practice metrics, public score context, and, when provided, the short musical-focus note written by a linked teacher. We never send raw audio or video, account name, email, or user ID. Email addresses, phone numbers, web links, and social handles are blocked from teaching notes before they can be saved or sent; teachers are also told not to enter names or sensitive information. Score drawings are never sent to OpenAI. By default, the OpenAI API does not use API data to train its models. Data may be retained for at most 30 days for abuse monitoring and is then deleted unless law requires otherwise.
5. Children and parents (under 14)
Students under 14 require a parent or guardian's explicit consent before any data is collected. Parents can view, export, or delete their child's data at any time from Profile > Privacy & Data. We comply with COPPA (US, age 13) and PIPA (Korea, age 14), using the stricter 14-year threshold globally.
6. Your rights
You can: (1) access and review what's stored about you, (2) export a portable JSON copy of your profile, subscription, sessions and scores, schedule, and AI interactions from Profile > Privacy & Data; for access to other personal data, contact our privacy officer, (3) correct inaccurate data, (4) delete your account permanently, including its account-scoped data on this device, (5) withdraw analytics consent without losing core features, and (6) object to or restrict certain processing. These rights are guaranteed by GDPR (EU), CCPA (California), and PIPA (Korea). You also have the right to lodge a complaint with your data protection authority.
7. Data retention
Active account: practice metrics are kept as long as you keep your account. Account deletion: all personal data wiped within 30 days; anonymized aggregate metrics may be kept for product improvement (no link back to you). If parental consent is never obtained: a consent request expires 7 days after it is sent, and if consent is still not confirmed 30 days after that expiry, we delete the student's account and its data. Before consent we do not collect practice data (see section 5), so the only information held during this period is the contact details and account record needed to obtain that consent. The only exception is the limited transaction records we are legally required to retain (for example, tax and e-commerce record-keeping laws), which are kept for the minimum period the law requires and then deleted.
8. Service providers and international data transfer
We rely on a small number of trusted service providers (processors) solely to run the service: Supabase (secure database, authentication, and hosting of account data, practice metrics, optional teaching notes, and score markings) OpenAI (API that generates coaching from the limited context described in Section 4), Sentry (anonymous crash reports so we can find and fix bugs — no account identifier is attached), Expo (delivery of remote push notifications — it receives only the device push token and the notification text, never your name or email), and Resend (sending the parent-consent email and its reminders; it receives only the parent’s email address and the message itself). These providers are located in the United States, so that limited data may be processed there. By using the app you consent to this transfer. Where data is transferred outside your region, we rely on appropriate legal safeguards. All transfers use TLS encryption, and data is encrypted at rest. Beyond these processors, we do not sell or share your data — the only exception is a teacher you choose to connect with (see Section 9).
9. Sharing with your linked teacher (optional)
String AI lets a student connect with their own teacher by entering an invite code the teacher shares. This connection is entirely optional and happens only when you enter the code yourself. What your teacher can see while connected: your practice time, scores and weakness summary, and your practice plans and homework progress. What your teacher can never see: audio or video. Practice Room recordings you explicitly save remain only in this account’s private folder on your device and are never uploaded or shared. Your teacher also cannot see your email address or account details. A connected teacher can assign a practice plan and write a short teaching note used to personalize lessons. Teacher score markings appear as a separate read-only layer; your own markings remain private. Under 14, connecting requires completed parental consent, and the parent or guardian must then approve the connection by email; nothing is shared with the teacher until they approve, and they may decline. You can disconnect at any time in Profile > My Teacher.
10. Posture (biometric) data
When the camera analyzes posture and bowing, your phone computes body-position (posture) measurements. Because these may qualify as biometric information, we disclose them separately. What: posture angles derived from body keypoints (positions of shoulders, arms, wrists, etc.). Why: solely for posture and bow-technique coaching. Where: processed entirely on your phone (offline) — neither the raw video nor the body keypoints are ever transmitted off the device. Retention & destruction: each frame is discarded immediately after analysis and is never stored permanently; only the session score (numbers) remains. We never sell or share this data with third parties. (Notice, consent, and destruction policy under Illinois BIPA, Texas CUBI, Washington's biometric law, and Korea's PIPA. Granting camera permission constitutes your consent to this collection.)
11. Subscriptions and payments
String AI offers auto-renewing monthly subscriptions purchased through the Apple App Store or Google Play. All payment processing is handled entirely by Apple or Google — we never receive or store your credit-card, bank, or billing details. To activate and verify your subscription, we receive a transaction identifier and the product you purchased from the store, and store it linked to your account. We use this only to grant your membership, restore your purchases, and meet tax and accounting obligations. Renewal, cancellation, and refund terms are described in our Terms of Service.
12. Changes to this policy
We may update this Privacy Policy as the app evolves or as the law requires. When we make a material change (for example, collecting a new type of data or adding a new processor), we will revise the effective date at the top of this policy and, where required, ask affected students or parents to review and re-consent inside the app. Continued use after an update means you accept the revised policy.
13. Who we are and how to contact us
String AI is the data controller responsible for your personal data. For any privacy request — access, export, correction, deletion, withdrawal of consent, or a complaint — contact our privacy officer at stringaiapp@gmail.com. We respond within 7 days. For urgent privacy issues (suspected data breach, parental concerns), please mark the subject line as PRIVACY URGENT. If you are not satisfied with our response, you may also contact your data protection authority (in the EU/EEA, your local supervisory authority; in the Republic of Korea, the Personal Information Protection Commission and the Personal Information Dispute Mediation Committee).