CHORDRIGHTCHORD LABORATORYOpen app
LEGAL · EFFECTIVE 1 OCTOBER 2026

Privacy Policy

This policy explains what personal data Chordright uses, why it is used, and the choices and rights available to you.

1. Who is responsible for your data

Chordright, operated from the Netherlands, is responsible for the personal data described in this policy. For privacy questions or requests, use the contact form.

2. Data we use

  • Account data: your email address, name if supplied, user ID, authentication status, and account security information handled by Clerk.
  • Your musical content: progressions, custom chord names and shapes, tunings, and related settings that you choose to save to your account.
  • Subscription data: plan, subscription status, billing period, Stripe customer and subscription references, payment event references, and limited transaction details. Chordright does not receive or store your complete card number.
  • Messages: information you provide when you contact Chordright for support or account help.
  • Technical data: security, request, and error information needed to operate and protect the service. Our hosting and authentication providers may also process device, browser, network, and cookie information.
  • Browser data: theme, settings, progressions, and custom chords may be stored in local storage or IndexedDB on your device. You can remove this by clearing the site data in your browser.

3. Why we use it

PurposeLegal basis
Create and secure your account, provide saved content, and supply Premium featuresPerformance of our agreement with you
Process subscriptions, cancellations, refunds, and required billing recordsPerformance of our agreement and legal obligations
Prevent misuse, investigate faults, and protect the serviceOur legitimate interests in operating a safe and reliable service
Send authentication, recovery, service, and billing messagesPerformance of our agreement, security interests, and legal obligations
Display and measure advertising through Google AdSenseYour consent where the law requires it

4. Services that process data

Chordright uses service providers only where needed to run the product:

  • Clerk for registration, sign-in, verification codes, recovery, and session management.
  • Google for Google sign-in, privacy-enhanced YouTube embeds, and Google AdSense advertising. These services may process device, browser, network, advertising, consent, viewing, and interaction information when enabled.
  • Supabase for the private account database, saved musical content, and contact form archive.
  • Cloudflare for hosting, delivery, reliability, and security.
  • Strato for delivering contact-form notifications by email.
  • Stripe for checkout, subscription billing, payment methods, and the billing portal when paid plans are enabled.

These providers may use infrastructure outside the European Economic Area. Where required, transfers are protected through an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism.

5. Cookies, advertising and device storage

Chordright uses essential cookies and similar storage to keep you signed in, protect the service, remember display choices, and keep local musical work. These functions are necessary for the features you request and remain available when optional services are refused.

YouTube media and Google AdSense advertising remain unloaded until you enable their respective categories. Google and its partners may use cookies or similar technologies to play videos, deliver ads, prevent fraud, measure performance, and, where permitted, personalise advertising. Your selection and the date of that selection are stored in your browser until you change the selection, clear the site’s browser data, or the consent format is replaced.

You can withdraw or change optional consent at any time through the Cookies control in the site footer. Disabling a previously enabled optional category reloads the page so its resources are removed.

6. How long data is kept

Account information and cloud-saved musical content are kept while your account is active and for as long as reasonably needed to complete deletion, resolve disputes, prevent abuse, or meet legal obligations. You may delete individual saved items in the product. Billing and tax records may be retained for the period required by Dutch law, generally seven years. Local browser data remains until you remove it or clear the site data.

7. Your rights

Depending on your situation, you may ask for access to, correction of, deletion of, restriction of, or transfer of your personal data, or object to certain processing. You may withdraw consent at any time where processing relies on consent. Withdrawal does not affect earlier lawful processing.

Send a request through the contact form. We may need to verify your identity before acting. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or your local supervisory authority.

8. Security and account choices

Chordright uses access controls, encrypted connections, managed authentication, and private database rules to protect account data. No online service can guarantee absolute security. Keep your sign-in details private and contact us if you suspect unauthorized access. You can review account and session options through the account menu when signed in.

9. Children

Chordright is a general music tool and is not directed to children. If local law requires parental permission for a young person to create an account, a parent or guardian must provide that permission. Contact us if you believe a child supplied personal data without the permission required by law.

10. Changes

We may update this policy when the service, providers, or legal requirements change. The effective date at the top shows the latest version. Material changes will be announced in the service or by email when appropriate.