Who handles your information
Yro LLC operates Tunings at tunings.io and is responsible for the personal information described here. Contact support@yro.dev with privacy questions or requests.
Information we handle
- Google account information. Firebase Authentication receives your account identifier, email address, verification status, and basic profile information such as your name and profile image when supplied by Google. Tunings uses this to sign you in and associate your saved data with your account. We do not receive your Google password.
- Saved instruments. Instrument names, tunings, string and fret settings, and related saved instrument data are stored with your account when you use the library.
- Music imports. MIDI files are read in your browser. If you confirm image or PDF transcription, Tunings sends a processed copy to Google Gemini to recognize the music. We remove image/PDF metadata before sending it, but visible text and music remain. The hosted importer processes files and drafts in memory without saving the original upload. We retain account-linked usage counters and request timestamps to enforce shared AI limits. Google handles submitted content under its Gemini API terms; data use and retention depend on the applicable service terms. Cancelling after submission cannot recall content already sent to Google.
- Music assistant. After you consent and press Send, your question, recent conversation, and a limited musical context (key, tempo, instrument tuning, selected chord and nearby timeline notes) are sent to Google Gemini. Tunings does not persist chat content on its servers. Conversation stays in browser memory while the panel is open and clears when you close it or change accounts. Chat shares the import usage counters. Google’s Gemini API terms govern its processing and retention; cancelling cannot recall content already submitted. Choosing or previewing chords by mood runs locally and does not send a chat request.
- Subscription information. We store identifiers linking your Tunings account to Stripe, your subscription status and billing period, trial-use information, and payment-event records needed to manage access. Stripe collects checkout and payment information directly. Tunings does not receive or store your full card number or security code.
- Browser and security information. Hosting, authentication, and abuse-prevention services process information such as IP addresses, request times, browser/device signals, and authentication or verification tokens to deliver and protect the service.
- Subscriber feedback. If you choose to complete our survey, we store your answers and feature vote with your authenticated account. We use this feedback to improve Tunings and prioritize development. Individual answers are private to you and our team; subscribers can see aggregate feature vote totals. You can update your response or contact us to request deletion.
- Support messages. When you use our support form or contact us by email, we receive your email address, topic, and message. Form submissions are stored privately in Firebase. If you are signed in, we may associate the request with your authenticated account. We retain a hashed email identifier for submission limits; the email entered in the form is not treated as proof of account ownership.
How we use it
We use information to provide the app, authenticate accounts, save and retrieve instruments, manage subscriptions and trials, resolve support requests, review subscriber feedback, prevent fraud and abuse, and meet applicable legal obligations.
Where data-protection law requires a legal basis, these purposes rely on providing the service you request, our legitimate interests in operating and protecting it, or compliance with legal obligations. Where consent is required for a particular activity, we will request it.
Google, Firebase & Stripe
We use Google Firebase and Google Cloud for hosting, sign-in, saved data, and backend processing. Firebase App Check with reCAPTCHA Enterprise helps distinguish legitimate app requests from abuse. Google processes device and interaction signals for this protection.
Stripe processes subscriptions, payments, invoices, and billing-portal requests. Service providers receive information needed for their role and may process data in other countries, including the United States. Their own privacy terms also describe their handling of information.
Read Google’s Privacy Policy, Google’s Terms of Service, Firebase’s privacy information, and Stripe’s Privacy Policy.
We may also disclose information when required by law or when necessary to protect accounts, users, or the service.
Browser storage & tracking
Tunings stores display settings, workspace preferences, custom tunings, and lesson packs in your browser. Custom tunings and lesson packs are separated by your signed-in account on that device. Older shared local work is copied into an account only when you choose to import it. This separation is not encryption against someone with access to your browser profile. Authentication and security services also use browser storage or cookies to maintain sign-in and verification. Clearing site data can remove local work and sign you out; it does not delete server records or cancel a subscription.
If you choose to allow optional analytics, Google Analytics measures page visits and selected actions, such as creating an account, opening checkout, playing a chord or timeline, saving an instrument or lesson, starting a trial, or purchasing a subscription. We store the day of your first measured musical action in this browser, tied to your analytics consent for up to 180 days, to understand return activity after one and seven days. This measures browsers, not signed-in accounts. Declining analytics clears this record; cleared site data or a new consent period can start a new browser cohort.
With your consent, we link verified subscription events to your browser’s analytics identifier and the public reference page that led you to checkout. Purchase events include the subscription product, amount, currency, tax, and an opaque transaction reference; we do not send your name, email, card details, Firebase account ID, or Stripe customer ID to Google.
Analytics consent expires after 180 days. You can withdraw through Privacy choices, including after signing out on the same browser. Withdrawal stops future measurement after confirmation; an already dispatched event cannot be recalled. Keep the page open to retry if confirmation fails. Clearing browser storage removes the withdrawal receipt; contact support for help withdrawing server-side measurement if that happens.
Google Analytics uses cookies and processes browser/device information to help us understand use of the site. We send known page names and event types, not support messages, instrument content, or account identifiers. With analytics-only consent, page URLs exclude all query strings. If you separately allow ad measurement, we also permit bounded Google ad-click identifiers (gclid, gbraid, and wbraid) on the landing-page URL so Google can attribute conversions. Other query parameters and URL fragments remain excluded. Personalized advertising and Google signals remain disabled.
Advertising measurement
Ad measurement is a separate, optional choice in Privacy choices. If you allow analytics and ad measurement, Google may store advertising cookies and use your ad-click identifiers and measured signup, trial, and payment events to report and optimize our Google Ads campaigns. We do not enable personalized advertising or upload names, email addresses, or customer lists for this purpose. Existing analytics consent does not grant ad measurement consent.
You can return to analytics only without disabling ordinary analytics. This clears our advertising measurement cookies and requests a one-way restriction on existing billing measurement permissions. If you are offline, keep the page open or return to retry; pending withdrawals are not undone by accepting again. Already dispatched events cannot be recalled. A later opt-in applies to browser activity and newly authorized checkout measurement, not previously restricted billing permissions. Ad measurement consent expires after 180 days.
Ads displayed on Tunings
Ad serving is not currently enabled. Our site includes a public Google AdSense ownership tag and an authorized-seller file; these do not load ads or advertising cookies. If advertising is introduced, public reference pages may show ads to visitors without a paid subscription. Paid subscribers will browse ad-free while signed in. We will update this policy and provide the required advertising consent controls before ad serving begins. Neither analytics nor ad measurement consent opts you into personalized advertising or ad serving.
Analytics choices
Analytics does not load until you allow it. You can decline or change your choice using the Privacy choices button. Declining does not prevent you from using Tunings. Your choice is stored in this browser for up to 180 days. Declining all optional tracking stops future measurement and clears our Analytics and advertising measurement cookies; it does not automatically delete data already processed by Google.
How long information is kept
Account and saved instrument information is kept to provide your account and saved library. Survey responses and feature votes are retained for product review until updated or removed; contact us to request deletion. Billing records, trial-use history, support correspondence, and security records may be retained as needed for payment reconciliation, fraud prevention, dispute resolution, and legal or accounting obligations.
Deletion requests are reviewed for records that can be removed and any records that must be retained. Backup copies and records held by payment or infrastructure providers may follow their own retention schedules. We do not promise immediate removal from every system.
Your choices & requests
Email support@yro.dev to request access to, correction of, or deletion of your personal information. Depending on applicable law, you may also have rights to data portability, to object to or restrict processing, or to complain to your local data-protection authority. We may verify your identity before acting.
There is no self-service account deletion button at present. Contact support for deletion help and tell us about any active subscription so billing can be addressed too. You can cancel directly through Manage billing without waiting for a privacy request to be completed.
Policy updates
We will update this page when our practices change and communicate material changes through the app or another appropriate channel. The date above identifies the current version.