Last Updated: August 2nd, 2026
I take your privacy seriously. This policy explains what data I collect and why, how I use it, and the control you have over your information. I'm into transparency, so I've written this in plain English instead of legalese.
Practice Data:
What: The items, routines, chord charts, practice events, and practice stats you create while using GPRA. This is your data. You own it, I just store it for you.
Why: The 'why' here is pretty self-explanatory.
Account information:
What: Your email address, username, and (if you signed up with Google or Tidal) your encrypted OAuth ID from those services. (Btw, if you sign up / login with Tidal, I don't get your email address, because they don't send it by default, and I don't request it, because I don't have a newsletter, I don't spam people with annoying upsell attempts, nor do I sell email addresses to spammers.)
Why: Your email address is needed for you to reset your password. For Google and Tidal logins, I have to keep the OAuth ID in order to be able to log you back in to the correct account. (Side note for Tidal users: If someone pays for the app for three months in a row without logging in at all, I'll send an email saying something along the lines of "Hey, you haven't been using the app, do you really mean to keep paying for it?" so, you'll need to add your email address on the Account/Settings page if you'd like to get those emails.)
Subscription data:
What: If you're on a paid tier, I store your Stripe customer ID, subscription tier, and payment history. (Stripe handles all the actual payment processing, I never see your credit card number.)
Why: I have to store your Stripe customer ID in order to connect your payments to the correct account. I store your payment history so I can keep your data for you for 90 days in case you miss a month, or if you purposefully pause your subscription for a couple of months. (Payment history also helps me keep an eye out for people who are trying to abuse the system to steal free or discounted use.)
Account activity:
What: I use PostHog for traffic analytics, feature flags, tracking my usage of the Anthropic API, error tracking, and to provide some of the features of the app, like your practice stats. PostHog tracks activity on the site.
Why: I'm not using it to "spy" on people, I'm using it to understand how the app is being used, where people are running into difficulty, and how I can make changes to improve the app to make it easier to use.
(Full disclosure: I work at PostHog, but GPRA is my own personal project, unrelated to PostHog beyond my use of PostHog as a customer.)
Optional stuff:
What: If you add your own Anthropic API key (the "byoClaude" feature), it's encrypted (I can't see it) and stored so it works. You can remove it anytime on the Account/Settings page.
Why: So you can use the autocreate feature with the free, Dollar Store, and Basic tier plans.
I use your data to provide GPRA's functionality, and to understand how people use the app so I can improve it. That's it. I'm not in the business of selling or sharing your information (email addresses, usage info, etc.), and I never will be. I can't, don't, and won't track your activity on other websites. I didn't build this app to "get rich", I'm just hoping I'll make enough to pay for the cost of hosting it, to break even. (Don't get me wrong, it'd be really cool if it makes a profit, but that seems quite unlikely with the low fees and the fact that it's kinda niche.) More specifically:
You have complete control over your data via the Account/Settings page (gear icon in the upper-right):
I use these services to make GPRA work. Each has their own privacy policy. I've linked to their privacy policies below, so you don't have to go find them yourself if you want to read them...
Handles all payment processing for subscriptions. I can't see your credit card numbers, Stripe keeps them safe and encrypted.
Analytics to help me improve GPRA. I track things like which features you use and how, and where bugs happen. PostHog also crunches the numbers for the practice stats you see on the Stats page. I use other parts of the PostHog platform too — the help/chat widget, feature flags, error tracking, session replay, etc. (there's a full rundown in the Cookies section below). You can opt out of PostHog cookies at anytime in Account/Settings (though opting out means no practice stats, since that's where they come from.)
Claude makes the chord chart autocreation feature happen. When you upload images or PDFs for chord charts, the images are sent to Claude for analysis so he can create the chord. (AFAIK, Anthropic doesn't save those files, but you can also bring your own Anthropic API key if it makes you feel better.)
Optional Google sign-in method using your Google account, and the tool to try to make sure you're human so my site doesn't get overwhelmed by bot farms.
Optional sign-in method using your Tidal account. Note: Tidal doesn't provide your email address to me by default, and I don't request it, so I create a fake email address as a placeholder for your account. You can add your real email address in Stripe's Customer Portal if you like (in case you want an email reminder when you pay for 3 months in a row without using the app.)
To send password reset emails and account notifications. That's all. I don't send marketing emails or spam. Ever. Period. (I'm not even comfortable using a spam-cannon company to send these emails, but they're free and dependable so...)
Practice Items, Routines, Chord Charts, Notes, Practice Stats: If you stop paying for your account, I keep your stuff for 90 days, in case you want to come back and pick up where you left off. After that I give it an extra 30-day buffer before anything is actually deleted, so nobody loses data they meant to keep by cutting it close. You'll get a reminder 7 days before deletion if you haven't downloaded your data yet.
Deleted Accounts: When you delete your account (either scheduled or immediate), I permanently erase all your data. There's no way to recover it, after deletion it's gone for good.
Here's everything GPRA uses cookies (and other browser storage) for:
`_GRECAPTCHA` cookie for that (Google's info about it). That's a security thing, not a tracking thing, and it's used regardless of your choice on optional cookies. I don't get any information from it, and I can't use it to track you across other websites (nor would I if I could).The code is open source, the repo is here. You can also use the chat widget in the bottom-right corner, or open an issue on GitHub.
