Privacy Policy

What Data the App Accesses

• PDF and image files you open or import. These are read from local storage on your device or, if you connect a cloud account or your Elattoo account, downloaded from there to your device. The app does not upload them anywhere.
• Annotations, set lists, and library organization (e.g. bookmarks, ink markup, page order) you create in the app. This is stored in the app's local database on your device and is not sent anywhere. Your teammates cannot see it.
• Cloud account connection, if you choose to add one. When you connect Google Drive, Dropbox, OneDrive, or Box, the app uses that provider's standard OAuth sign-in. The provider issues an access token (and, for Google, your account email address so the app can show which account is connected) directly to the app. This token is stored only on your device and is used only to make API calls to that provider on your behalf (e.g. listing and downloading your PDFs). It is never sent to Elattoo or any third party.
• Elattoo account connection, if you choose to sign in. You can optionally sign in with your Elattoo account to open the sheet music your team already shares in Elattoo. You sign in on Elattoo's own page and approve the connection there, so the app never sees your password — it receives only a limited, read-only key. That key lets the app list your teams and set lists and download score files and your own markings onto your device. It cannot upload, change, or delete anything in Elattoo, and it cannot show you another member's markings. The library it reads from is governed by the Elattoo Privacy Policy. If you never sign in, no Elattoo servers are involved in your use of the app.

What the App Does NOT Do

• It does not upload your files, annotations, or set lists to Elattoo. Signing in with your Elattoo account only lets the app download what your team already shares there.
• It does not sell, share, or transmit your files, annotations, or account information to any third party.
• It does not include advertising, analytics, or crash-reporting SDKs.
• It does not access contacts, location, camera, microphone, or any other data or device sensor unrelated to opening and organizing your sheet music files.

Google API Services — Limited Use Disclosure

Elattoo Score's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, the app uses Google Drive access only to let you browse and download your own files to your device at your request. Google user data is never transferred to others, never used for advertising, and never used to train AI or machine-learning models.

Third-Party Cloud Providers

If you connect a cloud storage account, your use of that service is governed by the provider's own terms and privacy policy, not this one. We do not control and are not responsible for how these providers handle your data: Google, Dropbox, Microsoft (OneDrive), Box.

This Website

• Hosting logs. Like most websites, our hosting provider may automatically record standard technical data (such as IP address, browser type, and pages requested) in server logs for security and operational purposes. We do not use this data to identify you.
• Fonts. This site loads fonts from Google Fonts, which means your browser sends a request (including your IP address) to Google's servers. See Google's privacy policy for how Google handles that data.
• No cookies or analytics. This site does not set tracking cookies and does not use analytics or advertising services.
• Email. If you contact us by email, we receive your email address and the contents of your message. We use them only to respond to you and retain them only as long as needed for that purpose.

Data Retention

Everything the app stores locally (your library, annotations, set lists, and cloud and Elattoo access tokens) lives on your device and remains there until you delete it in the app or uninstall the app; we retain none of it. The team library the app downloads from is stored on Elattoo's servers and retained as described in the Elattoo Privacy Policy.

Security

The app stores its data in your device's app-private storage, protected by your device's operating system security. Cloud connections use the providers' standard OAuth sign-in over encrypted (HTTPS) connections: you sign in on the provider's own page, and the app receives only an access token — it never collects or stores your account password. If you sign in with your Elattoo account, that connection is also encrypted (HTTPS), and shared content on Elattoo's servers is protected as described in the Elattoo Privacy Policy. That said, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security. Keeping your device itself secure (screen lock, OS updates) is the most important protection for data stored locally.

Your Privacy Rights

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Depending on where you live (for example the EU/EEA and UK under the GDPR, or California under the CCPA/CPRA), you may have rights to access, correct, delete, or export personal data, and to object to or restrict its processing. If you use the app without an Elattoo account, Elattoo holds no personal data about you, and these rights are exercised directly on your device: you can delete anything the app stores, and uninstalling the app deletes it all. If you sign in with your Elattoo account, that account and your team's library are handled — and your rights honored — as described in the Elattoo Privacy Policy. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use personal data for profiling or automated decision-making. For anything we do hold (such as an email you sent us), contact us at the address below and we will honor applicable requests. You may also lodge a complaint with the Office of the Privacy Commissioner of Canada or your local data protection authority.

International Users

App data is processed locally on your own device wherever you are. When you connect a cloud provider, your device communicates directly with that provider's servers, which may be located in other countries; that transfer is governed by the provider's own policies and your agreement with them. The team library the app downloads from is processed as described in the Elattoo Privacy Policy, including its section on international transfers.

Your Controls

• You can disconnect any cloud account at any time from within the app; this removes the locally stored access token.
• You can also revoke the app's access at any time from the cloud provider's own account/security settings (e.g. Google Account → Security → Third-party access).
• You can sign out of your Elattoo account at any time in the app, which revokes the app's read-only key. The scores in your team's library are added and removed in Elattoo itself, as described in the Elattoo Privacy Policy.
• Uninstalling the app removes all locally stored data, including your library, annotations, and any cloud or Elattoo connection tokens.
• If you use your device's own backup service (such as Android Backup or an iOS device backup), your operating system may include the app's data (your library and settings) in backups stored with your platform account. Those backups are yours, are governed by the platform's privacy policy, and can be managed or excluded in your device's backup settings. On Android, cloud connection tokens are excluded from these backups.

Children's Privacy

Elattoo Score is suitable for all ages. Used without an Elattoo account, the app collects no personal information and transmits nothing off your device, so it does not collect personal data from children (or anyone else) — and therefore complies with children's privacy laws such as COPPA in the United States and equivalent rules elsewhere by design. Signing in with an Elattoo account is subject to the age requirements in the Elattoo Privacy Policy: for children under 13 (or the higher minimum age required where you live), a parent or guardian must create and manage the account. Cloud account connections require signing in to a third-party provider, which children should only do with a parent or guardian's involvement, subject to that provider's own age requirements. If you believe a child has sent us personal information by email, contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time, for example if the app gains new features. If this policy changes, the "Last updated" date above will be revised, and material changes will be summarized here. If you use the app without an Elattoo account, we have no way to notify you directly, so please check this page periodically; where a material change affects signed-in users, we will notify you through your Elattoo account.

July 18, 2026: Updated to describe the optional Elattoo account sign-in for sharing scores and annotations with your team. Previously, the app operated entirely on-device with no Elattoo servers involved; that remains true when you use the app without signing in. Continued use of the app after a change takes effect constitutes acceptance of the revised policy.

Contact

Questions about this policy can be sent to privacy@elattoo.com.