Privacy Policy

What Data the App Accesses

• PDF and image files you open or import. These are read from local storage on your device or, if you connect a cloud account, downloaded directly from that provider to your device. They are never uploaded anywhere by the app.
• Annotations, set lists, and library organization (e.g. bookmarks, ink markup, page order) you create in the app. This is stored only in the app's local database on your device.
• Cloud account connection, if you choose to add one. When you connect Google Drive, Dropbox, OneDrive, or Box, the app uses that provider's standard OAuth sign-in. The provider issues an access token (and, for Google, your account email address so the app can show which account is connected) directly to the app. This token is stored only on your device and is used only to make API calls to that provider on your behalf (e.g. listing and downloading your PDFs). It is never sent to Elattoo or any third party.

What the App Does NOT Do

• It does not have a backend server, so nothing you do in the app is transmitted to or stored by Elattoo.
• It does not sell, share, or transmit your files, annotations, or account information to any third party.
• It does not include advertising, analytics, or crash-reporting SDKs.
• It does not access contacts, location, camera, microphone, or any other data or device sensor unrelated to opening and organizing your sheet music files.

Google API Services — Limited Use Disclosure

Elattoo Score's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, the app uses Google Drive access only to let you browse and download your own files to your device at your request. Google user data is never transferred to others, never used for advertising, and never used to train AI or machine-learning models.

Third-Party Cloud Providers

If you connect a cloud storage account, your use of that service is governed by the provider's own terms and privacy policy, not this one. We do not control and are not responsible for how these providers handle your data: Google, Dropbox, Microsoft (OneDrive), Box.

This Website

• Hosting logs. Like most websites, our hosting provider may automatically record standard technical data (such as IP address, browser type, and pages requested) in server logs for security and operational purposes. We do not use this data to identify you.
• Fonts. This site loads fonts from Google Fonts, which means your browser sends a request (including your IP address) to Google's servers. See Google's privacy policy for how Google handles that data.
• No cookies or analytics. This site does not set tracking cookies and does not use analytics or advertising services.
• Email. If you contact us by email, we receive your email address and the contents of your message. We use them only to respond to you and retain them only as long as needed for that purpose.

Data Retention

Because we operate no servers for the app, we retain no app data at all. Everything the app stores (your library, annotations, set lists, and cloud access tokens) lives on your device and remains there until you delete it in the app or uninstall the app.

Security

The app stores its data in your device's app-private storage, protected by your device's operating system security. Cloud connections use the providers' standard OAuth sign-in over encrypted (HTTPS) connections: you sign in on the provider's own page, and the app receives only an access token — it never collects or stores your account password. That said, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security. Keeping your device itself secure (screen lock, OS updates) is the most important protection for data stored locally.

Your Privacy Rights

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Depending on where you live (for example the EU/EEA and UK under the GDPR, or California under the CCPA/CPRA), you may have rights to access, correct, delete, or export personal data, and to object to or restrict its processing. Because Elattoo holds no personal data about app users, these rights are exercised directly on your device: you can delete anything the app stores, and uninstalling the app deletes it all. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use personal data for profiling or automated decision-making. For anything we do hold (such as an email you sent us), contact us at the address below and we will honor applicable requests. You may also lodge a complaint with the Office of the Privacy Commissioner of Canada or your local data protection authority.

International Users

App data is processed locally on your own device wherever you are. When you connect a cloud provider, your device communicates directly with that provider's servers, which may be located in other countries; that transfer is governed by the provider's own policies and your agreement with them.

Your Controls

• You can disconnect any cloud account at any time from within the app; this removes the locally stored access token.
• You can also revoke the app's access at any time from the cloud provider's own account/security settings (e.g. Google Account → Security → Third-party access).
• Uninstalling the app removes all locally stored data, including your library, annotations, and any cloud connection tokens.
• If you use your device's own backup service (such as Android Backup or an iOS device backup), your operating system may include the app's data (your library and settings) in backups stored with your platform account. Those backups are yours, are governed by the platform's privacy policy, and can be managed or excluded in your device's backup settings. On Android, cloud connection tokens are excluded from these backups.

Children's Privacy

Elattoo Score is suitable for all ages. Because the app has no accounts, collects no personal information, and transmits nothing off your device, it does not collect personal data from children (or anyone else) — and therefore complies with children's privacy laws such as COPPA in the United States and equivalent rules elsewhere by design. Cloud account connections require signing in to a third-party provider, which children should only do with a parent or guardian's involvement, subject to that provider's own age requirements. If you believe a child has sent us personal information by email, contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time, for example if the app gains new features. If this policy changes, the "Last updated" date above will be revised, and material changes will be summarized here. Since the app does not collect contact information, we cannot notify you directly; please check this page periodically. Continued use of the app after a change takes effect constitutes acceptance of the revised policy.

Contact

Questions about this policy can be sent to privacy@elattoo.com.