Privacy policy

Who is responsible

The data controller is Burak Altıntaş, Döşemealtı, Antalya, Türkiye.

For anything about your personal data, write to info@notanica.com.

Not registered in VERBIS: the controller is exempt from the duty to register.

What we process

Only what the app needs in order to work. We receive it from you, from the app on your device and from the providers you sign in or pay with.

Account

Your e-mail address, how you sign in (an e-mail code), language, display name, settings and the date you joined.

Library

Photos and PDFs of sheet music you scan, files you import, the music read from them, your corrections, notes, bookmarks, folders, tags, practice plans, lesson progress and per-score settings. Audio you play or record stays on your device.

Practice history

Date, length, tempo, loops and measures of your practice sessions, for “continue where you left off” and your own progress.

Children’s profiles and student accounts

A name or nickname, an avatar, an age band (profile) or a birth year (student account), settings and practice history. A parent’s consent is recorded for a student account.

Subscription

The stores and RevenueCat handle purchases. We receive only your plan, whether a trial or a paid period is active, and when it ends. We never receive card or payment details.

Devices and security

A proof from Apple (App Attest) or Google (Play Integrity) that a request comes from a genuine copy of the app, the device key behind it, session records and, if you allow notifications, a push token with platform, app and system version, language and permission state. Our own logs keep only keyed hashes of IP addresses and install identifiers, never the values.

Error reports

When something fails, the app sends an error code, the screen, the app and system version and an install identifier that we store only as a keyed hash. The report holds no text, scores or names.

Usage counts

Only if you agree in the app. Each count carries a random event ID, the name of the event and its outcome, the time in UTC, a random session ID made each time the app runs, the platform, the app version and build, and a random install identifier. That identifier is a one-way hash of the app’s own install ID: it cannot be joined to the ID that other calls carry, and never to your account. Our edge adds a two-letter country code from the request, and we do not store the IP address. Nothing is sent from a student account or a child’s device. The counts go to our own server only, never to a third party. You can switch this off in Settings › Privacy › Usage data: turning it off deletes the queue on your phone and asks the server to delete the events already sent.

Messages to us

What you write under “Write to us”, an optional screenshot and, only with your consent each time, diagnostics (app version and build, platform and system version, device class, language, policy revision, error codes with the screen each came from). Replies go by e-mail to the address on your account.

Classes and teachers

A teacher’s class names, codes, assignments and notes to students. A teacher sees a student’s progress only as far as the student (for a minor, the parent) consents. Every view is recorded and consent can be withdrawn at any time.

Sharing and the shared library

A share is an offer: nothing reaches the recipient until they accept, and only the music itself is copied, never the scan, the original page, your notes or settings. A score reaches the shared library only if you offer it, work by work, and staff verify it.

Donated scans

Only if you choose to donate a scan: its cleaned pages, without photo details, copied to a separate store in the EU under a random number that does not name you. The only link to your account is the record of your consent. A person at Notanica may look at them to measure and improve music reading.

Copyright notices

The name, e-mail address, statement and evidence link a rights holder sends in a notice.

Requests about your data

Your e-mails to us, the request, and how it was verified and answered.

We use no advertising identifiers and no advertising SDKs, we do not sell personal data, and we do not collect your location or contacts.

If you follow a YouTube video with a score, you paste its link and we keep only the video ID and your tap times for that score, in your library. The video plays in YouTube’s own player, which loads from YouTube and Google. When it loads, YouTube may collect data such as your IP address and device details, under its own terms. Notanica does not capture, download or store sound or video from YouTube. This is not offered in child mode or in a student account.

Why, and on what legal basis

• To run the service you asked for: your account, scanning and reading music, syncing, lessons, classes and subscription status. Basis: performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• To keep the service safe: proving the app is genuine, limiting abuse and fraud, handling rights notices and reports, fixing errors, recording access by our staff. Basis: legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• To see which parts of the app are used, from the usage counts above, if you agree in the app. They carry no name and no account, and you can switch them off at any time. Basis: consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)).
• To meet legal duties and answer lawful requests of authorities. Basis: legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
• For what is optional: notifications, diagnostics, usage counts, sharing a student’s progress with a teacher, offering a score to the shared library, donating a scan to improve music reading, and a parent’s consent for a student account. Basis: consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)). You can withdraw consent at any time in the app or by e-mail; this does not affect what happened before.

No decision with legal or similarly significant effect is made about you by automated means.

Who receives data

These providers receive data so that the service works.

Cloudflare

Carries the traffic, stores your files in its EU region and hosts this website.

Google Cloud

Runs the Notanica server, in Belgium.

Neon

Holds the database, in Frankfurt, Germany.

Resend

Sends sign-in codes and notices by e-mail.

RevenueCat

Reports your subscription status.

Apple and Google

Sign-in, proof that the app is genuine, store billing and delivery of notifications.

Expo

Passes notifications on to Apple and Google, and answers the app’s check for updates (it sees your IP address, app version and platform).

YouTube (Google)

Plays a video you add next to a score, in its own embedded player. Your use of YouTube videos in the app is under the YouTube Terms of Service, and Google’s handling of data is described in the Google Privacy Policy.

A teacher receives data only as described above, with consent. Authorities receive data only when the law requires it. Personal data is never sold and never used for advertising.

Where data is kept, and transfers abroad

Stored data is kept in the European Union: files in Cloudflare’s EU storage, the server in Belgium, the database in Germany. Cloudflare’s network handles requests worldwide, and Apple, Google, RevenueCat, Resend, Expo and Cloudflare also work from outside Türkiye and the EU, including the United States.

Where data goes to a country without an adequacy decision, we rely on the safeguards the law provides: standard contractual clauses (for transfers from Türkiye, the standard contract of KVKK Article 9, which we notify to the Personal Data Protection Authority as the law requires) and certifications such as the EU–US Data Privacy Framework where a provider holds one.

How long we keep it

Account and library

Until you delete your account. A score you delete waits 30 days in the trash, unless you remove it for good at once.

Deleted items in sync

Only an identifier remains, for 90 days, so that your other devices can follow.

Practice history

24 months.

Scanned pages

The photos you scan and the page images the app shows beside your score are kept for 6 months from the scan, then deleted. The score itself stays in your library.

Donated scans

12 months at most, then deleted. They are deleted at once when you take a donation back (Settings › Privacy › Donated scans) or delete your account. The record that you withdrew holds only a keyed hash and the date.

Sign-in

A session ends after at most 90 days without use, or when you sign out. A sign-in code works for 30 minutes.

Library backups and data exports

7 days.

Messages to us

Screenshots and diagnostics 90 days; a closed conversation 12 months.

Error reports

30 days.

Copyright notices

An unconfirmed notice lapses after 48 hours; a closed one is deleted after one year.

Logs and records

Server logs up to 30 days. The record that an account was deleted holds only a keyed hash and the date, no personal data.

Teachers’ views of progress

The record of each view, 24 months.

Device keys

Deleted after 180 days without use.

E-mails we send

Sent messages stay in the outgoing queue for up to 7 days.

Staff access records

Who looked at which account and when, without the content. They stay after an account is deleted.

Provider backups

The database provider keeps backups for at most seven days; erased data leaves them when they expire.

Usage counts

Raw events 35 days, then only combined daily totals with no installation or account in them. Turning them off deletes what was already sent.

Your rights

Under KVKK Article 11 and GDPR Articles 15 to 22 you may: learn whether your data is processed and ask for information; get a copy; learn the purpose and whether it is used accordingly; know the recipients at home and abroad; ask for correction of incomplete or wrong data; ask for deletion; ask that recipients be told of corrections and deletions; restrict or object to processing; receive your data in a portable format; withdraw consent; object to a result against you reached only by automated analysis; and claim compensation for damage from unlawful processing.

In the app you can change your data, download your data as one file and your scores as a backup, and delete your account. By e-mail, write to info@notanica.com: we send a code to the address registered on the account (for a student account, to the parent) and act when you read it back. We ask for no identity document. We answer within 30 days, free of charge. Delete your account

You may complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) or to the supervisory authority of your country in the European Union.

Children

An account holder must be 18 or older. A minor uses a student account opened by a parent, who consents on the child’s behalf, sees the connected devices and teachers, and can export or delete the child’s data. A student account has no e-mail address and no sign-in of its own. Child profiles under an adult’s account are managed by that adult. We do not knowingly collect data from a child without a parent’s account. Donating a scan is only for an adult account: never from a student account and never in child mode. No usage counts are sent from a student account or a child’s device.

Security

Connections are encrypted. Access tokens are short-lived and renew with rotating tokens. Our staff use a protected admin site that needs a security key or passkey, and each access there is recorded. If a breach puts your rights at risk, we notify the Authority and the people concerned as the law requires.

This website

This website sets no cookies and uses no analytics or advertising trackers. Our hosting provider keeps technical request logs. The copyright notice form sends what you type to our server and nothing more.

The class screen (the page a teacher projects) sends the room code you type to our server to join the room and then keeps a live connection to it. It stores nothing in your browser; the code and your screen’s pass stay in the page’s memory and are gone when you close it.

Changes

We change this policy when the service changes. The date above shows the current version; important changes are also announced in the app.