Privacy Policy
Privacy Policy
Sostenuto Last updated: 15 March 2026
1. Introduction
This Privacy Policy explains how Valerio De Feo ("we", "us", "our") collects, uses, stores, and protects information when you use the Sostenuto iOS application ("the App").
We take your privacy seriously. We collect as little data as possible, store it securely, and never sell it to third parties.
2. Information We Collect
2.1 Information you provide
- Account email address — if you choose to create an account (anonymous use does not require this)
- Practice data — session logs, piece titles, composers, scores, reflections, BPM, and tags you enter
- Learning Metrics (Maestro Profiling) — To provide our Spaced Repetition (SRS) features, we evaluate your performance logs (accuracy, tempo, flow) to calculate memory retention scores, "ease factors," and automated practice intervals. This data creates a learning profile used exclusively to schedule your upcoming practice sessions.
- Instrument preference — set during onboarding
- Practice recordings — audio and video files you record during sessions (Pro users only, stored in encrypted cloud storage)
2.2 Information collected automatically
- Anonymous session ID — a randomly generated UUID assigned to your device on first launch (no personal information)
- Crash reports — via Sentry. These may include device model, OS version, app version, and a stack trace. No personally identifiable information is included.
- Analytics events — via PostHog, hosted in the EU. We track anonymised usage events (e.g. "app opened", "session logged", "paywall viewed") to understand how the App is used. Events are linked to your anonymous or authenticated user ID — not your name or email.
- Purchase status — processed by RevenueCat. We receive your subscription status (active/inactive) but not your payment details.
2.3 What we do NOT collect
- Location data
- Contacts
- Health data
- Biometric data
- Any data from your device's photo library unless you explicitly choose to export a recording there
3. How We Use Your Information
| Data | Purpose |
|---|---|
| Email address | Account authentication and password reset |
| Practice data | Core App functionality, cloud sync (Pro), teacher sharing |
| Crash reports | Identify and fix bugs |
| Analytics events | Improve the App, understand feature usage |
| Purchase status | Unlock Pro features |
| Recordings | Playback to you, cloud sync (Pro) |
4. Data Storage & Security
- Local storage: Practice data is stored on your device in an encrypted SQLite database.
- Cloud storage (Pro): Cloud-synced data is stored in Supabase, a GDPR-compliant cloud database provider (EU region). Data is encrypted at rest and in transit.
- Recordings: Audio/video recordings are stored in your private Supabase Storage bucket, accessible only to your account. We use Row-Level Security to enforce this at the database level.
- Crash reports: Stored in Sentry (EU region).
- Analytics: Stored in PostHog (EU region).
- Passwords: We never store passwords. Authentication is managed by Supabase Auth using industry-standard hashing.
5. AI Processing (Maestro AI)
When you send a query to Maestro AI, the message is sent to our Supabase Edge Function, which forwards it to OpenAI's API servers. OpenAI processes the message to generate a response.
- We do not store your Maestro AI conversation history on our servers (sessions are local-only or forgotten after the context window closes).
- OpenAI's data processing is governed by OpenAI's Privacy Policy.
- We do not use your AI conversations to train any models.
6. Teacher Sharing
When you generate a Teacher Share token, the analytics page at the resulting URL shows aggregate statistics derived from your practice data. This data is shared with anyone who has the link. You can revoke the link at any time. No personal information (name, email, recordings) is visible on the shared page.
7. Third-Party Services
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Supabase | Auth & database | User ID, email, practice data | supabase.com/privacy |
| RevenueCat | Subscriptions | Purchase timestamp, subscription status | revenuecat.com/privacy |
| Apple / Google | App Store Services | Financial transaction data (processed independently; we only receive status) | App Store Privacy Policies |
| OpenAI | Maestro AI | Your AI chat messages | openai.com/privacy |
| Sentry | Crash reporting | Device info, stack traces | sentry.io/privacy |
| PostHog | Analytics | Anonymised usage events | posthog.com/privacy |
8. Your Rights (GDPR)
If you are located in the European Union, you have the following rights:
- Access: Request a copy of the data we hold about you.
- Correction: Request correction of inaccurate data.
- Erasure: Request deletion of your account and associated data.
- Portability: Request your practice data in a machine-readable format (via the in-app Backup export feature).
- Objection: Object to processing based on legitimate interests.
- Withdrawal: Withdraw consent for analytics at any time by disabling analytics in the App settings.
To exercise any of these rights, contact us at [email protected].
9. Data Retention
| Data | Retention |
|---|---|
| Local practice data | Until you delete the app or use the in-app erase function |
| Cloud-synced data | Until you delete your account |
| Crash reports | 90 days (Sentry default) |
| Analytics events | 1 year (PostHog default) |
| Recordings | Until you delete them or delete your account |
10. Children's Privacy
Sostenuto is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe your child has provided us with personal information, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via the App or email. Continued use after changes constitutes acceptance of the updated policy.
12. Contact
For privacy-related questions or to exercise your rights:
Email: [email protected] App: Settings → Contact & Legal
We will respond within 30 days.