Privacy notice

Student data, for teachers and parents

This section sums up, for students and the adults responsible for them, what the rest of this notice and the terms already say. It adds nothing to them.

• Age. iMeetStand is for people 13 and over. We do not collect a birth date and we do not verify age; an account found to belong to someone under 13 is closed. The terms ask a parent or guardian to agree to them on behalf of anyone under 18.
• Scores. A student’s scores live in a private library only their own signed-in devices can read.
• Asking about a passage. A question carries the passage the student boxed, and only that passage, never the rest of the score.
• What other people see. Other people see a student’s username, display name, instruments and meetie. Nobody sees their email address.
• Usage and diagnostics. These records never contain anything a student typed, drew, recorded or named, are never attached to their account, and are collected the same way whatever a person’s age. The two switches that govern them are in Settings.
• No advertising. We use no advertising network and no data broker, and we never sell or share any of this.
• Reports. A person reads every report, and the person reported is not told who reported them.
• Deleting an account. An account can be deleted from the profile at any time: everything in it is erased, and there is no undo. The one exception, a copyright legal hold, is described under Deleting your account.

What we collect, in total

Besides what your account needs to work, described further down, we collect usage and diagnostics from two places with two separate switches: the app on your device, and our server. Neither ever receives your sheet music, your questions, your answers, your messages, your annotations, your videos, or the words in any of them.

Your account

To run your account we keep your email address, your username, your display name, the instruments you play, your meetie’s colour and stage, the four quick facts you can choose to tell it, and the settings you change. If you sign in with Apple or Google, we receive the email address and the identifier they give us, and nothing else from them.

Other people see your username, your display name, your instruments and your meetie. Nobody sees your email address.

What is stored when you post, and for how long

Your scores live in a private library only your own signed-in devices can read. A question, with the passage you boxed, lives for twenty-four hours, or for up to 180 days while somebody is still using a kept answer, and is then deleted with its answers. A practice video, a comment and a like stay until you delete them. A message stays until either person in the conversation deletes their account. A post in a community room and a reaction to one are deleted after thirty days, and your practice trail after ninety. While you have a score open, your friends can see that it is open. We also keep a note of which score you opened and when, for seven days, so that your friends can see what you opened this week. Turning off Show my activity in Settings deletes those notes at once and stops new ones.

Each of these is shown only to the people the product shows it to: a question to holders of the same piece, a message to the person you sent it to, a video or a post to the audience you chose, and what you opened to the people you have accepted as friends, never to anyone you have blocked or who has blocked you. A score that is private to you is shown to them only as “a score”, without its name.

What a report sends, and who reads it

When you report something, we record which thing it was, the reason you chose, the words you added, the time, and that it was you who reported it. A person who administers the service reads it in a private queue, and to judge it they see the thing you reported - a preview of up to 280 characters of its text, including a private message if that is what you reported. The person you reported is not told who reported them, and there is no count of reports anywhere.

The person whose content is acted on is told what was decided and why, and how to appeal; you, as the reporter, are not told the outcome. No message text, and no other text of yours, is sent to any third party for moderation, and when the app refuses a word as you type, the refused text is never stored and nothing about the refusal is recorded against you.

Reports, and the record of what was done about them, are kept for as long as the service exists: they are its only record of what was said and what was done. They are not deleted when the account they were about is. If you delete your own account, the reports you made go with it.

Copyright notices are separate

Copyright notices and counter-notifications can contain legal contact information and signatures. They are kept in a separate private case system that ordinary administrators cannot read. Affected uploaders receive claimant-free status information. Read the copyright policy before submitting either form.

What changed in version 1.1

Version 1.0 of this notice said product analytics was not active and that we would ask before turning it on. If the app was already on your device, that still holds: the app asks, and nothing is sent before you say yes. On a device that first uses the app on a version that carries this notice, usage and diagnostics from the app are on unless you turn them off, except on a device set to a European time zone, where the app asks first. Error reports now go to the same provider under the same switch. We do not record your screen or your session, and the earlier text about screen replays is withdrawn: that was never switched on and has been removed from the app.

The three server counts described below have been running since 26 August 2026. Version 1.0 described them and said they were not yet active, which was not right, and this version corrects it. Until October 2026 one of those counts, a finished voice transcription, was recorded against a value derived from the account. It no longer is: all three are now plain counts that carry nothing about an account.

This notice was published before the collection from the app was switched on.

Usage and diagnostics from the app

The app sends our analytics provider, PostHog, a short record when certain things happen, so we can see which features are used and where people give up:

• that the app was opened, and which screen is showing, by a fixed name such as library or reader;
• each step of the introduction, and whether it finished;
• that a score import started, finished or failed, and whether it came from a file, IMSLP, the share sheet or a scan;
• that a score was opened, that marking up was started, that the tuner or metronome was opened, and that a practice session was logged;
• that a Reel was started, published or played;
• that a message, a boxed passage, an answer or a friend request was sent or answered.

Each record carries at most a few details, and every detail is one of a fixed set of choices, a yes or no, or a range: for example that an import came from the share sheet, that a score has between six and twenty pages, or that a practice session lasted between five and fifteen minutes. A record never contains anything you typed, drew, recorded or named. It also says whether it came from the website, the installed web app or the iPhone and iPad app, and which build of the app sent it.

Error reports. When the app hits an error it sends the kind of error, where in our own code it happened, and a short message from which web addresses, email addresses, identifiers, file names and quoted text have been removed. A crash of the iPhone or iPad app itself is not sent to us this way; Apple collects those under your device’s own Share With App Developers setting.

Loading speed. On the website and the installed web app only, the app also sends how long a screen took to appear and respond. The iPhone and iPad app does not.

There is no screen recording, no session replay, no heatmap, and no automatic capture of taps, clicks or typing. Every record is one of the kinds above, written by us, and checked against a fixed list before it leaves your device.

The switch, and where the app asks first

On a device that first uses iMeetStand on a version that carries this notice, this is on unless you turn it off. The switch is Share usage and diagnostics, in Settings under On this device. Turning it off stops it at once: nothing more is sent, anything not yet sent is dropped, and the identifier described below is removed from the device. The choice stays off through restarts, signing out and signing in as someone else.

If the app was already on your device, it asks first. The notice you installed it under said we would ask before turning this on, and we are keeping to that. On a device that had iMeetStand before this version, nothing is stored or sent until you answer, wherever you are, and nothing is sent unless you answer yes. The app knows it was there before by finding its own earlier data on the device: a saved sign-in, a setting, a score in its storage. If that data is gone, because the app was deleted and installed again, the browser’s site data was cleared, Safari removed it from the website after seven days without a visit, or your account was deleted, the device looks new to the app and starts as a new device does. This goes by the device, not the account: an older account signed in where the app has never run is on a new device. If the app cannot read its storage, it treats the device as one where it was, and asks; if it cannot store an answer at all, it asks nothing and sends nothing.

In Europe the app asks first. If your device’s clock is set to a European time zone, which covers the European Union, the European Economic Area, the United Kingdom and Switzerland, or to a time zone that does not say where you are, nothing is stored or sent until you answer, and nothing is sent unless you answer yes; answering not now stores only that answer, so you are not asked again. We decide this from the time zone on the device alone; we do not look up where you are.

This choice is stored on the device you make it on. Making it on your iPad does not make it on your phone.

The identifier, and what it is not

So that two records from the same device can be counted as one device, the analytics software creates a random identifier and keeps it in the app’s storage on that device. It is not your account, your email address, your username or your name, it is not derived from any of them, and we never attach any of them to it. We do not link it to your account, and signing out replaces it, so it does not follow one person to the next on a shared device.

This is pseudonymous, not anonymous. The identifier recognises a device over time, and under several privacy laws that makes it personal data. We are not calling it anonymous, because that would be a stronger promise than the data supports. It also means our counts are of browsers and devices, not of people.

We use it only to count usage and to tell one error on one device from the same error on many. It is never used to contact you, to build a profile of you, or for advertising, and it is never combined with data from another company.

What our server counts

Separately, our own server counts three things:

• A voice transcription finished, plus the audio format.
• A practice video was requested.
• An answer video was requested.

All three are recorded against nobody. Each is sent with the same fixed label, which is the same for every person and every request, so a count cannot be linked to you, to your account, or to another count. The video counts are of requests for a video, not of videos watched.

These are on unless you turn them off with Share product analytics for this account, in Settings under On our server, for your account. That switch applies to your whole account, on every device.

Two switches, and what each one does

The two switches are separate, and turning one off does not turn the other off.

Share usage and diagnostics governs what the app on that device sends. It has no effect on our server’s three counts.

Share product analytics for this account governs whether your account’s actions add to our server’s three counts. Turning it off takes effect with your very next action, on every device without you doing anything on them, because your account setting is checked on our server each time, not stored in your browser. It has no effect on what a device sends.

So if you want neither, turn both off. With only the device switch off, opening a practice video still adds one to a server count that names nobody.

If the account setting will not load, the app says so rather than guessing, and shows neither on nor off. While it is in that state our server counts nothing for your account: it checks the same setting before it counts, and when it cannot read the setting it records nothing.

How long this is kept, and what deletion can and cannot do

Usage records, error reports and the server counts are stored by PostHog in the United States for up to seven years. That is the period their plan sets; it has no shorter setting, and we cannot shorten it for one person.

Because nothing connects these records to your account or your email address, we cannot find or delete one person’s records on request. If you write to us with your email address, there is nothing we can look up with it, and we would rather say so here than promise a search we cannot run.

What you can do: turn Share usage and diagnostics off. That stops collection and removes the identifier from the device, after which the earlier records belong to an identifier that no longer exists anywhere. Turning either switch off does not delete records already sent. Deleting your account does not delete them either, because they were never attached to it.

What we can do: delete the whole analytics dataset, for everyone at once. We will do that if we stop using this provider.

What we never collect

In usage records, error reports and server counts: no sheet music, no PDF, and nothing about which edition you read from. No question text, answer ink, message, annotation, or note. No practice video or audio. No file names, titles, page numbers, or search terms. No name, username, email address or account identifier. No web address you visit, no referring page, and no location.

One thing we cannot remove: a record travels from your device to PostHog as an ordinary web request, and any web request arrives from a network address. The records themselves do not contain it, PostHog is set to discard it, and every record tells PostHog not to work out a location from it.

This is enforced in our code by a fixed list of permitted fields rather than by a list of forbidden ones, so a field we have not approved cannot reach our provider by being added later.

On your device

Your scores and PDFs live in the browser’s own file storage on your device, and the app’s settings, drafts, feature switches and the analytics choice live in local storage beside them. Signing in stores a session token the same way. While Share usage and diagnostics is on, the analytics identifier described above is kept there too; where the app asks first it is not there before you answer yes, and it is removed when you turn the switch off. We set no advertising cookies and no third-party cookies of any kind, and deleting your account clears what is stored on the device.

Voice input, and where your speech goes

When you dictate a message rather than typing it, your speech leaves your device. This is separate from analytics, it is not covered by either switch above, and it happens whenever you use the microphone.

Which company hears it depends on the device, and we do not control that choice:

• On iPad and in Safari, your device’s own speech recognition handles it, which sends the audio to Apple.
• In Chrome, the browser’s speech recognition sends the audio to Google.
• If neither works, we record a short clip and pass it through our server to Groq, a transcription provider, which returns the text.

In the third case our server is only a relay: it holds the audio in memory long enough to forward it, writes neither the audio nor the transcript to any log or database, and keeps no copy. In the first two cases the audio never touches our servers at all, because the browser talks to Apple or Google directly.

Nothing is captured before you start. Opening a composer, or the app, records nothing; the microphone opens when you tap it and closes when you stop. The transcript becomes ordinary text in the box, which you can edit or delete before sending, and which we then treat like anything else you typed.

We keep no recording of your voice, and none of this is analytics: no dictation audio, transcript, or word count is sent to PostHog.

Optional device notifications

If you turn on device alerts, we store an Apple notification address, a random installation identifier, and your time zone with your signed-in session. Apple receives a generic answer or reply alert and an opaque notification identifier. Your question, message text, score, and boxed passage are never included.

You can turn alerts off in notification settings. Registrations are removed on sign-out, account deletion, an invalid-address response, or after 90 days without a refresh. Pending alerts expire within 24 hours; delivery status records are deleted after seven days. Quiet hours, mutes, blocks, and your personal-news preference also control delivery.

Who receives your data, and where

These are the companies that receive any of your data, and what each one gets:

• Supabase stores your account, your library and everything you post, in the us-west-2 (Oregon) region of the United States.
• Fly.io runs our own server, in San Jose, United States.
• Vercel serves the web app.
• Apple delivers optional device notifications, handles Sign in with Apple, and your device’s own speech recognition sends dictation audio to Apple.
• Google handles Sign in with Google, and Chrome’s speech recognition sends dictation audio to Google. If you connect Google Drive - and only then - Google also receives the scores you choose to sync, through the narrow drive.file permission that reaches only files this app created, and they remain your own scores in your own Drive.
• Groq receives a short audio clip when neither on-device recognition works, relays back the text, and keeps nothing.
• Klipy receives your GIF search text and the request metadata any web request carries; the search runs at Klipy’s strictest content filter.
• IMSLP receives the public-domain score searches and downloads you ask for, proxied through our server.
• PostHog (PostHog, Inc., using PostHog Cloud’s US-hosted region) receives the usage records, error reports and server counts described above, and processes them for us and for no purpose of its own.

Nobody else. We use no advertising network and no data broker, we do not track you across other companies’ apps or websites, and we never sell or share any of this.

Errors in the app are reported to PostHog as described above. Errors on our own server are recorded in our own logs, with our hosting provider, and go no further.

Where this lives

Your account, your library and everything you post are stored with Supabase in the us-west-2 (Oregon) region of the United States. Our own server runs on Fly.io in San Jose, United States, and the web app is served by Vercel. Like any server, ours sees the network address each request comes from; we use it to rate-limit abuse, keep it only in memory while the server runs, and never send it to our analytics provider.

Age

iMeetStand is for people 13 and over, and the terms say so. We do not collect a birth date and we do not verify age; an account found to belong to someone under 13 is closed. Usage and diagnostics are collected the same way whatever a person’s age, which we do not know: under the random identifier described above, to understand and fix this app, and for nothing else.

Deleting your account

You can delete your account from your profile at any time: everything in it is erased server-side and on the device, and there is no undo. The usage records and counts described above were never attached to your account, so deleting it does not reach them. One exception: while a copyright legal hold covers your account, deletion is refused with a stated reason, and completes once the hold ends.

Reach us

Questions about any of this go to support@imeetstand.com.