ClassicalmusichubbPrivacy Policy
Last updated 30 October 2026
Classical Music Hub ("we", "us") is a web app at classicalmusichubb.app, and a phone app for iPhone and Android, CMH Studio, that turns piano recordings into videos showing every note, from a score or from the recording itself, with a community around it. This policy explains what personal data we collect, why, who helps us process it, and what your rights are. It is written to meet the UK GDPR and the EU GDPR.
1. Who is responsible
The data controller is Classical Music Hub, operated by Luca Mann, United Kingdom. Contact: luca@eventcage.com.
2. What we collect
| Data | Where it comes from | Why we use it |
|---|---|---|
| Email address, and a password we store only as a one-way hash | You, when you create an account | To sign you in, verify your address and let you reset your password |
| Name, email and profile picture from Google or Discord | Google or Discord, if you choose to sign in with them | To create and identify your account |
| Your name and email from Apple (or a private relay address, if you choose Hide My Email), and an Apple user ID | Apple, if you choose Sign in with Apple in the iPhone app | To create and identify your account |
| Files you upload: scores, recordings, videos, pictures, watermarks. In the phone app, a video you film with the camera and microphone, or choose from your Photos or gallery | You | To make your videos and sheet music. Uploads are stored so you can come back to your projects |
| Project settings and edits, finished videos and sheet music | You, and generated for you | To save your work and let you download it again |
| Profile details you add: name, picture, bio, location, instruments, favourite composers, what you are learning | You, on your member profile | To show your profile. If you make it public, anyone can see it |
| What you publish and share: Community projects, likes, catalogue scores you share | You | To show them to other users, with your name, as you chose |
| Your Discord account (ID, username, picture) if you link it, your points, level and activity in our Discord server and its games | You and our Discord server | To run points, the leaderboard, contests and games, and to pay out prizes |
| Billing details: name, email, country, the plan, renewal dates and a record of payments; the card itself stays with our payment provider. For a subscription bought in the phone app: what Apple (iPhone) or Google Play (Android) tells us about it (its transaction or purchase IDs, the plan, its dates and renewal status, the country and price, and any offer code used); Apple or Google takes the payment and we never see your payment details | You, our payment provider, and Apple or Google for purchases in the phone app | To take payments, send receipts and renewal notices, and keep accounting records |
| Partner details: your partner code, the accounts that used it, commissions; payout details are held by our payment provider | You, if you join the partner programme | To track referrals and pay commission |
| Messages you send us through the contact form | You | To answer you |
| Your choice about news emails | You, at sign-up or on your account page | To send, or not send, news and tips |
| Technical logs: IP address, browser or app version, request times, errors, and in the phone app how smoothly its preview plays (frame rate and timings, with your account ID) | Your browser or the app, automatically | Security, fixing faults, preventing abuse. Kept for up to 30 days |
| Which page is open in your browser, with a random browser ID | Your browser, while the site is open | To see how many people are on the site right now and help them. Held only in memory while you are on the site, not stored |
We do not use advertising trackers or analytics cookies, and we do not sell personal data.
Transcription. When the Service writes down the notes of a recording, it does so on our own servers. Your recordings are not sent to outside AI services and are not used to train anyone else's models.
The phone app. The app uses the camera and microphone only when you choose to film yourself playing, and your Photos or gallery only to open a video you pick or to save a video you made; it asks your permission first, and you can change it in your phone's settings. In Practice, if you turn on listening, the microphone hears the notes you play so the piece can wait for you: that sound is analysed on your phone only, never recorded, stored or sent to us. What you film or pick is uploaded to our servers to make your video, like an upload on the website. The app keeps a few settings on your phone (such as the last export options and whether you have seen the introduction). It contains no advertising or tracking, and it does not track you across other apps or websites.
Cookies and browser storage. We use a sign-in cookie that keeps you signed in. Your browser also keeps a few settings on your device (such as editor layout, sound and playback preferences, a partner code for up to 60 days after you follow a partner's link, and the random browser ID above). All of these are needed for features you use; none track you across other sites.
3. Legal bases
- Contract: everything needed to provide the service you signed up for, such as your account, uploads, videos, payments, points, contests and partner commissions.
- Legitimate interests: security logging, preventing abuse and fraud, improving the service, and sending news and tips to members (you can opt out at sign-up, on your account page and in every email), balanced against your rights.
- Consent: where you choose to sign in with Apple, Google or Discord, allow the phone app to use your camera, microphone, Photos or gallery, link your Discord account, make your profile public or publish a project, or anything optional we ask you about separately. You can withdraw consent at any time.
- Legal obligation: where we must keep or disclose records by law, such as payment records for tax.
4. Who processes data for us
We use a small number of carefully chosen service providers, each under a data-processing agreement and only for the purposes above:
- hosting and storage providers, for the website, our database and files, and the servers that process recordings and render videos;
- a payment provider, for payments, subscriptions and partner payouts;
- an email delivery provider, for account, payment and news emails;
- a bot-protection service, which checks that forms are filled in by people;
- Apple, for Sign in with Apple and for subscriptions bought in the iPhone app, which Apple sells and bills under its own terms and privacy policy;
- Google, for subscriptions bought in the Android app through Google Play, which Google sells and bills under its own terms and privacy policy;
- Google and Discord, when you choose to sign in with them or link Discord;
- in our Discord server only, an AI provider that powers our assistant bot: messages you send to it, and short notes it keeps about members it talks with, are processed by that provider.
Most of this processing takes place in the UK and EU. Some providers process data in other countries, including the United States. Where data leaves the UK or EU, we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or on adequacy decisions. You can ask us for details of the providers and safeguards.
We may also disclose data where the law requires it, or to protect our rights or users' safety.
5. How long we keep it
- Your account, projects, uploads, videos and profile: for as long as your account exists. Delete a project and its files are removed. You can delete your account yourself at any time: on the website on your account page, and in the phone app under Account, Delete account (steps: classicalmusichubb.app/delete-account). Your account, projects, uploads, videos, fonts and profile are deleted straight away, a subscription bought on the website is cancelled, and if you used Sign in with Apple the app’s access to your Apple ID is revoked; copies in our backups expire within 30 days. A subscription bought in the phone app is billed by Apple or Google, so cancel it there: on an iPhone in Settings, under your name, Subscriptions; on Android in the Play Store, under your profile, Payments and subscriptions, Subscriptions.
- Payment and commission records: as long as the law requires (in the UK, generally six years).
- Things you published or shared: removed when you delete them or your account, but copies other users made of a published project stay with them.
- Contact form messages: until we have answered and for up to 12 months after.
- Technical logs: up to 30 days. Emails we send: kept by our email provider for up to 30 days for delivery troubleshooting.
6. Your rights
You can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Email luca@eventcage.com and we will answer within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority.
7. Security
Connections are encrypted with HTTPS. Passwords are hashed and never stored in readable form. Files are stored in private storage that only your signed-in account and our processing servers can reach. Access to production systems is limited to the operator and protected by keys rather than passwords.
8. Children
The Service is for people aged 13 and over; under 18, with a parent's or guardian's permission. We do not knowingly collect data from children under 13. If you believe a child under 13 has given us data, contact us and we will delete it.
9. Changes
If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top tells you when it was last updated.