Privacy Policy

Last updated: October 2026

Cesure ("we", "us") is committed to protecting your privacy. This policy explains what data we collect, why, and how we use it.

Data We Collect:

Account data: If you create an account, we store your email address and authentication credentials via Supabase (hosted in the EU).
Public profile: An account comes with a username and a display name, given to you the first time you sign in. Other signed-in users can find you by typing your exact username; the directory answers an exact match or nothing at all, and cannot be listed or browsed. Being findable is on by default, and the switch that turns it off is on the "Me" screen.
Friends and presence: If you send or accept a friend request, we store that link, who asked for it, and the accounts you have blocked. Your friends can see your practice streak (the number of days in a row you have played), whether you are playing right now and the room you are hosting, so they can join you.
Practice statistics: We store how long you played and edited, how many tracks, imports, exports and sessions you made, and one line per day of activity — the figures behind your streak and your activity calendar.
Subscription data: If you subscribe to Cesure Pro, we store the state of that subscription alongside your account — plan, status, renewal date, and the transaction identifier issued by the store — so your access can be granted on any device. Payment is processed by the App Store, Google Play, or Stripe; we never receive or store your card number or billing address.
Feedback: If you send us feedback, we store your message along with your app version, platform, language and the screen you sent it from — shown to you before sending. Your account id is attached — sending feedback requires being signed in. Kept as long as needed to act on it.
Crash reports: Anonymous crash and error reports are sent so we can fix what breaks. Who receives them depends on the platform: Firebase Crashlytics on Android and iOS, Sentry on the web. They are not subject to the analytics choice below, on any platform — keeping the app working is not measuring an audience. On the web, the report carries no IP address and no cookie, and names no user; it does carry the address of the page and of the one before it — a share link without its token — and the name of the browser.
Analytics: If you opt in, usage data (screen views, features used, device model, OS version) is collected via Firebase Analytics. We never attach your email address or your account identifier to it: our code gives the analytics SDK no user identity at all. Anonymous it is not, for all that — one and the same switch governs advertising storage and personalisation, the four Google consent signals moving together, and on the web the measurement is tied to an identifier of your browser, which our own server receives with a signup, as described below. On our website one thing is written before any choice: if you arrive from an advertising link, the click identifier carried by the address is stored in your browser as the page loads, and read again if you then create an account, so that the signup can be attributed to that click.
Performance: On Android and iOS, Firebase Performance Monitoring measures start-up time and the duration of network requests, so we can find what is slow.
Notifications: On Android and iOS, if you allow notifications, the token issued for your device by Firebase Cloud Messaging is stored with your account so we can reach that device. Signing out asks our server to forget it.
Music data: The tab you are working on is kept on your device, so that a reload or a crash does not lose it; a draft you never save is discarded after fourteen days. Saving into "My scores" is a different thing: it requires an account and stores the file on our servers, with a version history that keeps a full copy of it each time a save changes something. Deleting a score deletes its history with it.
Shared links: If you turn a score into a share link, anyone holding that link can open it without an account, and messaging apps that unfold the link display its title. The link is never indexed and cannot be guessed or listed, and the score's menu revokes it whenever you want.
Session files: When you share a file in a synced play session, it transits through our servers temporarily (deleted after 30 minutes) so the other participants can load it.
Audio to Tab: When you convert a recording into a tab, the audio is uploaded to our servers, analyzed there, then deleted as soon as the analysis ends, whether it succeeded or not. We keep no copy of it, and only the resulting tab comes back to you. We do count your conversions, in order to apply the free quota.
Voice chat: When you enable voice chat in a synced play session, the audio is encrypted and, whenever the two networks can be paired directly, flows straight between participants (peer-to-peer, WebRTC). To pair them, your device asks a public STUN server run by Google (stun.l.google.com) what its public address is, so that server sees your IP address. Some networks cannot be paired that way, and the stream then transits through our relay, which forwards it without being able to read it. Your audio is never recorded or stored on our servers. Your IP address is technically visible to the other participants of your room, whatever route the audio ends up taking: pairing a connection works by exchanging with them the addresses at which your device can be reached, and our relay changes the route the audio takes afterwards, not the addresses already sent. As with any call, another participant can record the session locally on their device, including a separate audio track per participant; recording is always announced to every room member (badge and notification).

Assistants (ChatGPT, Claude):

Linking: In ChatGPT or Claude, you can link your Cesure account to that assistant. You allow it on a Cesure page that says what the assistant will be able to do. We keep the link — which assistant, and since when — while it exists; once you unlink it, we keep a record of it — which assistant, when you linked and unlinked it — until your account is deleted. The "Me" screen lists your linked assistants under "Linked assistants", and unlinking one there cuts its access at once.
What a linked assistant receives: when you ask it to, it sees the list of your scores, reads one of them in full, saves a new score into "My scores", where it counts toward your quota, and saves its changes over one of your scores — the score's history keeps the version before. It also sees the tags of your scores, puts tags on scores, takes them off, creates tags and deletes tags no score carries. It cannot delete a score. What it reads leaves Cesure for its provider — OpenAI for ChatGPT (chatgpt.com), Anthropic for Claude (claude.ai, claude.com) — and is handled there under that provider's own privacy policy, not ours. Another app can also ask for this link: the Cesure page then warns you that it does not recognise it, and what it reads goes to whoever runs it, whom Cesure does not know.
Public tools: Without any account, an assistant can send Cesure a score to read, edit or re-finger, and get back a link that opens it in Cesure. That score is kept on our servers as a draft, named by a random identifier, for 14 days after the last time it is read or changed, then deleted; a draft opened while your account is linked to that assistant belongs to your account alone. The link names the draft, not the score, and opens it in Cesure with no account. To share out the room drafts take and to count calls per minute, Cesure tells callers apart without storing who they are: a draft opened without an account keeps a fingerprint (a SHA-256 hash) of who opened it — the anonymous identifier ChatGPT gives each of its users (openai/subject), or else the address the call came from, an IPv6 address counted by its /64 block — never the identifier or the address itself. Claude sends nothing that tells its users apart, so drafts opened from Claude without an account are counted together.

How We Use Your Data:

Account data is used solely to authenticate you and provide account-related features.
Your profile, your friends and your presence are used solely to let the people you chose find you and play with you.
Practice statistics are used to show you your own progress; your streak, computed from them, is also shown to your friends.
Subscription data is used solely to grant and verify your access to the paid features.
Feedback is used to fix what is broken and decide what to build next.
Crash reports and performance data are used to identify and fix what breaks or drags.
Analytics data is used to understand how the app is used and prioritize improvements.
The link with an assistant is used solely to let that assistant do, at your request, what you allowed when linking it.
We never sell your data to third parties.

Third-Party Services:

Supabase (supabase.com) — authentication, account storage, and the scores, profiles and statistics described above.
Firebase (firebase.google.com) — crash reporting, optional analytics, performance monitoring, and push notifications. On the web, the Firebase SDK is served from www.gstatic.com.
Sentry (sentry.io) — error reporting on the web only; its SDK is served from browser.sentry-cdn.com and loaded before the app starts.
Google, beyond Firebase, on three further counts. The public STUN server stun.l.google.com, which your device contacts when you turn voice chat on and which therefore sees your IP address. www.googletagmanager.com, which serves the Google Analytics tag on our website pages: the tag is loaded on every visit, and your analytics choice governs what it may store, not whether it loads — until you accept, storage is denied. And google-analytics.com, to which our own server reports one signup event per account created on the web, carrying the sign-in method used and, only if you accepted analytics, the analytics identifier of your browser and its session number — never your email address, and never your account identifier.
OVH (ovh.com) — the mail relay our server sends through. Confirming your address, resetting your password and the alerts about your account (your password changed, a verification method added or removed) are emails our own server composes and hands to that relay, which therefore receives your email address and what each message carries: the verification link of a signup or a reset, the notice of a change.
OpenAI (openai.com) and Anthropic (anthropic.com) — only if you link ChatGPT or Claude to your account: the scores that assistant lists, reads and saves at your request go through them, as described under Assistants above.
Apple App Store, Google Play, and Stripe (stripe.com) — subscription payment processing. Your payment details are handled by them and never reach us.

Data Retention:

Account data is retained as long as your account exists. The "Me" screen carries a button that deletes it, and that button can also refuse: when it refuses, nothing is deleted and the app says so. Deleting it stops the billing we control — a subscription taken on the web is cancelled with Stripe first, and the deletion fails rather than leaving you billed for an account that no longer exists; a subscription bought from the App Store or Google Play has to be cancelled from that store. Your account then disappears, and with it your scores, their version history, your profile, your friendships and your statistics.

Several things outlive that deletion, and we would rather list them than promise otherwise. A feedback report you sent stays with us, detached from your account: its message — up to 2000 characters of free text, which may well name a piece, a frustration or an address — along with the app version, platform, language and screen recorded with it. A username you gave up by renaming yourself stays in a quarantine list: nobody can take it for 30 days, nobody but us can read that list, it is detached from your account there too, and the entry only goes away when someone does take that name up again. If you signed up on the web, our server keeps one signup record for your account — the account identifier, where the signup came from and, if you had accepted analytics, your browser analytics identifiers and the advertising click identifier — which is how registrations are counted, and which the deletion does not reach. If you subscribed on the web, we cancel the subscription we bill and we never ask Stripe to delete the customer it created for you: that record, and whatever Stripe keeps under it, outlives your account. And the copies already sent to Firebase, Sentry and Google Analytics expire on their own schedule, not on ours: crash and analytics data is retained for up to 14 months per Firebase policy. Write to us at contact@cesure.app and we will erase what our own server still holds.

Your Rights:

You may request access to, correction of, or deletion of your personal data by contacting us at contact@cesure.app. Deleting the account itself does not need us: it is a button on the "Me" screen — and if that button refuses, write to us and we will do it.

Contact:

For any privacy-related questions, contact us at contact@cesure.app.

Loading the app…