Privacy notice
Effective 28 September 2026
1. Who is responsible
PianoNear is operated by Michaël Petrov, an independent individual operator not registered as a company, of La Fontonne, 06600 Antibes, France. For privacy questions or requests, contact support@pianonear.com.
2. Information used to provide lessons
- Camera, microphone and MIDI: the browser asks for the relevant permissions. Audio, video and MIDI are sent to the other participant using encrypted WebRTC. PianoNear does not provide server-side recording or store lesson content. Another participant may independently record or capture what they receive.
- Network information: signaling uses room identifiers, participant roles, connection descriptions and network candidates. Direct WebRTC can disclose your public network address to the other participant. When direct connectivity fails, coturn relays encrypted traffic and processes connection metadata. Encryption does not hide all network metadata from participants, hosting or relay operators.
- Room details: the optional session name, room code and timer state are held in server memory while the room exists. A disconnected host's room normally remains available for up to five minutes; ending the lesson removes it immediately. The session name can be included in an invitation URL, so anyone receiving the link can read it. Do not use confidential details in invitation names.
- Saved invitations and preferences: for signed-in users, the account database retains hosted room codes, session names, target minutes and creation/last-hosted timestamps so the host can reuse an invitation from another device. It also stores camera and MIDI device identifiers, microphone mute/audio processing, camera on/off, video layout, MIDI playback mode and keyboard visibility, zoom, position and octave preferences. These records remain until account deletion; ending a lesson or clearing browser storage does not remove them. Saved devices unavailable in the current browser fall back to defaults. Old browser invitations are imported only after verifying that they belong to the signed-in account.
- Sign-in: when you choose to sign in, Auth0 and the selected provider (currently Google) authenticate you. PianoNear stores a random account ID, the identity's issuer/subject, display name, email and verification status if supplied, and account timestamps. PianoNear does not receive your Google password or request access to your contacts, Drive files or calendar. Guest participants do not need an account.
- Usage accounting: SQLite contains daily aggregate counts of rooms, joins, resumes and paired signaling presence time, globally and per host account ID. Your account page shows your hosted-lesson totals, the last 30 days and paginated session history. Session history stores your account ID, an internal sequence ID, start/end/checkpoint timestamps, status and paired presence duration for each hosted session. History is retained until account deletion and is included in account access/deletion requests. The usage database does not contain room names/codes, IPs, MIDI or media. These counts are not unique-person analytics and do not prove a successful media connection.
- Optional device statistics: off until you explicitly enable optional analytics in the app (including for guests). While a lesson is connected, the app sends one initial report and reports changed configurations: number of active outgoing cameras (0, 1, 2 or 3+), status of the local MIDI input (unknown, unsupported, denied, no input or connected input) and whether a separate instrument-audio input is active. An available MIDI input may be virtual and does not mean notes were played. The app sends no device names/IDs, notes, account/lesson IDs or media. Reports are combined by UTC day and configuration in a separate SQLite database, retained for 30 days, accessible only through the password-protected admin dashboard. The server receives normal network request metadata in transit; these counts represent consenting participant connections, not unique people. The operator enables this collector separately; without it, reports are dropped.
- Operational logs: application, relay and hosting systems may process network addresses, timestamps and errors for operation and security. The exact retention configuration and hosting-provider retention must be confirmed before this policy is finalized; we do not promise a deletion period that has not been implemented.
3. Purposes and proposed legal bases
Providing the requested account and lesson service relies on Article 6(1)(b) GDPR; proportionate security, operational diagnostics and service accounting rely on legitimate interests under Article 6(1)(f). Any future statutory financial records will have their applicable legal-obligation basis and retention period specified before live payments. Browser device permission is a technical authorization, not blanket consent to unrelated processing.
There is no advertising or sale of personal data. No marketing consent is bundled
with sign-in. Optional page and interaction analytics uses Umami Cloud only after you select
Allow in the bottom analytics notice on the site or app, or turn on
Analytics in the app's lesson settings. Both collections share
one optional choice across pianonear.com and app.pianonear.com.
This processing relies on consent (Article 6(1)(a)). The script is not loaded before
consent. Do Not Track and Global Privacy Control disable analytics.
We send a page path from a fixed public-page list, the site hostname, a fixed PianoNear title and our analytics website ID. We exclude query strings, fragments, referrers, lesson names/codes, account identifiers and lesson content. With consent, fixed event names count public-site clicks to the app and, in the app, demo starts, lesson starts and settings opens. They contain no click destination or lesson data; a click does not prove a successful app visit or link individual visitors across origins. Account, authentication, payment and admin pages are excluded. No WebRTC/MIDI diagnostic events, session replay or performance tracking are sent to Umami. Umami receives network metadata including your IP and browser request headers; its processing can derive visitor/session statistics, browser/device information and approximate location. These are consented visits and actions, not a count of successful lessons or all visitors.
4. Cookies and storage on your device
| Storage | Purpose | Lifetime / control |
|---|---|---|
__Host-pianonear-session cookie on the app |
Essential authenticated session, HttpOnly/Secure/SameSite=Lax | Up to 7 days; revoked on local sign-out |
__Host-pianonear-login cookie |
Bind an OIDC login attempt to the initiating browser | Up to 10 minutes; consumed after callback |
piano-tutor.host-settings in localStorage |
Remember session name and timer defaults | Until cleared in the app/browser |
piano-tutor.host-sessions in localStorage |
Up to 12 saved invitations and secret host-resume tokens | Until forgotten/cleared or displaced by newer entries |
pianonear_analytics_choice cookie on pianonear.com and subdomains |
Optional Umami analytics and (in the app) lesson device statistics choice; no user ID; Secure/SameSite=Lax | Allow and refusal expire after 180 days or can be changed earlier |
| Browser HTTP cache and service worker | Load application assets | Managed by the browser; clear site data to remove |
The app has a Clear saved lessons control. It clears PianoNear's saved lesson settings and invitations in that browser; it does not delete your server account, end a live lesson, erase other participants' copies or revoke every previously issued host token. Full browser site-data removal also clears cached assets and cookies.
Auth0 and Google may set their own authentication cookies when you visit their login pages. Signing out of PianoNear revokes its local session, not necessarily your Google or Auth0 SSO session. Admin Basic Auth credentials may be cached by the browser; the admin panel does not create an analytics cookie.
Necessary authentication/session storage is used to provide the requested service. The analytics notice covers only optional analytics, not essential sign-in cookies. The necessity/exemption of every retained preference must be reviewed before finalization; non-essential tracking, if introduced, must wait for a separate valid choice.
Analytics consent is shared by pianonear.com and app.pianonear.com through a
first-party domain cookie; it is not synced with your account or another device.
Earlier origin-local choices are not migrated; choose again. Use Analytics
in the app room footer and Decline, or turn off Analytics in the lesson settings,
to stop new reports. Other tabs read the current choice before sending. Already dispatched requests may still be processed,
and withdrawal does not delete previously collected reports. Clearing site data
returns analytics to off. Lessons remain available when analytics is off or blocked.
Device statistics use the same analytics choice in the room footer and lesson settings; browser device permissions remain independent. Turning the setting off stops new reports and cancels pending device sends in this browser; reports already delivered may have been counted and cannot be removed individually from combined totals. Each app tab checks its local choice before sending. Clearing site data resets the choice to off. No report is sent for the demo or while waiting for a host.
5. Providers and other recipients
- The other lesson participant receives the media/MIDI and relevant connection information necessary for the lesson.
- netcup hosts the application, databases and coturn relay on the existing German VPS. The operator administers these services.
- Umami Cloud supplies optional page analytics (
cloud.umami.isandgateway.umami.is). See Umami's privacy policy. It does not receive your lesson content or PianoNear account identity. - Auth0 / Okta, using an EU tenant and
auth.pianonear.com, supplies authentication. Google is the currently configured social identity provider. - Google STUN is presently used for network discovery (
stun.l.google.com). - GitHub Pages (
smpldsnds.github.io) supplies piano samples when optional software piano playback is initialized. Such requests reveal network information to the sample host; they are not needed to browse the landing page. Software piano is the default remote-note output mode in a lesson and can be changed in the call controls. - Namecheap provides domain/DNS services. Hosting in Europe does not imply that every DNS, authentication or third-party operation takes place only in Europe.
- Paddle receives your account email when you request your first checkout to create a billing customer, and processes checkout/payment information. Paddle.js loads only when checkout is requested. Subscription management opens Paddle's hosted customer portal with a temporary authenticated link generated on request. PianoNear stores linked customer, transaction, subscription and price IDs, status, billing dates and scheduled cancellation details, not card information or portal tokens. Live billing is enabled; Paddle's privacy notice applies to its own payment processing.
Some providers may process data outside the EEA. Their own privacy and transfer terms apply to that processing; selecting an EU Auth0 tenant does not by itself mean every provider operation takes place in the EEA.
6. Retention
Live room state is ephemeral as described above. Browser-saved invitations/settings remain until cleared. Local account records remain until account deletion is processed. Login attempts expire after 10 minutes; local sessions after 7 days. Expired database entries are periodically removed while the service runs.
Aggregate daily usage rows are retained for all-time totals; the dashboard displays the latest 30 days. They are stored in a separate database; per-account rows are linked by account ID and must be included in account access/deletion requests. Local billing references and subscription snapshots remain associated with the account until deletion; webhook event IDs are retained for 90 days. Deleting a local account does not cancel a Paddle subscription or delete Paddle's records; the operator must handle cancellation and applicable financial-retention obligations when processing the request.
Auth0 and Paddle apply their own retention periods to data they process. Operational logs and backups are retained only as long as reasonably necessary for security, operation and legal obligations. A persistent database volume is not itself a backup.
Umami Cloud analytics is stored by the provider under the selected Cloud plan's retention terms, not in PianoNear's SQLite usage database. The operator must confirm the actual plan retention; the 180-day browser consent expiry does not delete analytics already held by Umami.
7. Your rights
Depending on the applicable conditions, you may request access, correction, deletion, restriction and portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, it may be withdrawn without affecting prior lawful processing. Requests may require proportionate identity verification. The usual GDPR response period is one month, subject to the permitted extensions and exceptions.
Send privacy requests to support@pianonear.com. Account data and Auth0-held identity data may require coordinated deletion; signing out or clearing browser storage does not perform that deletion.
You may lodge a complaint with the French CNIL or another competent data-protection authority.
8. Students and minors
Guest access does not require registration. Teachers/organizers should explain the service to their students and, where appropriate, parents or guardians. Do not assume that a teacher's consent substitutes for every student's rights.
We will update this notice when the service or its data processing changes.