Legal

Privacy Policy

Last updated: March 2026 · We don't sell your data. Ever.

We collect only what's needed to run GTAI. No ads, no data brokers, no tracking pixels.

1. What We Collect

Data	Why	Stored
Username	Identify your account	Our database
Password (hashed)	Authenticate you securely	Our database (bcrypt, never readable)
Email address	Password reset only	Our database
Practice progress	Track your chord learning	Our database
Session history	Show your practice stats	Our database (last 50 sessions)
High score	Leaderboard	Our database

We do not collect IP addresses for tracking, device fingerprints, or browsing history.

2. How We Use It

To save and sync your practice progress across devices.
To send password reset emails when you request them.
To display your score on the leaderboard (username only).
To improve the app based on aggregate usage patterns.

We will never sell, rent, or share your personal data with advertisers or third-party data brokers.

3. Email

We only send emails when you explicitly request them (password reset, email verification). We do not send marketing emails unless you opt in. Transactional emails are sent via Resend.

4. Cookies

We use a single HttpOnly cookie to keep you logged in. This cookie:

Cannot be accessed by JavaScript — it's protected against XSS attacks.
Is only sent over HTTPS in production.
Expires after 30 days of inactivity.
Is deleted immediately when you sign out.

We do not use advertising cookies, analytics cookies, or third-party tracking cookies.

5. Third-Party Services

Render.com — hosts our backend server and database.
Netlify — hosts the frontend.
Resend — sends transactional emails.
OpenRouter / Meta Llama — powers the AI chat feature. Messages sent to the AI assistant are processed by these services.

Each of these services has their own privacy policy. We do not share your account data with them beyond what's necessary to operate the service.

6. Your Rights

Access: You can view all your stored data from your account settings.
Delete: You can permanently delete your account and all associated data at any time from Settings → Delete Account.
Correct: Contact us to correct any inaccurate data.
Export: Contact us to request an export of your data.

7. Data Retention

Your data is kept for as long as your account is active. When you delete your account, all data is permanently and immediately removed from our database. We keep no backups of deleted accounts.

8. Children

GTAI is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has created an account, contact us and we will delete it.

9. Changes

If we make significant changes to this policy, we will notify users by email and update the "Last updated" date above.

10. Contact

Privacy questions or data requests: support@gtai.app