Privacy

What Partbook is

A practice app for choirs. Accounts are invite-only: you are here because your choir invited you.

What we store

• Your account: your name, email address, voice part, and your notification and display preferences. If your choir's leader imported a member list that had a phone number in it, we store that number too, but nothing is ever sent to it: Partbook has no SMS and no phone sign-in today.
• Your choir's content: rehearsal tracks (audio, lyrics, scores), projects, announcements, and voice notes that your choir's leaders upload or record. A voice note can contain your voice if you were present when it was recorded; voice notes belong to the choir, and there is no field in a voice note that names or links to any account.
• Usage counters: aggregate, anonymous counts of feature use (for example, how many tracks were played on a given day). They contain no names, no account ids, no device ids, no IP addresses, and cannot be traced to you. There is no advertising and no third-party analytics.
• Operational logs: our servers log the route, status code, and duration of each request so we can see when something breaks. These lines carry no names, no ids, and no full URLs, and Cloudflare keeps them for at most 7 days.

Why we process it

Almost everything: because you asked us to, it is what makes the app work (in GDPR terms, performance of a contract). Operational logs and security measures: our legitimate interest in keeping the service running and abuse out. Nothing is processed for advertising, so there is nothing here that needs a consent banner.

Where it lives

Everything runs on Cloudflare. Our database and file storage are created under Cloudflare's EU jurisdiction, which restricts where the data may be stored as a guarantee, not a preference. Your data does not leave the EU at rest.

Requests themselves are processed on Cloudflare's worldwide network: the server code runs in the data center closest to wherever you are, which can be outside the EU. Voice-note transcription and the suggested note titles run on Cloudflare Workers AI, on GPU hardware somewhere on that same worldwide network. Transactional email goes out through Cloudflare's email service. Cloudflare, Inc. is a US company; its GDPR data processing addendum, which includes the EU standard contractual clauses, covers all of this.

Who else touches it

• Cloudflare: hosting, database, file storage, email delivery, and AI transcription. That is our one infrastructure provider.
• Apple and Google: only in their role distributing the mobile apps. We send them nothing about your Partbook account.
• Nobody else. We do not sell your data and we do not share it with anyone beyond the two above.

Who sees what

Members of your choir see your name and your voice part. Your choir's leaders manage its member list, and your choir decides what it uploads and records; we host it for them. We can access data when needed for support, safety, or to keep the service running, and when we open a member's view of the app to help with a problem, that access is written to an audit log we keep.

Signing in, cookies, email

Partbook is passwordless: we email you a sign-in link. Signing in stores a token on your device (in your browser's local storage, or the app's own storage), and it stays valid for 30 days of use.

On the web there is exactly one cookie. It contains the fixed text "1", nothing else: no identifier, no token, nothing about you. Its only job is to tell our server whether to answer partbook.app's front page with the marketing page or with the app, and it is deleted when you sign out. There are no tracking cookies and no third-party cookies, so there is still nothing here that needs a consent banner.

The complete list of email we send: your sign-in links, the invitation your choir sent you, and account-deletion confirmations. There is no marketing mail, and no code in Partbook that could send any.

How long we keep things

• Sign-in links: 15 minutes. Account-deletion links: 60 minutes.
• Sessions: 30 days, extended while you use the app.
• Your choir's content: for as long as your choir keeps it.
• Operational logs: at most 7 days, at Cloudflare.
• Usage counters: raw counters for 3 months, then only daily totals, which contain nothing personal to begin with.

Deleting your account

Go to partbook.app/delete-account, enter your email, and confirm through the link we send you. Immediately: your sign-in identities, memberships, sessions, and personal track library are deleted, and your email address is scrubbed everywhere we can find it. Two honest details about what remains:

• We keep one empty, nameless account row, because other records (like the support audit log) reference it. It says "Deleted Account" and points to nobody.
• The media files behind your personal library stop being reachable the moment you delete. A nightly cleanup job identifies such unreferenced files for removal, but it is currently in a verification period where it reports instead of deleting, so the bytes can sit in storage, unreachable, until that period ends. If you want them gone right away, write to hello@partbook.app and we will remove them by hand.

Content that already belongs to a choir stays with the choir: voice notes (which were never linked to your account) and published announcements, which keep the author name they were published with. If you are the only owner of a choir, transfer ownership first or write to hello@partbook.app.

No profiling

We make no automated decisions about you and build no profiles. The usage counters cannot even tell two people apart, so there is nothing to profile with.

Your rights

Under the GDPR you can ask for access, correction, erasure, a copy of your data, or object to processing: hello@partbook.app. You can also complain to your data protection authority (in Sweden: IMY, the Swedish Authority for Privacy Protection, imy.se).

Changes

We will update this page when something changes, and say so in the app when it matters.