Privacy Policy

1. Who is the controller

The data controller is Musico Labs LTDA, CNPJ (Brazilian company number) [TODO: CNPJ], which runs Riffo.

For any privacy matter, including contacting our data protection officer, write to privacidade@getmusico.com.

2. What data we process

• Anonymous device account. On first launch the app creates an account with no email, only a random identifier, to store and sync your progress, together with its creation and update times.
• Email (optional). Only if you sign in with email to take your progress to other devices. We also store when you confirmed the email.
• Password (optional). We never store the password itself, only a salted hash (PBKDF2-SHA256).
• Session tokens. The server stores only a hash of each token. On the phone the token lives in the Keychain (iOS) or Keystore (Android); on the website, in an httpOnly cookie that page scripts cannot read.
• Email sign-in links. We store only a hash of the link token. Sign-in links expire after 15 minutes and sign-up confirmation links after 24 hours. Each works once.
• Game progress. XP, streak, active days, stars, tempo and play count per lick, review schedule, and settings such as latency offset and note display. Kept on the device and synced with the server.
• Licks you create in Jam. The notes and the title, only after you tap Save. Unsaved transcriptions stay in the device memory.
• IP address. Used to prevent abuse (in-memory attempt counters) and recorded in the hosting provider's technical logs.
• Local settings. Onboarding answers, tuner preferences and, on the website, trail progress. They stay on the device or browser.
• Sign in with Apple or Google (optional). We receive the account identifier and the email Apple or Google gives us.
• Notification token. If you allow notifications, we store the device token to send notices and practice reminders.
• Usage analytics. App events linked to your account identifier: screens and features used, lessons and exercises started and finished, accuracy, tempo, practice time, streak, onboarding and subscription steps, plus device model, OS and app version. They tell us whether lessons teach and where people get stuck. They never include audio, video, tabs or text you write. Turn them off in Settings > Usage analytics.
• Crash reports. When the app fails, we send the technical error record (where it happened, device model, OS and app version) so we can fix it.

Microphone and camera. Riffo listens to your guitar to recognise notes and chords, to tune and to write tabs. This audio is processed on the device and is never sent to us or to third parties. Tab Cam videos and tabs also stay on the device; they only leave it if you export or share them yourself.

We do not collect your name, phone number, location, contacts, photos, advertising identifiers or payment data.

3. Why we use it and legal bases

• Providing the service (account, sign-in, syncing progress and licks across devices, emailing sign-in links): performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Security and abuse prevention (attempt limits, technical logs): legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Improving Riffo and measuring whether lessons teach (usage analytics) and keeping the app stable (crash reports): legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)). You can object at any time by turning analytics off in Settings.
• Practice reminders (notifications): your consent, given in the system permission and revocable at any time.
• Legal obligations and requests from authorities when required: LGPD art. 7, II; GDPR art. 6(1)(c).

We do not use your data for advertising, we do not sell it and we do not share it with advertisers. Usage analytics are used only to improve Riffo.

4. Who we share it with

Only with providers that run Riffo's infrastructure on our behalf (processors), under contract and only for that purpose:

• Fly.io: hosts the Riffo API (São Paulo region). Processes requests, including your IP address.
• Neon: PostgreSQL database (AWS, São Paulo region). Stores accounts, progress and saved licks.
• Cloudflare: hosts the riffo.getmusico.com website and delivers it (CDN). Processes the IP address of website visitors.
• Resend: sends transactional email (sign-in and confirmation links). Receives your email address and the message content.
• Expo (EAS): builds the app and distributes releases and updates. The app does not send your usage data to Expo.
• RevenueCat: manages Riffo Pro subscriptions. Receives your Riffo account identifier and the purchase status reported by the store (no card data).
• PostHog: usage analytics (United States). Receives the events described above, linked to the account identifier.
• Google Firebase: crash reports (Crashlytics) and notification delivery (Cloud Messaging).
• Apple and Google (sign in with): only if you choose to sign in with one of those accounts.
• Apple App Store and Google Play: distribute the app and process payments under their own privacy policies.

We may also disclose data when a law or court order requires it.

5. International transfers

The API and database are in Brazil. Some processors (PostHog, Google Firebase, Resend, Cloudflare and Expo) may process data outside Brazil, for example in the United States. Those transfers follow the LGPD (art. 33) and, where applicable, the GDPR, relying on contractual clauses and equivalent safeguards offered by those providers.

6. How long we keep it

• Account, email, progress and saved licks: until you delete the account (or the lick). Deletion is immediate.
• Sessions: up to 60 days, or until you sign out, change your password or delete the account.
• Email links: 15 minutes (sign-in) or 24 hours (confirmation), or until first use.
• Attempt counters per IP and email: at most 1 hour.
• Hosting technical logs: short retention, as configured by each provider.
• Usage analytics and crash reports: for the retention period configured in PostHog and Firebase, only as long as needed for those purposes.
• Local data: stays on the device until you uninstall the app or clear the website data.

7. Your rights

Under the LGPD (art. 18) and, if you are in the European Union, the GDPR, you can: confirm whether we process your data and access it; correct it; ask for deletion; receive a portable copy; object to processing; withdraw consent; and ask who we share it with.

How:

• In the app: Settings (gear) > Account > Download my data or Delete account. On the website, through the Account button at the top.
• On the Delete account page.
• By email: privacidade@getmusico.com. We reply within 15 days.

You can also complain to Brazil's data protection authority (ANPD) or, in the European Union, to your local data protection authority.

8. Children

Riffo is not directed to children under 13 and does not ask for an email to play. If you are a parent or guardian and believe a child created an account with an email, write to us and we will delete it (LGPD art. 14).

9. Security

• All traffic uses HTTPS (TLS).
• Passwords and tokens are stored only as hashes.
• On the phone the session lives in the system Keychain/Keystore; on the website, in an httpOnly, Secure cookie.
• Rate limits against password guessing and email flooding.
• Each account can only access its own data.

No system is 100% secure. If an incident creates a relevant risk to you, we will notify you and the ANPD as the law requires.

10. Changes to this policy

If we change something important, we will tell you in the app or on the website before it takes effect. The date at the top shows the last update.