Privacy Policy
Effective 1 November 2026. ChordPen collects as little as it can: your email address to sign you in, and the charts you write, so you can open them on any computer or iPad. No advertising, no third-party tracking, and nothing is sold. We count visits, the use of features and faults ourselves, without cookies.
1. Who is responsible
Moshe Tsarfati, a sole proprietor registered in Israel (business number 313441818), 11 Nassie St, Givat Shmuel 5402151, Israel, is responsible for your information as its controller. Write to us at [email protected] about anything in this policy.
2. What we collect, why, and on what basis
| What | Why | Legal basis (in the EU and the UK) |
|---|---|---|
| Your email address, and the one-time codes we send it | To create your account and sign you in | Performing our contract with you |
| Your charts, recovery drafts, Live Sets and settings, and the link to a YouTube video you attach to a chart | To keep your library in your account and bring it to every device you sign in on | Performing our contract with you |
| Your plan, and what Paddle tells us about your purchase: a customer number, the plan, its status and its dates - never your card details | To give you Pro and show you your plan | Performing our contract with you |
| What you write in the feedback form in Settings, with your email address and account number | To answer you and improve ChordPen. It reaches us as an email and is not stored in your account | Our legitimate interest in supporting ChordPen |
| The version of these terms you agreed to, and when | To be able to show that you agreed | Our legitimate interest in keeping a record of the agreement |
| How you came to ChordPen and use it: the site or link you first came from, your country, device, browser and language, and which features you use and when, including the steps towards a purchase. Your country is read from your connection by Cloudflare, and we do not keep your IP address for this. We never read your charts for it | To see what works, what to build next and where to tell musicians about ChordPen | Our legitimate interest in improving ChordPen and growing it |
| Reports of faults: what failed, on which screen, in which version and browser, with no account attached | To find and fix what breaks | Our legitimate interest in keeping ChordPen working |
| Totals of visits to this website, with where they came from and their country, device, browser and language, and no one identified | To see whether anyone comes, and from where | Our legitimate interest in growing ChordPen |
| Technical records our server provider keeps: IP address, browser, times of requests | To keep ChordPen secure and working, and to stop abuse | Our legitimate interest in security |
| What you write to us | To answer you | Our legitimate interest, or our contract with you |
Giving your email address is voluntary, but without it we cannot sign you in, so ChordPen cannot be used. Everything else is optional: it exists only if you write it.
Attached audio files never reach us. An audio file you add stays in your browser on your own device.
3. What stays on your device
ChordPen keeps these in your browser's own storage, because it cannot work without them: a working copy of your library (so it works without a connection), the audio files you attach, your sign-in session, and small conveniences such as where you last placed the YouTube window. There are no advertising or analytics cookies, and nothing is stored on your device to measure anything, so there is nothing to consent to. Signing out removes your library from the device; clearing your browser's data removes everything, recordings included.
4. YouTube
ChordPen uses YouTube API Services. When a chart with a YouTube video opens, YouTube's player, provided by Google, loads in ChordPen in its privacy-enhanced mode, and Google receives information such as your IP address and may store information on your device, as its own Privacy Policy describes. The player may show content and advertisements from YouTube. ChordPen keeps only the video's link with your chart. See also the YouTube Terms of Service.
5. Who receives your information
- Supabase hosts our server and database, where your account and library are stored, in the European Union (Frankfurt, Germany). It acts on our instructions.
- Resend, Inc. (United States) delivers the emails that carry your sign-in codes, and what you send through the feedback form. It acts on our instructions.
- Cloudflare hosts this website and, when you ask for a sign-in code, checks that a person is asking. It receives your IP address and technical details about your browser and device.
- Paddle (Paddle.com Market Limited and its group) sells Pro as our reseller and merchant of record. It receives your name, email address, country and payment details when you buy, and handles them as an independent controller under its own privacy notice.
- Google, when you play a YouTube video (section 4).
- Authorities or advisers, only when the law requires it or to protect our rights.
We never sell your information, and we never use it for advertising.
6. Where your information goes
Your account and library are stored in the European Union (Frankfurt, Germany). ChordPen is run from Israel, which the European Commission recognises as protecting personal data adequately. Some of our providers may handle information in other countries, such as the United States; where they do, they are bound by the European Commission's standard contractual clauses or an equivalent safeguard, and by written undertakings that meet Israel's rules on transfers abroad. You may ask us for a copy of these safeguards.
7. How long we keep it
- Your account and library: for as long as you keep your account. When you delete it, it is removed from our database at once and from our backups within 30 days.
- The record of your agreement to these terms: for as long as your account exists, and afterwards only as long as we may need it to answer a claim.
- Technical records: only as long as they are needed to keep ChordPen secure and working.
- How you came to ChordPen and use it: for as long as you keep your account; it leaves with your account. Reports of faults: 90 days. Totals of visits name no one and are kept.
- Purchase records: Paddle keeps them for as long as tax law requires.
8. Your rights
You may ask to see the information we hold about you, to have it corrected or deleted, to receive it in a portable form, to restrict how we use it, and to object to our use of it based on legitimate interests. Much of this you can do yourself: your charts are in front of you, Settings exports a full backup, and Account deletes your account. For anything else, write to [email protected]; we answer within one month and free of charge.
You may also complain to a data protection authority: in Israel, the Privacy Protection Authority; in the European Union, the authority of the country where you live; in the United Kingdom, the Information Commissioner's Office. We would be glad to hear from you first.
9. Children
ChordPen is not for children under 13. If we learn that a child under 13 has an account, we delete it. A parent who believes this has happened can write to us.
10. Keeping it safe
Information travels encrypted. Each person's library is separated from everyone else's by the database itself, not only by the application. Access to our systems is limited and protected, and we keep a record of security incidents. No system is perfectly secure; if a breach puts you at risk, we will tell you and the authorities as the law requires.
11. Emails from us
We send only the emails the service needs: your sign-in codes and important notices about your account or these terms. Paddle sends your receipts and payment notices. We will not send you news or offers unless you ask to receive them, and you can stop them at any time.
12. Automated decisions
We make no decisions about you by automated means alone. What we record of how you use ChordPen serves only to improve it and to see what brings musicians to it, not to treat you differently.
13. Changes to this policy
If we change this policy in a way that matters, we will tell you before the change applies, by email or in ChordPen. The date at the top shows when it last changed.