FretGirl 隐私政策
版本：privacy-beta-1 生效日期：2026-10-26
这份政策说明 FretGirl（中文名"看见指板"）收集哪些个人信息、为什么收集、存在哪里、保存多久，以及你可以怎样查看、导出和删除它们。
我们的原则很简单：只收集提供服务需要的信息；不卖你的信息；不做广告追踪；不用浏览器指纹。
1. 谁负责处理你的信息
FretGirl 由 桐开（成都）科技有限公司（以下称"我们"）运营，注册地址：四川省成都市武侯区郭家桥北街76号5层560室。我们是你个人信息的处理者（在欧盟、英国等地的法律中称为"数据控制者"）。
- 隐私问题联系邮箱：support@fretgirl.app
- 个人信息保护负责人：张文嘉（Zhang Wenjia），support@fretgirl.app
2. 不登录时
不登录也能使用 FretGirl。 不登录时，你在 FretGirl 里保存的东西（收藏、和弦进行、草稿、导入的曲谱、头像照片、各种设置）只保存在你当前的浏览器里，不会发送给我们。
不登录时，我们和我们的服务商仍然会处理两类请求：
- 网站托管服务必然要处理的网络请求（见第 5 节）；
- 应用打开后读取一次站内公告的请求，这个请求不带任何账号信息。
处理这些请求时，服务器会看到你的 IP 地址。我们自己不保存 IP，服务商（Supabase、Cloudflare）的系统日志可能会短时间保留。在 fretgirl.cn 上，以及判断出你在中国大陆或判断不出你在哪里时，你勾选跨境同意或登录之前，应用不会读取公告。
如果你不登录就提交反馈，我们会收到你在反馈里填写的内容（见第 3 节）。
3. 我们收集哪些信息，为什么
| 类别 | 具体内容 | 为什么需要 | 处理依据 |
|---|
| 账号信息 | 你的邮箱；账号创建时间和最近登录时间。用 Google 登录时，Google 会提供你的 Google 账号编号和邮箱，还可能提供你 Google 账号的显示名称和头像链接，我们的登录服务会把这些和登录记录一起保存；我们不使用、也不把名字和头像放进你的资料 | 让你登录，并在设备之间识别你 | 为订立、履行与你的合同所必需 |
| 登录安全记录 | 登录服务自动记录的安全日志，包括登录时的 IP 地址 | 防止账号被盗用和滥用 | 为履行合同所必需（保障账号安全） |
| 同步的内容 | 只有这 6 类：按法收藏、和弦进行收藏、你自己写的和弦进行、草稿、Jam 收藏、个人资料（只同步显示名和所选的预设头像；你自己选的头像照片只保存在这台设备上，不上传） | 在你的设备之间同步 | 为履行合同所必需 |
| 伴奏评价 | 登录后你对 Jam 伴奏点的"赞"或"踩"：账号、伴奏编号、赞或踩、评价和修改的时间。你随时可以修改或撤回。每个账号最多保存 2000 条 | 改进伴奏曲库：团队只看每首伴奏的汇总数字，其他用户看不到你的评价，也看不到汇总数字 | 为向你提供评价功能所必需（你主动评价） |
| 会员、试用和购买记录 | 公测期间所有人都可以免费使用 Pro，不会产生这些记录。 开始收费以后：会员状态和有效期；Paddle 提供的客户编号、订阅编号和订单编号；锁定年费资格；试用的开始和结束时间；给你发提醒邮件时使用的语言 | 判断你能不能使用 Pro，处理退款和客服问题 | 为履行合同所必需 |
| 防止重复领取试用 | 开始收费、你领取试用时才会产生：三个经过加盐处理的哈希值，分别来自设备上随机生成的标记、规范化后的邮箱地址、IP 地址。我们不保存原始的标记、邮箱和 IP。这些哈希值不和账号关联，删除账号后仍按第 7 节的期限保留，否则删除账号再注册就能再领一次试用 | 执行"每个账号、每台设备只能试用一次"的规则 | 为订立、履行合同所必需（试用规则） |
| 反馈 | 你选择的反馈类型和填写的文字；你自愿填写的回复邮箱。你勾选"附带诊断信息"时，还包括应用版本、浏览器信息、语言、窗口尺寸、图形（WebGL）信息和最近一次报错的文字。提交前，表单会显示将要发送的内容 | 处理你的问题，改进 FretGirl | 你的同意（你主动提交） |
| 防滥用限流 | IP 地址经过加盐处理后的哈希值 | 防止反馈和登录接口被滥用 | 为履行合同所必需（保障服务安全） |
| 邮件 | 收件邮箱和邮件内容 | 发送登录验证码和客服回复；开始收费以后，还有续费和到期提醒 | 为履行合同所必需 |
上表的处理依据按中国《个人信息保护法》第 13 条写。对适用欧盟或英国法律的用户，登录安全记录、伴奏评价、防止重复领取试用和防滥用限流的依据，还包括我们在保障安全、防止滥用和改进服务方面的正当利益。
我们不要求实名，也不收集手机号、生日、精确位置、通讯录、麦克风录音、银行卡信息、广告标识和浏览器指纹。我们不做行为追踪或使用分析，也不做自动错误上报。
我们不读你的个人内容来做分析。 只有在你联系客服、需要我们查看时，我们才会查看与你的问题有关的数据。为了运行服务，我们可能会看匿名的汇总数据，例如账号数量、存储用量，以及每首伴奏的评价汇总（见上表）。
我们不会发送营销邮件。
Google 用户数据
这一节专门说明我们怎样使用从 Google 收到的信息。
- 收到什么：只有你选择用 Google 登录时，我们才会从 Google 收到信息：你的 Google 账号编号和邮箱，可能还有你 Google 账号的显示名称和头像链接。我们不申请其他权限，不读取你的 Gmail、通讯录、云端硬盘或其他 Google 数据。
- 怎么用：只用于创建你的 FretGirl 账号、让你登录、在不同设备上识别你的账号，以及在你联系我们时回复你。
- 不做什么：不用于广告，不出售，不用来训练 AI 或机器学习模型，也不用于和提供登录功能无关的任何用途。
- 和谁共享：只给运行服务所必需的服务商：Supabase（存储账号、提供登录服务），以及我们给你发邮件时用的 Resend。不与其他任何人共享，除非法律要求。
- 保存和删除：这些信息和你的账号一起保存。你删除账号时，按第 7 节删除。你也可以随时在 Google 账号设置里撤销对 FretGirl 的授权（https://myaccount.google.com/permissions）。撤销授权以后，你就不能再用 Google 登录，但不会删除你在 FretGirl 的账号；要删除账号，请在应用里操作。
FretGirl's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
（上面这句是 Google 要求的原文声明，中文意思是：FretGirl 对从 Google API 收到的信息的使用和传输，将遵守 Google API 服务用户数据政策，包括其中的"有限使用"要求。）
4. 付款信息（开始收费以后）
公测期间不收费。开始收费以后：
FretGirl 的订单由 Paddle.com 作为 Merchant of Record（记录商户）处理。 你购买 Pro 时填写的姓名、邮箱、账单地址和付款信息，由 Paddle 直接收集和处理，Paddle 是这些信息的独立处理者（数据控制者）。我们拿不到你的银行卡号或其他完整的付款信息。 Paddle 只会告诉我们完成服务所需的信息，例如订单是否付款成功、订阅状态和订单编号。
Paddle 如何处理你的信息，见 Paddle 的隐私政策：https://www.paddle.com/legal/privacy
5. 我们和谁共享信息
我们只把信息提供给帮我们运行 FretGirl 的服务商，并要求它们只按我们的指示处理：
| 接收方 | 做什么 | 处理哪些信息 | 所在地 |
|---|
| Supabase, Inc. | 数据库、登录、服务端功能、站内公告 | 第 3 节中存储在服务器上的信息；请求中的 IP 地址 | 服务器位于新加坡 |
| Cloudflare, Inc. | 网站托管和全球加速 | 访问网站时的网络请求信息，包括 IP 地址 | 全球边缘节点 |
| Resend, Inc. | 发送邮件 | 收件邮箱、邮件内容 | 美国 |
| Google LLC | 打开登录时，以及你把鼠标移到账号按钮上时（为了让按钮更快出现），浏览器会从 Google 加载登录按钮。在中国大陆不显示 Google 登录，也不会加载 | 加载按钮时，Google 会收到你的 IP 地址和浏览器信息。只有你选择用 Google 登录时，我们才会收到第 3 节"账号信息"里列出的内容 | 美国及其服务所在地 |
| Paddle（Paddle.com Market Limited 及其关联公司），开始收费以后 | 结账和收款（独立处理者，见第 4 节） | 订单相关信息 | 英国及其服务所在地 |
此外，在法律要求或为了保护我们和用户的合法权益时，我们可能向主管机关或我们聘请的专业顾问（例如律师）提供必要的信息。
我们不出售你的个人信息，也不把它用于广告。
6. 信息存放在境外
我们的公司在中国大陆，但存储服务器位于新加坡，网站通过 Cloudflare 的全球网络提供。
- 即使不登录，你访问 fretgirl.app 时，网页本身和站内公告也是由中国大陆以外的服务器处理的（见第 2 节）。
- 如果你在中国大陆使用 FretGirl 并登录，你的账号信息（包括伴奏评价等与账号相关的记录）和同步内容会传输到中国大陆以外存储和处理。
境外接收方：
- 你在中国大陆登录时（通过 fretgirl.cn，或者通过网络判断你在中国大陆），我们会单独征求你对跨境传输的同意。你不同意的，仍然可以不登录使用 FretGirl，数据只保存在你的浏览器里。
- 你可以按第 8 节的方式，向我们行使你对境外处理的信息的各项权利。
如果你在欧盟、欧洲经济区、瑞士或英国，你的信息会被传输到这些地区以外（包括中国、新加坡和美国）。我们依靠服务商数据处理协议中的标准合同条款等法律认可的保护措施。
7. 保存多久
| 信息 | 保存期限 |
|---|
| 账号信息、同步内容、伴奏评价 | 直到你删除对应的记录（或撤回评价）或删除账号 |
| 登录安全记录 | 不超过 90 天 |
| 会员、试用和购买记录（开始收费以后） | 直到你删除账号 |
| 防止重复试用的哈希值（设备标记、邮箱，开始收费以后） | 领取后 1 年，删除账号后也保留到期满 |
| 防止重复试用的哈希值（IP，开始收费以后） | 30 天 |
| Paddle 通知记录（订单编号、事件类型、时间；不含卡信息和邮箱；开始收费以后） | 2 年 |
| 反馈 | 2 年；你删除账号时，反馈中的邮箱会被删除 |
| 防滥用限流的 IP 哈希 | 24 小时 |
删除账号后，我们会在 30 天内删除你在我们服务器上的数据，包括备份中的数据。 以下几项例外：
| 数据 | 为什么保留 | 保留多久 |
|---|
| 防止重复领取试用的哈希值（设备标记、邮箱；只在你领取过试用时才有） | 防止删除账号再注册来反复领取试用。哈希值不和账号关联，也不能还原出你的邮箱 | 领取后 1 年 |
| 防止重复领取试用的哈希值（IP） | 同上 | 30 天 |
| 付款通知记录（订单编号、订阅编号、事件类型、时间；不含卡信息和邮箱；只在你付过款时才有） | 账务核对和履行法律义务。和你账号的关联会在 30 天内去掉 | 2 年 |
| 反馈内容（去掉回复邮箱和账号关联以后的文字和诊断信息） | 保留客服处理的记录 | 提交后 2 年 |
| 登录安全记录 | 账号安全 | 不超过 90 天 |
| 防滥用限流的 IP 哈希 | 服务安全 | 24 小时 |
Paddle 作为卖家，会按照它自己的法律义务保存交易记录。
8. 你的权利
你可以：
- 查看和导出：在应用的账号模块里点"导出我的数据"，下载你的同步内容和设置。保存在服务器上的其他记录（例如同意记录、反馈），可以发邮件给我们索取副本。
- 更正：在应用里直接修改你的显示名和头像。
- 删除：在应用的账号模块里删除账号。删除前需要再确认一次身份。开始收费以后，如果你还有正在自动续费的订阅，应用会先提示你取消。删除后，我们会清除你的账号、同步内容、伴奏评价、会员和试用记录，以及反馈中的邮箱；为防止重复领取试用而保存的哈希值不和账号关联，会按第 7 节的期限保留。你这台设备上属于该账号的数据也会被清除，但你不登录时在本机保存的数据不受影响。
- 撤回同意：例如撤回对跨境传输的同意，请发邮件给我们。撤回后我们会停止相应处理（对跨境传输来说，就是删除你在服务器上的账号数据），但不影响撤回前已经进行的处理。
- 其他权利：限制或反对处理、获取你的数据副本、注销账号，以及法律赋予你的其他权利。
通过 support@fretgirl.app 联系我们行使上述权利。我们会在 15 个工作日内答复，最长不超过 1 个月。
如果你对我们的处理有异议，可以向你所在地的个人信息保护监管机构投诉。在欧盟、欧洲经济区和英国，你可以向当地的数据保护机构投诉。
加州居民：我们不出售也不"分享"（用于跨情境行为广告）你的个人信息。
9. 浏览器本地存储
FretGirl 使用浏览器的本地存储（localStorage 和 IndexedDB），只用于让应用正常工作：
- 你的设置，例如语言、外观、音色；
- 不登录时你保存的内容，以及导入的曲谱；
- 你自己选的头像照片（只保存在这台设备上，不上传）；
- 登录状态；
- 最近一次的会员状态，让你断网时也能继续使用 Pro，最长 7 天；
- 开始收费以后，用来防止重复领取试用的随机标记；
- 没有发送成功的反馈，等下次联网时再发送；
- 你读过哪些站内公告（只记公告编号，不上传）。
我们不使用 Cookie 或本地存储来追踪你或投放广告。
10. 未成年人
你需要年满 14 周岁才能自己注册账号。未满 14 周岁的，请在父母或其他监护人同意并陪同下使用。如果我们发现在没有监护人同意的情况下收集了未满 14 周岁儿童的信息，会尽快删除。监护人可以通过 support@fretgirl.app 联系我们。
11. 安全
- 所有传输都使用 HTTPS 加密。
- 每个账号只能读取和修改自己的数据，这一点由数据库的访问规则强制保证。
- 网页里不存放任何服务端密钥。
- 只有必要的人员可以访问服务器数据。
没有任何系统是绝对安全的。如果发生可能影响你的安全事件，我们会按法律要求通知你和主管机关。
12. 政策的更新
我们可能更新这份政策。每个版本都有版本号和生效日期。对你有重要影响的修改，我们会在生效前发邮件到你账号的邮箱通知你。如果法律要求事先取得你的同意，例如处理你个人信息的目的、方式或种类发生变化，或者新增境外接收方，我们会在对你适用新做法之前征求你的同意。
13. 联系我们
- 隐私问题：support@fretgirl.app
- 其他问题：support@fretgirl.app
- 桐开（成都）科技有限公司，四川省成都市武侯区郭家桥北街76号5层560室
FretGirl Privacy Policy
Version: privacy-beta-1 · Effective: 2026-10-26
This policy explains what personal information FretGirl (看见指板 in Chinese) collects, why, where it is stored, how long we keep it, and how you can see, export and delete it.
Our approach is simple: we collect only what we need to provide the service; we do not sell your information; we do not track you for advertising; we do not use browser fingerprinting.
1. Who is responsible for your information
FretGirl is operated by Tongkai (Chengdu) Technology Co., Ltd. (桐开（成都）科技有限公司), registered at Room 560, 5th Floor, No. 76 Guojiaqiao North Street, Wuhou District, Chengdu, Sichuan, China ("we", "us"). We are the controller of your personal information.
- Privacy contact: support@fretgirl.app
- Person responsible for personal information protection: 张文嘉（Zhang Wenjia）, support@fretgirl.app
2. If you don't sign in
You can use FretGirl without signing in. In that case, everything you save in FretGirl (favourites, chord progressions, drafts, imported scores, your avatar photo, settings) stays in your current browser only and is not sent to us.
Without an account, we and our service providers still handle two kinds of request:
- the network requests our website host necessarily processes (see section 5);
- one request for in-app announcements after the app opens, which carries no account information.
While handling these requests, the servers see your IP address. We do not store it ourselves; our service providers (Supabase, Cloudflare) may keep it briefly in their system logs. On fretgirl.cn, and when we detect that you are in mainland China or cannot tell where you are, the app does not fetch announcements until you tick the cross-border consent or sign in.
If you send feedback without signing in, we receive what you write in it (see section 3).
3. What we collect and why
| Category | What exactly | Why | Legal basis |
|---|
| Account | Your email address; when your account was created and when you last signed in. If you sign in with Google, Google gives us your Google account ID and email, and may also give the display name and profile-photo link of your Google account; our sign-in service stores these with your sign-in record. We do not use the name or photo or put them in your profile | To sign you in and recognise you across devices | Necessary to enter into and perform our contract with you |
| Sign-in security log | A security log kept automatically by our sign-in service, including the IP address used to sign in | To protect accounts against takeover and abuse | Necessary to perform our contract (account security) |
| Synced content | Only these six kinds: favourite chord shapes, favourite progressions, progressions you wrote, your draft, Jam favourites, and your profile (only your display name and chosen preset avatar; a photo you choose as your avatar stays on your device and is never uploaded) | To sync them across your devices | Necessary to perform our contract |
| Backing-track ratings | The thumbs up or thumbs down you give Jam backing tracks while signed in: your account, the track ID, up or down, and when you rated or changed it. You can change or withdraw a rating at any time. Up to 2,000 per account | To improve the backing-track library: the team sees only per-track totals; other users never see your ratings or any totals | Necessary to provide the rating feature you choose to use |
| Membership, trial and purchase records | During the public beta everyone can use Pro for free, so none of these exist. Once charging starts: your Pro status and dates; customer, subscription and order IDs from Paddle; your locked-price eligibility; your trial start and end dates; the language we use for reminder emails | To decide whether you can use Pro, and to handle refunds and support | Necessary to perform our contract |
| Preventing repeat trials | Created only once charging starts and you claim a trial: three salted hashes, of a random marker created on your device, of your normalised email address, and of your IP address. We never store the marker, email or IP themselves. These hashes are not linked to your account and are kept for the periods in section 7 even after you delete your account; otherwise deleting an account and signing up again would give another trial | To enforce the one-trial-per-account-and-device rule | Necessary to enter into and perform our contract (trial rules) |
| Feedback | The feedback type and text you enter; a reply email if you choose to give one. If you tick "include diagnostic info", also the app version, browser details, language, window size, graphics (WebGL) details and the text of the most recent error. The form shows you what will be sent before you send it | To deal with your request and improve FretGirl | Your consent (you choose to send it) |
| Rate limiting | A salted hash of your IP address | To stop abuse of the feedback and sign-in services | Necessary to perform our contract (service security) |
| Email | Your email address and the message content | To send sign-in codes and support replies; once charging starts, also renewal and expiry reminders | Necessary to perform our contract |
The legal bases above follow Article 13 of China's Personal Information Protection Law. For users covered by EU or UK law, the sign-in security log, backing-track ratings, repeat-trial hashes and rate limiting also rely on our legitimate interests in security, preventing abuse and improving the service.
We do not require your real name, and we do not collect your phone number, date of birth, precise location, contacts, microphone recordings, card details, advertising identifiers or browser fingerprints. We do no behavioural tracking or usage analytics, and send no automatic error reports.
We do not read your personal content for analysis. We look at data related to your issue only when you contact support and need us to. To run the service we may look at anonymous totals, such as the number of accounts, storage used, and per-track rating totals (see the table above).
We do not send marketing emails.
Google user data
This section explains how we use the information we receive from Google.
- What we receive: only if you choose to sign in with Google, we receive your Google account ID and email address, and possibly the display name and profile-photo link of your Google account. We ask for no other permissions and do not access your Gmail, contacts, Drive or any other Google data.
- How we use it: only to create your FretGirl account, sign you in, recognise your account across devices, and reply to you when you contact us.
- What we don't do: we do not use it for advertising, sell it, use it to train AI or machine-learning models, or use it for anything unrelated to signing you in.
- Who we share it with: only the service providers needed to run the service: Supabase (account storage and sign-in) and Resend when we email you. We share it with no one else unless the law requires it.
- Keeping and deleting it: it is kept with your account and deleted with it as described in section 7. You can also revoke FretGirl's access at any time in your Google Account settings (https://myaccount.google.com/permissions). Revoking access stops Google sign-in but does not delete your FretGirl account; to delete your account, use the app.
FretGirl's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Payment information (once charging starts)
Nothing is charged during the public beta. Once charging starts:
FretGirl orders are processed by Paddle.com as Merchant of Record. The name, email, billing address and payment details you enter when buying Pro are collected and processed directly by Paddle, which is an independent controller of that information. We never receive your card number or other full payment details. Paddle tells us only what we need to provide the service, such as whether an order was paid, your subscription status and order IDs.
How Paddle handles your information is explained in Paddle's privacy policy: https://www.paddle.com/legal/privacy
5. Who we share information with
We share information only with service providers that help us run FretGirl, and they may process it only on our instructions:
| Recipient | What they do | What they process | Location |
|---|
| Supabase, Inc. | Database, sign-in, server functions, in-app announcements | The information in section 3 that is stored on servers; the IP address in requests | Servers in Singapore |
| Cloudflare, Inc. | Website hosting and global delivery | Network request information when you visit, including your IP address | Global edge network |
| Resend, Inc. | Sending email | Recipient address and message content | United States |
| Google LLC | When you open sign-in, and when you move the pointer over the account button (so the button appears faster), your browser loads the sign-in button from Google. In mainland China, Google sign-in is not shown or loaded | While loading the button, Google receives your IP address and browser details. Only if you choose to sign in with Google do we receive the items listed under "Account" in section 3 | United States and where they operate |
| Paddle (Paddle.com Market Limited and its affiliates), once charging starts | Checkout and payment (independent controller, see section 4) | Order information | United Kingdom and where they operate |
We may also disclose necessary information to authorities when the law requires it, or to our professional advisers (such as lawyers) to protect our rights and those of our users.
We do not sell your personal information or use it for advertising.
6. International transfers
Our company is in mainland China, our servers are in Singapore, and the website is delivered through Cloudflare's global network.
- Even without signing in, when you visit fretgirl.app the web page itself and the in-app announcements are handled by servers outside mainland China (see section 2).
- If you sign in from mainland China, your account information (including account-linked records such as backing-track ratings) and synced content are transferred outside mainland China to be stored and processed.
Overseas recipients:
- When you sign in from mainland China (through fretgirl.cn, or when your network shows you are in mainland China), we ask for your separate consent to this transfer. If you do not consent, you can still use FretGirl without signing in, and your data stays in your browser.
- You can exercise your rights over the information processed abroad by contacting us as described in section 8.
If you are in the EU, EEA, Switzerland or the UK, your information is transferred outside those regions (including to China, Singapore and the United States). We rely on legally recognised safeguards, such as the standard contractual clauses in our service providers' data processing agreements.
7. How long we keep information
| Information | How long |
|---|
| Account, synced content, backing-track ratings | Until you delete the item (or withdraw the rating) or your account |
| Sign-in security log | Up to 90 days |
| Membership, trial and purchase records (once charging starts) | Until you delete your account |
| Repeat-trial hashes (device marker, email; once charging starts) | 1 year from the claim, kept for that year even if you delete your account |
| Repeat-trial hashes (IP; once charging starts) | 30 days |
| Paddle notification records (order IDs, event type, time; no card details or email; once charging starts) | 2 years |
| Feedback | 2 years; when you delete your account, the email in your feedback is deleted |
| IP hashes for rate limiting | 24 hours |
After you delete your account, we delete your data from our servers within 30 days, including backups. These are the exceptions:
| Data | Why we keep it | How long |
|---|
| Repeat-trial hashes (device marker, email; only if you claimed a trial) | To stop people deleting an account and signing up again for another trial. The hashes are not linked to your account and cannot be turned back into your email | 1 year from the claim |
| Repeat-trial hash (IP) | As above | 30 days |
| Payment notification records (order and subscription IDs, event type, time; no card details or email; only if you paid) | Accounting and legal obligations. The link to your account is removed within 30 days | 2 years |
| Feedback content (text and diagnostic info, with the reply email and account link removed) | To keep a record of support cases | 2 years from submission |
| Sign-in security log | Account security | Up to 90 days |
| IP hashes for rate limiting | Service security | 24 hours |
Paddle, as the seller, keeps transaction records as its own legal obligations require.
8. Your rights
You can:
- See and export your data: choose "Export my data" in the app's account section to download your synced content and settings. For a copy of other records we keep on servers (such as consent records or feedback), email us.
- Correct it: change your display name and avatar directly in the app.
- Delete it: delete your account in the app's account section. You will be asked to confirm who you are once more. Once charging starts, if you still have a subscription that renews automatically, the app will first ask you to cancel it. Deletion removes your account, synced content, backing-track ratings, membership and trial records, and the email in your feedback. The hashes kept to prevent repeat trials are not linked to your account and are kept for the periods in section 7. Data for that account on your device is also cleared, but anything you saved on the device while signed out is not affected.
- Withdraw consent: for example to the international transfer; email us. We then stop that processing (for the international transfer, by deleting your account data on our servers); processing before you withdrew is not affected.
- Other rights: to restrict or object to processing, to receive a copy of your data, to close your account, and any other rights the law gives you.
To exercise these rights, email support@fretgirl.app. We reply within 15 business days, and in any case within one month.
If you are unhappy with how we handle your information, you can complain to the data protection authority where you live. In the EU, EEA and UK, that is your local data protection authority.
California residents: we do not sell or "share" (for cross-context behavioural advertising) your personal information.
9. Storage in your browser
FretGirl uses your browser's local storage (localStorage and IndexedDB) only to make the app work:
- your settings, such as language, appearance and guitar sound;
- what you save while signed out, and scores you import;
- a photo you choose as your avatar (kept on this device only, never uploaded);
- your sign-in session;
- your most recent membership status, so Pro keeps working offline for up to 7 days;
- once charging starts, a random marker used to prevent repeat trials;
- feedback that could not be sent yet, to send next time you are online;
- which in-app announcements you have read (announcement numbers only; never uploaded).
We do not use cookies or local storage to track you or show you ads.
10. Children
You must be at least 14 to create an account yourself. If you are under 14, please use FretGirl only with the consent and supervision of a parent or guardian. If we learn that we have collected information from a child under 14 without a guardian's consent, we will delete it promptly. Parents and guardians can contact us at support@fretgirl.app.
11. Security
- Everything is sent over HTTPS.
- Each account can read and change only its own data, enforced by the database's access rules.
- No server secrets are stored in the web app.
- Only the people who need to can access server data.
No system is perfectly secure. If a security incident could affect you, we will notify you and the authorities as the law requires.
12. Changes to this policy
We may update this policy. Each version has a version number and an effective date. For changes that significantly affect you, we will email the address on your account before they take effect. Where the law requires your consent first, for example when the purpose, method or kinds of personal information we process change, or when we add an overseas recipient, we will ask for your consent before applying the change to you.
13. Contact us
- Privacy questions: support@fretgirl.app
- Everything else: support@fretgirl.app
- Tongkai (Chengdu) Technology Co., Ltd. (桐开（成都）科技有限公司), Room 560, 5th Floor, No. 76 Guojiaqiao North Street, Wuhou District, Chengdu, Sichuan, China