Privacy

Updated on September 6, 2026

This page says what Absolute Pitch Class keeps, where it keeps it and why. It is written in plain English, with no legal padding. If any sentence here does not match what the site does, the sentence is the one that is wrong — write to us.

What stays on your device

You can play without an account. In that case your progress is kept in the browser itself, with no copy on any server, and it disappears when you clear the site data.

But that covers the progress, not everything. Even without an account, each round sends an anonymous count to our server: the game, the level, the round number and whether it was finished or dropped halfway. That per-round count exists precisely for people without an account, and it is described under “Counting visits”.

• The level you are on and the levels already unlocked, in each game.
• Your best result on each level and the stars you earned.
• Device preferences: tempo, kids mode, answer type, microphone or MIDI keyboard input, help you have already seen. With an account, some of them travel up with your score — see the next section.
• The chord symbols you place on your songs.
• The MIDI files you import, kept in a database inside the browser itself (IndexedDB).
• If you sign in, your name, e-mail and picture stay in the browser for up to fourteen days, so the app opens already signed in.
• With an account too: the play diary queue while it has not gone up yet — at most five hundred lines, kept separately for each account.

What stays in your account

Creating an account is optional. It exists so your progress follows you from one device to another, and to unlock the level paths from the fourth level on.

When you sign up with e-mail and password, the password is stored scrambled (bcrypt): not even we can read it.

From the games, the server keeps your best result on each level and the diary described further down. What does not go up is the round note by note: neither the audio nor each tap of yours.

• E-mail, name and the site language you signed up in.
• The password, stored as a hash; and the link to Google, if you sign in with it.
• Best result per game and per level: accuracy, whether you passed, how many times you played and the settings you played with — the tempo actually played in Rhythm, kids mode and the input (keyboard, microphone or MIDI) in Reading, the chord style and the assist switch in the ear games.
• The date of your last active day — the date only, so we know who still uses the site.
• The songs you choose to sync, described further down.

Your songs and your chord symbols

Without an account, the MIDI file you import never leaves your device: it is read inside the browser.

With an account there is a “Sync now” button on your shelf. Only when you tap it do the file, its name and the chord symbols go up to your account. There is no automatic syncing, and nothing goes up behind your back.

What goes up is limited to three songs per account and is visible only to you. “Remove from account” deletes the song from the server without touching what is on your device.

The play diary

Signed-in play produces a diary: one line for each thing that happens, written once and never edited. It is what lets the app show study statistics and lets us see where people get stuck.

It exists only for people who are signed in. Guests produce no lines at all.

Each line has the time, your account number and a few values. It keeps no e-mail, no name and no text written by you.

• Level finished: game, level, accuracy, whether you passed and how long it took.
• Level abandoned: game, level, how long you spent on it and whether it was the free mode.
• Round time: game, whether it was the free mode, and seconds with the screen in view — time with the app in the background is subtracted.
• Song played to the end: which piece, whether it is a file of yours or one from the catalogue, which study mode and how long.

The ranking is public

If you play signed in, your name and picture appear on the Ranking screen for anyone who opens it, next to the level you reached and your average accuracy.

Your e-mail never appears there. Playing without signing in publishes no score anywhere.

Counting visits

To know how many people arrive and where from, the pages request a one-pixel image from our own server. It is not a third-party pixel and it creates no cookie.

What travels goes in the address of that request, as short codes: the page you opened, the language, the domain you came from, which app screen you entered, the game where the first sound played and whether a session was open or not.

Without an account, each round travels too: the game, the level, the round number and whether it was finished or dropped. And, with an account or without one, the outcome of the invitation to create an account (it appeared, you created one, you closed it) and the reason an account form was refused — the error code, such as “short password”, never the e-mail. On the two pages that explain rhythm and music reading, what you did there travels: which demos you played with, whether you read to the end, how long the page stayed in view and which game the button led to.

Each of those requests goes into the server log, with the IP address, the browser and the time — like any request to any site. Once a day, a program of ours reads that log and writes one summary per visit.

That summary has no name and no e-mail, but it is not truly anonymous either. It keeps a visitor identifier computed from your IP block (the first three numbers) and your browser, the scrambled IP, the browser in full, the games opened, the deepest level reached, the outcome of the account invitation and the reasons account forms were refused. The server log rotates every fourteen days; the summary does not — it stays, and today there is no set deadline for deleting it.

There is no Google Analytics, no social network pixel and no third-party audience measurement on this site.

• No cookie is created because of this count, and your name, your e-mail and your account number never enter it.
• Of the address you came from, only the domain is taken, never the full page address.
• The origin domain is held in the tab's memory so the count is not lost on the second page, and it disappears when you close the tab.
• The typefaces come from Google Fonts, so your browser makes a request to a Google server when the pages load.
• Blocking that pixel changes nothing: the site works the same.

What the server logs

Like every web server, ours writes down each request it receives: date and time, IP address, browser and the file requested. It is the log that makes errors, attacks and traffic visible.

That log rotates every fourteen days, and the oldest day is discarded.

There is also an account log. It records both what works (signed in, created an account, confirmed the e-mail, reset the password) and every refusal the server gives to any request — unknown action, expired session, no permission, too many attempts, invalid form ticket. Each line has the request, what happened, the e-mail typed when there was one, the account number when there was a session, the IP and the browser. It exists to diagnose failed sign-ups and to stop mass attempts; it rotates by size and keeps one previous file.

Signing in with Google

Signing in with Google is optional. From your profile we ask for three things — and nothing beyond them.

The sign-in itself brings two more pieces of information along, and both are stored: the stable identifier of your Google account (a number, not your e-mail), which is what ties that sign-in to your account here, and Google's word that it has already confirmed that e-mail.

We do not ask for and do not receive your contacts, your calendar, your files or your Google password.

One rule that has to be written down: if an account already exists here with the same e-mail and that e-mail has not been confirmed yet, linking Google erases that account's password. It is a protection, because someone else could have signed up with your e-mail before you did. When it happens the app says so on screen and sends an e-mail about it; to have a password again, use “forgot my password”.

During the trip to Google and back, a technical cookie holds the code for that trip for ten minutes, only to check that the return is the same trip.

• E-mail: it becomes the account login.
• Public name: it is what appears on the ranking.
• Profile picture: it is the avatar in the header and on the ranking.

E-mails you may receive

We only send e-mail because of something you did. There is no newsletter and no mailing list.

• Welcome, when you create an account with e-mail and password, with a link to confirm the address.
• Welcome, the first time you sign in with Google.
• Address confirmation, when you ask for it to be sent again.
• Password reset, when you ask for one — the link is valid for one hour.
• Password removed notice, when linking Google erases the account password.

Cookies

There are two cookies, and both are born the first time the browser talks to our API. That happens when you use the account screen, sign in with Google, are already signed in — or when you open the Ranking, which is public and reads the list from the server even without an account. Someone who only plays, without opening any of those screens, gets neither. Both last fourteen days.

One is the session cookie: it is what keeps you signed in, because without it the server cannot tell it is you. The other is the form ticket: when you submit an account form, the server checks that ticket to be sure the submission came from our site and not from somebody else's page.

During the Google sign-in there is a third one, for ten minutes: the technical cookie described above.

There is no advertising cookie, no social network cookie and no audience measurement cookie. Signing out kills the session on the server — the cookie stays in the browser, but stops being worth anything.

How to delete your account

In the account menu inside the app there is “Delete account”. The button asks for one confirmation and there is no undo.

You do not have to write to anyone or wait for a deadline: the deletion happens right away.

What was on your device stays on your device. To remove it from there, clear the site data in your browser.

• Gone from the database: sign-up details, password, the Google link, scores, synced songs and the play diary.
• Gone from the server: the MIDI files you had synced.
• Still yours: the progress, the chord symbols and the files kept in your browser.
• Around for a while: the server log lines, until the normal rotation; the daily summary from the visit count, which has no set deadline; and the database backups, replaced in rotation within ninety days — one stays on the server and the other on a personal computer, off it.

Talking to us about data

To ask for a copy, a correction or the deletion of your data, write to contato@aulademusica.com.br. It is the same address as on the contact page.

This page covers the three addresses of the project: aulademusica.com.br, absolutepitchclass.com and oidoabsolutoclass.com.

When this page changes, the update date changes with it.

← Home