Privacy Policy

Effective Date: 26 September 2026

This Privacy Policy describes how enScore ("we", "us", "our") collects, uses, stores, and protects your personal information when you use our application. enScore is available for iOS, iPadOS, macOS, Android, and Windows, and is operated by Jonathan Vardouniotis (ABN 76 556 821 750). By installing or using enScore, you consent to the practices described here.

We are committed to handling your data in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the EU and UK General Data Protection Regulations, and the California Consumer Privacy Act, where applicable.

---

1. What We Collect

We only collect data necessary to provide the features you use. The lists below are exhaustive — we do not collect anything beyond them.

Without an account (anonymous use)

If you use enScore without signing in, we do not collect any personal data. Your library, annotations, and bookmarks remain on your device only.

Account data (only if you sign in)

• Email address — provided by Sign in with Apple (which may be a private-relay address), Sign in with Google, Sign in with Amazon, or Sign in with Huawei.
• Display name — provided by the sign-in provider, if you choose to share it.
• Authentication tokens — issued by our authentication provider (Supabase Auth) and stored locally on your device (in the platform's secure credential store — e.g. Apple Keychain, Android Keystore, or Windows Credential Locker).

If you sign in with a different provider using the same, verified email address as an existing enScore account, we link the new sign-in to that existing account rather than creating a duplicate — this is what lets a purchase or library made under one sign-in method follow you if you later sign in a different way.

Library data (only if you enable Sync)

• PDF files you import into enScore
• Annotations: pen strokes, highlighter marks, eraser actions, layers, stamps, and shortcuts
• Bookmarks
• Folder structure
• Lists / playlists, including any page-range, tempo, or metronome settings you save against a list entry
• Per-document settings: cover-page-on-right, half-page-turns, alternating-page-turns, landscape page zoom, half-page split positions, metronome BPM, page crops, the page you were last reading, whether you dismissed a suggested title, and links you attach to external recordings (see "Linked media" below)
• If you record or attach an audio file to a score, its settings (title, file size, a fingerprint of the file, playback speed, transpose, loop and start points, page turns, bookmarks and timed layer changes), but never the audio file itself, which stays on the device where you added it
• Your app preferences that follow your account: ink colours and widths, eraser settings, your folder images and list cover images, metronome sound and pulse settings, the tuner's reference pitch, your daily practice goal and practice-logging pause, and whether Magic Suggestions are on. Volume levels and your recently-opened list stay on each device.

Device data (only if you sign in)

• A locally-generated device identifier (UUID)
• Platform identifier (ios / ipados / macos / android / windows)
• Your device's display name (e.g. "Sam's iPad")
• App version

This is used to label devices in your account and to attribute synced changes to the correct origin device.

Camera, microphone, and Bluetooth (only when you use these features)

• Camera — used only to scan or photograph sheet music so it can be turned into a PDF in your library. Captured images are processed on your device; we do not receive or store them unless you choose to import the resulting PDF into a library you sync.
• Microphone — used only by the built-in tuner. Audio is analysed on your device in real time to detect pitch; it is never recorded, stored, or sent anywhere.
• Bluetooth — used only to connect wireless MIDI pedals, keyboards, and similar accessories (for example, to turn pages or trigger playback). No data about your Bluetooth devices leaves your device.

Linked media (only if you attach a recording to a score)

enScore lets you attach a link to an existing recording of a piece — on YouTube or Apple Music — so you can play it back next to the score. We do not see or store the recording itself.

enScore uses YouTube API Services. When you use enScore's YouTube features, Google also collects and processes data under the Google Privacy Policy, and you agree to the YouTube Terms of Service. In detail:

• Searching. Your search text is sent to our server, which queries the YouTube Data API on your behalf and returns the results (video ID, title, channel name, duration, and thumbnail URL). Our server keeps a copy of each search's results for up to 24 hours so that repeated searches do not cost a new API call, and deletes them after 30 days at the latest. Searches are rate-limited using a hashed (not raw) copy of your IP address, which is deleted after 7 days. We do not link searches to your account.
• Playing. Playback uses YouTube's official embedded player, which loads directly from YouTube inside a sandboxed web view on your device. YouTube may set cookies or local storage in that view and receives your requests directly, under Google's privacy policy; enScore does not read those cookies.
• What enScore stores. When you attach a video, enScore stores the video ID, title, channel name, duration, and thumbnail URL with that score on your device. If you enable Sync, only the video ID and your own settings for it (such as speed and loop points) are stored in your synced library; the title, channel name, duration and thumbnail are never sent to our servers, and each of your devices fetches them from YouTube itself. This stored copy expires after 30 days and is re-fetched from YouTube the next time you use the link (or removed if the video is no longer available); the embedded player itself always shows YouTube's current content. enScore does not access your YouTube account, and never asks you to sign in to YouTube.
• Deleting. Removing a link or recording from a score moves it to Recently Deleted on your devices, where you can restore it for 30 days; after that, or as soon as you delete it from Recently Deleted, it is permanently deleted from your devices and from our servers. Deleting a score moves it to Recently Deleted, from which it is permanently purged after 30 days; you can purge it immediately from there. Deleting your enScore account erases it at once. You can also ask us to delete any of this data by emailing the address below, and we will do so within 7 calendar days. Deleting data from enScore does not delete anything from YouTube itself — that is done through YouTube's own applications and settings.

Apple Music links work the same way through Apple's MusicKit: the request goes directly to Apple, and enScore stores only the song ID, title, artist, duration, and artwork URL with the score on your device. If you enable Sync, only the song ID (and your storefront) and your own settings for it are stored in your synced library; the title, artist, duration and artwork are never sent to our servers.

Usage analytics and crash diagnostics

We use two privacy-oriented third-party services to keep enScore working:

• Sentry — for crash and error reporting. When something goes wrong, we receive technical diagnostic information: device model, OS and app version, and details about the failure (e.g. a stack trace). This is tied to a randomly generated installation identifier, not your Apple/Google/Amazon/Huawei ID or email, and we do not send your name, email, or library content to Sentry.
• TelemetryDeck — for aggregate feature-usage analytics (e.g. which features are used, how often). This uses a salted, per-installation identifier rather than an advertising identifier, and does not identify you personally.

Neither service is used for advertising, and neither is sold or shared onward for advertising purposes.

AI-assisted title and composer detection (optional feature)

enScore can suggest a title and composer for a score you import, to save you retyping it. This has two parts:

• An on-device engine that runs entirely on your device, with no network request at all.
• An optional cloud-assisted engine (toggle: Settings → Magic Suggestions) that, only while you are signed in and online, sends a single downscaled image of the score's first page (not the full document) and the file's current name to our server, which forwards it to Anthropic's Claude API to read the title and composer. The image is used only to answer that one request; it is not stored by us, and Anthropic's commercial API does not train on it or retain it beyond what it needs to detect abuse of its own service.

You can turn the cloud-assisted engine off at any time in Settings; the on-device engine keeps working regardless.

Purchase data

• The identifier of any in-app purchase or subscription you have made
• The current entitlement state for your account ("Pro active", "Sync active until …")
• Receipt/transaction metadata (product, price, currency, and which store it came from) forwarded to us by our subscription provider, RevenueCat, or — for stores RevenueCat does not support — verified directly against that store's own purchase-verification service. We never see or store your card or payment-account details; those are held entirely by Apple, Google, Microsoft, Amazon, or RevenueCat.

If you redeem a coupon or promo code

Redeeming a physical or digital enScore coupon happens on our website, not in the app. That flow collects the email you sign in with there, and a hashed (not raw) copy of your IP address, used only to prevent abuse of the redemption system. The same hashed-IP approach is used to rate-limit sign-in attempts generally — we do not retain your raw IP address for this purpose.

What we do not collect

• Your geographic location
• Your contacts or calendar
• Your photos, except ones you explicitly choose to import or capture as a score
• Your browsing history outside enScore
• Advertising identifiers (e.g. IDFA) or hardware serial numbers — our device and analytics identifiers are randomly generated by the app itself
• We do not sell your data, run advertising, or track you across other apps or websites

2. How We Use Your Data

We use your data only for the purposes described below. We do not sell, rent, or share your data with third parties for advertising or marketing purposes.

Data	Purpose
Email + name	Account creation and sign-in
Authentication tokens	Verifying your identity for sync requests
Library data (incl. linked-media links and audio attachment settings, but not the audio files)	Storing and synchronising your library across your devices
Device data	Distinguishing your devices in account management
Purchase data	Verifying access to paid features, across every platform you sign into
A page-1 image + filename (only if you use cloud-assisted detection)	Suggesting a title/composer for that one score; discarded immediately after
Crash diagnostics (Sentry)	Finding and fixing bugs
Usage analytics (TelemetryDeck)	Understanding which features are used, in aggregate, to prioritise development

We do not use your library data for advertising, for training machine-learning models, or for any purpose beyond providing the features described above.

3. Where Your Data Is Stored

enScore relies on the following service providers ("Sub-processors"):

Provider	Purpose	Location	Privacy Policy
Supabase	Database (Postgres) and file storage for synced library	Japan (Tokyo)	supabase.com/privacy
RevenueCat	Subscription state and entitlement management	United States	revenuecat.com/privacy
Anthropic	Reads a score's first page to suggest a title/composer (only if you use cloud-assisted detection)	United States	anthropic.com/privacy
Sentry	Crash and error reporting	United States	sentry.io/privacy
TelemetryDeck	Aggregate, privacy-oriented usage analytics	See their policy	telemetrydeck.com/privacy
Apple	App Store payments, Sign in with Apple, Apple Music playback (if you link a recording)	Various	apple.com/legal/privacy
Google	Sign in with Google; Google Play billing and Play Services (Android); YouTube playback (if you link a recording)	United States	policies.google.com/privacy
Amazon	Sign in with Amazon; Amazon Appstore billing (if purchased there)	United States	amazon.com/privacy
Huawei	Sign in with Huawei (HUAWEI ID)	Varies by region	consumer.huawei.com/en/privacy
Microsoft	Microsoft Store billing (Windows)	United States	privacy.microsoft.com

Your synced library files are stored encrypted at rest by Supabase Storage. Database access is gated by Row-Level Security (RLS) policies that ensure only your account can read or modify your own rows; no other user — including us, in normal operation — can read your synced content.

4. International Data Transfers

Your synced library and account data are stored in Japan (Tokyo) by Supabase; our other service providers operate primarily in the United States. By using enScore's cloud features, you consent to the transfer of your data to Japan and the United States. Our providers commit to appropriate safeguards (Standard Contractual Clauses or equivalent) where required by EU/UK/Australian privacy law.

5. Your Rights

Access and Correction

You can view and edit your synced library directly within enScore. You can view your account email within enScore's account/sync settings.

Deletion

You can delete your data in three ways:

1. Delete an item from enScore — items are soft-deleted and propagated to your other devices. After 30 days they are permanently purged from our servers.
2. Sign out — your synced data is retained on the server so you can sign back in. No data is deleted.
3. Delete your account — tap Delete Account directly within enScore's account/sync settings (or email us if you're unable to access the app). This immediately and permanently erases your account, your synced library content, and your files from our servers — it is not a queued or delayed process. A few things it deliberately does not do: it does not cancel an active subscription (see Section 3 of our Terms of Service — cancel that separately through the store you subscribed with), and it does not touch the copy of your library that already lives on your own devices.

Ledger records that exist to satisfy tax, fraud-prevention, or "a redeemed code must stay redeemed" obligations (see Data Retention below) are anonymised rather than deleted when you delete your account — they no longer identify you, but the transaction itself isn't erased from our accounting records.

Additional rights (where applicable)

• EU / UK GDPR — you have the right to access, rectify, erase, restrict, object to processing, and data portability. You also have the right to lodge a complaint with your local data protection authority.
• Australian Privacy Act — you have the right to access and correct your personal information, and to make a complaint about a privacy breach to the Office of the Australian Information Commissioner.
• California (CCPA / CPRA) — you have the right to know, delete, and not be discriminated against for exercising your rights. We do not sell or share personal information for cross-context behavioural advertising.

To exercise any of these rights, contact us at [email protected].

6. Data Retention

Data	Retention period
Active account data	While your account exists
Soft-deleted library items (in Recently Deleted)	30 days, then permanently purged
YouTube search results cached on our server	Served for up to 24 hours; deleted after 30 days
YouTube / Apple Music link metadata stored with a score on your device (title, channel or artist, duration, artwork URL); never stored on our servers	While the link exists; expires after 30 days and is re-fetched on next use
Removed links and recording settings (in Recently Deleted)	30 days, then permanently deleted from your devices and our servers
Hashed IP addresses used for rate-limiting	7 days
Account data after a deletion request	Erased immediately
Purchase / entitlement records (legal/tax retention)	Up to 7 years, in line with Australian tax record-keeping requirements — anonymised after account deletion, not identifying you

7. Security

We protect your data with:

• HTTPS / TLS for all network communication between enScore and our servers
• Your device's own secure credential store (e.g. Apple Keychain, Android Keystore, Windows Credential Locker) for authentication tokens, protected by your device passcode/biometrics where available
• Row-Level Security on our database — every read and write is validated against your account ID, so no user can access another user's data
• Service-role authentication for server-side functions, restricted to specific operations (e.g. webhook receivers)
• Public anon key + JWT for client requests — the anon key alone cannot read user data; a valid signed-in JWT is required
• Hashed, not raw, IP addresses for the small number of anti-abuse checks described above (coupon redemption, sign-in rate-limiting)
• sendDefaultPii disabled on our crash-reporting SDK, so crash reports do not carry your IP address or account details by default

No system is perfectly secure. If you believe your account has been compromised, contact us immediately.

8. Children's Privacy

enScore is not directed to children under 13 (or the digital consent age in your jurisdiction, where higher), and we do not knowingly collect personal data from children below that age at sign-up. We recognise many enScore users are students of all ages using the app for lessons, ensembles, or practice; we do not collect any data specifically about, or targeted at, a user's age, and account creation does not require or record a birthdate. If you believe a child has provided us with personal data in a way that concerns you, please contact us and we will address it.

9. Cookies and Tracking

enScore is a native application (iOS, iPadOS, macOS, Android, and Windows) and does not use cookies or cross-site tracking of its own.

Information stored on your device. enScore stores your library, annotations, settings, linked-media metadata (see "Linked media" above), authentication tokens (in the platform's secure credential store), and a randomly generated installation identifier for analytics and crash reporting on your device. Where enScore embeds an official third-party player so you can play a linked recording (YouTube or Apple Music), that embedded content is served directly by Google or Apple within a sandboxed web view on your device and may place, access, or recognise its own cookies or local storage there under the Google Privacy Policy or Apple's privacy policy — enScore does not read or use those. Uninstalling enScore removes all of this from your device.

The enScore website at enscore.app may use minimal first-party analytics (e.g. page-view counts) for site-improvement purposes, and uses a bot-verification check (Cloudflare Turnstile) on the coupon-redemption page. No cross-site advertising tracking is performed.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the service, applicable laws, or our data practices. The "Effective Date" above reflects the most recent revision. Where the changes are material, we will provide reasonable notice via the app, by email, or on our website. Continued use of enScore after a change constitutes acceptance of the new Policy.

11. Contact

For privacy questions, data subject requests, or to report a privacy concern: