In short. We collect the minimum: your e-mail and password (or your Google account) for the account, and what you tell us about your playing to personalise the site, and the charts you save, which stay private. We do not sell your data and do no marketing. To view, correct or delete your data, write to us.
1. Who is responsible for your data
The data controller is the publisher of the OpenRealb website (www.openrealb.com), a private individual publishing the site on a non-professional basis (see the terms of use). For any question about your data: contact@openrealb.com.
This policy describes, in accordance with articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act, which data we process, why, for how long, with whom, and your rights.
2. The data we collect
2.1 Without an account
You can browse the whole site without an account. We then process only:
- Technical connection data: IP address, browser and system (user agent), pages requested, timestamps. They appear in the network logs of our host, Cloudflare, and in those of our application, and serve to run the site, to limit the number of sign-in attempts per IP address and to detect abuse.
- Analytics: see section 6 (cookies and trackers).
- The “Report an issue” form: the type of feedback, your message, your e-mail address, the page and the tune concerned, and whether you asked for the newsletter. These submissions are currently written only to the application logs (see the retention period in section 5).
2.2 Your account
| Data | Source | Why |
|---|---|---|
| E-mail address | You, or Google if you sign up with Google | Account identifier, sending sign-in codes and account-related messages |
| Password | You | Signing in. Stored only as a hash; we cannot read it |
| Name and picture | Google, if you sign up with Google | Shown in the site header (initials, avatar) |
| Google account id and access tokens | Recognising your Google account at the next sign-in | |
| Interface language | The page you sign up from | Language of e-mails and redirects |
| E-mail verification status, creation and last-change dates, onboarding completion date | Generated by the site | Account management |
| Sessions: token, expiry date, IP address and browser at sign-in | Generated at each sign-in | Keeping you signed in; letting you see and close your sessions; security |
| One-time codes (sign-in, verification, reset) | Generated by the site | Checking that you control the e-mail address |
2.3 Your musical profile (onboarding and account page)
After sign-up, the site asks you a few questions, all optional, which you can skip and change later from your account page:
- your instrument(s), in order of preference;
- the reading key of your instrument (C, B♭, E♭…);
- your level (beginner, intermediate, advanced, professional);
- the styles you like to play;
- your goals (learn, jam, play in a band, teach, write);
- the onboarding step you stopped at, to resume it;
- the date of your consent to the newsletter, if you subscribed.
This information is used solely to personalise the service: opening charts in your instrument’s key, suggesting tunes and styles, adapting the tools to your level. It is not used for advertising or marketing, and is not passed on to third parties.
2.4 Your charts (“My charts”)
The charts you create in the editor, or copy from the catalogue with “Remix”, are stored on our servers and tied to your account: title, key, tempo, styles and people entered, the content of the chart, creation and modification dates and, for a remix, the original tune.
They are private: only you can access them, from “My charts”; we do not publish them or disclose them to anyone. The publisher only looks at them when needed for the technical maintenance of the Service or at the request of an authority. You can delete them one by one at any time; they are all erased with your account.
2.5 What we do not collect
The metronome and player settings, and your display preferences, stay in your browser (local storage) and are not sent to the site. We collect no payment data, no precise location data and no sensitive data.
3. Why, and on what legal basis
| Purpose | Data | Legal basis (art. 6 GDPR) |
|---|---|---|
| Providing the site and the account: sign-in, sessions, code e-mails | Account, sessions, codes | Performance of the contract (the Terms) |
| Storing your charts and giving you access to them | Your charts | Performance of the contract (the Terms) |
| Personalising the service | Musical profile, language | Performance of the contract; you choose what you enter |
| Security: limiting sign-in attempts, detecting abuse, diagnosing outages | IP address, technical logs | Legitimate interest (security and proper running of the site) |
| Handling your feedback and correcting charts | Feedback form | Legitimate interest (improving the service); the e-mail lets us reply to you |
| Newsletter: sending you the site’s news | E-mail, language, consent date; your instruments, level and styles, to pick the news that concern you | Consent, withdrawable at any time (unsubscribe link in every e-mail, or My account) |
| Notifications on your devices | The browser’s notification subscription, your account id | Consent (the permission you give the browser), withdrawable at any time from My account or the browser settings |
| Anonymous analytics, without cookies | Usage events; IP address and browser, reduced to a daily fingerprint by PostHog (see section 6.2) | Legitimate interest (understanding how the site is used, to improve it) |
| Extended analytics: persistent identifier, link to the account, session recording | See section 6.3 | Consent, which can be withdrawn at any time |
| Advertising (Google AdSense), personalised or not | See section 6.5 | Consent for personalised ads and for the cookies they need; legitimate interest for the limited, non-personalised ads shown without it |
| Recording your cookie choice | Your choice per purpose and vendor (IAB TCF consent string) | Legal obligation (proving the consent) |
| Answering your requests and meeting legal obligations | Correspondence, account data | Legal obligation; legitimate interest |
We make no automated decisions with legal effects on you, and do no profiling beyond the personalisation described above.
4. Who has access to your data
Your data is neither sold nor rented. It is accessible to the site’s publisher, and processed on their behalf by the following providers (processors within the meaning of the GDPR):
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting of the site, the database and the logs; sending the code e-mails | Global network; data stored in Europe where possible. Transfers outside the EU are covered by the European Commission’s standard contractual clauses and the Data Privacy Framework certification |
| PostHog, Inc. | Analytics (see section 6) | Servers in the European Union (Frankfurt) |
| OneSignal, Inc. | Sending the newsletter and the notifications, if you asked for them: your e-mail, your account id, your language, your instruments, level and styles (newsletter), your devices’ notification subscriptions | United States; transfers covered by the European Commission’s standard contractual clauses |
| Google LLC | Sign-in with a Google account, if you choose that option | United States; transfers covered by the Data Privacy Framework. Google processes your data under its own privacy policy |
| Google Ireland Ltd (AdSense, Privacy & messaging) | Displaying ads; asking for and recording your cookie choice | European Union and United States; transfers covered by the Data Privacy Framework. For personalised ads, Google and its ad partners act as independent controllers under their own policies |
| YouTube (Google) | Video playback, only when you start a video | See Google’s privacy policy. Nothing is loaded from YouTube until you start a video |
Your data may also be disclosed to authorities that request it within the framework provided by law.
5. For how long
| Data | Period |
|---|---|
| Account and musical profile | As long as the account exists. Erased immediately when the account is deleted (by you or by us, see the Terms). An account with no sign-in for three years may be deleted after a warning |
| Your charts | Until you delete them, or until the account is deleted |
| Sessions | Sixty days without activity, or until sign-out. All your sessions are closed when you change your password |
| One-time codes | A few minutes, then erased |
| Application logs (Workers Logs), including feedback form submissions | At most seven days |
| The host’s network logs (IP address, requests) | The period Cloudflare sets for its own logs, under its privacy policy |
| Newsletter consent, and the data sent to OneSignal to deliver it | Until withdrawn or until the account is deleted (which also erases your data at OneSignal) |
| A device’s notification subscription | Until turned off or until the account is deleted |
| Analytics | At most one year for the persistent identifier (with your consent), aggregated data afterwards |
| Your cookie choice | Thirteen months at most, kept by Google’s consent tool; we then ask again |
| Correspondence (rights requests, notices) | The time needed to handle the request, then at most three years as evidence |
6. Cookies and trackers
Your choices are asked for and recorded by Google’s consent tool (Privacy & messaging, IAB Transparency & Consent Framework). You can review them at any time: manage cookies, or the “Cookies” link at the bottom of the site’s pages.
6.1 Strictly necessary
These cookies and this storage need no consent (article 82 of the French Data Protection Act, article 5(3) of the ePrivacy Directive): they only serve to provide the service you ask for. They are set by the site itself; on the site over HTTPS, the session cookies also carry the __Secure- prefix.
| Name | Role | Lifetime |
|---|---|---|
FCCDCF, FCNEC (Google) | Remember your cookie choice (the consent string of each purpose and vendor), so that you are not asked on every page | Thirteen months at most |
better-auth.session_token (and its session_data cache) | Keeping you signed in. Not readable by scripts (HttpOnly) | Sixty days, renewed with each activity |
better-auth.dont_remember | Ending the session with the browser, if you unticked “Keep me signed in” | The visit |
better-auth.last_used_login_method | Showing the sign-in method you used last on the sign-in page | Thirty days |
orb_auth | Tells the browser to show the signed-in header without waiting for the server. Holds no secret | Same as the session |
Browser local storage (orb-*) | Your initials and avatar for the header, your settings (player, metronome, editor, display), and a copy of your consent to extended analytics, read by the analytics tool when the page loads | Until you clear it, or until the consent is withdrawn |
Browser session storage (orb-*) | The sign-in mode for the duration of a Google sign-up or sign-in | Until the tab is closed |
| OneSignal’s service worker and local storage | Receiving notifications on the device. Loaded only when you turn notifications on, or on a device where you already allowed them | Until notifications are turned off |
6.2 Anonymous analytics, without cookies
To know how many people use the site and how (page views, searches, tunes opened, tools used, clicks, errors met, charts created), we use PostHog (servers in the European Union), without cookies or storage on your device. Visitors are told apart for one day by a fingerprint computed on PostHog’s servers from the IP address and the browser, with a salt renewed every day: it can neither recognise you from one day to the next, nor identify you. Events are sent from the site itself, through the/ingest address, and are not tied to your account.
As nothing is read from or written to your device, this measurement needs no consent; it relies on our legitimate interest in knowing how the site is used, to improve it. You can object by writing to us, or by blocking the /ingest address in your browser.
6.3 Extended analytics, with your consent
If you accept, PostHog also sets a persistent identifier (cookie and local storage prefixed ph_, lasting at most one year) which makes it possible:
- to link your visits together;
- when you are signed in, to tie your usage to your account id (never to your e-mail or your name);
- to record your sessions (your path through the pages, clicks, without the content of form fields), to understand the difficulties met.
This is purpose 1 of the consent message (“Store and/or access information on a device”). Your choice is kept for thirteen months at most; we then ask again. You can withdraw your consent at any time, as easily as you gave it: the identifier is then erased and the measurement becomes anonymous again. The site works fully without it.
6.4 Third parties
Starting a video loads the YouTube player, which may set its own trackers under Google’s policy. The sign-up and code forms use Cloudflare Turnstile, an anti-bot check needed for the security of the accounts.
6.5 Advertising
Some pages show ads served by Google AdSense. If you accept, Google and its ad partners (listed in the consent message) may read and set cookies (for example __gads, __gpi, IDE) to show you ads based on your interests and measure them. If you refuse, Google only shows limited, non-personalised ads, chosen from the page’s content. None of your account or musical profile data is shared with Google. Seehow Google uses information from sites that use its services.
7. Your rights
You have the following rights over your data:
- Access: obtain a copy of the data we hold about you;
- Rectification: correct inaccurate or incomplete data;
- Erasure: ask for your data to be deleted;
- Restriction: ask for processing to be frozen in the cases set out in article 18 GDPR;
- Objection: object to processing based on our legitimate interest, on grounds relating to your particular situation;
- Portability: receive the data you gave us in a structured, machine-readable format;
- Withdrawal of consent: at any time, without affecting past processing (newsletter, analytics);
- Post-mortem instructions: decide what happens to your data after your death (article 85 of the French Data Protection Act).
To exercise any of these rights, write to us at contact@openrealb.com, preferably from your account’s e-mail address. We handle each request by hand and answer within the one-month period set by the GDPR. We may ask you to confirm your identity before acting on it.
You may also lodge a complaint with the CNIL, the French supervisory authority.
8. Security
The site is served over HTTPS only. Passwords are hashed with an algorithm designed for the purpose and never stored in clear text. Session cookies are protected (HttpOnly, Secure). The number of sign-in attempts and code e-mails is limited per IP address. Access to the database and the hosting is restricted to the publisher and protected by strong authentication. In the event of a data breach likely to result in a high risk to you, we will inform you in accordance with article 34 GDPR.
9. Minors
The site is intended for people aged 15 and over. Under that age, sign-up requires the consent of a parent or legal guardian. If you believe an account was created by a child under 15 without that consent, write to us: we will delete it.
10. Changes to this policy
This policy may change with the service, for instance if we add a feature that processes new data or change a provider. The update date appears at the top of the page. Members are told of a substantial change by e-mail or by a notice on the site. Should we ever want to use your data for marketing, we would ask for your consent first.
11. Contact
For any question about your data: contact@openrealb.com.