Privacy Policy

The short version

Your audio, your MIDI, and the layouts you build never leave your computer. ChordViz processes everything locally. It goes online to start your trial, check your licence and look for updates, to send a bug report when you ask it to, and, unless you turn it off, to send usage events that never contain your music. Recordings you make with ChordViz are written to a folder on your own computer and are never uploaded.

What the desktop app sends

• Trial check. On first launch ChordViz sends a salted, one-way SHA-256 hash of a device identifier to our trial service, which records when your 30-day trial started. The hash cannot be reversed into your hardware ID. It exists so the trial can be offered once per machine. Our trial service also reports the start and end of your trial, under that hash, to our product analytics (PostHog, below), so we can measure how many trials turn into purchases. It also keeps a salted one-way hash of the IP address your first launch came from, for 14 days, used only to connect your trial to an email you gave on this site (see “Download form and trial emails” below). The IP address itself is not stored.
• Licence activation. When you enter a licence key, ChordViz sends that key and a device identifier to Lemon Squeezy to activate, validate, or deactivate the device slot. This is what lets you see and manage your devices from your account. Once a machine is activated, we link its trial hash to the email on your order in our product analytics, so we can tell which trials led to a purchase.
• Update check. ChordViz fetches an update feed from our download host to see whether a newer version exists. As with any web request, our host sees your IP address.
• Bug reports. Only when you write one and press Send: your text, technical details about your setup, and your email if you enter it. A salted hash of the IP address it came from is kept to limit abuse.
• Usage analytics.On by default, and off with “Share usage data” in Settings → Account → Privacy. ChordViz sends events such as the app opening, the first chord named from your MIDI keyboard, or a widget being added, under the same trial hash, to PostHog. No audio, MIDI notes, recordings, layouts, file names, device names or licence keys are ever sent.

ChordViz contains no advertising SDKs, and with “Share usage data” off it sends no usage events at all.

What this website collects

• Account. If you create an account, we store your email address and authentication details through Clerk. We use your verified email to find the orders and licences that belong to you.
• Purchases. Checkout is handled by Lemon Squeezy as merchant of record. They collect your payment and billing details; we never see or store your card information. We read your order history and licence keys from them to display your account page.
• Mailing list. If you submit your email for launch updates, it is stored with Resend and used only to email you about ChordViz. Every email includes an unsubscribe link.
• Download form and trial emails.If you give your email to download ChordViz or to get the download links, we store it with our trial service and send it to Resend to email you: the links, then two emails while you try ChordViz (a welcome, and before your trial ends a one-time discount), or the links once more if no trial starts. To send them for the right trial, we connect your address to your trial in one of two ways: a cookie this site sets when you download, read if you open the app’s “Getting started” page in the same browser, or a salted one-way hash of the IP address you downloaded from, matched to the one your trial started from. The IP address itself is never stored, and the hashes are deleted after 14 days. Once connected, we record in our product analytics which trial your address belongs to. These emails stop when you buy, and every one has an unsubscribe link. You are added to the mailing list only if you tick the box asking for updates.
• Hosting logs. Our host, Vercel, keeps standard request logs (IP address, user agent, requested URL) for security and reliability.
• Website analytics and performance. This website uses Vercel Web Analytics to count page views and a handful of actions — which downloads and demo plays happen, and how often checkout is opened — and Vercel Speed Insights to measure how quickly pages load and respond. Both are cookieless, set no cross-site identifier, and do not build a profile of you or follow you to other sites.
• Partner referrals.If you arrive here from one of our affiliate partners, your link carries a partner code. We then ask Lemon Squeezy to record the visit so the partner is credited if you buy, and we store a single cookie holding that visit’s identifier. Lemon Squeezy also derives a browser fingerprint at that moment, which they use to match the click to the order. This happens only on arrival from a partner link — visit this site any other way and none of it runs, and no request is made.
• Advertising measurement. We advertise ChordViz on Facebook and Instagram, and this website uses the Meta Pixel to learn which ads lead to a download or a purchase. When it is on, Meta sets cookies in your browser and receives the pages you view here and whether you download, request the download links, or buy. If you type your email into a form on this site, the Pixel also sends Meta a hashed (scrambled) copy of it so the visit can be matched to your Meta account. Meta may use all of this to show you ads. If you are in Quebec, the European Economic Area, the United Kingdom or Switzerland, the Pixel is off unless you accept itin the banner shown on your first visit. Elsewhere it is on by default, and is switched off automatically if your browser sends a Global Privacy Control signal. Wherever you are, you can turn it on or off at any time with the “Cookie preferences” link in the footer of every page.
• Product analytics. We use PostHog, hosted in the European Union, to understand how visitors move through this site — which pages they view, what they click, whether they download, open checkout or buy — and to fix errors that happen in your browser. It also records your sessions on this site (mouse movement, clicks and scrolling) so we can see where the site is confusing; anything you type into a form is masked and never recorded. When it is on, PostHog stores an identifier in your browser so your visits can be connected, and if you sign in to your account we link that identifier to your email address. PostHog follows the same choice as the Meta Pixel: off in Quebec, the European Economic Area, the United Kingdom and Switzerland unless you accept, on by default elsewhere, switched off by Global Privacy Control, and changeable at any time with “Cookie preferences”. If you decline, PostHog only counts your visit, without cookies or any stored identifier, and cannot connect it to your other visits. Separately from that choice, our servers record business events in PostHog: when you buy, Lemon Squeezy tells us about the order (email, amount, and whether it came from this site or the app) and we record the purchase under that email, along with the trial records described above.

The Meta Pixel is the only advertising or cross-site tracking technology on this site, and PostHog the only other one that stores an identifier in your browser. The other cookies set here are the ones Clerk needs to keep you signed in, the partner-referral cookie described above when you arrive on a partner link, and the download cookie described above when you download with your email.

Processors we use

• Lemon Squeezy — payments, tax, licence keys (merchant of record), and affiliate referral tracking on partner links
• Clerk — account sign-in
• Supabase — trial records (device hashes), bug reports, and the emails given on the download form
• Resend — mailing list, download-link and trial emails
• Meta — advertising measurement on this website, subject to the consent described above
• PostHog — product analytics, session recordings and error tracking on this website (EU hosting), subject to the consent described above
• Vercel and Cloudflare R2 — website hosting, cookieless website analytics and performance measurement, and installer downloads

We do not sell your personal information, and we do not share it with anyone beyond the processors above.

How long we keep it

Order and licence records are kept as long as your licence is valid, since a perpetual licence needs a lasting record. Trial hashes are kept so a trial can’t be restarted on the same machine. Emails given on the download form are kept for six months after your last request, and IP hashes for 14 days; if you unsubscribe, we keep only a note that you did, so you aren’t emailed again. Mailing-list entries are removed when you unsubscribe. Account data is deleted when you delete your account.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it — including your account and your place on the mailing list. Email charles@chordlab.ca and we will action it. Depending on where you live, you may also have the right to complain to a data protection authority.

Children

ChordViz is not directed at children under 13, and we do not knowingly collect their personal information.

Changes

If this policy changes, the “last updated” date above changes with it. See also our Terms & License.

Contact

Charles-Antoine Pouliot — charles@chordlab.ca