Privacy Policy

1Who we are

Social Piano is operated by Social Piano (socialpiano.com). This policy applies to the website, the Android app and related services (the "Service") and explains which personal data we process, why, who we share it with and what your rights are.

2What we process

• If you sign in with Google: your name, email address and profile photo (as shared by Google).
• Your profile: username, avatar, name colour, bio, level and scores, friends and block list.
• Content you share: songs you upload or publish, room chat, clan chat and direct messages; they are kept for reports and safety reviews.
• Reports: when someone reports you, your username, avatar, bio and recent messages at that moment are saved with the report.
• Technical data: connection and error logs (browser or app version, device type, language, error message, time).
• IP address: recorded when you send room or clan messages, send and read direct messages, report a player, and on account actions such as sign-in and store purchases. It is kept to prevent abuse and to respond to legal requests.
• Stored on your device: your settings, recordings and imported songs stay in your device's local storage and are not sent to us unless you upload them to your account.

3What we do not collect

We do not collect your location, contacts, photos, microphone or camera data, and we currently do not use advertising identifiers. If you connect a MIDI keyboard, key input is processed only on your device.

4Notifications

If you allow it, your browser or device shows a notification when a friend sends you a direct message while Social Piano is in the background. The notification contains the sender's name and the beginning of the message. It is generated on your device and we collect no extra data for it. You can withdraw permission at any time in Settings → General, in your browser's site settings or in your device settings. If we later use a push service (such as Firebase Cloud Messaging) to notify you while the app is closed, we will store a device-specific push token for that purpose and update this policy.

5Advertising and payments

The Service currently shows no ads and offers no real-money purchases. If we add advertising (for example Google AdMob) or in-app purchases (Google Play Billing) in the future: the ad provider may process your advertising ID, device information and approximate location; where required (for example in the European Economic Area) we will ask for your consent before showing personalised ads; payments are processed by Google Play and your card details never reach us, we only keep the purchase record and order number. This policy will be updated and the change announced in the app before such features go live.

6Why we process it and legal bases

• To create your account and keep you signed in; to run rooms, chat, friend and clan features; to save scores, level and store items: performance of our contract with you (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)).
• To prevent abuse, review reports, keep the Service secure and fix bugs: our legitimate interests (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)).
• To respond to lawful requests and meet record-keeping duties under Turkish Law No. 5651: legal obligation (GDPR Art. 6(1)(c), KVKK Art. 5(2)(ç)).

7Who we share it with

• We do not sell or rent your data, and we do not use or share it for targeted advertising.
• Service providers: Supabase (database and sign-in), Google Cloud (game server), Vercel (website hosting) and Google (sign-in). They process data only on our behalf and on our instructions.
• Other users: your username, avatar, player ID, level, public profile and the content you publish are visible to other players.
• Legal requirements: where required by law, such as a court order or a request from a competent authority.
• Business transfers: if the Service is transferred or merged, data may pass to the new operator under the protections of this policy.

8Third-party content

When you play a YouTube video shared in chat, it loads from youtube-nocookie.com and YouTube receives your IP address and device information. The website may load fonts from Google Fonts and some sound samples from GitHub Pages, which then see your IP address. These third parties' own privacy policies apply.

9International transfers

Our service providers may process data on servers in the European Union and the United States. These transfers are necessary to provide the Service and rely on safeguards such as the providers' standard contractual clauses.

10How long

For as long as your account exists; IP addresses are kept together with the record they belong to.

You can delete your account yourself in Settings → General → Delete account. Your profile, messages, friend list, scores, songs and items are removed from the app immediately. If you cannot use the app, follow the steps at socialpiano.com/delete-account or write to support@socialpiano.com; requests are completed within 30 days.

To fight abuse and answer legal requests, when your account is deleted your identity details (email, name, username), messages, IP records and report records are moved to an archive that only administrators can access; it is deleted automatically after 2 years. While there is an open report or a moderation action against you in the last 30 days, or while the account is banned, in-app deletion is disabled; you can still request deletion by email and it will be processed once the review is over.

11Security

All connections are encrypted (HTTPS/TLS). In the database each user can only access their own private data; administrator access is limited and logged. No system is completely secure, so we cannot guarantee that your data can never be accessed without permission; if a breach occurs we will notify as required by law.

12Children

The Service is not directed to children under 13 and we do not knowingly collect personal data from them. If we learn that a child under 13 has created an account, we delete the account and its data. Parents who become aware of this can write to support@socialpiano.com and we will act promptly.

13Your rights

Under the GDPR, the Turkish KVKK and similar laws you can ask whether we process your data, request access to and a copy of it, correction, deletion or restriction, object to processing, receive your data in a portable format and seek compensation for damage.

We answer requests within 30 days. If you are not satisfied, you can complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) or, if you live in the European Union, to the data protection authority in your country.

California residents: we do not sell your personal information or share it for cross-context behavioural advertising; you can exercise access and deletion rights at the same address.

Requests: support@socialpiano.com

Data controller: Social Piano (socialpiano.com)

14Cookies and local storage

We use no advertising, analytics or tracking cookies, so there is no tracking that would respond to "Do Not Track" signals. Your device's local storage keeps your session and settings; clearing app or browser data removes them.

15Changes

We may update this policy; the date at the top shows the latest version. We announce important changes in the app.