Privacy Policy

Everything below lives in the app's private storage on your device (the documents directory on Android and iOS, the app support directory on desktop) and is never uploaded on its own. The only thing that reaches a service operated by us is what you put into a problem report and send yourself (section 2.9). • Songs: title, artist, variant, key, tempo, time signature, capo, tags, ChordPro content, private notes, transposition, auto-scroll speed and other per-device settings. • Attachments: PDFs, MusicXML and photos of sheet music you attach to a song. Stored as ordinary files next to the database. • Setlists: name, event date, venue, start time, song order, per-song notes and breaks. • Handwritten annotations: pen and highlighter strokes you draw over a song. Bound to a song and display mode, and never shared over sync. • User profile: display name, instrument, chord notation, stage theme, language and other interface preferences. • Automatic safety backups: before a restore that overwrites your library, and before merging a library with another of your devices, the app writes a full backup of the library as an .eutbackup file to its private storage so you can undo the action. The two most recent are kept per library; you can bring them back in Settings → Libraries and backups → Back up and restore. • Error log: when an error occurs, it is written to a local log (Settings → Help and privacy → Error log). It contains a technical description of the fault, not your data. It is never uploaded on its own; it is attached to a problem report only if you choose to include it when sending (section 2.9). You can clear it at any time. • A problem report you are writing stays on the device until you send or clear it. • Song MIDI commands and pedal mappings, if you set them up. If you keep several libraries, each has its own storage for songs, setlists and attachments. The user profile and settings are shared across all of them. You can export all of it at any time via Settings → Libraries and backups → Back up and restore as a single .eutbackup file, and delete all of it via Settings → Help and privacy → Manage data → Delete all data.

Below are all ten features where it is worth asking what leaves your device. Only one of them sends data to a service operated by us — the problem report (2.9), and only when you send it yourself. 2.1 Band sync (local network) When you start or join a band session, a WebSocket connection is established directly between phones on the same local WiFi network. Data does not leave your network and does not pass through any server or relay. What is exchanged with the phones of members you are connected to: your display name, the shared fields of songs and setlists (title, artist, variant, ChordPro content, key, tempo, tags, song order), scroll position and auto-scroll state. Attachments are transferred only when a member explicitly requests them, and only to that member. Personal fields — notes, transposition, attachment paths, auto-scroll speeds — are not transferred at all. Encryption depends on how you start the session. A password-locked session encrypts the messages and the transferred content with AES-256-GCM; the key is derived from a password only your band knows and is never sent anywhere. An open session is not encrypted — it runs over a WebSocket (ws://) with an http:// join endpoint and does not use TLS. The reason is practical: TLS on ad-hoc connections between phones would require a certificate authority, which is not sensible for an app aimed at musicians, and a password solves the same problem more simply. On an untrusted network (public WiFi at a venue, hotel WiFi), lock the session with a password. In an open session another device on that network can read the songs and setlists you share. mDNS advertising: while your device advertises as a band leader, it broadcasts an mDNS record on the local network with the service type _eutepio._tcp and your device name. This is standard practice for service discovery on a network. 2.2 Importing a song from a web address The URL import downloads the address you enter over HTTPS. The server you download from will see your public IP address in its log, exactly as it would for any browser. We do not proxy the request and we do not log the addresses you enter. 2.3 On-device OCR (Google ML Kit) Text recognition from a photo on Android and iOS uses Google ML Kit. According to Google's documentation the model runs entirely on your device and does not upload images or recognised text to Google's servers. We do not send OCR results anywhere. The feature reads text and chord names from a photo of paper. It does not recognise musical notation. If we ever add cloud-based music recognition that uploads a photo to an external server, it will be an explicit opt-in in settings and this policy will be updated before that feature ships. 2.4 Automatic backup (Android only) If you turn automatic backup on, the app writes a full library backup once a day into a folder you pick yourself through the system folder picker. The app writes only into that one folder and nowhere else. A caveat: if you pick a folder that a cloud service syncs (Google Drive and the like), that service carries your data off the phone. Eutepio does not upload it, but the outcome is the same — the backup ends up on somebody else's server under that service's terms. Choose the destination accordingly. 2.5 MIDI If you enable MIDI, the app talks to a music device connected over USB or Bluetooth. Only musical commands are sent (preset changes, parameter changes). No personal data or library content travels over MIDI, and the app collects nothing about you through it. 2.6 Exporting a setlist to PDF Exporting a setlist to PDF happens entirely on your device. The font used to typeset diacritics ships with the app, so the export needs no connection even the first time, and nothing goes out during it. 2.7 Built-in songbook browser The app can search the web for songs. Underneath it is a real browser — open a third-party songbook page and it loads exactly as it would in Chrome, including everything that page asks for on its own: scripts, ads and third-party visitor tracking. That means the site's operator and its partners see you like any other visitor — your public IP address, the pages you view, and any cookies they set. Eutepio sends them nothing about your library, your name or your band, and hands them none of your song content. If you never use this way of finding songs, none of it happens. Songs can be typed in by hand, imported from a file or scanned from paper. 2.8 Editing from your computer (local network) When you turn on editing from your computer, the phone starts an HTTP server on the local network and a computer on the same Wi-Fi reaches it through a browser. The server has no public address, passes through no relay, and the data does not leave your network. Access is protected by a six-character key handed over by QR code; the app keeps it between launches. The connection is not encrypted — unlike a band session it cannot be locked with a password, so anybody listening to the network can see what you send. The server runs only while the feature is switched on. 2.9 Problem reports from the app In Settings → Help and privacy → Report a problem you can describe a problem and send it to us. Nothing is sent on its own: the report goes out only after you have reviewed its full contents and tapped Send report or Open email. What a report contains: the text you write (what went wrong and, optionally, how to reproduce it), a report number, and always the app version and the name of the operating system. Depending on your choice, also: • Device and display details — on by default, you can turn them off: device manufacturer and model, system version (on Android also the API level and processor architecture), display resolution, app window size, pixel ratio, orientation, text scaling, app language and theme, and build mode. • Technical diagnostics — off by default: a cleaned error log (times, source and location in the app's code, without the error message texts). • An email address for a reply — optional. • A screenshot — optional, you pick it yourself. Your songs, libraries, notes and attachments are never attached automatically, and the app does not read the serial number, device name, account or any installation identifier. How a report travels. You can choose: • Send directly: the report goes over HTTPS to our receiving service reports.eutepio.com (running on Cloudflare Workers), which forwards it to a private channel on Discord. The receiving service does not store the report text, the contact, the screenshot or your IP address; it processes the IP address only momentarily to limit the number of requests. For 7 days it keeps only technical details about the report (report number, a fingerprint of the content and the delivery status) so the same report is not delivered twice. Processors are Cloudflare (cloudflare.com/privacypolicy) and Discord (discord.com/privacy). • Send by email: the app opens your mail app with a prefilled message to [email protected]. You send it yourself, and your email provider's terms apply. Purpose and retention. We use reports only to find and fix the problem and to reply if you left an email address. We keep a report until the problem is resolved, at most 12 months after we receive it. You can ask for earlier deletion at [email protected] — include the report number shown in the preview. 2.10 My devices (experimental) My devices is an experimental feature and is off by default (Settings → Connections and sharing → Experimental features). When you turn it on and pair your devices — for example a phone, a tablet and a computer — they exchange your library directly over the local network: songs including private notes and transposition, setlists, attachments and the setlist order. Data does not leave your network and does not pass through any server or relay. Pairing uses a code or QR code valid for 5 minutes, and both devices show the same number to confirm. The connection is encrypted (the Noise protocol); the encryption keys are created on the device, are never sent anywhere and are not part of backups. Paired devices see the name you give your device. To find each other, the app advertises on the local network via mDNS with the service type _eutepio-me._tcp and a random name, without your name. You can turn the feature off at any time; “Disconnect this device” deletes its identity and keys, and your libraries stay.

Eutepio requests the following permissions: • Camera — to take photos of sheet music you attach to a song. • Local network and nearby devices — to discover band members on the local WiFi. • Notifications (Android 13+) — showing an ongoing notification while a band session, editing from a computer or an exchange between your devices is running. Denying notifications does not break these features; you just won't see the status notification. • WiFi state — to keep the WiFi radio active for the duration of a session so the connection does not drop when the screen turns off during a performance. On Android the app does not request access to your photo library. Both picking an image and picking a backup folder go through the system file picker, which grants access only to what you select. We do not use location, contacts, SMS or advertising identifiers.

The app embeds these libraries. None of them collect analytics about your use of Eutepio. • Flutter (Google) — the user interface runtime. • Isar — the local database. • Google ML Kit Text Recognition — on-device OCR, see 2.3. • flutter_inappwebview — the WebView that renders notation and hosts the built-in songbook browser, see 2.7. • flutter_midi_command — communication with MIDI devices. • audioplayers — metronome sound and backing-track playback. Stems are read from your device and never sent anywhere. • battery_plus — battery level for the pre-gig check (the value is sent only to other members of your session on your local network). • OpenSheetMusicDisplay — MusicXML rendering. The library ships inside the installation package and loads locally, so opening a score sends no outbound request. • cryptography — encryption of band sessions and My devices. • flutter_email_sender — opening a prefilled problem report email in your mail app. • url_launcher — opening the link to this policy in your browser. The app contains no analytics, no automatic crash reporting and no telemetry. You send problem reports only manually (section 2.9).

Different rules apply on the website than in the app, because the website has forms. Beta signup: submitting it sends your name, your email address, the platform you chose, optional answers to three questions (how you will use Eutepio, how many of you play and what you use today) and an optional note to our internal Discord queue. Those three answers only help us talk about the beta with a mix of different groups; you can leave them out and nothing changes. The form is optional — you install Eutepio without it on all three platforms. We need the address in full only so we can reply to you. We use the address solely for testing and related contact, we do not pass it on, and we do not use it for the newsletter. You can ask to be removed from the queue at any time at [email protected]. Feature request and bug report forms: submitting one sends your name, email address, description and the technical details you filled in (device, app version, severity) to the same queue. The email is used solely so we can reply to you, and is not shared further. The Buggy button (report a bug): submitting one sends your description, the kind of problem and how much it bothers you, optional steps to reproduce it, an optional email address, the address of the page you were on, your browser window size, the browser and operating system name, and the site language to the same queue. For an app bug it also sends the platform you pick, and optionally a device description and the app version. For a website bug it also attaches the technical log of an error the page itself reported — you see it in the panel before you send. If you leave Attach a screenshot of this page ticked, an image of that page as you currently see it is sent too. The screenshot is produced from the page content inside your own browser — it captures nothing outside the tab, no other windows and no desktop. You see it in a preview before the report goes out, and you can untick it. You can attach your own image from your device instead; for an app bug that is the only way, because the website cannot see into the app. You choose the file, nothing is uploaded in the background, and you see it in a preview before sending. Without an email the report is anonymous. Newsletter: only the domain of your address is sent to our queue, in the form *@example.com. We do not store the address itself. That holds for every destination we send to — nobody receives the full newsletter address, ourselves included. Where that "queue" actually goes: every form sends its message to one or more destinations we configure. In practice that is a Discord channel — a third-party processor, policy at discord.com/privacy — and our own server, where the message is stored so it does not get lost. We pass it to nobody else, and we neither sell the data nor use it for advertising. localStorage: the site stores your light/dark mode choice and language preference in the browser. This is a technical setting that stays on your device. We use no advertising or tracking cookies. Visitor measurement: the site runs Cloudflare Web Analytics. It records which pages were viewed, how fast they loaded, where the visitor came from, and their device type and country. It uses no cookies and no browser fingerprint, does not follow you across sites, and stores nothing that could identify you. We only ever see aggregate numbers. The processor is Cloudflare; their policy is at cloudflare.com/privacypolicy. The app itself has no measurement of any kind. Payments: Eutepio is free and contains no purchases. If we introduce voluntary contributions in the future, they will run through a third-party payment provider, we will not have access to your card number, and this policy will be updated beforehand.

All app data lives on your device. Uninstalling Eutepio makes the operating system remove the app's private storage, which deletes everything the app stored, including safety backups. To delete the data without uninstalling, use Settings → Help and privacy → Manage data → Delete all data. Problem reports you sent us are kept until the problem is resolved, at most 12 months (section 2.9).

Eutepio has no age gate; it is meant for musicians of any age. It does not knowingly collect personal information from any user, so no special provisions for children apply. A worried parent can uninstall the app at any time. The only thing left on our side is a problem report that was sent manually; we delete it on request at [email protected].

App data is on your device, so your GDPR rights over it are self-service: • Access: your data is on your device. • Portability: Settings → Libraries and backups → Back up and restore → Create backup produces an .eutbackup file with your whole library. • Erasure: Settings → Help and privacy → Manage data → Delete all data, or uninstall. • Rectification: edit your songs directly in the app. For problem reports from the app and for anything you sent us through the web forms, contact us at [email protected] and we will delete it.

We may update this policy as Eutepio evolves. The revision date at the top of the document reflects the last change. Material changes will be called out in the release notes.

Data controller: Eutepio, Czech Republic. Email: [email protected]