Legal

Privacy Policy

Last updated: March 2026 · We don't sell your data. Ever.

We collect only what's needed to run GTAI. No ads, no data brokers, no tracking pixels.

1. What We Collect

Data	Why	Stored
Username	Identify your account	Our database
Password (hashed)	Authenticate you securely	Our database (bcrypt, never readable)
Email address	Password reset only	Our database
Practice progress	Track your chord learning	Our database
Session history	Show your practice stats	Our database (last 50 sessions)
High score	Leaderboard	Our database
📷 Camera feed	Real-time hand tracking for chord feedback	Never stored or transmitted — processed locally on your device only, discarded frame-by-frame
🖐 Hand landmark coordinates	Detect finger positions and chord shapes	On-device only — computed in your browser, never uploaded, discarded after each frame
🎙 Microphone audio	Tuner and string-check features	Never recorded or sent — processed locally in real time only

We do not collect IP addresses for tracking, device fingerprints, or browsing history.

2. How We Use It

To save and sync your practice progress across devices.
To send password reset emails when you request them.
To display your score on the leaderboard (username only).
To improve the app based on aggregate usage patterns.

We will never sell, rent, or share your personal data with advertisers or third-party data brokers.

3. Email

We only send emails when you explicitly request them (password reset, email verification). We do not send marketing emails unless you opt in. Transactional emails are sent via Resend.

4. Cookies

We use a single HttpOnly cookie to keep you logged in. This cookie:

Cannot be accessed by JavaScript — it's protected against XSS attacks.
Is only sent over HTTPS in production.
Expires after 30 days of inactivity.
Is deleted immediately when you sign out.

We do not use advertising cookies, analytics cookies, or third-party tracking cookies.

5. Third-Party Services

Render.com — hosts our backend server and database.
Netlify — hosts the frontend.
Resend — sends transactional emails.
OpenRouter / Meta Llama — powers the AI chat feature. Messages sent to the AI assistant are processed by these services.

Each of these services has their own privacy policy. We do not share your account data with them beyond what's necessary to operate the service.

6. Camera & Microphone

📷 No images or video ever leave your device.

Your camera feed is processed entirely inside your browser using WebGL. No video frames, screenshots, images, or hand landmark data are uploaded to our servers or any third party — not even temporarily.

How hand tracking works: GTAI uses MediaPipe, an on-device AI library from Google, to detect 21 hand-joint positions (landmarks) in real time directly on your device's GPU. The raw camera pixels are consumed by MediaPipe and immediately discarded. Only the resulting landmark coordinates (21 x/y/z numbers) are used to evaluate your chord shape — and those numbers are also discarded after each video frame (~33 ms).

What's captured	Processed where	Stored / transmitted?
Raw video frames from webcam	Your device (WebGL / GPU)	Never — discarded each frame
Hand landmark coordinates (21 points)	Your device (JavaScript)	Never — discarded each frame
Microphone audio (tuner / string check)	Your device (Web Audio API)	Never — not recorded or sent

Privacy controls: The app includes built-in camera privacy options in Account settings:

Crop to Hand Area — zooms the camera into the circular hand-tracking area. Only your fretting hand and guitar neck are visible; your face and surroundings are outside the frame entirely.
Background Blur — keeps the hand circle sharp and softens everything outside it with a blur effect. The AI tracking continues working at full accuracy while your environment and face are obscured.

Camera and microphone access can be revoked at any time from your browser's site permissions. The app will stop all media capture immediately.

7. Your Rights

Access: You can view all your stored data from your account settings.
Delete: You can permanently delete your account and all associated data at any time from Settings → Delete Account.
Correct: Contact us to correct any inaccurate data.
Export: Contact us to request an export of your data.

8. Data Retention

Your data is kept for as long as your account is active. When you delete your account, all data is permanently and immediately removed from our database. We keep no backups of deleted accounts.

9. Children

GTAI is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has created an account, contact us and we will delete it.

10. Changes

If we make significant changes to this policy, we will notify users by email and update the "Last updated" date above.

11. Contact

Privacy questions or data requests: [email protected]