Privacy notice
Last updated: 1 November 2026.
Who processes the data
Data controller: Massimiliano Fioravanti. Privacy contact: privacy@musicappitaly.com; for anything else support@musicappitaly.com.
What we do not collect
- Session audio, video and chat do not go through our servers: they travel between the participants' computers, encrypted.
- WAV recordings stay on your computer.
- This site uses no cookies and no tracking tools.
Which data, why and for how long
| Data | What | Purpose and legal basis | Retention |
|---|---|---|---|
| Account | Email, password (kept by Supabase only as a non-reversible hash), support code | Providing the service (contract) | Until the account is deleted |
| Rooms | Name, type, capacity, 6-digit code, cryptographic proof of the password (never the password) | Providing the service | Until deleted; a room empty for 3 days is deleted after a notice |
| Presence | The room you are in, a random device identifier, times | One presence per account, entry ticket | About 90 seconds after the last update |
| Connection | Public IP address and port of the coordinator; during a session the participants' computers exchange IP addresses (also the home network one, only between those behind the same router) to connect to each other; whoever enters leaves its public address and port for at most 60 seconds, so the coordinator can open its own router for it. To learn its public address the app asks Cloudflare's and Google's STUN servers, which only see the IP address: no audio or room data passes through them | Delivering the audio (contract) | While the room is open |
| Security | Failed access attempts linked to the account or IP | Preventing abuse (legitimate interest) | At most 30 minutes; after 10 wrong attempts entering rooms is locked for 20 minutes |
| Subscription | PayPal subscription id and status, expiry. Payment data stays with PayPal | Contract, tax obligations | For the subscription and the years required by law |
| Anonymous measurements (optional) | Only technical numbers of the session, rounded (latency, loss, interruptions, buffers, format, OS, version) and the day received; no account, IP, name, room or time of day | Consent, revocable in the app | Deleted automatically after 3 months |
| Service emails | Your address, for room and account notices | Contract | Until sent |
Who we rely on
Supabase (database, sign-in and service functions, servers in the European Union, Ireland), Aruba (sending emails), PayPal (payments, as an independent controller for payment data), Cloudflare (hosting this site and the administration page). We do not sell data to anyone.
Your rights
You can ask for access, correction, deletion, restriction, portability, and object to processing based on legitimate interest, by writing to privacy@musicappitaly.com. You can withdraw consent to the anonymous measurements at any time on the app's «Stanze» (rooms) page. You can also lodge a complaint with the Italian data protection authority (garanteprivacy.it) or your local one.