Spiccor Privacy Policy
Effective date: October 29, 2026
Spiccor is a violin practice tool built by a small team of students as a hackathon project. It is not a company. In this policy, "Spiccor," "we" and "us" mean the people who build and run it. Questions or requests go to [email protected].
The short version
- Spiccor stores your account, music, recordings and feedback on our servers, not on your device, so you can reach them from anywhere you sign in.
- You can try Spiccor as a guest without an account. A guest library is tied to your browser and is erased 30 days after you start it. Sign in to keep it.
- Your camera and microphone turn on only after your browser asks you and you allow it.
- Some optional features send limited data to outside services: Bitdeer for written feedback and the tutor, and your browser's speech service if you ask the tutor a question out loud. You choose when to use them.
- We don't sell your data, show ads, or use your recordings to train models.
- When you remove something, you can undo it for 10 minutes. After that it is deleted for good. You can delete your whole account yourself at any time.
What we collect
Guest use. Without an account, Spiccor gives your browser a random guest ID in a cookie so your library stays private to you. We don't ask who you are. If you sign in later, your guest library moves to your account. Otherwise it is erased 30 days after you start it, or sooner if you choose Delete my data. Clearing your cookies loses access to it, and it is still erased on schedule.
Account information. Your email address (you sign in with a one-time code we email you), a display name (we start it from the part of your email before the @, and you can change it), and the sign-in records our authentication provider keeps.
Your library. The sheet music you upload (PDF, MusicXML or compressed MusicXML), the recordings you make or upload (audio, and video if you use the camera), the names you give pieces and recordings, and the analysis Spiccor produces. That analysis includes note timing, pitch, vibrato, loudness and posture measurements, scores, and written feedback. For a song you upload, Spiccor keeps the converted audio and the melody it separates from it (the singing, lead or guitar part), so you can listen to that melody beside the violin part. Both are erased with the piece.
Camera and microphone. Spiccor uses your camera or microphone only after your browser asks for permission and you allow it. You can withdraw that permission at any time in your browser's settings. When you use the camera, Spiccor estimates the positions of points on your body and hands, such as shoulders, elbows, wrists and finger joints, frame by frame. It uses them only to measure your playing posture and hand shape. We don't use them to identify you or recognize your face, and we don't compare them across people for that purpose.
Speaking to the tutor. The tutor reads its answers aloud with Kokoro, an open-source voice model that runs inside your browser, on your device. The first time you use it, your browser downloads the model from Spiccor's own server (92 MB, or 326 MB on devices with a graphics processor) and keeps it for next time. The tutor's words are never sent anywhere to be spoken. If the model can't run, your browser's built-in voice is used instead, also on your device. If you ask a question out loud, your browser turns your speech into text, and many browsers do that on their maker's servers: Chrome and Edge send the audio to Google or Microsoft, and Safari may send it to Apple. That company handles the audio under its own privacy policy, not ours. Spiccor receives only the text. The microphone turns on only when you press the button to ask by voice. If you'd rather not, type your question instead.
Tutor conversations. The questions you type or speak to the violin tutor, and its answers.
Technical information. Basic server logs that hosting normally produces, such as IP address, browser type, request times and error messages. We use them to keep the service running and to fix problems. To stop any one person from overloading Spiccor, the server also counts recent requests by IP address and by account or guest ID. Those counts are kept only in the server's memory, last at most an hour, and are not written to disk.
Analytics, only if you allow it. When you first visit, Spiccor asks whether it may use Google Analytics. If you say yes, Google Analytics sets cookies (_ga) and records which pages and features you use, your approximate location (country or city), your device and browser type, and how you arrived. Google receives your IP address to do this but doesn't store it. We use the reports only to see which features people use and where Spiccor breaks. Google signals and ad personalization are off, and nothing is used for advertising. Your music, recordings, feedback, tutor questions and email address are never sent to Google Analytics. If you say no, the Google Analytics script never loads. You can change your answer any time from Analytics at the bottom of the library.
What we don't collect. We don't use advertising trackers, we don't use analytics unless you allow it, and we don't buy data about you from anyone.
How we use it
We use your information to:
- Run the features you ask for: read your sheet music, analyze your recordings, show your feedback, and keep your library
- Answer your tutor questions
- Keep the service secure, prevent abuse, and fix bugs
- Contact you about your account or about changes to this policy
We don't sell or rent your personal information. We don't share it for cross-context behavioral advertising. We don't use your recordings, camera measurements or conversations to train machine-learning models.
Outside services that receive data
Spiccor uses these providers. Each receives only what its feature needs.
| Provider | When | What it receives |
|---|---|---|
| Supabase | When you sign in | Your email address and sign-in records. It runs sign-in for us. |
| Bitdeer AI | Written feedback, video posture review, and the tutor | Summaries of your feedback, such as flagged notes and their measurements, and your tutor questions. For video posture review, a few still frames from your video and the hand measurements. Not your full recordings. |
| Google Analytics | Only if you allow analytics | Page and feature use, approximate location, device and browser type, and your IP address, which Google uses for location and then discards. Ads features are off. |
| Your browser's maker (Google, Microsoft or Apple) | When you ask the tutor a question out loud | The audio of your question, to turn it into text. This goes from your browser to them, not through Spiccor. |
| Microsoft Azure and Cloudflare | Always | Azure runs the server that stores your library, uploads and recordings. Cloudflare carries the connection between your browser and that server. |
Each provider handles data under its own terms and privacy policy.
We may also share information if the law requires it, to protect someone's safety, or to investigate abuse of the service.
Children
Many violinists are young. Spiccor isn't directed at children under 13, and we don't knowingly collect personal information from them. Anyone under 13 should not create an account or send recordings to Spiccor. If you think a child under 13 has given us information, email us and we will delete it.
If you are 13 to 17, please use Spiccor with a parent's or guardian's permission.
How long we keep it
- Things you remove: When you remove a piece or recording, you have 10 minutes to undo it. After that we permanently erase it: the original file, the recording, its analysis and feedback, and the posture tracking made from its video. A piece that one of your saved recordings still uses is erased once that recording is gone too. Copies in backups may last up to 30 days before they are overwritten.
- While you keep something: Pieces, recordings and feedback stay in your library until you remove them or delete your account.
- Guest libraries: Erased 30 days after the guest library starts, unless you sign in first.
- Account deletion: Choose Delete account in the library menu. Your pieces, recordings, feedback, stored files and profile are erased right away. Copies in backups may last up to 30 days before they are overwritten. You can also email us and we'll do it for you.
- Logs: We keep server logs for up to 30 days unless we need them longer to investigate a security problem.
- Rate-limit counts: Kept in memory for at most an hour, and lost whenever the server restarts.
- Analytics: If you allow analytics, Google Analytics keeps that data for 2 months, then deletes it. Its _ga cookies last up to 2 years in your browser unless you clear them or choose "No thanks".
- Outside providers: Bitdeer, and your browser's maker for spoken questions, keep what they receive according to their own policies.
Spiccor is a hackathon project and may shut down. If it does, we will delete all stored data and give notice on the site before we do.
Security
Each account's library is kept apart by database access rules. Uploaded files sit in a private storage area that only that account can reach. Connections to Spiccor and to AI providers use HTTPS. No system is perfectly secure. Spiccor is a student project, not an audited production service, so please don't upload anything you couldn't stand to lose or have exposed.
Your choices and rights
- Remove what you don't want kept. Anything you remove is erased for good after 10 minutes.
- Skip the camera. Spiccor works with audio only; posture feedback is simply left out.
- Skip the AI features. The tutor, AI-written feedback and voice are optional.
- Say no to analytics. Choose "No thanks" when asked, or change your answer from Analytics at the bottom of the library. Blocking cookies in your browser works too.
- Access, correct, export or delete. Email us, and we'll respond within 30 days.
Depending on where you live (for example California, other U.S. states, the European Economic Area or the UK), you may have legal rights to access, correct, delete or move your data, and to object to or limit some uses. We will honor those requests for everyone, wherever they live. We won't treat you differently for making one. If you are in the EEA or UK, we process your data to provide the service you asked for and, for security and bug fixes, for our legitimate interest in keeping it working. You can also complain to your local data protection authority.
Our servers and providers may be in the United States or elsewhere, so your data may be processed outside the country where you live.
Changes
If this policy changes, we'll update the date at the top. For significant changes, we'll also notify signed-in users in the app or by email before the change takes effect.