Privacy policy

Last updated 17 October 2026

SimpleNotation (simplenotation.com) is run by C. Kerger in San Francisco, California (“we”, “us”). This page explains what the site collects, why, who else sees it and how long it is kept. Questions go to info@simplenotation.com or the contact form.

• You can use the editor without an account. Nothing reaches our database until you press Save.
• An account stores your email address, a display name and a hashed password. Nothing else about you.
• Scores are private by default. Only scores you make public are listed on the site and shown to search engines.
• We count visits with Ahrefs Web Analytics, which sets no cookies. There are no ads, and we never sell or share personal data.

What we collect and why

Your account. When you create an account we store your email address (to sign you in), a display name (yours, or the part of your email before the @ if you leave it empty) and your password as an scrypt hash, which we cannot turn back into the password.

Guest sessions. If you save without an account, we create a guest account with a random name such as “Guest 4821” and no email address. It is tied only to a cookie in your browser.

Your scores. For each score you save we store its music, title, privacy setting, every saved version (that is how version history works) and when it was created and changed. If you are signed in, we also store your editor preferences so they follow you between devices.

Files you import. Guitar Pro, MusicXML and MIDI files are read and converted inside your browser; the file itself is never uploaded. An imported score reaches our server only if you then save it.

Messages you send us. The contact form emails your name, email address and message to our mailbox. The site itself does not store them. We keep the email as long as we need it to answer you and deal with what you raised.

Server logs. Like every web server, ours logs each request: your IP address, the time, the address you asked for and your browser’s user agent. We use the logs to keep the site secure, to limit abuse (for example, too many sign-in attempts) and to fix errors. They are deleted after about two weeks.

Visit statistics. We use Ahrefs Web Analytics to see how many people visit and which pages they read. On each page view its script sends Ahrefs the page address, the page you came from, your browser language and your browser and device type. Ahrefs also receives your IP address with that request, as any server you connect to does. The script sets no cookies and does not use your browser’s storage; we checked. See Ahrefs’ privacy policy for how they handle the data.

Cookies and browser storage

We set exactly one cookie, fl_session. It is set only when you save as a guest or sign in, and it keeps you signed in. It lasts 60 days and renews while you keep using the site. It cannot be read by scripts and is not used for tracking or advertising. We store only a hash of it on the server.

The editor also keeps a few things in your browser’s local storage. They stay on your device and are never sent to us:

• fl.draft: your unsaved draft, so a closed tab does not lose your work
• fl.view, fl.editorPrefs and fl.playback: your view, editing and playback settings
• fl.recent: the scores you opened recently
• fl.tourDone: whether you have already seen the introductory tour

You can delete all of it at any time by clearing this site’s data in your browser. Clearing it also signs you out, and a guest loses access to their guest scores (see below).

Who can see your scores

• Private (the default): only you.
• Unlisted: anyone who has the link can open, play, export and copy the score. It is not listed anywhere, and search engines are asked not to index it.
• Public: anyone can open, play, export and copy it. It is listed on Explore and in our sitemap, and search engines may show it.

Unlisted and public scores show your display name as their author. If someone copies one of your unlisted or public scores, the copy belongs to their account and stays when you delete yours.

Who else receives data

The site, its database and its logs run on a server we operate. All its files, fonts and scripts come from that server, with one exception: the Ahrefs analytics script. Only these other parties receive personal data:

• Ahrefs (web analytics), as described above.
• Purelymail, our email provider, which carries contact-form messages and our replies.

We do not sell personal information, share it for advertising or give it to anyone else, unless the law requires us to.

How long we keep it

• Accounts and scores: until you delete them. A score you delete is removed from the database straight away, with all its versions.
• Sign-in sessions: they expire after 60 days without use, and expired sessions are cleared from the database regularly.
• Guest accounts: kept like any account. Because there is no email address, we cannot help you get one back once the cookie is gone. Create an account if you want to keep your scores.
• Server logs: about two weeks.
• Emails to us: as long as needed to deal with them.

Your choices and rights

You can export any of your scores (as PDF, Guitar Pro, MusicXML, MIDI, text tab, PNG or audio), change their privacy setting and delete them in the editor. To delete your account and everything in it, or to get a copy of the data we hold about you, write to info@simplenotation.com from the account’s email address. There is no button for deleting an account yet. We answer within 30 days.

Depending on where you live, you may have a legal right to access, correct, delete or export your data, and to object to how we use it. These include rights under the EU and UK GDPR and the California Consumer Privacy Act. We honour these requests from everyone, wherever they live. You can also complain to your local data protection authority.

For the GDPR, our legal bases are: providing the service you asked for (your account and scores), and our legitimate interest in keeping the site secure, understanding how many people use it and answering messages (logs, statistics and email).

Security

All traffic is encrypted with HTTPS. Passwords are stored only as scrypt hashes and sign-in cookies only as SHA-256 hashes. Private scores are served only to their owner. If we ever learn of a breach that affects your data, we will tell you.

Children

SimpleNotation is not aimed at children under 13, and they should not create an account. If you think a child under 13 has given us personal information, write to us and we will delete it.

Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use data you have already given us, we will say so on the site before it takes effect.