Compose with Me Compose with Me

Privacy Policy

Last Updated: October 23, 2026

1. Overview

At Compose with Me (accessible at composewithme.com), your privacy and the privacy of your young musicians is our highest priority. This Privacy Policy outlines what information we collect, how it is used, and the steps we take to protect your data.

Compose with Me is offered only to people who live in the United States or a U.S. territory. We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and U.S. state privacy laws. See Your U.S. State Privacy Rights for the rights you have over your information.

2. Microphone Audio Processing (Crucial)

Compose with Me uses your device’s microphone strictly for interactive pitch detection and real-time tuner feedback.

  • Audio is processed locally in real-time in device memory.
  • Audio is never recorded, stored on any server, or transmitted over the internet.
  • Microphone access is requested only when activating practice or tuning tools.

3. Information We Collect

  • Account Credentials: If you register, we store your email address and authentication credentials securely via our authentication provider (Supabase). If you sign in with Google, see Google User Data for exactly what we receive from Google and how we handle it.
  • Age Question: When an account is set up we ask for a birth month and year and where you live (the U.S. or a U.S. territory, and your state if you're in the U.S.). These answers stay on your device and are never sent to us. We keep only the outcome: whether the account holder is an adult, a teen whose parent or guardian pays for the plan, or a parent who set the account up for a child (see Section 5), together with that parent's name and the date and version of the Parent Notice they agreed to.
  • Location Check: Because Compose with Me is offered only in the U.S. and its territories, when you sign up, answer the age question, or start a subscription, our server checks which country your IP address belongs to. It uses a copy of the IP Geolocation by DB-IP database kept on our own server, so your address isn't sent to DB-IP or anyone else. Neither the address nor the country is stored.
  • Parent Billing for Teens: If a teen asks a parent or guardian to pay for their plan, we email the address the teen enters through our email provider, Resend. We don't store that address in our database: it travels sealed inside the link we email, which stops working after 7 days. The parent's page shows the teen's account email and the plan. If the parent pays, Stripe keeps their email as the billing contact, along with the time they confirmed they are the teen's parent or guardian.
  • Free Trial: We record when your free trial started and ends, and about two days before it ends we send one email to your account's email address, through our email provider Resend, so you can choose a plan in time.
  • Compositions & Learning Progress: Sheet music notes, practice streaks, tempo preferences, and mastery percentages are stored to synchronize your music library across your devices.
  • Practice Activity: When you play a song in the practice player we record the song title, how long you practiced, and whether you finished the piece. This powers your streaks and assignment progress.
  • Sharing With Your Teacher: If you join a studio run by a teacher, or redeem a teacher's assignment code, that teacher can see the display name you chose, your practice streak, practice time, recently practiced song titles, and assignment completion. Teachers never see your email address or account details. You stop sharing with a studio's teacher by leaving the studio.
  • Error Reports: When something in the app breaks, a technical report (the error message, the page and code involved, and your browser or device type) is sent to our error-monitoring provider, Sentry, so we can fix it. Error reports do not include your email address, password, IP address, or payment details.
  • Feedback: If you send feedback from Settings, we receive your message, the topic you picked, your account's email address (so we can reply), your account ID, and whether you sent it from the website or the Android app. It is delivered by email to our support inbox through our email provider, Resend, and is not stored in the app's database, so Download My Data doesn't include it. Messages with offensive language are refused before they are sent and are not kept.
  • No Advertising / No Trackers: We do not sell your personal information, display third-party advertisements, or use behavioral tracking scripts.

Google User Data

You can sign in to Compose with Me with your Google Account instead of a password. This section explains what Google user data the app receives when you do, and how we handle it. Signing in with Google is optional; you can always use an email address instead.

What we access

We ask Google only for basic sign-in information (the “openid”, “email”, and “profile” permissions). Google then shares with us:

  • your email address and whether Google has verified it;
  • your name as it appears on your Google Account;
  • the web address of your Google profile picture;
  • your Google account ID, a number that identifies your Google Account to us.

We do not ask for, and cannot see, your Google password, Gmail, contacts, calendar, Drive files, YouTube activity, location, or any other data in your Google Account.

How we use it

  • Email address and Google account ID: to create your Compose with Me account, sign you in, and recognize you when you sign in again. We also use the email address to answer feedback you send and to contact you about your account.
  • Name: to greet you by name in the app until you choose a display name. Only you see it; teachers and group members see only the display name you choose.
  • Profile picture: not used or displayed. It is kept only because our sign-in provider saves it with the rest of your sign-in record.

We use Google user data only to provide and secure the features of Compose with Me that you see in the app, and for no other purpose.

How we store, share, and protect it

  • Storage: this information is kept in your sign-in record with our authentication provider, Supabase (United States), which processes it only on our instructions to sign you in. Our server, hosted by Render (United States), reads it when it runs the features below and does not keep a copy.
  • Sharing: we do not sell, rent, or trade Google user data. Only your email address leaves Supabase, and only for these features:
    • Stripe (Link), when you subscribe on our website: we fill in your email address on the checkout page so your receipt and billing account use it.
    • Resend, our email provider, when we send an email about your account, and when you send feedback (your address is the reply-to, so we can answer you). Feedback and our replies are kept in our support inbox at Proton.
    • Your parent or guardian, if you are a teen and ask them to pay for your plan: the email we send them, and the page it links to, show your account's email address so they know who asked.
    Each of these providers uses it only to deliver that feature for us. Otherwise we disclose Google user data only when the law requires it (for example, a valid court order). Your Google name and profile picture are never shared with anyone, and teachers, studio members, and group members never see your email address, Google name, or profile picture.
  • Protection: Google user data is sent only over encrypted HTTPS connections, is encrypted at rest in our database and its backups, and can be reached only by your own signed-in account and by the systems that need it for the features above. See How We Protect Your Information.

Retention and deletion

  • We keep Google user data for as long as your Compose with Me account exists.
  • When you delete your account (Settings > Danger Zone > Delete Account & Data, the account deletion page, or by emailing support@composewithme.com), your Google user data is deleted from our database immediately. Database backups expire on our provider's normal schedule and are never used to bring back deleted data.
  • An account a child creates with Google sign-in is deleted, with its Google user data, unless a parent completes setup (see Section 5).
  • You can also remove Compose with Me's access to your Google Account at any time at myaccount.google.com/connections. That stops Google sign-in for Compose with Me but does not delete your account; delete it as described above if you want your data removed too.

Limited Use

Compose with Me's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data:

  • to serve advertising, including targeted, personalized, or interest-based ads;
  • to sell it, or to transfer it to data brokers or information resellers;
  • to develop, improve, or train artificial intelligence or machine learning models, including generalized AI/ML models;
  • to determine creditworthiness or for lending purposes;
  • for any purpose other than providing or improving the features of Compose with Me that you use.

No person at Compose with Me reads your Google user data unless you ask us to (for example, in a support request), it is needed for security or to investigate abuse, or the law requires it. If we ever change how the app uses Google user data, we will update this policy and tell you in the app before the change takes effect.

4. Data Deletion and Control

You have full ownership of your data. You may delete your account and all associated songs, progress, and settings at any time:

  • Directly inside the app via Settings > Danger Zone > Delete Account & Data, or Delete Account on the Plans page if your subscription has ended. Deleting the account also cancels a subscription bought on our website right away; a Google Play subscription must be canceled in Google Play.
  • Online via our public deletion page: composewithme.com/delete-account.html.
  • By emailing our support team at support@composewithme.com.

You can also download a copy of everything we store for your account, in a machine-readable (JSON) file, from Settings > Your data > Download My Data (or the same button on the Plans page).

5. Children's Privacy (COPPA)

Compose with Me is used by musicians of all ages, including children under 13. We comply with the U.S. Children's Online Privacy Protection Act (COPPA). When an account is set up we ask for a birth month and year and where the user lives (the U.S. or a U.S. territory, and the state in the U.S.); none of these answers is stored. Below, “child” means anyone under 13.

  • Parents set up children's accounts. A child never creates an account. A parent or legal guardian signs up with their own email address, reads our Parent Notice, and gives consent; the consent is completed when the parent starts a paid subscription. If a child tries to sign up, we ask for a parent instead, and an account a child made with Google sign-in is deleted unless a parent completes setup.
  • What we collect from a child: the songs, settings, and practice activity described in Section 3, a display name if the child joins a studio or group, and any feedback sent from the account (our reply goes only to the parent's email address). If feedback contains a child's personal information, we delete it once we have answered. We do not collect a child's email address, phone number, photo, location, contacts, or advertising ID, and the microphone audio never leaves the device.
  • How we use it: only to provide the app's features. We do not show ads, sell information, use behavioral tracking, or build profiles of children.
  • Who sees it: a teacher whose studio the child joins or whose assignment they redeem; members of ensemble groups the child joins; and our service providers Supabase (sign-in and storage), Render (hosting), Cloudflare (website delivery and security), Sentry (error reports), and Resend and Proton (email, for feedback), which may use it only to run the app for us. Joining studios and groups is optional.
  • Parents' rights: a parent may review their child's information, have some or all of it deleted, or withdraw consent and stop further collection at any time. Use Settings > Danger Zone > Delete Account & Data, the account deletion page, or email support@composewithme.com from the account's email address.
  • If we learn that we have collected information from a child under 13 without a parent's consent, we delete it.

Data Retention

We keep personal information only as long as we need it to run the app, and then delete it:

  • Account, songs, settings, and practice activity: for as long as the account exists. Deleting the account erases them from our database immediately.
  • Free trial already used: if an account that had the free trial is deleted, we keep a one-way, keyed fingerprint of its email address so that address can't start a second free trial. The fingerprint can't be turned back into the email address. We keep it for two years after the account is deleted, then delete it automatically. You can ask us to remove it sooner, but we may keep it where needed to prevent trial abuse.
  • Accounts set up for a child that never start a subscription: deleted after 30 days, along with the parent's name and email address.
  • Database backups: expire on our hosting provider's normal schedule and are never used to bring back deleted data.
  • Error reports: deleted automatically by Sentry within 90 days.
  • Feedback and other emails to support: kept in our support inbox for up to 12 months after the conversation ends, then deleted. Ask us to delete yours sooner at any time.
  • Purchase records: Stripe's Link and Google Play keep their own records of payments as the law requires them to; we keep only a customer reference and subscription status while the account exists.

How We Protect Your Information

  • Encrypted connections: everything sent between the app and our servers travels over encrypted HTTPS connections.
  • Encrypted storage: our database and its backups are encrypted at rest by our storage provider.
  • A second layer for everything you write: for every account, whatever its age, your songs, settings, names, studio and assignment content, and practice notes are encrypted again by our own server before they are saved, and are decrypted only by that server when you open the app. The key for that layer is kept separately from the database, so a copy of the database alone does not reveal them.
  • Access controls: each account can reach only its own information, apart from the sharing with teachers and groups described in Section 3.
  • No system is perfectly secure. If a breach ever affects your information, we will notify you as the law requires.

Your U.S. State Privacy Rights

Depending on where you reside (such as California, Colorado, Connecticut, Utah, or Virginia), you may have specific rights regarding your personal information:

  • Right to Know / Access: You may request to know what personal information we collect, use, and disclose.
  • Right to Delete: You may request the deletion of your personal information.
  • Right to Correct: You may request that we correct inaccurate personal information.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
  • No Sale or Sharing of Personal Information: We do not sell or share your personal information (as defined by applicable state laws) for cross-context behavioral advertising.

To exercise any of these rights, use the Download My Data and Delete Account tools in Settings or email us at support@composewithme.com. If you are a parent managing a child's account, you may exercise these rights on their behalf.

Who Processes Your Data, and Where

  • Supabase (sign-in and database, United States).
  • Render (hosting of the website and our server, United States). Like any web host, it briefly logs the IP address of each request for security and troubleshooting.
  • Cloudflare (delivers composewithme.com and protects it from attacks, United States, with servers worldwide). Every visit to the website passes through Cloudflare, so it processes your IP address and the page requested, to deliver the site and block abuse. When you sign up, sign in with a password, reset a password, or ask for a new code, Cloudflare's Turnstile check also looks at technical signals from your browser (such as its type and how the page was loaded) to tell people from automated sign-ups. Cloudflare doesn't use it for advertising or to track you across websites.
  • Sentry (error reports, United States).
  • Resend (delivers feedback from the app to our support inbox, the payment links teens ask us to send their parents, and the email telling you your free trial ends soon, United States).
  • Proton (our email inbox, where feedback and support emails are kept, Switzerland).
  • Stripe (Link) and Google Play handle purchases under their own privacy policies.

Our service providers act only on our instructions under data processing agreements.

Fonts and instrument sounds are served from our own website, so opening the app does not send your IP address to Google, GitHub, or any third party other than the service providers listed above.

Cookies and storage on your device

We do not use advertising or analytics cookies or trackers. The app keeps a few items in your browser's local storage that it needs to work: your sign-in session, your settings and theme, an offline copy of your songs, and the age question's outcome on that device. Because these are strictly necessary for the service you asked for, they do not require a consent banner.

6. Subscriptions, In-App Purchases & Billing

Compose with Me offers optional auto-renewing subscription tiers, billed monthly or annually (Student Tier at $4.99/month or $49.99/year, Advanced Tier at $9.99/month or $99.99/year, and Teacher Tier at $14.99/month or $149.99/year) that unlock expanded song limits, advanced sheet music composition tools, collaborative ensemble groups, and studio tools for individual teachers.

  • Web Purchases: Subscriptions bought on our website are sold and processed through Link, a service of Stripe, which acts as reseller and merchant of record and handles payment, sales tax, and receipts. Link collects the payment details and billing address needed for the purchase under its own privacy policy. We receive only your subscription status, a customer reference, and the country of your billing address, never your full card number. Because we serve only the U.S. and its territories, a purchase billed to another country is emailed to our support inbox (the account ID, the country, and the Stripe references) so we can review it.
  • Android Purchases: In-app subscriptions on Android are processed through Google Play Billing.
  • No Card Storage: Compose with Me does not collect, process, or store payment card details or bank account numbers on its servers.
  • Auto-Renewal: Subscriptions automatically renew at the rate for your plan at the end of each monthly or annual billing period unless cancelled at least 24 hours before renewal.
  • Cancellation & Management: Web subscribers can cancel, switch plans, or update their card through “Manage Billing” on the Plans page or at link.com. Android subscribers can manage their subscription in the Google Play Subscriptions Center. Cancellation takes effect at the end of the current prepaid billing period.
  • Refunds: Web refund requests can be sent to support@composewithme.com. Google Play purchases follow Google Play's standard refund policies. See our Terms of Use for details.

7. Contact Us

If you have questions regarding this Privacy Policy, your subscription, or your data, please contact:

support@composewithme.com

CCM Tech Services, LLC
7901 4th Street N, STE 300, St. Petersburg, FL 33702-4626
(850) 761-7300

Terms of Use Back to Dashboard