Privacy Policy

Who we are

NewKey is operated by Erik Hughes Web Development, LLC, 213 North Glendale Ave. #1247, Glendale, CA 91206. This policy explains what we collect, why, and what choices you have.

What we collect

Account data: your name, email address and password when you create an account. If you sign in with Google, we receive your name and email address from Google rather than a password.

The charts you transpose, briefly. Your file is read, transposed and then discarded: we do not keep the chart you upload. What we do keep is a record that the work happened, which is its filename, a fingerprint of the file, how many staves it had and which key you asked for. The transposed PDF is stored for seven days so you can download it, and is then deleted automatically.

Billing data: a record of credit purchases and your credit balance. Card details are handled entirely by Stripe and never reach our servers.

Sign-up diagnostics: the IP address and browser user agent recorded when an account is created, kept to tell automated sign-ups from real ones.

Why we collect it

To run the product: to sign you in, to store and transpose the work you save, to sell and track credits, and to send the transactional email the service depends on, such as password resets and purchase receipts. We do not use your content to train models.

Who we share data with

We do not sell or share your personal information with third parties for advertising. We use a small number of service providers to run the product, each processing data only to provide their specific service to us:

• Stripe: processes payments and stores card details. We never see your full card number.
• SendGrid: sends transactional email on our behalf.
• Amazon Web Services: stores uploaded files and serves them over a CDN.
• Netlify: hosts and runs the application.
• Our database host: stores your account and content, in Postgres.
• Google: used only for “Sign in with Google,” if you choose that method.

Your rights and choices

As a matter of good practice, rather than because a business this size currently meets California's CCPA/CPRA thresholds, we honour the same kinds of requests larger companies are required to:

• Access and export: download everything held about you, as a file, from Settings.
• Correction: your name and email can be changed from your settings; ask us for anything else.
• Deletion: delete your account from Settings, without asking us.

What deletion actually does, because "delete" is doing two different jobs in most policies. Your name, email address, sign-up diagnostics and password are removed; your transposition history and any stored PDF go with them; and you can no longer sign in. What remains is the record of credits bought and spent, which tax and accounting rules require us to keep, with nothing left attached to it that says whose it was. We also ask Stripe to remove your name and email from the customer record it holds, though Stripe keeps the payment history itself under its own obligations.

Anything you would rather ask a person about, or a request we have not built a control for, still reaches us at the address below, and we aim to respond well within 30 days.

Cookies and analytics

NewKey uses a single first-party session cookie to keep you signed in. If analytics are enabled we use Plausible Analytics, which is cookieless, collects no personal information and reports only aggregate figures such as page views and referrers. We do not use advertising or tracking cookies, and we will update this section if that changes.

Children

NewKey is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.

Contact

Questions about this policy or your data: [email protected], or write to us at the address below.