⚠ DRAFT — not yet in effect

This is a working draft prepared for review by a qualified attorney before publication. It describes the data practices intended for Jam Trainer and must be confirmed against the Service's actual configuration before it is relied upon. Bracketed items in [THIS STYLE] are to be finalized. If your audience includes EU/UK or California residents, have counsel confirm the GDPR/CCPA sections.

Jam Trainer Privacy Policy

Last updated: [EFFECTIVE DATE]

This Privacy Policy explains what information Jam Trainer (“we,” “us”) collects, how we use it, and the choices you have. It applies to the Jam Trainer website and web application at jamtrainer.com (the “Service”). By using the Service you agree to this Policy. We collect as little as we reasonably can, and we never sell your personal information.

1. Information we collect

Information you provide

Account information — your email address and a password. Authentication is handled by Google Firebase Authentication; your password is stored by Firebase in hashed form and is not readable by us. You may also provide a display name.
Your content — the songs, chord charts, tabs, lyrics, notes, links, lists, themes, and settings you create or import. This is stored so the Service can sync it across your devices.
Payment information — if and when you subscribe, payment is processed by Stripe. We do not receive or store your full card number; we may store limited details such as card brand, the last four digits, and expiration date, and your subscription status.
Communications — messages you send us (for example, support or feedback emails).

Information collected automatically

Local storage & cache — the Service stores data in your browser (via localStorage, IndexedDB, and a service-worker cache) so it loads quickly and works offline. This includes your songs, preferences, and a cached copy of the app and audio samples.
Technical & log data — like most web services, our providers may process technical information such as IP address, browser and device type, and timestamps in order to deliver the Service, keep it secure, and diagnose errors.

What we do not do: we do not use third-party advertising trackers, we do not build advertising profiles, and we do not sell or rent your personal information. Emails are only about the Service — not an ongoing newsletter unrelated to it.

2. How we use information

to provide, sync, and maintain the Service and your library;
to authenticate you and keep your account secure;
to process subscriptions and payments;
to send Service-related email — verification, password reset, subscription notices, and a small number of onboarding/feature emails you can opt out of;
to respond to your requests and provide support;
to diagnose problems, prevent abuse, and improve the Service;
to comply with legal obligations.

3. Service providers we share data with

We share personal information only with providers that help us run the Service, and only as needed for them to perform their function. We do not sell it or share it for others' marketing.

Provider	Purpose	Data involved
Google Firebase	Account authentication and cloud storage/sync of your songs and settings	Email, hashed password, your content, technical data
Netlify	Website/app hosting and serverless functions (including sending email)	Technical/log data; data passed to functions
Resend	Delivering transactional and lifecycle emails	Email address, name
Stripe (when subscriptions are live)	Processing payments	Email, name, payment details (handled by Stripe)

Keep this table in sync with the services actually used. Add any analytics or error-monitoring provider here if one is later added.

4. Content you share with others

If you publish a song to the shared/global library, share it by link, embed a chart, or use a live jam session, that content (and, for attribution, a name you provide) becomes visible to other people. When a song is shared or redistributed, the Service is designed to strip free-text material such as notes, lyrics, tab, and resource links before it leaves your library. Do not put sensitive personal information into song content you intend to share.

5. Affiliate links

The Service and our marketing pages may include affiliate links to retailers such as Amazon. If you follow such a link, the destination site sets its own cookies and collects information under its own privacy policy; we may earn a commission on qualifying purchases at no extra cost to you.

6. Retention and deletion

We keep your information for as long as your account is active or as needed to provide the Service. You can delete individual songs and lists at any time, and you can request deletion of your account by contacting info@jamtrainer.com. When you delete content or your account, we remove it from active systems (some deletions are tracked to keep the deletion in sync across your devices); residual copies may remain in backups for a limited period and are then overwritten. We may retain limited records where required by law.

7. Exporting your data (portability)

Your songs are yours. The Service provides tools to export your library so you can back it up or move it elsewhere. We consider your ability to leave with your own data a core principle, not an exception.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise any of these, email info@jamtrainer.com; we will respond as required by applicable law and will not discriminate against you for exercising your rights.

California (CCPA/CPRA): we do not sell or “share” personal information as those terms are defined, and we do not process it for cross-context behavioral advertising.
EU/UK (GDPR): our legal bases are performance of our contract with you (to provide the Service), your consent (for optional emails), and our legitimate interests (security and improvement). [Confirm data-transfer mechanism — the Service is hosted in the United States, so EU/UK data is transferred to the U.S.]

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us information, contact us and we will delete it.

10. Security

We use reputable providers and reasonable measures to protect your information, including encrypted connections and hashed passwords. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will take reasonable steps to notify you. The “Last updated” date above shows when it last changed.

12. Contact

Questions or requests about your privacy: info@jamtrainer.com [add a postal address if required for your jurisdiction].

This document is a draft pending legal review and is not legal advice.