Privacy policy

Last updated: 13 November 2026

This policy explains how we handle personal data on opensheetmusiceducation.org.

Who is responsible

The controller is PhonicScore GmbH, Assmayergasse 26/3, 1120 Vienna, Austria. For anything about your data, write to support@phonicscore.com.

The sight reading generator

The generator writes, draws and plays each exercise in your browser. Your settings and the exercise's number are in the page's address, so a link opens the same exercise; we don't store them. PDFs, prints and MusicXML downloads are made on your device too.

The piano sound and the metronome load from opensheetmusiceducation.org. Our server fetches them from midi-js-soundfonts on GitHub Pages, so GitHub sees our server, not you.

Exercises embedded on other websites. An embedded exercise is a frame that your browser loads from opensheetmusiceducation.org, so this policy applies to it, and to the website around it the policy of whoever runs that site. The frame sets no cookies and stores nothing.

Visiting the site

• The site is served by Cloudflare. To deliver a page and protect the site from attacks, Cloudflare processes your IP address, the time, the page requested and details of your browser. Legal basis: our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR).
• Visit statistics. We count visits with Usermaven, without cookies, to see which pages and settings are used and where the site needs work. Your browser sends the address and title of the page (on the generator, the choir generator, the rhythm trainer, ear training and the note-reading trainer the address holds the exercise's settings, on the first three also a title or line under it that you changed), the page you came from, your browser's language, screen size and time zone, and clicks on links and buttons to opensheetmusiceducation.org, never to Usermaven directly; our server passes them on to Usermaven with your IP address. From the generator, your browser also reports a few steps the same way: a new exercise, its first playback, a PDF or MusicXML download, a print, a copied link or embed code, each with the page's language and the exercise's level, major or minor, number of measures and time signature, and for a PDF or print the paper size, but never the title or line you typed. From the rhythm trainer, your browser reports its steps the same way: a new rhythm, its first playback, the start of a try at tapping along and copied embed code, each with the rhythm's level, time signature and number of measures (for a new rhythm also whether the button or a changed setting made it); the end of a try, with these and how many notes were on time as one of four bands, the strictness, whether you tapped with touch, a mouse or pen, the keyboard or a MIDI keyboard, the try's number up to three and the tempo as slow, medium or fast; measuring the delay, with its outcome and the delay as one of four bands; connecting a MIDI keyboard, with its outcome; a PDF or MusicXML download, a print and a copied link, with the paper size for a PDF or print. Each comes with the page's language, but never with your taps or the title or line you typed. From ear training, your browser reports its steps the same way: the first playback, with the exercise (intervals or melodic dictation); a new melody, with its level, major or minor and time signature, and whether the button or a changed setting made it; a checked melody, with these, how much of it was right as one of five bands, the help you used (the first note, the rhythm, both or none) and whether you answered mostly on the piano on screen, the computer keyboard or a MIDI keyboard; each answered interval, with the interval, whether your answer was right, whether it went up, down or sounded together, and whether you answered with its name or its second note; a copied link or embed code, with the exercise; connecting a MIDI keyboard, with its outcome. Each comes with the page's language, but never with the notes you played or wrote. From the choir generator, your browser reports its steps the same way: a new exercise, its first playback and copied embed code, each with the choir (SATB, SAB, SSA, TTBB, SA or TB), the level, the number of measures, the time signature and what stands under the notes (do re mi, scale degrees or nothing), for a new exercise also whether the button or a changed setting made it, and for the first playback also the sound (choir or piano) and whether all parts played alike, one louder or one alone; the starting chord, with the choir and the sound; a PDF or MusicXML download, a print and a copied link, with the paper size for a PDF or print. Each comes with the page's language, but never with the title or line you typed. From the note-reading trainer, your browser reports its steps the same way: the start of a round, with the clef, the level, the number of notes in the round, whether you answer on the piano keys or with note names, and whether you answered the first note on the screen, the computer keyboard or a MIDI keyboard; the end of a round, with these and how many answers were right; connecting a MIDI keyboard; a worksheet downloaded as PDF or printed, with the clef, the level and the paper size. Each comes with the page's language, but never with the notes you answered. Usermaven shortens the IP address before processing it and tells visits apart by an identifier formed from the shortened address and your browser details, so we see neither who you are nor what you do on other sites. If your browser sends the Global Privacy Control signal, we don't count your visit at all. Exercises embedded on other websites are not counted. Legal basis: our legitimate interest in knowing how the site is used (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR), for example by switching on Global Privacy Control.
• Language. Our server reads the languages your browser asks for and shows the page in the first one we offer; it doesn't store them. If you pick a language in the language menu, your browser keeps that choice in a cookie named lang (for example lang=de) for one year, so the site opens in that language next time. The cookie holds only the language code, isn't used to recognize you, and is the only cookie the site sets. You can delete it in your browser at any time. It needs no consent because it is strictly necessary for the choice you made (§ 165 (3) TKG 2021).
• Light or dark mode. If you switch between light and dark with the button at the top of the page, your browser keeps that choice ("light" or "dark") in its local storage on your device, so the next page opens the same way. It is never sent to us. Switch back to your system's setting and the entry is removed; you can also delete it in your browser's settings. It needs no consent, because it is strictly necessary for the choice you made (§ 165 (3) TKG 2021).
• Tapping along. The rhythm trainer compares your taps with the notes in your browser; your taps are not sent to us. If you measure the delay, your browser keeps the result, a number of milliseconds, in its local storage on your device, so later tries take it off; it is never sent to us. "Forget the delay" removes it; you can also delete it in your browser's settings. It needs no consent, because it is strictly necessary for the function you asked for (§ 165 (3) TKG 2021). If you use a MIDI keyboard, your browser asks you first and then passes the keys you press to the page; they stay in your browser.
• Ear training. Ear training checks your answers in your browser; the notes you play or write are not sent to us, and it keeps nothing on your device. If you use a MIDI keyboard, your browser asks you first and then passes the keys you press to the page; they stay in your browser.
• Note reading. The note-reading trainer checks your answers in your browser; they are not sent to us. Your browser keeps your settings and your best round for each clef and level in its local storage on your device, so they are there next time; they are never sent to us. "Forget my results", under the trainer, deletes them; you can also delete them in your browser's settings. It needs no consent, because it is strictly necessary for the function you asked for (§ 165 (3) TKG 2021). If you use a MIDI keyboard, your browser asks you first and then passes the keys you press to the page; they stay in your browser.
• The site has no accounts and no login, and shows no advertising.

Contacting us

When you write to us, we use your message and contact details to answer. Legal basis: our legitimate interest in answering (Art. 6(1)(f) GDPR).

Who receives data

• Cloudflare, Inc., USA: hosting and delivery of this site, as our processor.
• Usermaven Inc., Lewes, Delaware, USA: visit statistics, as our processor. Usermaven keeps the data in EU data centers.
• Our tax advisers, auditors and lawyers, and authorities, where the law requires.

We do not sell personal data.

Transfers outside the EU

Cloudflare may process data in the USA, and Usermaven Inc. is a US company, although it keeps the statistics in EU data centers. Transfers to the USA rest on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the EU Standard Contractual Clauses.

How long we keep data

• Emails to us: as long as needed to deal with your request.
• Cloudflare's request data: as briefly as Cloudflare needs it to deliver and protect the site.
• Visit statistics: as long as our Usermaven account is active.

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Write to support@phonicscore.com; we answer within one month. You can also complain to a data protection authority. In Austria that is the Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb.gv.at.

Changes

We update this policy when the site or the law changes, for example when the newsletter arrives. The date at the top shows the current version.