Privacy

The free practice activities do not require a name, email, or account. A student’s practice record stays on the device. Microphone audio is analyzed on your device as you play and is never recorded, saved, or uploaded. A parent account is optional and is used only to buy the paid full range on the website and restore that website purchase in another browser or on iOS. Students whose band program provides access can instead use a shared program code and passphrase without giving us a student name or email. First 5 Notes Classroom works in the browser and in the iPhone app. In the iPhone app (version 1.2 and later), a student or co-teacher taps Use a school program code and enters the program code and passphrase to unlock the full-range content covered by an active Classroom purchase.

Your microphone

The “Play the Note” step asks for microphone access so the app can hear the pitch you are playing. The audio is analyzed on your device as you play. Nothing is recorded, nothing is saved, and nothing is sent anywhere. If you prefer not to grant microphone access, a tap-to-self-check option works without it.

Your progress

Your practice record is stored only in your browser’s local storage on your own device. We never see the record itself. Clearing your browser data erases it. The anonymous counts below say only which activity was used or finished, never who used it.

Anonymous product counts

To understand whether First 5 Notes is being used, the app sends one anonymous session-start count per browser-tab journey and one anonymous first-open count for each instrument page visited during that journey. Each arcade page also sends one anonymous count when it opens, carrying only the page and the instrument and nothing about play. If you arrive from one of our tagged links, your browser remembers that link until you close the tab and sends one tagged arrival so we can tell which posts help teachers find us. If you later open the purchase sheet, the link name is included with that sheet’s activity. These counts contain no name, email, account, notes played, or microphone audio. If something breaks during practice, such as a diagram that will not load or a microphone the browser blocked, the app sends one short error report so we can fix it: the same anonymous journey id, the instrument, the screen and file involved, the browser window size, and a brief error message. That report contains no name, email, account, notes played, progress, or microphone audio either. What your browser remembers is stored on your own device in session storage and is not a cookie.

The app also sends a few anonymous progress counts. One is sent the first time, on a device, that a learning-path step, a Key step, or a song in Learn a song is finished. One is sent the first time a round of each arcade game is finished on a device. One is sent the first time, on a device, that each step of a rhythm level is finished: tapping the beat, tapping the rhythm, and playing it. One is sent the first time, on a device, that a World Music Library song is played, and one the first time it is heard to the end. The app also sends one count on each day an arcade game is played, and one count for each day the app is used.

Each of these counts carries only the instrument, the lesson, key, song, rhythm level, or game and the step, plus two ranges worked out on the device: how many days the app has been used (1, 2-3, 4-7, or 8+) and how many visits (the same ranges). The day-of-use count carries only the two ranges. These counts carry no name, account, school, program code, or device or session identifier. They carry no exact counts and no dates.

To work out the ranges, the device keeps its own tally of visits and days in local storage. The tally never leaves the device, and it is not a cookie. The device also remembers which first-time counts have been sent. “Clear this device” on the account page erases the tally and these marks.

For these counts, we store only the date, not the time. After 90 days we delete the individual counts and keep only daily totals. We only look at totals, and we hide small groups.

Optional parent accounts

When a parent or guardian buys the full range on the website, we create an account for the email they give at checkout and email them a link to set a password. We store the parent email address, a Firebase account identifier, and the products that account owns. The password is handled by Firebase Authentication and is not visible to Virtunity. This account information is used only for sign-in, purchase access, security, support, and restoring access on another browser or in the First 5 Notes app.

School-managed program access

A band program may buy shared access for its enrolled students and co-teachers. The adult purchaser or director provides the school, program, adult contact, and billing information needed to set up and support that access.

No roster upload or individual student account is required for this shared credential. Students do not provide a name or email address. First Five Notes does not display advertising or create advertising profiles from Classroom use. We do not create individual student profiles, track individual students from one device to another, or create student-level practice analytics for this credential. Practice progress remains on each device. Microphone audio is analyzed on your device as you play and is never recorded, saved, or uploaded. Limited aggregate website and security events may be processed as described in the Privacy Policy, but they are not associated with a named student.

A student enters the program code and shared passphrase supplied by the director. Those credentials are sent to Virtunity for verification, and Firebase then provides one school-managed program identity and its access record. Program access expires at the end of its term. An authorized program representative can ask Virtunity support to rotate the passphrase or revoke access, and Virtunity may revoke access as described in the Terms.

Before shared program access was available, some school access was issued through individual sign-ins. For each of those legacy sign-ins, the email address, Firebase account identifier, and entitlement remain until the sign-in is deleted or migrated. That information is not used for practice analytics or advertising. The user or program director can contact Virtunity to request deletion or migration.

Payments and service providers

Card checkout is processed by Stripe. Virtunity receives purchase status and transaction identifiers, but not the full card number. A school purchase may instead be paid by an invoice through Stripe or by another payment method that Virtunity confirms before activation; we retain the invoice request and confirmed payment record for fulfillment, accounting, refunds, and disputes. Firebase provides parent sign-in, school-program sign-in, entitlement storage, and password-reset email. Resend may deliver transactional purchase and setup email. Upstash processes the IP address and browser user-agent information used to rate-limit account, purchase, and school-program requests and prevent abuse. For the anonymous counts, the IP address is scrambled with a key that changes every day before the rate limit sees it, and it is not stored. Supabase stores the limited website-analytics counts described above. Firebase and the applicable access services are contacted when someone uses a parent sign-in, school-program sign-in, purchase, restoration, or account control. The anonymous error reports described under Anonymous product counts go to our own server and are stored with those counts.

Optional problem reports

A report is optional. The email field is for a teacher or parent who wants a reply. The report goes to a private issue tracker (GitHub) and a support mailbox (Resend). We keep it until 90 days after the issue closes. Please do not include names.

Deletion and retention

A signed-in parent can delete the account from the website account page or from the account section in the iOS unlock screen. This removes First 5 Notes access and its web entitlements. The sign-in itself is deleted when it is used only for First 5 Notes, and retained when it is shared with a Virtunity account. App Store purchases remain with Apple and can still be restored. Payment and invoice records may be retained when needed for accounting, refunds, disputes, fraud prevention, or legal obligations.

A student can remove school-program access from the current device by choosing “Leave program on this device.” Because the program identity is shared, this does not delete or change access for the rest of the program. A director can request credential rotation, revocation, or deletion by contacting Virtunity. Program purchase and support records may be retained for the same accounting, security, and legal reasons described above.

What we don’t do

The shared school-program flow does not require an individual student account or roster and does not create an individual student profile. The legacy individual sign-ins described above may remain until deletion or migration. We do not record which notes a student plays. We do not keep a record of how far any one student gets or when they stop. The automatic session, instrument-open, arcade-open, tagged-arrival, progress, daily arcade, day-of-use, and error counts are described above. The optional problem-report form is described separately. No advertising. No advertising profiles. No tracking of an individual student from one device to another. No tracking cookies. No sale of personal information. No microphone recordings or uploads. Parent account and purchase information is not used for advertising or tracking.

Children

This app is built for beginning band students, including children. The free practice activities do not require a name, email, or account. A report is optional. The email field is for a teacher or parent who wants a reply. Please do not include names. Any purchase account must be created and managed by a parent or guardian, not by the student. School-program access is created and managed by an adult director or school contact; the student enters only the shared credentials that adult provides.

Questions

Contact: hello@virtunity.io