Privacy policy
Last updated 26 August 2026
Who you are dealing with. Follow the Chords is run by legal name to be filled in, at registered address to be filled in. Write to support@followthechords.com about anything on this page and you will get a reply from a person.
This page says what Follow the Chords knows about you, why, who else sees it and how to get rid of it. Follow the Chords is the data controller for everything described here, under the UK General Data Protection Regulation.
The microphone, first, because it is the question everyone asks. Follow the Chords listens through your microphone while you practise. The sound never leaves your computer. The listening happens inside your own browser, no audio is recorded, no audio is uploaded and no audio is stored anywhere at any point. What gets saved is the score: which notes you hit, which you missed, which bars went wrong and at what tempo. Nobody, including us, can hear you play.
What is kept and why
| What | Why | Legal basis |
|---|---|---|
| Your email address | To sign you in, to send the password reset link and to tell you about your account and your payments | Performing our contract with you |
| Your name, if you give one | To address emails to you. Leaving the name blank is fine | Performing our contract with you |
| Your password, scrambled | To check your password without ever holding the password itself. The scrambling is one way, so the real password cannot be read back, by us or by anyone who stole the database | Performing our contract with you |
| Your practice record | The scores, tempos and problem notes the trainer works out, so the practice plan can suggest what to do next and so your work follows you to another computer | Performing our contract with you |
| Your licks and your settings | So the trainer opens where you left it, on any computer you sign in on | Performing our contract with you |
| When your account was made | To work out when the free trial ends | Performing our contract with you |
| Whether you have paid | To open the trainer for you | Performing our contract with you |
| Which inbox your address belongs to | The free trial is one per inbox rather than one per address, so a plus tag or an extra dot does not open a second free week. Your address with the tag and the dots taken out is stored beside your account. Nothing is ever sent to it | Our legitimate interest in not giving the same person the same free trial over and over |
| A fingerprint of the network address a sign-up came from | To stop one machine opening hundreds of accounts. The address itself is never written down: what is stored is a one way hash of it, which cannot be turned back into an address or matched against anything outside our own count. Deleted after a day | Our legitimate interest in keeping the sign-up page from being abused |
| A random number your browser keeps, plus what it asked for | To count visits. Your browser makes the number up and sends it back on later visits, which is the only reason a return visit can be told apart from a first one. It means nothing on its own and is never joined to your account, your email or anything you type. Stored beside it are the page, the site that linked you here, any campaign tags on the address, the country and whether you are on a phone, a tablet or a computer | Our legitimate interest in knowing whether anybody is finding the site |
What is not kept
- No audio. Nothing you play is recorded or uploaded.
- No card details. Paddle takes the payment and we never see a card number, a bank account or a billing address.
- No tracking across other sites. There is no advertising pixel and no third party cookie on this site. Nothing here follows you anywhere else, because nothing here is shared with anyone who could. We do count visits to our own pages, which is described below under Counting visits. The sign-up fingerprint described above is not tracking either: it is counted for one day to stop the sign-up page being abused. The fingerprint never reaches another page and the address behind it is never stored.
- No IP addresses. The network address you arrive from is never written to our database, not even in a log.
- No profiling. Nothing about you is fed to an automated decision that affects you and nothing about you is sold to anyone, ever, for any price.
Counting visits
We count page views so we know whether anybody is finding the site. Each view records the page you asked for, the site that linked you here if there was one, any campaign tags on the address, the country the request came from, whether you are on a phone, a tablet or a computer and whether this browser had been here before.
None of it is tied to you. Your browser makes up a random number the first time it arrives and sends that number back on later visits, which is the only reason a return visit can be told apart from a first one. The number means nothing on its own, it is never joined to your account, your email or anything you type. Your network address is never stored. We cannot work out who you are from any of this and we do not try. Delete the cookie below and your browser is a stranger to us again.
Cookies
Follow the Chords sets two cookies and no more.
ups_chords_session says you are signed in. The cookie lasts
six months from the last time you opened the trainer, so opening the trainer
starts the six months again and somebody practising regularly is never asked
to sign in a second time. Signing out deletes the cookie. Without the cookie
there is no way to stay signed in from one page to the next.
up_vid holds the random number described above. It lasts a
year from your last visit and holds nothing else.
Both are first party, meaning they are readable only by this site. Neither is shared with anyone. Neither is used for advertising. That is why there is no consent banner to click.
Who else handles your information
Four companies help run Follow the Chords. Each one only gets what it needs to do its job and none of them may use your information for anything else.
- Vercel hosts the site and runs the code. Vercel sees the requests your browser makes.
- The database host stores your account and your practice record, on servers in the European Union. A second database, shared with the other things we make, holds the visit counts and nothing that names you.
- Resend sends the welcome email and the password reset link. Resend sees your email address and the words in those emails.
- Paddle takes payments as the merchant of record. Paddle handles your card details and your billing address and we do not. Paddle tells us your email address and whether you have paid and nothing else. Paddle's own privacy notice covers what Paddle does with the rest.
Information may be handled outside the United Kingdom by these companies. Where that happens the transfer is covered by the standard contractual clauses the law provides for, or by the country having its own adequacy decision.
We hand your information to nobody else, unless a court or the law requires it and if that ever happens you will be told unless telling you is itself against the law.
How long it is kept
- Your account and your practice record are kept while your account is open and deleted within 30 days of you closing the account.
- An account that has never been paid for and has not been signed into for two years is deleted, after an email warning you 30 days first.
- Records of payments are kept for six years, because tax law requires it.
- Password reset links last 45 minutes and are then useless.
- The sign-up fingerprint is deleted a day after the sign-up. Yesterday's are cleared as today's arrive.
- The random number used to count visits lasts a year in your browser from the last time you came. Delete the cookie and your next visit is counted as a first one.
What you can ask for
Under the UK GDPR you can ask us to:
- send you a copy of everything we hold about you
- correct anything that is wrong
- delete your account and everything on it
- stop using your information in a particular way, or object to a use
- send your information to another service in a machine readable file
Write to support@followthechords.com and we will do it within 30 days. Asking costs nothing. You do not have to give a reason for asking to be deleted.
The Back up button inside the trainer already gives you a machine readable file of your licks, your practice record and your settings, at any hour, without asking anyone.
If you are unhappy with us
Tell us first at support@followthechords.com, because most complaints are quicker to fix than to escalate. If we do not put it right you can complain to the Information Commissioner's Office at ico.org.uk, or by phone on 0303 123 1113.
Children
Follow the Chords is not aimed at children and accounts are for people aged 16 and over. A younger player is welcome to practise on a parent's or a teacher's account with that person present. If you believe a child has opened an account, write to support@followthechords.com and the account will be deleted.
Changes to this page
If what we do with your information changes, this page changes with it and the date at the top moves. A change that matters is emailed to every account holder before the change happens.