Privacy Policy

Overview

Frett ("we", "our", or "us") is a guitar fretboard training application. This page says what we collect, where it lives, and who else touches it.

Your Microphone

In microphone mode, Frett listens to your guitar to check which note you played. All of that happens inside your browser. We never record audio, never store it, and never send it to our servers or anyone else. Turning the mic off, or using Click mode, stops the listening entirely.

Information We Collect

Without an account

Your settings and practice history are saved in your browser's local storage on your device only. Frett also sends the anonymous product events described below so we can tell whether the practice flow works.

With an account

If you create an account with an email and password, we store your email address, a hashed password, and your name if you give one. If you sign in with Google, we receive your email address, your name, and a Google account identifier.

Signed in, your practice data syncs to our servers so it follows you across devices:

• Practice statistics (accuracy, response times, streaks, personal bests)
• Per-string mastery progress
• Session history
• Practice settings that sync (scale, strings, pitch tolerance, mastery threshold). Input mode and session length stay on the device.

Shared Results

Sharing requires an account. When you create a result link, we save a fixed copy of the result shown in your preview: note counts, practice duration and results by string where recorded. If you choose to share progress, this also includes practice dates and results from up to 12 recent sessions. Anyone with the link can view these statistics without signing in, including in a messaging app's link preview. We use these counts to show accuracy, pace and, for progress links, a session timeline. The shared page does not include your name, email address or history beyond the results shown in your preview.

Result links do not expire. Deleting a session from your history does not remove its shared result. Deleting your account removes the results tied to it, although messaging apps may retain cached previews.

Anonymous Product Events

Frett records a small set of first-party events such as opening the practice page, trying the microphone, starting or completing a session, being asked to create an account, and creating, copying, or opening a shared result link. Shared-result events include the result identifier so we can measure which links lead to practice. These events may include the page path, campaign tags in the link you opened, the referring site's domain, input mode, session length, note count, rounded accuracy, how a session ended, and a short code for why a microphone or sign-in attempt failed.

Each event also records which browser, operating system, and kind of device you are using. Our server works those out from the user-agent your browser sends with every request and saves only the general category — for example “Safari, iOS, mobile”. The user-agent itself is never stored.

We assign the browser a random identifier in local storage and each visit a separate identifier in session storage. The product-event records do not include your name, email address, IP address, microphone audio, or the notes you played. Shared-result identifiers can connect sharing activity to the account that created the result. Our hosting provider may process ordinary connection information, such as your IP address, to deliver Frett. We honor Global Privacy Control and the browser's Do Not Track setting. Clearing Frett's site data resets the browser identifier.

Product Analytics and Session Replay

Frett uses PostHog to understand where the app is confusing. We send the product events described above to PostHog as well, including shared-result attribution through subsequent practice and account creation. PostHog records the pages you visit and the elements you click, and it records a replay of your visit — a reconstruction of what the page looked like and how you moved through it, so we can see where people get stuck rather than guess.

Your microphone is never recorded. No audio is captured, stored, or transmitted — not in a replay, not anywhere. Pitch detection happens entirely inside your browser, as described above.

Everything you type is masked before it leaves your browser: replays show that a field was filled in, never what was typed in it, and your email address is masked where the app displays it. A replay does show the practice screen as you saw it, including the note names the app put on the screen while you played — that is the point of it, and it is how we find out where the fretboard is confusing.

PostHog is loaded from frettapp.com rather than from PostHog's own servers, so it sets no third-party cookies; your identifier is kept in local storage like the one described above. Links that carry a one-time credential, such as a password-reset email, have that credential stripped before anything is recorded. If you're signed in we tell PostHog your account id, email address, and name so support questions can be traced to the right account. If you're not signed in, you stay anonymous to it.

We honor Global Privacy Control and the browser's Do Not Track setting: with either turned on, PostHog does not load at all.

How We Use Your Information

• To run the service and pick your next practice target
• To sync your progress across devices when you're signed in
• To send account emails: verification and password reset
• To understand which promotions lead to completed practice sessions and where the setup flow fails

We don't use your data for advertising, and we don't sell it.

Where Your Data Is Stored

Account data and anonymous product events are stored in a PostgreSQL database hosted on Railway. Analytics and session replays are stored by PostHog on servers in the United States. Without an account, your settings and practice history stay in your browser; the product events and analytics described above are what leave it.

Service Providers

These companies process data on our behalf, only as needed to run Frett:

• Railway hosts the application and the database.
• Resend delivers account emails (verification and password reset). They receive your email address for that purpose.
• Google handles sign-in if you choose "Continue with Google", and serves the web fonts the site uses.
• PostHog provides the product analytics and session replay described above. Requests are proxied through frettapp.com, so PostHog receives the event and replay data but not your IP address from a direct connection.
• GitHub hosts the guitar sound samples the app plays in Click mode and for target previews. Your browser downloads them directly from GitHub Pages, so GitHub sees your IP address the way any website host does. No account data is involved.

We may also disclose data if required by law or to protect our rights.

Cookies and Local Storage

Signing in sets a session cookie so you stay signed in. We use browser local storage for your settings, practice history, an in-progress session, the random product-event identifier, and PostHog's analytics identifier. Session storage holds a separate identifier and campaign attribution for the current visit. We use no advertising cookies and no cross-site trackers, and because PostHog is served from frettapp.com it sets no third-party cookies.

Your Rights

You can:

• See your data any time in the Progress page
• Delete individual sessions from your history
• Delete your account and everything tied to it by emailing us
• Use Frett without an account (data stays on your device)

Children's Privacy

Frett is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes to This Policy

We may update this policy. Changes are posted on this page with a new effective date.

Contact Us

Questions about privacy, or a deletion request: support@frettapp.com.