Privacy Policy
Last updated: 21 August 2026
This Privacy Policy explains how Strumfolio (“we”, “us”) collects, uses, and protects your personal data when you use this service.
1. Who we are
Strumfolio (strumfolio.com) is run by an individual developer, with no company or commercial entity behind it, offering a free plan and paid plans — see our Pricing page for details. That individual is the data controller for the personal data described in this policy, and can be reached at the contact address below. If you need the controller's full identity — for example to exercise your rights or to file a complaint — write to that address and we will provide it without delay.
For any privacy-related question, you can contact us at: info@strumfolio.com.
2. What data we collect
Account data. The email address you use to sign in, and:
- if you sign in with an email address and password, a cryptographic hash of your password — we never store or see the password itself;
- if you sign in with Google, the email address and basic profile information (such as your name and profile picture) that we receive from your Google account; we never receive your Google password.
Plan and billing status. Which plan your account is on, including any paid plan, its renewal or expiry date, and any upgrade, downgrade or cancellation you have already scheduled. Strumfolio does not currently collect or transmit any payment card details — see our Pricing page for the plans on offer.
Preferences. Basic display and app settings you choose, stored on your device or with your account so that the app behaves the way you left it.
Content you create. The songs, lyrics, chords, songbooks and sections you personally import or create. Strumfolio does not host or provide any pre-existing lyrics, chords, or song library — all content in your collection comes from you, entered manually or imported from files on your own device.
Usage and technical data. Basic technical information needed to run and secure the service, such as log data, device and browser type, and IP address as processed by our hosting provider.
Aggregated analytics. We use Vercel Web Analytics and Speed Insights to understand overall traffic and page performance. These tools do not use cookies and do not build cross-site profiles: visitors are identified by a temporary hash that is discarded within 24 hours, and only aggregated data is available to us.
Sing Together sessions. When you create or join a session, we process the session identifier and the synchronisation data needed to keep devices in step. Participants can join a session through a shared link without creating an account; for those participants we process only the session identifier and the minimum technical data needed to run the session — see section 6 for how long that data lasts.
For details on cookies and local storage, see our Cookie Policy.
3. Why we collect it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account | Performance of a contract — Art. 6(1)(b) |
| Store, sync and let you access your song collection | Performance of a contract — Art. 6(1)(b) |
| Run Sing Together sessions, including for participants without an account | Performance of a contract — Art. 6(1)(b) — and, for participants without an account, our legitimate interest in delivering the session requested by the leader — Art. 6(1)(f) |
| Send service emails (email verification, password reset, account notices) | Performance of a contract — Art. 6(1)(b) |
| Keep the service secure and working properly | Legitimate interest in preventing abuse, diagnosing faults and protecting the service and its users — Art. 6(1)(f) |
| Measure aggregate traffic and performance | Legitimate interest in maintaining and improving the service — Art. 6(1)(f) |
Is providing this data required? Providing an email address is necessary to create an account and use Strumfolio: without it we cannot provide the Service, and no account can be created. Everything else — the songs you add, the preferences you set — is entirely up to you.
Automated decision-making. We do not carry out automated decision-making or profiling that produces legal effects for you or similarly significantly affects you.
4. Who processes data on our behalf
Strumfolio is a small project built on a limited number of technical providers. The following act as our data processors under a data processing agreement:
- Vercel Inc. — hosting, application delivery, and Vercel Web Analytics / Speed Insights.
- Neon — the PostgreSQL database where your account and content are stored, provisioned through Vercel.
- Resend — delivery of transactional emails (email verification, password reset, account notices).
Google LLC is different: if you choose to sign in with Google, Google acts as an independent data controller for your Google account and for the sign-in process itself, under its own privacy policy. We only receive the account details listed in section 2 as a result of that sign-in.
We do not sell your data, and we do not share it with anyone for advertising or marketing purposes. We may disclose data where required to do so by law.
5. International transfers
Some of these providers are established in the United States or may process data outside the European Economic Area. Where that happens, transfers are covered by appropriate safeguards under Chapter V GDPR — the EU-U.S. Data Privacy Framework where the provider is certified (Vercel and Google are), and the European Commission's Standard Contractual Clauses in the remaining cases. You can obtain a copy of these safeguards, or further details about them, by writing to the contact address above.
6. How long we keep your data
We keep your account and content data for as long as your account is active. When you delete your account from within the app, your account and your songs are removed immediately from the live service; residual copies in encrypted backups and technical logs are erased within our normal backup rotation cycle, except where we are required to retain data by law. Sing Together session data is deleted as soon as the broadcaster ends the session, and in any case automatically stops being usable after a few hours of inactivity even if it is never explicitly ended. Analytics data is aggregated and retained in non-identifying form.
7. Your rights
If you are in the EU/EEA, under the GDPR you have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- request deletion of your data;
- request a copy of your data in a portable format;
- restrict certain processing;
- withdraw any consent you have given, without affecting processing carried out before withdrawal;
- lodge a complaint with your national data protection authority (in Italy, the Garante per la Protezione dei Dati Personali).
Your right to object. Where we process your data on the basis of our legitimate interest — namely to keep the Service secure and to measure aggregate traffic and performance — you have the right to object to that processing at any time, on grounds relating to your particular situation. If you object, we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. To object, write to info@strumfolio.com.
Strumfolio lets you export your full collection and delete your account directly from within the app, at any time and without having to ask us. For anything else, or if a self-service option is not working, contact us at info@strumfolio.com. We aim to respond within 30 days.
8. Data security
We take reasonable technical and organizational measures to protect your data against unauthorized access, loss, or misuse, including encrypted connections, hashed passwords, and access limited to what is needed to run the service. No system is 100% secure, and we encourage you to keep your account credentials confidential.
9. Children
Strumfolio is a general-purpose tool and is not directed at children. If you are a minor under the law of your country, you should use Strumfolio only with the involvement and permission of a parent or guardian. If we become aware that we hold data relating to a child in a way that is not permitted under applicable law, we will delete it.
10. Changes to this policy
We may update this Privacy Policy from time to time. If we make significant changes, we will notify you through the app or by email.
11. Contact
For any question about this policy or your data, contact us at info@strumfolio.com.