Privacy

1. Who is responsible

We are the data controller for this website and for the licence check inside the application. We have not appointed a data protection officer; there is no threshold here that requires one, and the address above reaches a person.

2. This website

There is no cookie banner on this site because there is nothing to consent to. Page visits are counted with Cloudflare Web Analytics — it sets no cookies, does no fingerprinting, and does not track you across other sites; it is a counter, not an advertising or profiling tool, which is why regulators generally do not treat it as needing consent. Beyond that, the site keeps one small item in your browser’s local storage: the name of the link that brought you here (for example “yt”), for 30 days, so that a download or a purchase can be credited to that link. It holds nothing about you and leaves your browser only as that one word, when you download or buy. Nothing else is loaded from a third party — no hosted fonts, no tag manager, no embedded video, no chat widget, no payment script.

The site is hosted on Cloudflare Pages. Like any web server, Cloudflare’s edge records the technical detail of each request — IP address, time, the file requested, browser user agent — in short-lived operational logs used to serve the page and to stop attacks. We also see an aggregate dashboard from Web Analytics — page views, referring sites, country-level traffic — never a name, never an individual visitor, never a profile that follows you anywhere else.

Legal basis: our legitimate interest in delivering a working, secure website (Art. 6(1)(f) GDPR). Cloudflare acts as our processor. Details of their handling are in Cloudflare’s privacy policy.

2a. When you download

Usually, before handing you the installer we ask for an email address and confirm it with a one-click link (double opt-in). We store the address, the platform you chose (macOS or Windows), the time, and whether the address was confirmed — on Cloudflare Workers KV, inside our own account. It is used for exactly two things: confirming the address is yours, and writing to you when something meaningful ships — release notes, nothing else. It is never sold or shared.

Legal basis: your consent (Art. 6(1)(a) GDPR), given by submitting the form and confirming the link. Withdraw it any time by replying to any of our emails or writing to the address in section 1 — we delete the record and stop writing. Unconfirmed addresses expire from the pending store within 48 hours on their own.

From one of our own links — a video description, a post, our free chord tools — the download starts straight away, with no email. For those downloads we record only the time, the platform and the name of the link (for example “yt”): no address, no IP, nothing that identifies you, kept for about 13 months so we can see which links bring people. Afterwards you may leave an address for release notes; it is confirmed with the same one-click link and used exactly as described above.

3. The application on your computer

Cadenza is a desktop application, not a service. It reads your MIDI keyboard, works out chord and scale names on your machine, and writes files to your disk.

What never leaves your computer: the notes you play, your recorded takes, your exported MusicXML, MIDI and PNG files, your favourites, your chord history, your practice results, your settings, and your recordings shelf. These live in the application’s own folder on your disk and are never uploaded anywhere. There is no account, no cloud sync, and no way for us to see any of it.

What does leave your computer: exactly one thing. When you activate a licence, and periodically afterwards to confirm it is still valid, the application sends your licence key and a short identifier for the machine to our licensing relay (a Cloudflare Worker), which confirms the key with Lemon Squeezy. The machine identifier is a one-way hash of your computer’s name, operating system and architecture — it is used only to count how many machines a key is active on, and it cannot be turned back into your computer’s name.

The camera, if you use it: Camera mode straightens a webcam view of your real keyboard onto the on-screen keys, so the two line up in OBS. macOS and Windows ask for camera permission the first time. The picture is processed on your machine and drawn into a window — nothing is recorded, saved or sent anywhere, and the application has no way to upload it. Say no to the permission and every other part of Cadenza works exactly as before.

During the three-day trial — and on the free Basic tier after it — there is no licence to check, so the application makes no network requests at all.

4. When you buy

The purchase is handled by Lemon Squeezy as merchant of record. You enter your payment details on their systems, not ours. We never see your card number, and no payment data ever touches this website.

From a completed order we receive your email address, name or company name, country, and the order details — what we need to send your licence key, issue support, and honour a refund. Lemon Squeezy is an independent controller for the sale; see their privacy policy.

Legal basis: performance of the contract with you (Art. 6(1)(a) and (b) GDPR) and, for keeping order records, our legal obligation under accounting and tax law.

5. When you write to us

If you send an email, we keep it — your address and what you wrote — so that we can answer, and so that the next person with the same problem gets a better answer. Support mail is kept in our mailbox, hosted by Google Workspace, and is deleted when it is no longer useful.

There is no newsletter. Writing to us does not subscribe you to anything — the only list is the release-notes one in section 2a, and you are on it only if you confirmed it.

6. How long things are kept

7. Your rights

Under the GDPR you may ask us for a copy of what we hold about you, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable form. You may withdraw consent where consent is what we relied on.

Write to [email protected]. We will answer within one month, and normally much sooner — this is one person reading the mail, not a queue.

If you think we have handled your data badly and we have not fixed it, you may complain to your national supervisory authority. In Lithuania that is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt).

8. Transfers outside the EU

Cloudflare and Lemon Squeezy are US companies with EU infrastructure. Where data reaches the United States, those transfers rely on the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework. We use no other processors.

9. Children

Cadenza is a tool for musicians of any age, and a teacher may well sit a child in front of it. Nothing in it collects data from the person playing. We do not knowingly sell licences to children — the purchase is made by whoever holds the card.

10. Changes

If this policy changes, the new version appears here with a new date. If a change is material — if we ever start collecting something we do not collect today — it will be said plainly at the top, not buried in a clause.

See also: Terms and licence · Refunds and cancellation