Privacy Policy

ScoreLens photographs a page of sheet music and turns it into a score you can play back, transpose and export. This page explains exactly what leaves your phone, why, and for how long it is kept. It describes what the app actually does, not what it might do one day.

Who is responsible

ScoreLens is made by Dzmitry Shaidorau, an individual developer in Poland, who is the data controller for the purposes of the GDPR. For any privacy question, or to have your data deleted, write to hello@scorelens.app. We have not appointed a data protection officer because the law does not require one for this processing.

What is sent to the server, and why

The photo of the page. Recognising sheet music needs more computing power than a phone has, so each page you scan is uploaded to our server, processed, and then deleted. The photo is stored on the server only while the job runs — typically under a minute — and is removed as soon as recognition finishes, whether it succeeded or failed. If a server fault ever interrupts that, an automatic storage rule deletes any photo left behind after one day. The result is held for at most one hour so the app can collect it, and then expires automatically; from 4 November 2026 the notation, but never the photo, is also kept as described under Recognised notation and corrections. When a result looks doubtful, or you cancel or report it, we keep the recognised music and its technical summary (never the photo, and only a one-way code of the device identifier) for 7 days to check what went wrong, then it is deleted automatically. From 21 October 2026 there is one exception for the photo itself, described next.

Part names, to suggest an instrument. To suggest the instrument of a part, the text printed on the page (for example “Clarinet in B♭”), as read by our server, may be processed by Google’s Gemini model on Google Cloud (Vertex AI) in the European Union, as our processor. No image, device identifier, account or location data is sent. Google does not use it to train its models and may keep it briefly to detect abuse.

The same text lines may also be sent, for the same purpose and with the same limits, through Vercel’s AI Gateway to the Jev model of TypeSafe AI, whose answer we compare with Google’s; nothing in the app depends on it. No image, device identifier, account or location data is sent. Vercel states that AI Gateway does not retain prompts or outputs and does not use them for training. TypeSafe AI states that it does not train on prompts and will not keep a prompt longer than needed to produce the answer, nor the answer longer than needed to meet its obligations to us. TypeSafe AI hosts its service in the United States.

Photos of pages that didn’t read well (from 21 October 2026)

When a page doesn’t read well (the reading failed or looks doubtful, or you cancelled it while it was being read), we keep its photo for 30 days so we can see what went wrong and improve the reader, then it is deleted automatically. Pages that read well are never kept. We keep a photo only if the app has first shown you a notice about this and “Help improve recognition” is on; older versions of the app, and the very first session after a new install, never ask us to keep anything.

The kept photo is cropped to the page, re-saved without its location or other camera data, and stored encrypted on our server in the European Union (Google Cloud, Belgium). It is kept with a one-way code of the device identifier, never the identifier itself, so that we can delete it if you ask. It is seen only by the developer, is not shared with anyone, and is never shown to any AI service. If a kept photo shows a person’s face or a full name, we delete it rather than use it. From a kept photo we may cut out the printed staves, only where they show no names, handwriting, stamps or people, and keep those cut-outs to test and train our own recognition engine; they contain no information about you.

We do this on the basis of our legitimate interest in finding and fixing recognition errors: the recognised music alone can’t show why a page failed (a shadow, the crop, a missed staff), and reports you send yourself are too rare to rely on.

You can object to this at any time. Switch off “Help improve recognition”, on the notice or in Settings. From then on no photo is kept, and the photos already kept from your device are deleted. You can also write to hello@scorelens.app.

A device identifier. Every request carries an identifier supplied by the operating system: identifierForVendor on iOS, ANDROID_ID on Android. Both are specific to this app on this device and are not the advertising identifier; on their own they do not tell us who you are. If the system does not provide one, the app generates a random value and stores it locally. We use it to count how many free pages the device has used, so the free allowance can be enforced without making you create an account (the counter resets automatically after the free window ends); to limit how often one device can send pages or reports, so the server is protected from abuse; to check that only the device that sent a page can collect or cancel it; and to limit how many devices share one Pro purchase (kept with the purchase identifier for 30 days). It is also stored with a report you choose to send (see "Reporting a bad result"). Everywhere else we keep only a one-way code derived from it. A nightly backup of the free-page counters, referral credits and teacher-code records, which contain the identifier or its one-way code, is kept for 30 days so they can be restored after a fault, then deleted automatically.

Your IP address. Like any internet service, our server sees the IP address each request comes from. We use it only to limit abuse: it is kept as a rate-limit counter for at most one day (a report about a shared part keeps only a one-way code of it, see below). The request logs of our hosting (Google Cloud Run) record it with the time and the address requested; they are kept for 30 days to diagnose faults and then deleted automatically.

A purchase token, if you buy ScoreLens Pro. Purchases are handled entirely by Apple or Google; we never see your payment details, card number or billing address. To unlock Pro features the app sends a purchase identifier from RevenueCat, our subscription management provider, and the server asks RevenueCat whether that identifier is entitled to Pro. The answer is cached for up to 24 hours.

Sharing a part by link

Sharing is off until you use it, and you choose it separately for each piece. When you tap "Create link", the app uploads only the notes of that piece (the recognised music as MusicXML, one file per page), its title, and, if you leave them on, the tempo, key change and instrument you were practising with, plus a studio name if you type one. The photo of the page is never uploaded for sharing; it stays on your phone.

Anyone who has the link can open the part on our website or in the app, play it, slow it down and change its key. The link is a long random code that cannot be guessed, and shared pages are marked so search engines do not list them, but anyone you pass it to can pass it on.

The notes are stored on our server in the European Union (Google Cloud Storage) for 30 days and then deleted automatically. You can stop sharing sooner with "Stop sharing" in the app, which deletes them at once and makes the link stop working. To recognise that it is your device asking, the server keeps a one-way code derived from the device identifier, never the identifier itself. People who opened the part in the ScoreLens app keep their copy on their phone until the link would have ended, unless they save their own copy.

Free pages for sharing. If you open a shared part and later scan your own page, we tell the sender's app that they earned free pages. We store a one-way code for both devices, never who you are. On Android, the Play install referrer tells us which shared link led to the install.

Reports. The web page for a shared part has a Report link, for rights holders and for anything abusive. A report stores the reason, an optional note and optional contact details you give us, with a one-way code of the sender's IP address used only to limit abuse; reports are kept for 180 days. If a report is justified we delete the shared notes and the link says it was taken down.

Teacher codes. If your teacher gives you a code, entering it checks it with our server, which records that the code was used, when, a one-way code of your device identifier (so a code works once per phone), and the random RevenueCat purchase identifier described above, which it asks RevenueCat to give 30 days of Pro. Your teacher's own free Pro depends only on how many codes were used in the last 30 days; your teacher is not told who used them. No name or email is involved.

Usage analytics

To learn which parts of ScoreLens work and where people give up, the app records usage events: for example that onboarding was finished, a page was photographed, a recognition succeeded or failed (with its error code), playback started, a tempo or key was changed, the upgrade screen was opened and from where, and whether a purchase went through. Events carry small facts such as counts, durations, the page count or the export format, together with the app version, the operating system and its version, and on Android the device brand and model.

Events are pseudonymous: they are tied to a random identifier created by the analytics library on your device and, once the subscription service has started, to the random RevenueCat purchase identifier described above. That identifier lets us see whether people who reach the upgrade screen go on to buy. It is not linked to your name, email or any account, because ScoreLens has none.

Events never include your photos, the recognised music, the names you give your pieces, the text of a report, your contacts or your location beyond the country and city that Mixpanel derives from your IP address when an event arrives; the IP address itself is not stored. The app does not read the advertising identifier, does not use analytics to show you ads, and does not track you across other companies' apps or websites.

We also keep a small profile per installation in Mixpanel with the same kind of facts: when the app was first opened, the instrument and goal you chose, your plan, and running counts such as pieces played. If you came from one of our campaign links, the profile and your events also record which campaign it was; on Android this is read once from Google Play’s install referrer. We sometimes test two versions of a screen, such as the upgrade screen; the version you saw is recorded with your events and with your purchase status at RevenueCat. On iPhone, RevenueCat receives Apple’s ad attribution token, which tells us only which Apple Ads campaign, if any, led to the install; it is not the advertising identifier and needs no tracking permission. None of this is used to make decisions about you.

The events are processed for us by Mixpanel, Inc., acting as our processor under a data processing agreement, and stored in Mixpanel's EU data centre. We keep them for up to 24 months and then delete them.

Turning it off. Open Settings in the app and switch off "Share anonymous usage data". From that moment nothing more is recorded (no usage events and no crash reports), and the random analytics identifier on the device is discarded; switching it back on starts a new one. To have events already sent deleted, email hello@scorelens.app. Because they are keyed only to random identifiers we may not be able to single out yours; if you can give us a date and time you used the app, or your purchase receipt as a Pro user, we will find and delete what we can.

Our website

The website at scorelens.app (as opposed to the app itself) uses Vercel Web Analytics, built into our hosting, to count page views and see which pages get visited. It does not use cookies, does not assign you any identifier, and cannot be tied to a particular visitor or device from one page view to the next. If a page was reached through one of our YouTube videos, it also records which video's link it was (the "utm_source", "utm_medium", "utm_campaign" and "utm_content" values in the page's address, e.g. which video and which pillar of content), so we can see which videos actually send people to the site; it never records anything else about the visit. This data is processed for us by Vercel Inc., our hosting provider, as our processor.

Opening a shared part's page (a "/p/..." link) sends one Mixpanel event that the link was opened. To count repeat visits, the page stores a random identifier ("sl_web_id") in your browser's local storage and sends it with the event; you can clear it by clearing the site's data in your browser. Requesting the app store ("/get") sends one event recording which store you were sent to and which campaign link (if any) sent you there, with a new random identifier each time. None of these identifiers is linked to your name or to the app's own usage events. They are processed the same way as the app's usage events described above.

Do Not Track. The site and the app do not track you across other sites or apps, so they do not change behaviour when a browser sends a Do Not Track or Global Privacy Control signal. No third party collects data about your activity across sites through ScoreLens.

Measuring our own ads

When you open scorelens.app from an ad for ScoreLens in ChatGPT, OpenAI adds an ad-click reference to the link (a parameter called “oppref”). We use it for one purpose: to tell OpenAI (United States) which of its ads led to the opening of our store link and, on Android, to a trial or a subscription, so that we can see whether the ad works. From our server we send OpenAI that reference, the type of event (“store link opened”; on Android also “trial started” or “subscription started”, with our plan name and its price) and the time. We send no name, email address, IP address, device identifier or advertising identifier, and nothing else from inside the app. The page sets no cookie and does not load OpenAI’s tracking pixel.

On Android the reference travels in Google Play’s install referrer. The app reads it once and keeps it as an attribute of the random RevenueCat purchase identifier described above, so that a later trial or purchase can be reported; it is not added to the usage events. If you switch off “Share anonymous usage data” in Settings, the app removes the reference and nothing is reported. On iPhone, Apple gives no way to link an install to an ad click, so only the first event (store link opened) is sent. Our legal basis is our legitimate interest in measuring our advertising; you can object at any time by writing to hello@scorelens.app. OpenAI handles what we send under its own terms for advertisers.

The same applies to our ads on Google (Search) and X. When you open scorelens.app/app or scorelens.app/ja/app from one of them, the ad network adds a click reference to the link (“gclid”, “gbraid” or “wbraid” from Google, “twclid” from X). When you tap a store button, our server sends that network the click reference and the time, so that we can see which ads lead to the store, and nothing else: no name, email address, IP address, device identifier or advertising identifier. The reference is not passed on to the App Store or Google Play and is not stored by us; we record only which kind it was. The page sets no cookie and loads no tracking pixel of Google or X. This is off for a network until we set up its measurement. You can object at any time at hello@scorelens.app.

Crash reports

When the app crashes or hits an error it cannot recover from, it sends a crash report so we can find and fix the fault. A report contains the technical trace of where in the app's code the error happened, the app version and update, the operating system and its version, the device model, free memory and similar technical state, and a short list of the app's own preceding technical steps (for example the requests it made to our server, without their parameters). It is tied to a random identifier the crash-reporting library creates on your device, used only to count how many installations are affected; it is not linked to the analytics identifiers, the purchase identifier or the device identifier described above.

Crash reports never include your photos, the recognised music, the names you give your pieces, screenshots or recordings of the screen, your IP address, or the link of a part you shared: the app removes share codes, purchase identifiers and web addresses' parameters from a report before it is sent, and does not record log messages or what you tap.

Crash reports are processed for us by Functional Software, Inc. (Sentry), acting as our processor under a data processing agreement, and stored in Sentry's EU data centre (Frankfurt, Germany). They are deleted automatically after at most 90 days.

The Settings switch "Share anonymous usage data" covers crash reports too: with it off, the app sends none.

Reporting a bad result

When recognition gets something wrong, you can tap "Report a bad result". This happens only when you actively choose it: the screen says exactly what will be sent, its box starts unticked, and nothing leaves your phone until you tick the box and tap Send.

Sending a report uploads the photograph of the page, the recognised music, your optional written note and the device identifier. We keep these to study where recognition fails and to improve the engine, including by using them as training and evaluation material for our own recognition engine; the developer may use an AI assistant (Anthropic, see below) to examine them. A report is kept for 180 days and then deleted automatically. Reports are not published, not sold and not shared with advertisers or data brokers. If you would rather your report were removed sooner, email hello@scorelens.app and we will delete it.

Please do not attach anything you would not want stored: the report sends the entire photograph, including whatever else happens to be in the frame.

Notes you correct

When you fix a note in the score editor, the app sends us that bar as it was read and as you corrected it: only the notes of that bar, never the photo or the rest of the piece. We use these bars to find and fix recognition mistakes, including as test material for our own recognition engine. Until 4 November 2026 they are kept with a one-way code of the device identifier, never the identifier itself, for 7 days and then deleted automatically; from then on they are kept as described under Recognised notation and corrections. Switch off “Help improve recognition” in Settings and the app stops sending them, and the bars your device sent in the last 7 days are deleted, including their long-term copies; older bars are no longer linked to your device, so we can’t tell which are yours. You can also ask us by email, as described on Delete your data.

Recognised notation and corrections (from 4 November 2026)

We keep three things: the notation ScoreLens recognises from your pages (as MusicXML), the corrections you make in the editor, and fingerprints derived from the notes (a compact code that can’t be turned back into a page). With them go technical details (the app version, the quality grade and the country as a two-letter code, never the IP address) and a one-way checksum of the photo, which can’t be turned back into the photo and only tells us when the same shot was sent twice. We use them to improve recognition, to train our recognition models, and to recognise the same pieces faster for everyone. They are stored without a device identifier or any name, so they are not linked to you, and we keep them for 1 year, then delete them. The device code that goes with a correction for the first 7 days is not part of this long-term store.

Photos are different. The photo of a page is never used for training and is not stored for that purpose; saved photos are not read by AI. Photos are deleted as described above. The only exceptions are the two you can see above: pages that didn’t read well, while “Help improve recognition” is on, and reports you choose to send.

Copyrighted music. Many pieces are protected by copyright. One person’s reading of a piece is used only as a signal to correct another person’s reading of the same piece. We never give one user’s reading to another user as a copy of the piece.

We do this on the basis of our legitimate interest in making recognition more accurate and faster. You can object at any time by writing to hello@scorelens.app; because the data is not linked to you we can’t always find yours, but a rights holder can ask us to remove a work. Switching off “Help improve recognition” stops the app from sending your corrections.

What stays on your phone

Your library — the pages you scanned, their images, the recognised music and any names you gave them — is stored only on your device, in the app's private storage. It is not uploaded, not backed up to us, and not readable by us, except for the notes of a part you choose to share by link and the bars you correct in the editor (see above). Deleting a piece in the app deletes it. Deleting the app removes all of it, along with your instrument choice and free-page state. We cannot restore any of it, because we never had a copy.

Exports you create — MIDI, MusicXML or PDF — are produced on the device and go wherever you send them through the system share sheet.

Other services involved

• Apple App Store and Google Play process purchases and provide their own reporting to us. We see aggregate sales figures, never your payment details. Their privacy policies apply to that part.
• RevenueCat manages purchase state and tells our server whether a device is entitled to Pro. If you ask Apple for a refund, RevenueCat sends Apple a short summary of how the purchase was used (such as how long you have used the app and your past purchases and refunds) so Apple can decide the request. No music, photos or name are included.
• OpenAI receives the ad-click reference, the event type and the time when you arrive from one of our ads in ChatGPT, as described under “Measuring our own ads”, in the United States.
• Mixpanel stores the usage events described above, in its EU data centre, as our processor.
• Sentry stores the crash reports described above, in its EU data centre, as our processor.
• Vercel Web Analytics counts page views on our website, cookie-free and without an identifier, as described under "Our website" above.
• Instrument sounds for most instruments the app offers are built in, so playback needs no connection. For the few that are not, and for the web player for shared parts on scorelens.app, the app downloads them from the midi-js-soundfonts library hosted on GitHub Pages. That host sees your IP address, as it would for any file downloaded from the internet. No identifier of yours is attached to the request, and nothing about your score is sent with it.
• Google Cloud runs our own server (Cloud Run, Cloud Storage, Cloud Key Management, Cloud Logging) in the European Union (Belgium), as our processor.
• Google Cloud (Vertex AI, Gemini) reads printed part names, as text only, to suggest an instrument, in the European Union, as our processor.
• Vercel (AI Gateway) and TypeSafe AI receive the same printed part names, as text only, to check the instrument suggestion. Vercel passes them on without keeping them; TypeSafe AI processes them in the United States, as our processor.
• Upstash (Redis) holds our server’s working data (the free-page counters, referral credits, teacher codes, rate limits, cached Pro status and the short-lived job state), in its European Union region, as our processor.
• Anthropic (Claude), an AI assistant the developer uses to analyse reports and recognition errors. While working on a problem it may be shown a report you sent (the photo, the recognised music and your note) or the recognised music of a doubtful reading, never your device identifier and never a kept photo of a page that didn’t read well. Anthropic acts as our processor under its commercial terms and data processing addendum, which do not allow it to train its models on this material, and this material is not used for training; it is processed in the United States under the EU Standard Contractual Clauses.

Apart from Mixpanel for the usage events and Sentry for the crash reports above, there is no advertising SDK and no other analytics or crash-reporting SDK in ScoreLens. Nothing about you is sold, and nothing is used to show you ads; the only advertising use is measuring our own ads in ChatGPT, described above.

YouTube publishing tool

Our YouTube channel, ScoreLens (@scorelensapp), is published with a small internal tool that uses the YouTube API Services. It signs in only to our own channel, uploads videos we make, and reads that channel's own statistics. It does not access any viewer's or other user's account or data, and it isn't offered to anyone else. By watching our videos you are subject to the YouTube Terms of Service and the Google Privacy Policy.

Transfers outside the EU

Our server, photos, usage events and crash reports are stored in the EU. RevenueCat, Inc. (purchase status) and Anthropic, PBC (reports you send) process data in the United States, as does TypeSafe AI (printed part names, as text only). Some of our EU-hosted providers (Mixpanel, Sentry, Vercel, Upstash, Google) are US companies whose staff may access data from the US for support or security. Each transfer is covered by the EU–US Data Privacy Framework where the provider is certified and otherwise by the European Commission’s Standard Contractual Clauses in the provider’s data processing agreement (RevenueCat and Anthropic use Standard Contractual Clauses). You can ask us for a copy of the relevant safeguards.

Legal basis

Under the GDPR we rely on: performance of a contract for uploading and recognising a page, which is the service you asked for; legitimate interest for the device counter that enforces the free allowance and protects the server from abuse, for its 30-day backup, and for IP-based rate limits and server logs; legitimate interest for keeping, from 21 October 2026, the photo of a page that didn’t read well for 30 days to fix recognition errors, which you can object to at any time with the “Help improve recognition” switch; legitimate interest for keeping recognised notation, corrections and fingerprints, from 4 November 2026, to improve recognition, train our models and recognise known pieces faster, which you can object to by email at any time; legitimate interest for pseudonymous usage analytics and crash reports, which you can switch off in Settings at any time; performance of a contract for storing a part you chose to share, for the 30 days you asked for; legitimate interest for handling reports about shared parts and removing unlawful material; and your consent for anything sent through the report button, which you may withdraw at any time by writing to us.

Your rights

You may ask what we hold about you, ask for a copy (including in a portable format), ask for correction, deletion or restriction of processing, or object to processing, and you may withdraw any consent at any time without affecting what was done before. Where we rely on legitimate interest you can object at any time; for kept photos of pages that didn’t read well, the “Help improve recognition” switch does it at once. In practice, outside the one-hour job window we can still hold only the recognised music of a doubtful, cancelled or reported page and the bars you corrected in the editor (for 7 days), from 21 October 2026 the photo of a page that didn’t read well (for 30 days, unless you switched “Help improve recognition” off), a report you chose to send (for 180 days), from 4 November 2026 recognised notation, corrections and note fingerprints (for 1 year, not linked to your device, so we can’t single out yours), the free-page counter and its backup (for 30 days), server logs with your IP address (for 30 days), the notes of a part you shared by link (for at most 30 days, and you can delete them yourself with "Stop sharing"), and the usage events and crash reports described above (crash reports for at most 90 days), which we can only single out with your help (see "Turning it off"). Write to hello@scorelens.app; we answer within one month. Uploading the photo is needed to recognise a page; everything else is optional or switchable. We make no decisions about you by automated means that have legal or similarly significant effects. You also have the right to complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the authority where you live or work; in the UK, the Information Commissioner’s Office (ico.org.uk).

Children

ScoreLens is a general-audience app: it is rated 4+ on the App Store and "Everyone" on Google Play, where its target audience is 13 and over. It is not designed or marketed for children under 13 and is not in the App Store's Kids category, but younger students do use it, often with a teacher or parent, so it is built to collect as little as possible: no accounts, no names, no ads, no tracking and no messaging. Usage events are pseudonymous (tied to random identifiers, never to a name). If you are under 16, ask a parent or teacher before sending a report with a photo. If you believe a child under 13 sent us a report, write to us and we will delete it. A kept photo of a page that didn’t read well that shows a person is deleted, not used, and if we learn that kept photos came from a child under 13, we delete all of them from that device.

Changes

Keeping recognised notation, corrections and note fingerprints to improve recognition (see Recognised notation and corrections) was published on 21 October 2026 and takes effect on 4 November 2026.

If this policy changes in a way that affects what we collect or keep, the date at the top changes and the new version appears here before the change takes effect in a released version of the app, with the date it takes effect. The current change (keeping photos of pages that didn’t read well) was published on 7 October 2026 and takes effect on 21 October 2026; the app also tells you about it on screen before any photo is kept. Sending the bars you correct in the editor (see Notes you correct) was added here on 15 October 2026, before any version of the app sends them.

日本のお客様へ

個人情報の保護に関する法律に基づく公表事項（利用目的、外国にある事業者としての所在国、安全管理措置）は日本語のページにまとめています。