Privacy Policy for Legato

Effective Date: February 28, 2026
Last Updated: February 28, 2026

Introduction

ProximityLabs ("we," "us," or "our") develops the Legato mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App on iOS and Android devices.

We are committed to protecting your privacy and ensuring you have a positive experience using Legato. This policy applies to all users of our App and complies with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable privacy laws.

Information We Collect

Information Stored Locally on Your Device

The following data is stored exclusively on your device using our local Isar database and is NOT uploaded to our servers:

• Practice Session Data: Duration, goals, progress tracking, and completion status
• User Preferences: Instrument type, daily practice goals, onboarding preferences
• Audio Recordings: Practice session recordings in M4A format (44.1kHz)
• PDF Files: Sheet music files you import into the App
• User-Generated Content: Practice notes, annotations, activities, pieces, routines, tags, composers, and bookmarks
• Performance Statistics: Progress tracking, daily statistics, achievement data, and waveform data

Information Collected and Stored on Our Servers

We collect and store the following information on our secure servers (Supabase):

Account Information (Optional)

Account creation is entirely optional. The App works fully without an account. Accounts are used solely to enable cross-device subscription sharing. If you choose to create an account, we collect:

• Email address (for email/password sign-up or social login)
• Name (if provided via Google or Apple sign-in)
• Account creation date and authentication provider
• Firebase anonymous UID linked to your Supabase account

Device Information (Account Holders Only)

When you are signed in to an account, we record device information to power the linked-devices management feature:

• Device identifier, device name, and platform (iOS or Android)
• App version and OS version
• Last seen timestamp

This data is only collected when you are authenticated with an account and is stored in our user_devices table.

Subscription Information:

• Subscription status (active, expired, cancelled)
• Platform (iOS or Android)
• Product ID and purchase tokens/transaction IDs
• Subscription purchase and expiration dates
• Auto-renewal status
• Linked Supabase user ID (if account is connected for cross-device sharing)

Support Information:

• Support ticket messages and email addresses (if provided)
• Device information submitted with support tickets (app version, OS version, device model)

Webhook Events:

• Subscription lifecycle events from Apple App Store and Google Play Store
• Event timestamps and processing logs

Information Collected Through Third-Party Services

We use Firebase services (operated by Google) which automatically collect certain information:

Firebase Authentication:

• Anonymous user identifiers (generated automatically on app launch, no personal data required)
• Authentication timestamps

Firebase Analytics:

• Screen views and navigation patterns (163 event types, 49 screens)
• User interaction events and app usage statistics
• Session duration and frequency
• Device information (model, OS version)
• General location (country/region level only)

Note: Firebase Crashlytics, Firebase Cloud Messaging (FCM), and Firebase App Check are installed in the App but are currently not initialised or active and do not collect data. We will update this policy before activating any of these services.

This information is processed according to Google's Privacy Policy.

How Accounts Work

Account Creation (Optional)

You may use Legato fully without creating an account. An account is only needed if you wish to share your subscription across multiple devices. You can create an account using:

• Email and password — requires email verification via a confirmation link sent to your inbox.
• Google Sign-In — available on both iOS and Android.
• Apple Sign-In — available on iOS only.

When you sign in with Google or Apple, we receive an identity token which Supabase exchanges for a session. We store your email address and, where provided by the OAuth provider, your display name.

Cross-Device Subscription Sharing

When you create an account and link it to your subscription, your Firebase anonymous UID is associated with your Supabase account. The subscription record is updated with your Supabase user ID, allowing you to access your active subscription on any device where you are signed in with the same account. A subscription can be linked to one account only and cannot be transferred between accounts.

Data Sync Disclaimer

Practice data sync across devices is not currently implemented. All practice sessions, recordings, sheet music, and related content remain stored locally on each device and are not synchronised to the cloud. This policy will be updated if cloud sync is introduced.

Email Verification and Password Reset

When you register with an email address, we send a confirmation email containing a deep link that redirects back into the App to verify your address. Password reset emails are sent to your registered address on request. These emails are delivered via the Resend email delivery service.

Account Deletion

You may request deletion of your Supabase account and all associated server-side data at any time by contacting support@proximitylabs.dev. Upon deletion we will remove your email address, linked device records, and account identifiers. Subscription webhook history and support ticket records are retained for the periods described under Data Retention.

How We Use Your Information

We use the information we collect to:

• Provide Core Functionality: Enable practice tracking, progress monitoring, subscription management, and access to practice tools
• Process Subscriptions: Verify purchases, manage subscription status, handle renewals/cancellations, and enable cross-device subscription sharing
• Account Management: Authenticate users, manage linked devices, and support cross-device access
• Provide Customer Support: Respond to support tickets and technical inquiries
• Improve App Performance: Identify and fix bugs, optimise features, and enhance user experience
• Analytics: Understand how users interact with our App to improve features
• Security: Runtime integrity checks to protect against tampering
• Legal Compliance: Comply with applicable laws and enforce our Terms of Service

Device Permissions

Legato requests the following device permissions:

Microphone Access (iOS and Android)

Required for tuner functionality and audio recording features. Audio is processed locally for real-time tuning feedback and saved recordings. You can revoke this permission in your device settings.

Camera (iOS and Android)

Required for scanning and importing sheet music. Images are processed locally. You can revoke this permission in your device settings.

Photo Library (iOS only)

Required for importing sheet music images from your photo library. You can manage this permission in your device settings.

Storage Access (Android 12 and below)

Required for importing and managing PDF sheet music files and audio recordings. Read and write access is limited to designated app storage areas.

Notifications (Android)

Required to deliver local practice reminders. Notifications are generated on-device only and do not involve our servers.

Exact Alarm (Android)

Required for scheduling precise practice reminder notifications at the times you specify.

Foreground Service (Android)

Required to run the background practice timer so it continues while the screen is off or other apps are in use.

Internet Access (iOS and Android)

Required for subscription verification, account authentication, support tickets, and analytics. Your practice session data, recordings, and PDFs are NOT transmitted over the internet.

Billing (Android)

Required to process in-app purchases through Google Play Billing.

Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following circumstances:

Service Providers

• Firebase / Google — anonymous authentication, usage analytics
• Supabase — secure database hosting for account data, device records, subscription data, and support tickets
• Resend — email delivery for account verification, password reset, and support notifications
• Google Play API — purchase token verification for Android subscribers
• Apple App Store API — transaction ID verification for iOS subscribers
• freeRASP (Talsec) — runtime application security and device integrity checks
• Google OAuth — identity token exchange for Google Sign-In
• Apple Sign-In — identity token exchange for Apple Sign-In

Other Disclosures

• Legal Requirements: If required by law, court order, or governmental authority
• Protection of Rights: To protect our rights, privacy, safety, or property
• Business Transfers: In connection with a merger, sale, or acquisition of our company
• With Your Consent: When you explicitly agree to sharing for a specific purpose

Data Security

We implement appropriate technical and organisational measures to protect your information:

• Encryption: All data transmitted to our servers uses industry-standard TLS/SSL encryption
• Secure Database: Subscription, account, and device data stored on Supabase with row-level security policies
• Access Controls: Limited internal access to user data; service role keys secured as environment variables
• Authentication: Firebase Authentication and Supabase Auth for secure user identification
• Regular Updates: Security patches and updates to address potential vulnerabilities

While we strive to protect your information, no method of electronic storage or transmission is 100% secure.

Data Retention

Local Device Data

Stored indefinitely until you delete the App or clear app data. You maintain full control over this data through your device.

Server-Stored Data

• User accounts and device records: Retained while the account is active; deleted upon account deletion request
• Subscriptions: Retained for the duration of your subscription plus 90 days for billing and support purposes
• Support tickets: Retained for 2 years for customer service purposes
• Webhook events: Retained for 90 days for audit and debugging purposes

Firebase Analytics Data

• User-level data: 14 months (Google's retention policy)
• Event-level data: 2 months
• Aggregated data: No expiration

Your Privacy Rights

GDPR Rights (European Users)

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Restriction: Limit processing of your personal data
• Portability: Receive your data in a portable format
• Objection: Object to certain processing activities
• Automated Decision-Making: Opt out of automated decision-making

CCPA Rights (California Residents)

• Know: What personal information we collect, use, and share
• Delete: Request deletion of your personal information
• Opt-Out: Opt out of the sale of personal information (Note: We do not sell personal information)
• Non-Discrimination: Equal service regardless of exercising privacy rights

How to Exercise Your Rights

To exercise these rights, contact us at support@proximitylabs.dev. We will respond within 30 days. You may request:

• Export of your subscription data and server-side account data
• Deletion of your account and all associated server-side data
• Correction of inaccurate information

Children's Privacy (COPPA Compliance)

Legato is designed for musicians of all ages. For users under 13:

• We do not knowingly collect personal information from children under 13 without parental consent
• The App works without an account; Firebase Authentication uses anonymous identifiers that do not require personal information
• Account creation (which requires an email address) is optional and not necessary to use the App
• Parents/guardians may review and request deletion of their child's information

If we discover we have collected personal information from a child under 13 without parental consent, we will delete it immediately. Parents who believe we have information about their child should contact us at support@proximitylabs.dev.

Premium Subscription Features (LegatoPlus)

LegatoPlus enables seamless integration of tools within your practice sessions: in-practice metronome, drones, audio recording, notes and annotations, and PDF sheet music access. These tools are available for free use outside of practice sessions; LegatoPlus provides uninterrupted access during active practice.

Subscription Processing

• Handled through Apple App Store or Google Play Store
• Payment information is processed by Apple/Google, not by us
• We receive only subscription status and basic transaction information
• Subject to Apple/Google privacy policies

Subscription Verification

• We verify purchases with Apple/Google servers to prevent fraud
• Purchase tokens are securely stored on our servers
• We automatically update subscription status based on webhooks from app stores
• If you link an account, your subscription is associated with your Supabase user ID for cross-device access

International Data Transfers

Your data may be processed in countries outside your country of residence:

• Supabase servers: Located in the United States (configurable by region)
• Firebase services: May process data globally according to Google's infrastructure

We ensure appropriate safeguards for international transfers including Standard Contractual Clauses, compliance with GDPR adequacy decisions, and adequate security measures.

Updates to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the new Privacy Policy in the App, updating the "Last Updated" date, and sending an in-app notification for significant changes. Continued use of the App after changes constitutes acceptance of the updated policy.

Contact Information

For questions, concerns, or to exercise your privacy rights, contact us at:

ProximityLabs
Email: support@proximitylabs.dev
Privacy Inquiries: support@proximitylabs.dev

For GDPR concerns, EU residents may also contact their local Data Protection Authority.

Additional Information for Specific Jurisdictions

California Residents

Under California Civil Code Section 1798.83, California residents may request information about disclosure of personal information to third parties for marketing purposes. We do not share personal information for marketing purposes.

European Economic Area

Our legal bases for processing under GDPR:

• Consent: For optional features like analytics
• Contract: To provide App services you requested (subscription management, account features)
• Legitimate Interests: For improving our App, ensuring security, fraud prevention, and runtime integrity checks
• Legal Obligation: When required by law

Nevada Residents

Nevada residents may opt out of the sale of personal information. We do not sell personal information, but you may register your preference by emailing support@proximitylabs.dev.

---

By using Legato, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.