Symfora helps music programs manage their library, instruments, uniforms and members. This page explains what we collect, why, who helps us run the service, and how to have your data deleted. Questions go to privacy@symfora.org.
The short version
- We collect what's needed to run your program in Symfora, and nothing for advertising.
- We don't sell or rent personal information, and we don't show ads.
- A program's data belongs to that program. Its directors decide what goes in and can delete it.
What we collect
Account information
Your name, email address and password when you sign up or are invited. Passwords are stored only as a one-way hash, so we can't read them. If you use Sign in with Google, we receive and keep your Google account ID and email address so we can recognize you. We don't get your Google password or access to anything else in your Google account.
Program information
What directors and staff enter about their program: member names, grade or graduation year, contact details, photo permission, notes, attendance, dues, and which instruments, uniforms and music are assigned to whom. Also the sheet music images you scan or upload, and notes you draw on them.
Technical information
Like any website, our servers see your IP address, browser type and the pages requested. We use this to keep the service running and secure (for example, to limit repeated login attempts), not to profile you.
How we use it
- To provide Symfora: show your program its data, let members read their music, and so on.
- To send account emails, such as invitations and password resets. We don't send marketing email from the app.
- To read scanned music automatically: an AI model reads the top of each scanned page (title and part name) to sort pages into parts. This runs on our hosting provider's AI service for your program only.
- To protect the service, fix problems, and meet legal obligations.
Students and schools
When a school or other program uses Symfora, it controls the information it enters about its members, and we handle that information on the program's behalf and only to provide the service. If a program invites students to sign in, the program is responsible for any consent the law or its own policies require, including parental consent for children under 13. We don't knowingly collect personal information directly from children under 13 without that consent. Parents can ask their program, or us, to review or delete their child's information.
Who helps us run Symfora
We share information only with the service providers that run Symfora, under their own privacy and security terms:
- Cloudflare: hosting, file storage, email sending, and the AI model that reads scanned pages.
- Neon: our database.
- Google: only if you choose Sign in with Google. This website also loads its fonts from Google Fonts.
These providers may store and process data in the United States and other countries. We may also disclose information if the law requires it, or to protect people or the service.
Cookies and browser storage
The Symfora app keeps your sign-in in your browser's storage, and uses one short-lived cookie during Sign in with Google. We don't use advertising or tracking cookies.
How long we keep it, and deleting it
We keep a program's information while its account is active. Directors can delete members, music and other records in the app at any time. To delete your login or a whole program's account, email privacy@symfora.org, and we'll delete it within 30 days. Copies in our backups expire on their own schedule after that.
Security
Everything travels over HTTPS, passwords are hashed, and each program's data is kept separate from every other program's at the database level. No system is perfectly secure, but we work to protect your information and will tell affected programs promptly if a breach involves their data.
Changes to this policy
If we change this policy, we'll update the date at the top of this page, and tell account holders by email about any significant change.
Contact
Email privacy@symfora.org.