Effective date: 1 September 2026
Who we are: 4rt Studio Ltd — support@codapad.com
Codapad is a sheet-music reader. You can use it entirely on your own device without an account: your library, setlists and settings stay on the device, encrypted, and we never receive them. Only if you register an account and join or create an ensemble do we store data on our servers, so that your ensemble can share charts and setlists. This policy explains what that data is, why we process it and what you can do about it.
Your account. Your email address, a display name you choose, an optional profile picture, and a hashed copy of your password. We use these to sign you in, to let ensemble admins invite and manage members by email, and to send you the codes and notices the service needs: registration verification, password reset, a notice when your password changes, and ensemble invitations. We send no marketing email.
Your devices. Sessions are bound to a device. For each we store an identifier generated by the app, a short label taken from your device’s software identification string, and when it was created, last used or signed out. You can see and end them from Account → Devices.
Your ensembles. Ensemble names, pictures and optional contact emails; each member’s email, display name, role and status; invitations and join requests; and the PDF sheet music ensemble admins upload, with its filename. Content is visible only to that ensemble’s members, according to the parts and setlists each has been granted. Nothing is public. Ensembles have a plan tier that sets storage, member and device limits; there is currently no payment.
Server logs. Requests to our servers are logged with the IP address they came from, and IP addresses are held briefly in memory to rate-limit sign-up and login attempts. They are not linked to your account and are discarded after 30 days.
Crash reports. To fix bugs, the app sends crash and error reports to Sentry (Functional Software, Inc., EU data centre). A report contains the app version, device model and OS version, the screens visited before the error, technical details and, if relevant, a chart’s filename. When you are signed in your email is attached so we can tell you if a problem affects your account. No screenshots are taken. Sentry keeps reports for 90 days.
We collect nothing else: no analytics, no advertising, no location, contacts or photos. The camera is used only while you scan an ensemble’s join QR code, on your device.
Legal basis (UK/EU GDPR): performing our contract with you for account, device, ensemble and content data; our legitimate interest in a secure, working service for logs, rate limiting and crash reports.
Other members of your ensembles see your display name, picture and role; admins also see your email. Our staff can look up account and ensemble records to provide support and handle abuse. Our processors are a hosting provider, an email delivery service, and Sentry as described above. Our servers may be located in the United Kingdom, the European Union or the United States, and may move between them. Where personal data leaves the UK or the EEA we rely on the safeguards the law provides for such transfers, such as the UK Addendum and the EU Standard Contractual Clauses, or the recipient’s certification under the Data Privacy Framework. We do not sell data and share it with no one else unless the law compels us.
Sessions expire after 30 days of non-use, or when you sign out, revoke a device or reset your password. Verification and reset codes expire after 15 minutes. Account and ensemble data is kept while the account or ensemble exists.
You can delete your account in the app (Account → your account menu → Delete account). This removes you from every ensemble, ends your sessions and frees your email address for a fresh registration, which starts as a brand-new account. If you are the only admin of an ensemble, hand the role over or delete the ensemble first. Deleted accounts and deleted ensembles are erased within 30 days. Content you uploaded as an admin belongs to the ensemble and stays with its remaining members.
Deleting your account or signing out never touches the music on your device.
You can access, correct, export or erase your personal data, object to or restrict its processing, and complain to a supervisory authority (in the UK, the Information Commissioner’s Office, ico.org.uk). Most of this you can do in the app; for anything else, email support@codapad.com and we will reply within one month.
We will post changes here with a new effective date and tell you in the app before material changes take effect.