V2 Privacy Policy

Effective date: 16 September 2026. This Policy applies to the Forte V2 app and its connected services from the V2 release. Until then, the V1 app and Website remain covered by the V1 Privacy Policy. This V2 notice does not expand the permitted use of V1 data already collected.

1. Introduction

Forte is a music practice app. This Privacy Policy explains how SaxApp Pty Ltd (“we”, “us”, or “our”) collects, uses, stores, shares, and protects (“processes”) your personal information when you:

  • download and use the Forte iOS app (the “App”), including its widgets;
  • visit our website at https://getforte.app, including public profile-link pages at getforte.app/u/<username> (the “Website”); or
  • contact us, including through in-app feedback or by email.

This single Privacy Policy covers the App and the Website (together, the “Services”). It is a notice about our practices, not a request for blanket acceptance of future data uses. You can contact us about questions or privacy choices using section 19.

2. Who We Are

The Services are owned and operated by SaxApp Pty Ltd, a company based in Australia. For the purposes of laws such as the EU and UK General Data Protection Regulation, SaxApp Pty Ltd is the data controller of the personal information described in this Policy.

3. Summary of Key Points

  • You can use Forte without creating an account, including the tuner, basic metronome, keyboard, and selected training exercises. Some tools and advanced features require Forte Pro. Recording and saving a practice session requires an account.
  • If you choose to create an account, we collect account and profile information. New accounts in V2 use Apple or Google sign-in; previously created email/password accounts can still sign in and recover access, and older app versions may still offer email signup during the transition. Signed-in practice session times, durations, and instruments sync to our servers under your privacy settings.
  • New accounts are private by default. Existing accounts keep their chosen privacy setting. You control visibility of your synced practice statistics and factual session history, subject to age restrictions.
  • The tuner analyses microphone audio on your device in real time. Microphone audio is never recorded, stored, or uploaded.
  • Optional V2 practice photos, session descriptions, practiced-piece names, filter and card choices, and saved share images stay on your device. Forte does not upload them to its servers or show them to other Forte users. You can choose to send a rendered card to an external destination through the iOS share sheet.
  • We do not show ads, do not use advertising or cross-app tracking, and do not sell your personal information.
  • Subscriptions are processed by Apple and managed with RevenueCat. We never receive your full payment card details.
  • The Website does not use analytics scripts, tracking pixels, or non-essential cookies.
  • You can delete your account and associated data directly in the App, and you can separately delete the Forte data stored on your device.

4. Information We Collect

We collect information in four ways: information you provide to us, information collected automatically when you use online features, information generated by other users’ actions that involve you, and information our service providers (such as Apple) make available to us. Much of Forte’s data is also processed only on your device and never reaches us, as described in section 4.3.

4.1 Information you provide to us

  • Account details and provider identity. For a new account in V2, you can sign in with Apple or Google. We receive your provider identity and email information (which may be an Apple private-relay address), account ID, username, display name, selected instrument, and privacy choice; our authentication provider processes the credentials or provider tokens needed for sign-in. We do not receive your Apple or Google password. Email/password sign-in and recovery remain available for existing email accounts, and older installed versions may still offer email signup while supported; those passwords are stored in protected, hashed form by our authentication provider and cannot be read by us. The username you type is sent to our servers to check availability. New accounts default to private; existing accounts keep their chosen setting. If a provider email is verified as matching an existing account, that account may open with its history unchanged. An Apple private-relay address may instead create a separate account; we do not promise automatic merging of all accounts.
  • Date of birth. When you create an account we ask for your date of birth to confirm you meet our minimum age requirement and to apply age-based protections (see section 13). If you enter a date of birth that makes you too young for an account, we do not create an account and your date of birth is not sent to or stored on our servers. If an account is created, we store your date of birth against your account while the account exists.
  • Interrupted account creation. If Apple or Google authentication finishes but you leave before completing your Forte profile, an authentication identity may temporarily exist without a completed public profile. The App lets you resume setup. A date of birth entered by someone too young for an account is not sent to or stored on Forte servers.
  • Age-range signal from Apple. In regions where age assurance is required, Apple may provide us with an age range for the Apple Account signed in on your device (for example, 16–17 or 18 and over) when you create an account. Apple provides only this range, not your date of birth. We use it, together with the date of birth you enter, to confirm eligibility and apply age-based protections; we do not store the range itself, only whether an age-based restriction applies to your account. Apple handles the underlying age information as an independent controller under its own privacy policy.
  • Profile details. Your preferred instrument and recently used instruments (which can include custom instrument names you type), and your choices about which practice statistics are hidden from other users.
  • Practice session facts. Recording and saving a practice session requires an account. We sync start and end times, durations, instrument names and timing for each part of a signed-in practice session, and service identifiers used to keep sync reliable. We use these facts to calculate statistics and authorized friend activity. They can reach our servers even if you never create or share a card. Optional photos, session descriptions, practiced-piece names, and rendered cards remain local.
  • Feedback and support. If you use Help & Feedback in the App, we collect the category you select, your message, and (optionally) a contact email address, together with the App version and build number and a support identifier so we can act on your report. If you email us, we collect the information you include in your message.
  • Sharing actions. If you share your profile invite link or QR code, the link contains your username. What happens after you share it depends on the destination you choose in the iOS share sheet.

4.2 Information collected automatically

When you use features that connect to our servers or our service providers, we collect:

  • Account and service identifiers. A unique account ID, a subscription app-user ID used by our subscription provider (an anonymous identifier if you have not signed in), and notification installation identifiers for your device.
  • App download transaction identifier. If you sign in to a Forte account, we store the identifier Apple assigns to your App Store download of Forte (the “appTransactionID”) together with your account. Where a US state app-store law applies, Apple uses this identifier to tell us when a parent or guardian withdraws consent for a minor’s use of Forte, and we use it only to act on that withdrawal (for example, signing the account out), to comply with those laws, and for related safety and record-keeping purposes.
  • Device and notification data. If you enable social push notifications, a push notification device token issued by Apple, the platform (iOS), and related installation credentials used to deliver notifications to your device and to remove stale registrations.
  • Purchase and subscription data. Your subscription and entitlement status (for example whether a Forte Pro subscription is active), purchase and restore events, and related product interaction needed to operate the paywall and subscriptions. Payments are processed by Apple; we never receive your full payment card number or banking credentials.
  • Search queries. If you search for other users in the App, your search query is processed to return results. Our anti-abuse logs do not store your raw search text; they store a one-way coded fingerprint and the query length.
  • Technical and connection data. When your device communicates with our servers, we process your IP address, request timestamps, and related request metadata for delivery, security, rate limiting, and abuse prevention. Where feasible, our security logs store one-way coded fingerprints instead of raw identifiers.
  • App analytics, crash, and performance reports via Apple. For users who have opted in (in iOS settings) to share data with developers, we receive aggregated App Store analytics and crash and performance diagnostics from Apple. Apple provides these opt-in reports to us in a form that is not personally identifiable to us, and we use them to understand overall usage and to fix crashes and performance problems.
  • App Store sales and subscription reports. Separately from the opt-in reports above, Apple provides App Store acquisition, sales, transaction, and subscription reporting for all purchases as part of operating the App Store, regardless of your analytics opt-in. These reports do not identify individual customers to us; Apple holds the underlying transaction records as an independent controller (section 8.1).
  • Subscription analytics. We use our subscription provider’s reporting (for example active subscription counts and conversion metrics) to understand subscription performance.

4.3 Information processed only on your device

The following information is processed locally on your device and is not transmitted to us:

  • Microphone audio. The tuner uses your microphone (with your permission) to detect the pitch and loudness of your instrument in real time. Audio is analysed on the device and immediately discarded. We never record, store, or upload microphone audio, and the App has no audio recording feature. You can revoke microphone access at any time in iOS Settings.
  • Practice to-do notes. To-do items you write during a practice session stay on your device and are not synced to our servers.
  • Metronome setlists and pieces. Setlist names, piece names, tempos, and related metronome settings stay on your device.
  • Tool settings and training progress. Ear training selections and streaks, dictation and exercise settings, generated sheet music, keyboard and tuner settings, and similar preferences stay on your device.
  • Widgets. Forte’s home screen widgets run on your device and read a locally stored subscription-status value; they do not collect or transmit data.
  • Practice reminders. The optional “Still practicing?” reminder is a local notification scheduled on your device.
  • Metronome flash and camera. The metronome flash toggles the device torch. Separately, the optional V2 practice-memory feature can use the camera to capture a still image with your iOS permission; no photo is required to finish a session. The tuner microphone remains an on-device audio analysis feature, not an audio recording.

Optional V2 practice memories. For a qualifying session, you can skip a photo, capture one with the camera after granting iOS camera permission, or choose a single image through Apple’s PhotosPicker. The App stores reduced original and processed photo copies, filter/look settings, a description and practiced-piece names you choose to add, the selected card design, and a rendered PNG alongside your local session. You can edit, replace, or remove the photo. A saved card can appear on your own profile on that device. These items are not synced to Forte servers, available for recovery from server-synced history, or shown on another person’s Forte profile. Forte does not use CloudKit to sync them. Depending on your iOS/device backup arrangements, local app data may be included in an Apple or device backup; such a backup is governed by your backup provider, not a Forte media upload.

4.4 Statistics we derive from your practice data

From your synced practice sessions we calculate practice statistics, such as total practice time, practice this month, longest and average session, an instrument breakdown, your peak practice day, and practice-time patterns (for example, whether you tend to practise in the morning or at night). These statistics are shown to you, and to other users only in accordance with your visibility settings described in section 7. You can hide individual statistics from other users.

4.5 Information from other users

We process information about you that is generated by other users’ actions — for example, when another user sends you a follow request, follows you, or blocks you. This is necessary to operate the social features described in section 7.

4.6 Website visitors

The Website is an informational site. It does not include analytics scripts, tracking pixels, third-party embeds, or contact forms, and it does not set non-essential cookies. When you visit the Website, our hosting provider (Cloudflare) processes standard web request data — such as your IP address, browser user agent, the pages requested, response status, approximate country or region derived from your IP address, timing, and error details — to deliver the site and to provide security, reliability, and debugging. These operational logs are retained only briefly, as described in section 11.

Public profile-link pages at getforte.app/u/<username> can be opened by anyone who has the link, with or without a Forte account. These pages display only the username that is already contained in the link itself, together with a prompt to open the profile in the App. The Website does not look up, display, or confirm any account information when rendering these pages.

4.7 Information we do not collect

  • We do not access your contacts or address book. The social graph in Forte is built only from follow relationships you and other users create in the App.
  • We do not collect your precise location.
  • We do not record or receive microphone audio.
  • We do not receive your full payment card details; Apple processes payments.
  • We do not collect data for advertising, do not use advertising identifiers, and do not track you across other companies’ apps or websites.

5. How We Use Your Information

We use personal information to:

  • provide and operate the Services, including accounts, practice history sync, profiles, social features, search, notifications, and subscriptions;
  • authenticate you and keep your account secure;
  • deliver push notifications you have enabled (such as follow requests, new followers, and accepted follow requests);
  • respond to your feedback and support requests;
  • protect the Services and our users through security monitoring, rate limiting, anti-abuse and moderation safeguards, and fraud prevention;
  • understand overall usage and improve the Services, using aggregated analytics and crash and performance diagnostics;
  • operate, measure, and improve subscriptions and purchases; and
  • comply with legal obligations and enforce our rights.

We do not use your information for third-party advertising, and we do not send marketing emails. We do not make decisions about you that produce legal or similarly significant effects solely by automated means.

6. Legal Bases for Processing (EEA, UK, and Similar Jurisdictions)

Where laws such as the EU or UK General Data Protection Regulation apply, we rely on the following legal bases:

  • Performance of a contract. Most processing is necessary to provide the Services you ask for: creating and operating your account, syncing your practice history, providing profiles and social features, delivering subscriptions, and responding to support requests. Providing account details is necessary to use account features; if you prefer not to provide them, you can still use the App’s on-device tools without an account.
  • Legitimate interests. We process limited technical, security, and usage information for our legitimate interests in securing the Services, preventing abuse and fraud, keeping our systems reliable, and improving the Services using aggregated, non-identifying reports. We balance these interests against your rights and apply safeguards such as short retention periods and one-way coded identifiers in security logs.
  • Consent. We rely on consent where required — for example, for the optional contact email you may add to feedback, and for device permissions such as microphone access and notifications, which you grant through iOS and can withdraw at any time in iOS Settings. Withdrawing consent does not affect processing that happened before withdrawal.
  • Legal obligation. We may process information where necessary to comply with applicable law or valid legal process.

7. Social Features and Your Visibility Choices

Forte includes optional social features for signed-in users: profiles, following, a friend activity feed, profile search, and social notifications. You control how visible your information is:

  • Private accounts (default). New accounts are private by default. On a private account, your practice statistics and session history are visible only to you and to followers you approve. Follow requests require your approval.
  • Public accounts. If you switch your account to public, any signed-in user can see your profile, practice statistics, and session summaries, and new followers are approved automatically (including any pending requests at the time you switch).
  • Search. Signed-in Forte users can search for profiles by username or display name. If an account is private, other signed-in users may see a limited profile result, but practice stats and session history are visible only to the account owner and approved followers.
  • Friend activity. Users who follow you (with your approval, if your account is private) can see recent and in-progress factual practice activity, including instrument and duration. The V2 Friends screen changes how this existing activity is presented; it does not publish your locally saved photos, descriptions, piece names, or cards. A session in progress may be visible even if you never make or externally share a card.
  • What others can see. Depending on your settings, other signed-in users may see your username, display name, join date, follower and following counts, practice statistics (except statistics you hide), and factual summaries of completed sessions (times, durations, and instruments). Your own profile may display a locally saved share card on your device. Other users’ profile views and the friend activity screen do not receive your photo, description, practiced-piece names, or generated card. Practice to-dos remain device-only.
  • Blocking. You can block other users. Blocking hides each of you from the other, removes any follow relationships between you in both directions, and removes social notifications between you. You can manage blocked accounts in Settings.
  • Notifications. Social notifications (follow requests, new followers, accepted requests) include the other user’s display name and username and can be delivered to your device as push notifications if you enable them.
  • Profile links. Your profile link (getforte.app/u/<your-username>) contains your username. Anyone who has the link can open the corresponding Website page, which displays that username. Opening your full profile in the App still requires a signed-in user who is allowed to see your content under your privacy settings.

8. When and With Whom We Share Personal Information

We do not sell personal information, and we do not share personal information with data brokers or advertising networks. We share personal information only as described below.

8.1 Service providers

We use providers to host, operate, secure, and support the Services. Some process information on our behalf under service agreements. Apple and Google also independently operate their account and authentication services under their own privacy policies:

  • Supabase — backend platform providing our database, account authentication, and server functions. The data described in sections 4.1, 4.2, 4.4, and 4.5 that syncs to our servers is stored on cloud infrastructure located in Sydney, Australia. Supabase privacy notice.
  • RevenueCat — subscription management (purchase validation, entitlement status, and subscription reporting). RevenueCat is based in the United States. RevenueCat privacy policy.
  • Apple — App Store distribution, in-app purchase and payment processing, push notification delivery, Sign in with Apple identity, opt-in developer analytics and crash reports, App Store sales and subscription reporting, and, where required, age-range signals. Apple independently handles Apple Account credentials, payments, and underlying age data under its privacy policy.
  • Google — optional Google account sign-in for new V2 accounts. Google independently handles the Google Account and authentication under its privacy policy; we receive identity and email information through our authentication provider as described in section 4.1, not your Google password.
  • Cloudflare — Website hosting, content delivery, security, and operational logging for getforte.app. Cloudflare is based in the United States and operates a global network. Cloudflare privacy policy.
  • Upstash — rate-limiting infrastructure used to protect our servers from abuse. Upstash receives only one-way coded rate-limit keys; raw user IDs, IP addresses, usernames, search queries, and device tokens are not sent to Upstash as rate-limit keys. Forte's active Upstash Redis database is configured with its primary region in Sydney, Australia. Upstash privacy policy.
  • Resend — transactional email delivery for account emails (email-address verification codes and password-reset codes). Resend receives the recipient email address, the message content (which contains only the one-time code), and delivery logs. Resend (operated by Plus Five Five, Inc.) is based in the United States, and our sending region is in the United States. Resend privacy policy.

We also use standard business tools (such as email) to handle correspondence you send us.

8.2 Other users and the public

Your profile and practice information is shared with other users only as described in section 7 and as controlled by your visibility settings. Your username appears in profile links you choose to share.

8.3 Legal requirements and safety

We may disclose personal information if we believe in good faith that it is necessary to comply with applicable law or valid legal process (such as a court order), to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of our users, ourselves, or the public. Where lawful requests from public authorities require disclosure, we may be obliged to comply.

8.4 Business transfers

If we are involved in a merger, acquisition, financing, reorganisation, or sale of some or all of our assets, personal information may be transferred as part of that transaction, subject to this Policy or to safeguards that are at least as protective.

8.5 With your consent

We may share personal information for other purposes if you ask us to or give your consent.

8.6 Sharing a practice card outside Forte

Saving a card or tapping Done does not publish it to Forte or other Forte users. If you tap Share image, iOS opens its share sheet with the rendered image. The card may contain a photo, your username, time, duration, instruments, notes, practiced-piece names, or a weekly summary, depending on the design and fields you include. When you choose Photos, Messages, Instagram, or another activity, the selected destination receives what you share and handles it under its own privacy rules. Forte does not automatically receive a copy of that external share. Check the card, including any visible location information, before sharing.

9. Cookies and Similar Technologies

The Website does not use analytics, advertising, or tracking cookies, and it does not run analytics scripts, tracking pixels, or similar technologies. We do not set first-party cookies. Our hosting provider, Cloudflare, may set strictly necessary cookies for security purposes (for example, when protecting the site against malicious traffic). Because these are strictly necessary for delivering and securing the site, they do not require consent, and the Website therefore does not show a cookie banner.

The App does not use browser cookies, ad trackers, or third-party analytics or advertising software development kits.

10. International Data Transfers

We are based in Australia, and our service providers process data in other countries. In particular:

  • synced account, profile, practice, social, feedback, and notification data is stored on infrastructure located in Australia (Sydney), managed by Supabase;
  • subscription data is processed by RevenueCat in the United States;
  • Website traffic and operational logs are processed by Cloudflare, headquartered in the United States, on its global network, and rate-limiting keys are processed through an Upstash Redis database configured with its primary region in Australia (Sydney);
  • account verification and password-reset emails are delivered by Resend from infrastructure in the United States; and
  • Apple processes purchases, push notifications, and opt-in analytics on its own global infrastructure — for payments, App Store transactions, and your Apple account, as an independent controller under its own policy (section 8.1).

Some of these countries may not have data protection laws equivalent to those of your country. Where applicable law requires safeguards for these transfers, we rely on the protections in our providers’ data processing agreements, which for a number of our providers incorporate recognised standard contractual clauses, together with the measures described in section 12. Cloudflare additionally maintains active certifications under the EU–U.S. Data Privacy Framework, its UK Extension, and the Swiss–U.S. Data Privacy Framework. Data in transit between the App, the Website, and our servers is encrypted. You can contact us using the details in section 19 for more information about the safeguards that apply to a particular transfer.

11. Data Retention

We keep personal information only as long as needed for the purposes described in this Policy, then delete it. Current retention periods:

  • Account, profile, practice, and social data: kept while your account exists; deleted when you delete your account (section 14).
  • Date of birth and age-based restrictions: your date of birth and any age-based restriction flag are kept while your account exists and are deleted when you delete your account (section 14). A date of birth entered by someone too young for an account is not stored on our servers.
  • App download transaction identifier: kept while your account exists and deleted with it. If Apple tells us a parent or guardian has withdrawn consent for a minor’s use of Forte, we keep a record that the withdrawal was received and acted on; the link between that record and your account is removed when the account is deleted.
  • Feedback submissions: automatically deleted after 180 days, or earlier when deleted with your account.
  • Push notification tokens: removed when you disable social notifications, sign out, or delete your device data or account; inactive registrations are automatically deleted after 180 days.
  • Social moderation audit records: automatically deleted after 30 days.
  • Server operational and error logs: Supabase platform logs (API, authentication, database, and server-function logs) are kept for reliability, security, and debugging under our current Supabase plan’s retention, currently 1 day, and then deleted automatically, with technical measures that avoid recording raw identifiers where feasible.
  • Website operational logs: retained on Cloudflare’s platform under Cloudflare-managed retention for the current Workers Free configuration, currently for up to 3 days, and then deleted automatically.
  • Account email delivery records: verification and password-reset emails are delivered by Resend, which retains the message (containing only the one-time code), the recipient address, and delivery logs under its plan retention, currently 30 days.
  • Local device data: Device-only photos, reduced original and processed images, descriptions, practiced-piece names, filter/design choices, and saved cards are stored with a signed-in practice session on that device. They are not backed up or recoverable from Forte’s servers. Deleting the local session, signing out of an account, or using Delete Device Data removes the App’s local copies on that device; iOS or device backups and external copies you shared may persist under their own arrangements.

Residual copies may persist for a limited time in our service providers’ encrypted backups and are purged on their backup schedules. Your customer record with RevenueCat is deleted when you delete your account (section 14); RevenueCat otherwise retains subscription records under its own retention policies. Apple’s App Store transaction records are outside our control and are retained by Apple under Apple’s privacy policy; you can review and manage the data Apple holds about you at privacy.apple.com. We may retain specific information longer where required by law, to resolve disputes, or to enforce our agreements, and where retained for those reasons it is kept only as long as necessary.

12. How We Keep Your Information Safe

We use technical and organisational measures appropriate to the nature of the data we process, including:

  • encryption of data in transit (TLS) between the App, the Website, and our servers;
  • passwords stored in one-way hashed form;
  • security credentials and log identifiers stored in hashed or one-way coded form where feasible;
  • sensitive on-device items (such as notification credentials) stored in the device’s secure keychain;
  • access controls so that server-side data is reachable only through authenticated, permission-checked operations;
  • rate limiting and abuse monitoring; and
  • hosting with reputable infrastructure providers that publish their security practices and certifications.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You can help protect your account by using a strong, unique password and keeping your device and the App up to date. If we become aware of a data breach affecting your personal information, we will investigate, notify affected users and supervisory authorities where required by law, and take reasonable steps to mitigate harm.

13. Children’s Privacy and Age Requirement

Forte is intended for a general audience and is not directed to children. You must be at least 16 years old — or older if a higher minimum age applies where you live — to create a Forte account or to use any account or social feature, including profiles, search, following, follower and following lists, activity feeds, and social notifications. By creating an account, you confirm that you meet this age requirement.

To enforce this requirement, we ask for your date of birth when you create an account, and in regions where age assurance is required we also use an age-range signal provided by Apple (both described in section 4). If either indicates you are under 16, an account is not created. If you are 16 or 17, your account is created as private and cannot be made public until you turn 18. We store your date of birth to apply these protections and so that a private account can become eligible for public visibility once the account holder is 18; it is deleted when you delete your account (section 14). A date of birth entered by someone too young for an account is not stored on our servers.

We do not knowingly collect personal information from anyone under 16. If we learn that an account belongs to someone under the applicable minimum age, we will restrict and then delete that account and its associated personal information. If you believe someone under the minimum age has provided us personal information, or you are a parent or guardian who would like to review or request deletion of a child’s information, please contact us using the details in section 19 and we will act on your request.

14. Managing, Reviewing, and Deleting Your Data

You can manage your information directly in the App:

  • Review and update. You can view and edit your profile details (display name, username, instruments) and see your practice history in the App.
  • Visibility. Eligible adults can switch between private and public, hide individual statistics from other users, and manage followers, follow requests, and blocked accounts. Accounts held by 16- and 17-year-olds remain private until eligible at 18, subject to any additional age-assurance restriction.
  • Notifications and microphone. You can turn practice reminders and social push notifications on or off in Settings, and you can manage notification and microphone permissions in iOS Settings.
  • Subscriptions. You can manage or cancel a subscription through your App Store subscription settings.
  • Delete your account. Settings → Account → Delete Account deletes your sign-in account, your profile, your synced practice sessions, your follow and block relationships, your social notifications, your push notification registrations, your feedback submissions (those linked to your account, plus feedback sent from the device you delete from — including feedback sent before you signed in — if its support identifiers are still stored on that device; feedback we can no longer identify as yours is instead deleted automatically on the 180-day schedule in section 11), and your customer record with our subscription provider. The App then removes Forte’s data from your device. Your App Store purchase history is held by Apple and is not deleted by this process; you can manage it with Apple.
  • Sign out. Signing out of a Forte account removes device-only photos, notes, practiced-piece names, cards, and other local data on that device after an in-app warning. Your synced account and factual practice data remain on Forte servers; an iOS/device backup or an external copy you shared may persist under its own arrangements.
  • Delete device data. The App’s Delete Device Data option removes Forte data from that device, including local practice history, photos and saved cards, descriptions, practiced-piece names, setlists, preferences, and its notification registration. It does not delete your account, factual session data already synced to Forte servers, Apple purchase history, or copies you sent to external destinations. Use Delete Account for server account deletion.
  • Delete a session or an external copy. Removing a practice session removes its local memory and, for a signed-in account, removes or queues deletion of its synced factual session record. Deleting an account or device data cannot remove a card already saved to Photos or sent through Messages, Instagram, or another destination; you must seek deletion there. Device-backup copies may follow your backup provider’s retention and controls.
  • Removing the App. Deleting the App removes Forte’s locally stored data from your device, except that iOS may preserve small items in the device’s secure keychain (such as sign-in state) until the App is reinstalled or the device is reset. For the most complete local removal, use Delete Device Data (or Delete Account) before removing the App.

You can also exercise any of these options, or any of the rights below, by emailing us at privacy@getforte.app. Including the User ID shown in the App’s settings helps us locate your data.

15. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

  • to know whether we process your personal information and to request access to it and a copy of it;
  • to correct inaccurate or incomplete information;
  • to delete your personal information;
  • to receive your personal information in a structured, commonly used, machine-readable format (such as CSV or JSON);
  • to object to, or ask us to restrict, certain processing;
  • to withdraw consent at any time where processing is based on consent; and
  • not to be discriminated against for exercising your rights.

You can exercise these rights using the in-app tools described in section 14 or by contacting us at privacy@getforte.app. We may need to verify your identity before acting on a request (for example, by asking you to write from the email address associated with your account and to provide the User ID shown in the App’s settings); we use that information only for verification. We respond within the timeframes required by applicable law. If we cannot fulfil a request, we will explain why, and you may have the right to appeal or to complain to a supervisory authority.

15.1 European Economic Area, United Kingdom, and Switzerland

If you are in the EEA, UK, or Switzerland, the rights above apply to you under the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection, alongside the legal bases in section 6 and the transfer safeguards in section 10. You also have the right to lodge a complaint with a supervisory authority: in the EEA, your national data protection authority; in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would, however, appreciate the chance to address your concerns first.

16. United States State Privacy Rights

Residents of U.S. states with applicable privacy laws may have rights to access, correct, delete, and obtain a copy of their personal data, to opt out of targeted advertising, sales, and certain profiling, and to appeal a refusal. We honour the access, correction, deletion, and portability rights described in section 15 for all users.

We do not sell personal information, we do not share personal information for cross-context behavioural advertising, we do not use personal information for targeted advertising, and we do not profile you in ways that produce legal or similarly significant effects. Accordingly, there is no sale, sharing, or targeted advertising to opt out of, and we have not sold or shared personal information in the preceding 12 months.

For California residents, the categories of personal information collected in the preceding 12 months or that may be collected when you choose a new V2 provider account, as described in section 4, are:

  • Identifiers (collected): display name, username, email address or Apple private-relay address, provider identity information, account and service identifiers, device push token, and IP address.
  • Customer records information (collected): name and email address as above, and date of birth (section 4); no financial account details.
  • Commercial information (collected): subscription and purchase status from Apple and our subscription provider.
  • Internet or other electronic network activity (collected): interactions of the App with our servers, in-app profile search activity, and Website request logs.
  • Geolocation data (collected, approximate only): country or region derived from IP address by our infrastructure providers for security and operations; we do not collect precise geolocation.
  • Audio, image, or other sensory information: tuner audio and optional V2 practice images are processed on the device and are not collected by Forte servers. An image can be disclosed to a destination you choose through the iOS share sheet.
  • Inferences (collected): practice statistics derived from your practice sessions (such as practice-time patterns), used only to display your practice statistics to you and to other users in line with your visibility settings.
  • Sensitive personal information (collected): account authentication credentials or provider tokens as applicable. We use authentication information only to sign you in and secure your account; we do not use or disclose sensitive personal information for purposes that would require a California “Limit the Use of My Sensitive Personal Information” option. Date of birth is described separately above as an age-related characteristic.
  • Characteristics of protected classifications (collected): date of birth, and the age derived from it, used only to verify age eligibility and to apply the age-based account protections described in section 13.
  • Biometric information, professional or employment information, and education information: not collected.

The sources, purposes, disclosures, and retention periods for these categories are described in sections 4, 5, 8, and 11. We disclose relevant categories to the providers in section 8.1 for the purposes described there and to other Forte users only under the profile and practice visibility rules in sections 7 and 8.2. A card sent to an external destination through the iOS share sheet is a user-directed disclosure of device-only content, not a Forte server collection or disclosure. You may designate an authorised agent to submit requests on your behalf; we may require proof of authorisation and verification of your identity. If we decline a request, you may appeal by replying to our decision or emailing privacy@getforte.app with the subject “Privacy Appeal”; if your appeal is denied, you may contact your state attorney general. California’s “Shine the Light” law: we do not disclose personal information to third parties for their direct marketing purposes.

17. Do-Not-Track and Global Privacy Control

We do not track users over time or across third-party websites or apps, so there is no cross-site tracking for a “Do-Not-Track” browser signal to switch off, and we do not respond to such signals. Because we do not sell or share personal information or use it for targeted advertising, opt-out preference signals such as Global Privacy Control have no additional effect on how we process your data — every user already receives the protections described in this Policy.

18. Additional Regional Disclosures

Australia. Where the Privacy Act 1988 (Cth) applies to our handling of personal information, we comply with its applicable requirements, including the Australian Privacy Principles. You can raise a privacy concern using the contact details in section 19, and we will review and respond to it.

New Zealand. Where the Privacy Act 2020 (NZ) applies, this Policy describes the kinds of personal information we collect, how we collect and hold it, the purposes for which we use it, and how you can access and correct it (sections 14 and 15). Information may be disclosed to overseas service providers as described in section 10. If you have a complaint, you may contact us using the details in section 19. You may also complain to the Office of the Privacy Commissioner.

Canada. We process personal information in accordance with the Personal Information Protection and Electronic Documents Act and applicable provincial laws (including Quebec’s Act respecting the protection of personal information in the private sector). For purposes of Quebec privacy law, the person exercising the highest authority at SaxApp Pty Ltd serves as the person in charge of the protection of personal information and may be contacted through our Privacy Contact using the details in section 19. You may request access to or correction of your personal information, request a copy of computerized personal information collected from you in a structured, commonly used technological format, and withdraw consent subject to legal and contractual restrictions, using those contact details. Your information may be processed outside Canada (see section 10). If you are not satisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner of Canada or your provincial regulator.

Brazil. If the Lei Geral de Proteção de Dados (LGPD) applies to you, you have rights to confirmation of processing, access, correction, anonymisation or deletion, portability, information about sharing, and revocation of consent. You can exercise them using the contact details in section 19, and you may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

South Africa. If the Protection of Personal Information Act applies to you, you may request access to or correction of your personal information using the contact details in section 19, and you may lodge a complaint with the Information Regulator (South Africa).

Other regions. Where other local data protection laws give you rights in relation to your personal information, we will honour requests to the extent required by those laws. Contact us using the details in section 19.

19. How to Contact Us

For any questions, concerns, or requests about this Policy or your personal information, contact:

When submitting a data request, please include the User ID shown in the App’s settings so we can locate your information.

20. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. The “Effective date” at the top shows when this text was last revised. If we make material changes, we will provide prominent notice — for example, in the App or on the Website — and, where applicable law requires advance notice, we will provide it before the changes take effect. We encourage you to review this Policy periodically.