Privacy Policy

We reserve the right to amend this Privacy Policy at any time. Any modifications will be reflected by updating the “Effective Date” at the top of this document. We encourage you to review this policy periodically to remain informed of how we protect your information.

2.1 Categories of Information

We collect information directly from you, automatically through your interactions with our services, and from third parties (such as sign-in providers). The categories of information we may collect include:

• Account information: email address, display name, password hash (if you use email/password), locale preference, optional country and date of birth, newsletter opt-in, and email verification status.
• Authentication with third parties: when you sign in with Google or Facebook, we receive identifiers and profile details those providers share with your authorization (for example email, name, and avatar URL).
• Instrument and calibration data: berimbau labels/voices you save and calibration frequencies needed to score practice in cents.
• Practice and progression data: toques played, session accuracy, hits/misses, streaks, timing/pitch summary statistics, and unlock/progress state. We store structured hit/miss events and related metadata — not raw audio recordings of your playing.
• Optional diagnostic data: if you grant diagnostic consent, we may store text logs and technical metadata about a practice session to improve detection quality and support. You can grant or withdraw consent anytime in Profile.
• Contact and feedback messages: name, email, subject, and message body you submit through our forms.
• Log and device information: technical details such as IP address, browser type, approximate device class, user agent, and a client device identifier used to associate sessions with a login device.
• Usage information: features accessed, session timing, and similar product analytics needed to operate and improve the service.

2.2 Microphone audio

When you practice or calibrate, your browser may request microphone access. Pitch detection and hit scoring run on your device. We do not upload raw microphone audio streams to Toque Play servers. Only structured results (for example note identity, hit/miss, timestamps, and related scores) and optional diagnostic text you consent to share are sent to our backend.

2.3 Cookies and similar technologies

We use cookies and similar technologies that are necessary to operate the service — for example an httpOnly refresh-token cookie to keep you signed in securely, and local browser storage for preferences or legacy session recovery. For non-essential cookies or similar technologies, we ask for your choice via a first-visit consent banner (Accept all / Essential only); your choice is stored in local browser storage. Most browsers let you manage or block cookies; blocking essential cookies may prevent login or practice features from working.

2.4 Google Analytics

If you choose Accept all on the website cookie banner, or you accept this Privacy Policy and the Terms in the native app’s first-run screen, we use Google Analytics 4 (on the web via gtag.js; on Android/iOS via Firebase Analytics) to measure how people use the landing site, the web player, and the mobile app. Typical signals are page or screen views and product events such as sign-up, practice start, and checkout. On the website Google may set cookies such as _ga and _ga_*. After you sign in we may send our account identifier as a user id — not your email or password. We do not send microphone audio, pitch frequencies, or diagnostic session logs to Google. Essential only on the web never loads Analytics. Advertising features and Advertising ID collection stay off.

We use the information we collect to:

• Provide, maintain, and improve Toque Play (accounts, calibration, practice scoring, progression).
• Authenticate you, secure sessions (access and refresh tokens), and prevent abuse.
• Respond to contact and feedback messages and provide customer support.
• Send transactional emails such as email verification and password reset.
• Send product or newsletter messages only where you have opted in or where otherwise permitted by law.
• Analyze trends and performance in aggregate to improve detection quality and user experience.
• Detect and prevent fraud, spam, or other unauthorized activities.
• Comply with legal and regulatory obligations.

4.1 Authorized sharing

We may share your information in the following circumstances:

• Service providers: vendors that help us operate the service (for example hosting, databases, email delivery, CDN/security). They process data on our instructions and are not permitted to use it for their own unrelated purposes.
• Analytics: Google Analytics 4 / Firebase Analytics when you have accepted non-essential cookies on the web, or the first-run privacy and terms screen in the native app.
• Authentication providers: Google or Facebook when you choose those sign-in methods.
• Legal compliance: when required to comply with laws, regulations, or valid legal processes.
• Corporate transactions: in connection with a merger, acquisition, or asset transfer, subject to appropriate confidentiality.
• Aggregated or de-identified data: for research and operational purposes without reasonably identifying you.

4.2 What we do not do

We do not sell your personal information. We do not use your berimbau practice audio as a product offering to third parties. We do not stream raw mic audio to our servers for storage or advertising.

5.1 Communication preferences

You may turn news and product emails on or off in Profile, or unsubscribe using the instructions in those emails (when available). Transactional messages required for account security (such as password reset) may still be sent.

5.2 Accessing, updating, or deleting data

You can update certain profile fields in the app. You may request access to or deletion of your personal information by using the in-app account deletion flow where available, or by contacting us through the Contact page. Deletion requests may take up to 30 days to complete and may be limited where we must retain data for legal, security, or legitimate operational reasons (for example fraud prevention or backup retention for a limited period).

5.3 Microphone and diagnostics

You can deny or revoke microphone permission in your browser settings; practice features that depend on the mic will not work without it. Diagnostic uploads require your consent and can be turned on or off anytime in Profile.

5.4 Facebook Login data deletion

If you signed in with Facebook, you can request deletion of Facebook-derived data from Facebook: Settings → Apps and Websites → Toque Play → Send Request. Meta then notifies us via a signed callback. For accounts that use only Facebook sign-in, we delete the Toque Play account the same way as in-app account deletion. If Facebook is linked alongside email/password or Google, we remove Facebook identifiers and Facebook login data and keep the rest of the account.

Meta receives a confirmation code and a status-page URL so you can check progress. You can also request access or deletion through the in-app deletion flow or the Contact page, as described above.

We implement industry-standard measures appropriate to our service, including encrypted transport (HTTPS), hashed passwords, short-lived access tokens, and httpOnly refresh cookies. No system is completely secure. You use our services at your own risk.

If you believe you have identified a security vulnerability, please report it via our Contact page. Do not include passwords or authentication tokens in your report.

We retain account, practice, and support data for as long as your account is active and as needed to provide the service, resolve disputes, enforce our agreements, and meet legal obligations. When you delete your account, we delete or anonymize associated personal data within a reasonable period, subject to the exceptions described above.

Toque Play is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

Our services may be hosted and operated in regions that differ from your own. By using Toque Play, you understand that your information may be processed in countries where data protection laws may differ from those in your country of residence. We take steps appropriate to our size and service to protect your information as described in this policy.

10.1 California Consumer Privacy Act (CCPA)

If you are a California resident, you may have rights under the CCPA, including to request access to or deletion of personal information, and to know categories of information collected and shared. We do not sell personal information. To exercise these rights, submit a verifiable request through our Contact page.

10.2 Categories of personal information collected

Depending on how you use the service, we may collect:

• Identifiers (for example name, email, IP address, device identifiers, optional country and date of birth).
• Account information (for example display name, locale preference, and practice progression).
• Internet or device activity (for example browser type, pages or features used).
• Audio-derived practice results processed on-device and stored as structured scores — not raw mic recordings on our servers.
• Inferences limited to product progression (for example unlock status based on practice performance).

If you have questions about this Privacy Policy or wish to exercise your rights, contact us via:

• Website form: the Contact page on toque-play.com.
• Email: [email protected].