Privacy Policy

How Fretly handles your data under the GDPR and similar laws.

1. Who we are

Fretly ("we", "us", "our") is a web application for visualising guitar scales, chords and fingering systems on a fretboard. It is built and operated by Fretboard Knowledge, the practice of guitarist and guitar teacher Alexander Stakenburg, established in the Netherlands.

This page explains what personal data we collect, why we collect it, how long we keep it, and the rights you have under the General Data Protection Regulation (GDPR) and equivalent laws. For any privacy question or request, reach us through the Contact page.

2. What data we collect

We deliberately collect as little as possible. In normal use we only process:

• Account data: the username, email address and password you provide when you register, plus your account role (for example member, teacher or student). Passwords are stored only as salted hashes; we never see or store the password itself. We do not ask for real names, addresses or phone numbers.
• Billing data: if you take a paid membership, payment is handled entirely by our payment processor Stripe. Your card number never touches our servers. We store only what we need to run your subscription: a Stripe customer reference, your subscription status and its renewal date.
• Technical data: the IP address and user agent your browser sends with every request, used only for server logs, security and rate-limiting failed login attempts. These logs are kept for a maximum of 30 days.
• Referral & link analytics: when you arrive from one of our partner sites (such as fretboardknowledge.com) through a tagged link, we record which link you came from, which page you landed on, and the time, so we can see which partner links are useful. We do not store your IP address for this; entries are keyed to a one-way hashed session identifier only.
• User content: any charts, collections, custom boards or presets you save while logged in. This data is stored so we can show it back to you on your next visit, and, if you are a teacher, share it with the student accounts you choose.
• Messages you send us: if you use the Contact page or the Report a bug page, the text you submit (and the email address you provide, if any) is stored so we can respond and fix the issue.

3. Cookies and local storage

Fretly uses the following browser storage mechanisms:

• Session cookie (strictly necessary): a PHP session cookie keeps you signed in. Without it, login cannot work. No consent is required for strictly necessary cookies.
• Preferences (localStorage): keys such as fretly-theme remember functional choices like light or dark mode and your display settings. These never leave your browser except where needed to sync your own preferences across your own devices.
• Consent record (localStorage + cookie): the keys fretly-consent (localStorage) and fretly_consent (cookie) record your choices on the cookie banner so we can respect them on later visits.

We run no analytics scripts, no advertising pixels and no third-party trackers, and there are no ads anywhere on Fretly. If that ever changes, you will see those categories in the consent banner before they are activated, and nothing optional will be set unless you accept it.

You can re-open the consent banner at any time using the "Cookie choices" link in the footer.

4. Legal basis for processing

• Contract (Art. 6(1)(b) GDPR): we process your account, billing and user-content data so we can provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f) GDPR): we process technical data to keep the service secure, prevent abuse and debug problems.
• Legal obligation (Art. 6(1)(c) GDPR): we keep invoicing records for as long as tax law requires.
• Consent (Art. 6(1)(a) GDPR): if we ever add optional categories such as analytics or marketing, they will only run after you have opted in via the consent banner.

5. Who we share data with

We do not sell your data, and we do not share it with anyone for advertising. The only parties that process data on our behalf are:

• Our hosting provider, which stores the application and its database on our behalf.
• Stripe (Stripe Payments Europe, Ltd.), which processes payments for paid memberships. Stripe acts under its own strict privacy and security obligations; see stripe.com/privacy.

Beyond that, data may be disclosed only when required by law.

6. International transfers

Fretly is operated from the Netherlands and aims to keep data within the European Economic Area. Our payment processor Stripe may transfer limited payment-related data outside the EEA (for example to Stripe, Inc. in the United States); those transfers are covered by the European Commission's Standard Contractual Clauses and Stripe's own safeguards.

7. How long we keep it

• Account data and user content: for as long as your account exists, plus 30 days after deletion.
• Billing records: as long as tax law requires (in the Netherlands, seven years).
• Server logs: maximum 30 days.
• Contact messages and bug reports: up to 12 months after the issue is resolved.
• Consent records: 180 days, then you will be asked again.

8. Your rights under the GDPR

You have the right to:

• request a copy of your data (right of access);
• ask us to correct inaccurate data (rectification);
• ask us to delete your data (erasure, the "right to be forgotten");
• object to processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time (for anything based on consent);
• lodge a complaint with your local supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens; a full list of EU authorities is available at edpb.europa.eu/members.

To exercise any of these rights, contact us via the Contact page. We will respond within one month of receiving your request.

9. Security

Passwords are stored as salted hashes and are never kept in plain text. Sessions are protected with HttpOnly, SameSite cookies and, over HTTPS, the Secure flag. Login is protected against brute-force attempts, and access to your saved content requires your account. No system is perfectly secure, but we keep the attack surface deliberately small: minimal data, no third-party scripts, no ad networks.

10. Children

Fretly is a music-education tool and is suitable for learners of all ages. Where a young student uses Fretly through a teacher, the account is set up and managed within that teaching relationship. We knowingly collect no more data from any user, of any age, than described in section 2.

11. Changes to this policy

If we change this policy we will update the "Last updated" date above and, for material changes, notify you inside the app.