Privacy Policy

beatspark ("we", "us") is interactive music-production lesson software for Ableton Live, currently in closed beta. This policy explains what data we collect, why, who we share it with, and how to get it removed. If you spot something that doesn't match what the app actually does, email privacy@beatspark.com and we'll fix the policy or the app.

1. What we collect

1a. From the marketing site (beatspark.com)

• Your email address, when you join the waitlist.
• Sign-up timestamp and a position counter, so we can grant access to the first 100 sign-ups.

We also set strictly-necessary cookies for bot protection — see section 2.

1b. From the beatspark app (when you sign in)

• Authentication email + magic-link OTP, via Supabase Auth. Used only to identify you across devices.
• Lesson progress: which lesson you started, the highest step you reached, and the .als project path you were working on. Stored so you can resume.
• Telemetry events: lesson ID, step number, event type (e.g. "step_complete", "lesson_quit"), app version, and an anonymized session ID. Used to debug pipeline issues and track completion rates. No content from your Ableton session is sent.
• Feedback you submit through the in-app Feedback button: the freeform text you wrote and a screenshot of the beatspark overlay region at the moment you clicked Feedback.

1c. What stays on your device

beatspark uses Accessibility and Screen-Recording permissions to read Ableton's UI and OCR the bar/note rulers. Those screenshots and OCR scans are processed locally and never uploaded. The only data leaving your device is the telemetry above and the feedback screenshot you submit.

2. Cookies & tracking

beatspark.com sets only strictly necessary cookies:

• __cf_bm (Cloudflare bot management, ~30 minutes) — required to keep automated abuse off the waitlist form. Cannot be disabled without breaking the site.
• __cflb (Cloudflare load balancing, session) — set only if you visit through a routed endpoint; required for traffic steering.

No analytics, advertising, or tracking cookies. Because every cookie we set is strictly necessary under the GDPR ePrivacy framework, we don't show a consent banner. If we ever add a non-essential cookie we'll add a banner and update this section.

3. Who we share it with

We don't sell or rent your data. We do use the following sub-processors to operate the service:

4. How long we keep it

• Waitlist email, never granted access: deleted after 12 months of inactivity.
• Waitlist email, granted access: kept while you use beatspark; deleted on request.
• Lesson progress + telemetry: kept while your account is active; deleted on request.
• Feedback: kept indefinitely so we can refer back when fixing the issue, unless you ask us to delete it.
• Resend email logs: 30 days, per Resend's retention.

5. Your rights

Email privacy@beatspark.com to:

• Get a copy of the data we hold about you
• Correct it
• Delete it (final — we cannot recover deleted accounts)
• Opt out of telemetry while continuing to use the app

We respond within 30 days. If your jurisdiction grants you statutory privacy rights (GDPR, UK GDPR, CCPA/CPRA, OCPA, PIPEDA, etc.), those rights apply here in full regardless of how this list is phrased.

6. Children

beatspark is not directed at children. You must be at least 16 to join the waitlist or use the app. If you become aware that a child under 16 has signed up, contact us and we'll delete the record.

7. Changes to this policy

Material changes to what we collect or how we use it bump the "Last updated" date above. Significant changes are emailed to users with granted beta access.

8. Contact + jurisdiction

Questions: privacy@beatspark.com.

beatspark is operated by You Suck at Producing LLC, an Oregon limited liability company. This policy is interpreted under Oregon law, without prejudice to your rights under your own jurisdiction's privacy law (GDPR for EU residents, UK GDPR for UK residents, PIPEDA for Canadian residents, CCPA/CPRA for California residents, OCPA for Oregon residents).