Privacy
Last updated 29 October 2026
Who we are
Choreosheet is run by Lucent Enterprises Ltd., 515-2840 Peatt Rd, Victoria, BC V9B 3V4, Canada. We are responsible for your personal information. Our privacy officer answers at support@choreosheet.com, or write to the address above.
What we collect and why
Your audio files and the sheets made from them (beats, lyrics, your notes and edits), to make your count sheet. A random account ID in a cookie, to keep your sheets together. Your email address and Google account ID if you sign in, so you can sign in on any device, and your first name from Google, to greet you in our emails. Your IP address when your account is made, and a daily count of uploads per IP address, to stop abuse of free uploads. Your purchases (plan, amount, currency, date, Stripe customer ID and the email typed at checkout), to give you what you bought and to handle refunds. Simple usage events (for example: the pages you open, which site or campaign you came from, uploads, exports and plan clicks), tied to a random visitor ID and your account ID and not to your IP address, to learn which pages help people. We do not record your screen, your clicks on the page or what you type. Error reports when something breaks, to fix it. Emails you send to support.
Google sign-in and Google Drive
If you sign in with Google, we receive your email address, your Google account ID, and your name and profile picture. We store the email address, the account ID and your first name. We use them to sign you in, and the first name only to greet you in emails we send you. If you use "Open in Google Sheets", Google asks you to let Choreosheet create files in your Drive (the drive.file permission). Choreosheet can then see only the files it creates. The access token stays in your browser and never reaches our servers. Your browser remembers which Google account you chose, so you do not have to choose again. We do not read your other Drive files and we do not share Google data with anyone. You can remove access at any time at myaccount.google.com/permissions. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Cookies and browser storage
Two cookies are needed for the service: cs_user keeps you logged in (up to 400 days), and cs_oauth protects Google sign-in (10 minutes). Outside the EU and the UK, Google Analytics sets its own cookies (_ga, up to 2 years) to count visits, and PostHog keeps a random visitor ID in a cookie and in browser storage (ph_…_posthog, up to 1 year) to connect your visits; in the EU and the UK neither stores anything in your browser. Your browser also stores where your visit came from until you close the tab, the Google account you chose for Google Sheets, and your blank-template draft. We use no advertising cookies on our site. Amazon may set its own cookies when you click through to amazon.com (see below). Our fonts are served from our own site.
Who processes it
Cloudflare hosts Choreosheet, stores files and data, runs the beat detection and the lyric transcription (on Cloudflare's own servers), sends our emails and keeps short-term server logs. Stripe and its Link service take payments, handle tax and send payment receipts; Link's own privacy policy covers what you type at checkout. Google provides sign-in, Google Sheets export, Google Analytics (visit counts, with IP addresses not stored) and our support email. PostHog receives the usage events above, without your email, and discards IP addresses. Sentry receives error reports, without your email or IP address. Amazon: if you use "Find the MP3 on Amazon", we send the song name you type to Amazon to get results, and the cover pictures load from Amazon's servers, so Amazon sees your IP address. Links to Amazon carry our Amazon Associates tag. If you click one, Amazon may set or read its own cookies on amazon.com and tells us about qualifying purchases, but not who made them. Amazon's privacy notice covers that. These companies act for us under data protection agreements, except where they deal with you directly under their own terms.
Where your data is
We are in Canada. Cloudflare, Stripe, Google and Sentry may store and process your data in the United States and other countries. The law in those countries may let their authorities access it. For people in the EU and the UK, data comes to Canada under an adequacy decision, and our providers use approved safeguards such as standard contractual clauses.
Legal basis (EU and UK)
We use your data to provide the service you asked for (contract), to prevent abuse, fix errors and keep the service secure, and to understand which pages help people (legitimate interests), and to keep records the law requires (legal obligation). Google Sheets export uses your consent, and you can withdraw it at any time.
How long we keep it
Sheets and audio: until you delete them or your account. Previews from a browser that never signs in or buys anything: 30 days. Account and email: until you ask us to delete your account. Upload counts by IP address and the IP address from account creation: 30 days. Usage events: 24 months. Login links: deleted within a day after they are used or expire. Error reports: 90 days. Purchase records: 6 years, for tax law. Support emails: as long as needed to answer you, and no more than 2 years.
Your choices and rights
You can delete a sheet and its audio from the sheet page at any time. Email support@choreosheet.com to see, correct, download or delete your data, or to delete your account. We reply within 30 days. If you are not happy with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, in the EU or UK, your data protection authority.
Emails
We send only the emails you need: login links, a receipt with a sign-in link after a purchase, one welcome email with tips on using Choreosheet when you first sign in, and, if you are signed in, one email with a sign-in link when a sheet you uploaded is ready. Link also sends a payment receipt. We do not send marketing emails unless you ask for them.
Security
We use HTTPS, signed cookies and one-time login links that we store only in scrambled (hashed) form. Only you can open your files and sheets, unless you share a sheet's link. We look at them only if you ask us to (for example, to check a refund request) or if the law requires it. If a breach puts you at real risk of significant harm, we will tell you and the authorities as the law requires.
Children
Choreosheet is not for children under 13, and we do not knowingly collect their data. If you think a child under 13 has used Choreosheet, email us and we will delete the data.
What we do not do
We do not sell your data, share your music, or use your files to train AI models. Cloudflare does not train models on them either.
Changes
If we change this policy in an important way, we email signed-in users before the change takes effect. The date of the last change is at the top of this page.