Embrace Strings

EMBRACE STUDIO

Privacy Policy (Beta)

Embrace Strings LLC
Effective Date: September 14, 2026
Last Updated: September 14, 2026

A Note Before You Read

Here is the short version:

  • Your recordings and notes are private. Only you can see them.
  • We do not watch, listen to, or read your individual content — ever.
  • We do not sell your data. We do not use it for advertising.
  • We do not share your data with third parties except the infrastructure providers that store and deliver it on our behalf.
  • You can download or delete your data at any time.

1. Who We Are

Embrace Studio is a practice application made by Embrace Strings LLC, a company based in Texas, United States. References to "we", "us", "Embrace Strings" or "Embrace Studio" in this policy refer to Embrace Strings LLC and the Embrace Studio application. The user of the application will be referred to in this policy as "you", "your" or "the user" hereafter. "Third parties" means any organization or individual unaffiliated with Embrace Strings or you, other than the service providers we name in Section 4.4, who process data only on our instructions.

Contact: studio@embracestrings.com

Embrace Studio is currently in a closed beta. This policy applies to all users of the application during the beta period.

2. What We Collect

We collect only what is necessary to operate the application. Here is exactly what that means:

2.1 Account Information

  • Email address — used to create and access your account, to send you the emails described in Section 3.3, and for the Embrace Strings mailing list
  • Password — stored as a cryptographic hash by our authentication provider (Supabase). We never see your actual password.
  • Your first and last name — shown to you inside the app (for example, "Turner's Studio") and used to address you in emails
  • Your instrument — used to set up your studio (for example, choosing a starter piece and a default tuning reference)
  • Your confirmation that you are 18 or older and agree to our Terms of Service and this policy, with the date you gave it

2.2 Practice Content

  • Audio and video recordings you make through the app
  • Notes you write about a piece, about a practice session, and about individual recordings
  • Piece names, composers, session names, and recording names
  • Cover images you upload for pieces, and the one-word description you give them
  • Sheet music (PDF files) you upload, and any markings you draw on it in the app
  • Practice settings, including your tuner reference pitch, default recording mode, metronome sound, and each piece's last tempo and whether it is archived

Microphone and camera. Embrace Studio uses your device's microphone (and camera, for video) only while you are recording a take you started, and only to make that recording. It never listens or records in the background, and it does not access your photos or files except the ones you choose to upload.

This content is yours. It is stored privately in the United States, associated with your account only, and is not accessible to other users or to us in day-to-day operations. See Section 4 for full details on who can access what.

2.3 Usage Data

We do not run any separate usage tracking. The following is derived from your own content and account:

  • The date of each practice session, recorded as the calendar date on your device at the time. This is how the app shows your practice history and streaks. It does not store your location or time zone.
  • Counts derived from your content, including how many pieces, sessions, and recordings you have, and their total duration, which the app shows you on your Profile.
  • The date and time of your last sign-in, kept by our authentication provider.

Feedback you send us. If you use "Send feedback" inside the app, we store your message together with your email address, the app version, the page you were on, and your browser and device type (for example, "Safari on iPhone"), so we can reply and reproduce the problem.

We may look at these figures in aggregate across all users, including how many people are active and how many recordings exist, to understand whether the application is working and decide what to build next. We do not review individual content to do this.

2.4 What We Do Not Collect

  • Payment information
  • Location data
  • Device identifiers or fingerprints — the only device information we keep is the browser and device type attached to feedback you choose to send us (Section 2.3), apart from our host's short-lived server logs described in Section 4.4
  • Contacts, calendar, photos, or any other data stored on your device outside what you upload to the application
  • Behavioral tracking data or advertising identifiers

3. How We Use Your Data

We use your data for three purposes only:

3.1 To Operate the Application

Your email and password are used to sign you in. Your recordings, notes, sheet music, and pieces are stored so the app can show them back to you, and so you can take them with you: you can download any single recording, any piece (its recordings and notes together), or your entire studio from within the app. See Section 7.4.

3.2 To Understand Usage

We review aggregate statistics, such as how many users are active, how many recordings exist across the platform, and average session frequency, to understand whether the application is working and to make informed decisions about what to build next. We do not review individual user content to conduct this analysis.

3.3 To Communicate With You

We send emails about the application, such as updates, replies to questions you've asked, and, during the beta period, requests for honest feedback about your experience.

By creating an account, you will also be added to the Embrace Strings mailing list, which carries news about Embrace Strings, our other products, and our newsletter. These emails are sent through MailerLite, which receives your name and email address for that purpose (see Section 4.4). Every marketing email includes an unsubscribe link, and you can unsubscribe at any time without affecting your account. We do not add users located in the EU or UK to the mailing list without their separate opt-in.

Whether or not you are on the mailing list, we will still send the emails required to operate your account, such as email-change confirmations, password resets, export links, and security notices.

3.4 What We Do Not Do With Your Data

  • We do not sell your data to anyone, for any reason.
  • We do not use your data for advertising or behavioral targeting.
  • We do not share your data with third parties.
  • We do not use your recordings or notes to train machine learning or Artificial Intelligence ("AI") models.
  • We do not analyze or view the content of your recordings or notes except in the limited circumstances described in Section 4.3.

4. Who Can Access Your Data

4.1 You

You have full access to all content you create: your recordings, notes, pieces, and sessions. You can view, edit, download, and delete any of your own content at any time.

4.2 Other Users

Your recordings, notes, and pieces are private to your account. Other users cannot see your content, search for it, or access it in any way.

4.3 Embrace Strings

We at Embrace Strings operate and maintain the application using administrative controls and system access. Certain authorized personnel within our company (and any authorized service providers acting on our behalf) may have administrative access to the underlying infrastructure that could, in some circumstances, allow them to view, access, or retrieve stored user data, including user recordings, notes, or other user content.

We will not view, listen to, read, or otherwise access individual users' user content except as described in this Section. Access is restricted to the minimum necessary to perform our legitimate business and operational responsibilities, and our personnel access is subject to technical, administrative, and policy safeguards designed to prevent unauthorized use.

Except as expressly permitted below, we will not:

  • Listen to, watch, or review individual users' recordings, notes, or practice content;
  • Use users' content to profile, target, or otherwise evaluate individuals for non-operational purposes; or
  • Disclose user content to any third party unless required or permitted under this Privacy Policy.

We may access User Content when necessary and only to the extent required to:

  • Provide, troubleshoot, and maintain the service: for support, bug resolution, performance monitoring, security monitoring, evaluating aggregated statistics (such as login counts, recording counts, days active) and system maintenance where access to user content is required to investigate or fix a problem. We do not review individual content.
  • Security and abuse prevention: to investigate suspected violations of our terms, protect against fraud, malware, or other security threats, and respond to emergencies.
  • User requests and consent: when a user explicitly requests or authorizes access (including account recovery or support actions specified by the user).
  • Legal and regulatory obligations: when we are required to do so to comply with applicable law, lawful requests from government authorities, subpoenas, court orders, or to protect our legal rights.

Administrative access is limited to authorized personnel who are trained on these restrictions and who are required to follow internal access controls. We will maintain appropriate safeguards to ensure access is logged, traceable, and used only for the permitted purposes above.

4.4 Service Providers

We rely on a small number of companies to run Embrace Studio. Each processes data only on our instructions, only to provide its service to us, and under its own privacy and security commitments:

  • Supabase — stores your account, database records, and files (recordings, cover images, sheet music) on servers in the United States, handles sign-in, and sends account emails (sign-up confirmation, password reset, email-change confirmation). Privacy policy: https://supabase.com/privacy
  • Vercel — hosts and runs the application. Like any web host, it keeps standard short-lived server logs, which include the IP address and browser type of each request. Privacy policy: https://vercel.com/legal/privacy-policy
  • Resend — delivers the other emails we send you, such as export notifications. It receives your email address and the contents of those emails. Privacy policy: https://resend.com/legal/privacy-policy
  • MailerLite — sends the Embrace Strings mailing list (Section 3.3). It receives your name and email address. Privacy policy: https://www.mailerlite.com/legal/privacy-policy

We do not use any analytics, advertising, or tracking services. We will update this policy before adding a provider that handles your content.

4.5 Law Enforcement and Regulatory Requests

We will disclose user data to law enforcement and regulators only when required to do so by valid legal process, which may include a court order, subpoena, or other legally binding demand from a competent authority. We will notify affected users before disclosing their data if we are legally permitted to do so.

5. Where Your Data Lives

Your data is stored on Supabase infrastructure in the United States, subject to contractual requirements designed to protect personal information. All data is encrypted in transit using HTTPS. Storage files (recordings, cover images, sheet music) are encrypted at rest and stored in private buckets that are not publicly accessible.

5.1 Users Outside the United States (Cross-Border Transfers)

By accepting this Privacy Policy and accessing the Embrace Studio app from outside of the United States, you consent to the transfer, processing, and storage of your information in the United States. We do this to provide, operate, and secure the app, including for account management, aggregate usage statistics, moderation, and customer support. The United States may provide different legal protections than those in your country. We use appropriate safeguards for these transfers, which may include contractual protections requiring recipients to protect personal information to an appropriate standard.

By using the app, you consent to these transfers and processing activities as described in this Privacy Policy, to the extent such consent is required under applicable law.

5.2 When Data Is Transferred

We transfer personal information to the United States when:

  • It is necessary to operate the app and deliver requested services to you; and/or
  • We engage service providers and processors that support app operations (for example, hosting, security, fraud prevention, aggregate usage statistics, and customer support); and
  • We are required to do so by law or lawful requests.

5.3 Safeguards for Transfers

When we transfer personal information from outside the United States, we use appropriate safeguards designed to protect that information. These safeguards may include:

  • Contractual terms that require recipients in the United States to protect personal information to an appropriate standard; and
  • Technical and organizational security measures appropriate to the nature of the information and the risks involved.

5.4 Your Rights and Where to Request Access or Changes

Depending on where you live, you may have rights relating to your personal information (such as access, correction, deletion, or objection to certain processing). If you would like to exercise these rights, please see the "Your Rights" section (Section 7) of this Privacy Policy and contact us using the details provided in the "Contact Us" section (Section 12). We will respond to requests in accordance with applicable law.

5.5 EU/EEA and Other European Users — Cross-Border Transfers to the United States

If you are located in the EU/EEA or elsewhere in Europe and you use our app, your personal information will be transferred to, processed, and stored in the United States. This may happen because our servers and/or service providers used to operate the app are located in the United States, or because certain support, security, moderation, aggregate usage statistics, or other operational activities are performed there.

When we transfer your personal information from the EU/EEA (or other European regions covered by applicable data protection laws) to the United States, we use appropriate transfer safeguards required by applicable law. These safeguards may include one or more of the following:

  • entering into standard contractual clauses (and, where applicable, any addenda or supplementary measures) approved by the European Commission or otherwise permitted under applicable law; and/or
  • other lawful transfer mechanisms permitted under applicable law.

We take reasonable steps intended to ensure that the recipients in the United States protect personal information in a manner consistent with applicable data protection requirements.

Depending on your location and the legal framework applicable to you, you may have additional rights and options regarding these transfers, including the ability to request information about the safeguards used. You can exercise any such rights by contacting us using the details in the "Contact Us" section (Section 12).

5.6 No Special Marketing to Cross-Border Users

We do not sell personal information. We do not use personal information for targeted advertising.

6. Data Retention

We keep your data for as long as your account exists. When you delete your account:

  • Your authentication record is permanently deleted.
  • All database records associated with your account are permanently deleted — pieces, sessions, recordings, notes, settings.
  • All files stored on our behalf are permanently deleted — audio/video recordings, cover images, sheet music.

One exception: if you requested a full export of your studio before deleting your account (Section 7.4), the export files remain available at the emailed links for seven days after deletion, so you can finish downloading them. They are then permanently deleted.

The beta period is scheduled to end on September 28, 2026, and may be extended. When it ends, we intend to carry your account and data over into the next release, which will be governed by an updated Privacy Policy and Terms of Service that you will be asked to accept before continuing. If you prefer not to continue, you can export your data and delete your account (Sections 7.3 and 7.4). Because this is a beta, we cannot guarantee that all data will survive the transition, so please export anything important to you before then.

Account deletion is permanent and irreversible. You can delete individual recordings and pieces at any time from within the application. You can delete your entire account from your Profile; the deletion takes effect immediately. If you cannot access the app, you can also request deletion by emailing studio@embracestrings.com.

Supabase keeps database backups for seven days for disaster recovery. We cannot use them to retrieve individual data, and after seven days deleted records no longer exist in any backup. Deleted files (recordings, cover images, sheet music) are not backed up and are gone immediately.

7. Your Rights

Depending upon your location, you may have the following rights regarding your personal data:

7.1 Access

You can access all of your data (practice content) at any time from within the application.

7.2 Correction

You can edit your notes, piece names and composers, recording names, cover images, sheet music, practice settings, and your name and instrument at any time from within the application. Your email address can be changed from your Profile; the change takes effect once you confirm it from both your old and new addresses.

7.3 Deletion

You can delete individual recordings and pieces from within the application. You can delete your entire account and all associated data from your Profile; this takes effect immediately (see Section 6). If you cannot access the app, email studio@embracestrings.com and we will process the deletion within 5 business days.

7.4 Data Portability

You can take your data with you at any time from within the app:

  • Any recording — download it from the take's menu.
  • Any piece — download a folder containing all of its recordings, its notes, and a summary file, built on your device.
  • Your entire studio — request a full export from your Profile. We assemble one archive per piece plus your account information and email you download links, which remain valid for seven days.

Recordings are provided in their original format (MP4 or WebM); notes and piece information are provided as plain-text and JSON files.

If you cannot access the app, or need your data in a different format, email studio@embracestrings.com from the address associated with your account and we will respond within 48 hours. We may need to confirm your identity before fulfilling a request. Some information may be excluded where we cannot lawfully disclose it or where it is needed for security or legal compliance.

7.5 How to Exercise Your Rights

Contact us at studio@embracestrings.com. We will respond to all privacy-related requests within 48 hours during the beta period.

8. Security

We have implemented the following security measures to protect your data:

  • All data is transmitted over encrypted HTTPS connections.
  • Storage files (recordings, cover images, sheet music) are stored in private buckets with signed URLs. Files are not accessible via public links.
  • Row-level security policies at the database level prevent one user's queries from returning another user's data.
  • Two-factor authentication is enabled on all administrative accounts (Supabase and Vercel).
  • Environment variables containing sensitive credentials are stored securely and are not exposed to the browser or client-side code.

Despite these measures, no system is 100% perfectly secure. We cannot guarantee that your data will never be accessed without authorization, but we take reasonable steps to protect user information in accordance with applicable law and industry practices. If you believe your account has been compromised, change your password, use "Sign out of all devices" on your Profile, and contact us immediately at studio@embracestrings.com.

If we become aware of a confirmed data security incident that affects the confidentiality or integrity of your personal data, we will notify affected users by e-mail as promptly as practicable and in accordance with applicable law. We may also provide additional updates as more information becomes available.

9. Cookies and Tracking

Embrace Studio uses authentication cookies to keep you signed in. These are functional cookies necessary for the application to work.

We do not use:

  • Advertising cookies or tracking pixels.
  • Third-party analytics services (e.g. Google Analytics).
  • Social media tracking cookies.
  • Any cookies that track your behavior across other websites.

We do not display cookie consent banners because we only use strictly necessary functional cookies, which the user consents to by using the Embrace Studio application.

10. Children's Privacy

During the beta period, Embrace Studio is available only to people 18 or older, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it and close the account. If you believe someone under 18 has created an account, contact us at studio@embracestrings.com.

We intend to open the app to musicians aged 13 to 17, with parental consent, in a future release. The privacy practices for those users will be described in the Privacy Policy that accompanies that release.

11. Changes to This Policy

This policy applies for the duration of the beta period, which may be extended. When Embrace Studio moves to general release, you will be asked to accept an updated Privacy Policy and Terms of Service before continuing to use the app; the updated policy replaces this one from the date you accept it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational updates. When we make material changes — changes that affect your rights or how we use your data in a meaningful way — we will:

  • Notify you by email at least 14 days before the change takes effect.
  • Update the "Last Updated" date at the top of this document.
  • Clearly describe what changed and why.

If you continue to use Embrace Studio after receiving notice of a material change, you are agreeing to the updated policy. If you do not agree, you may delete your account before the change takes effect.

For minor, non-material changes (such as clarifications of existing practices or corrections of typographical errors), we will update the document without individual notification.

12. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or the handling of your personal data, please contact:

General Inquiry
studio@embracestrings.com

Chief Embrace Officer
Turner Rey
Embrace Strings
turner@embracestrings.com

Data Protection Officer
Declan McPhillips
Embrace Strings
declan@embracestrings.com

We commit to responding to all privacy-related inquiries within 48 hours during the beta period.

A world where no musician is held back from fully Embracing their music.
Play freely.