Privacy Policy

1. Who is responsible

Music Secrets is the controller of your personal data. For any privacy question or request, write to info@1000feetabove.com.

2. What we collect

• Account: your name, email address and password (stored only as a secure hash by our login provider).
• Membership and payments: your plan, its status and renewal date, and the Stripe customer and subscription references. Stripe collects your card details and billing address directly; we never see your full card number.
• Course use: which lessons you have watched or completed, so we can show your progress.
• Site statistics, only if you allow them: the pages you visit, the website that sent you and your approximate country, with a random ID that lasts for your browser session. If you are signed in, these visits are linked to your account. We do not store your IP address for this. You can change your choice anytime with the “Privacy preferences” link at the bottom of the page.
• Emails you send us and our replies.
• Technical data: IP address, browser and device type, and logs that our hosting and database providers keep to run the site securely.

Microphone and MIDI: the sing-it-back exercises and the playable keyboard work only after you allow them in your browser. Your voice and what you play are analysed on your device and are never recorded, stored or sent to us.

3. Why we use it

• To create your account, give you the lessons you paid for and remember your progress (to perform our contract with you).
• To take payments, manage renewals and cancellations, and keep tax and accounting records (contract and legal obligation).
• To send emails about your account and membership, such as sign-up confirmation, password reset and receipts.
• To keep the site secure, fix problems and understand which ads lead to sign-ups (our legitimate interests, or your consent where the law requires it).
• To see which pages are useful and how people find us (site statistics, with your consent).

We do not sell your personal data and we do not send marketing emails without your permission.

4. Cookies and similar technologies

• Essential: your login session is kept in your browser’s local storage so you stay signed in, and your statistics choice is remembered there too. Stripe uses its own cookies during checkout to prevent fraud.
• Site statistics: only after you click “Allow analytics”, a random ID is kept in your browser’s session storage until you close the tab.
• Advertising measurement: we use the Google tag (Google Ads) to measure whether our ads lead to visits and purchases. Google may set cookies and process your IP address and browsing data for this; see how Google uses data from sites that use its services. You can turn off personalised ads at adssettings.google.com and block or delete cookies in your browser settings.

5. Who processes data for us

We use trusted providers that process data only on our instructions:

• Supabase: login, database (including site statistics) and storage of course files.
• Stripe: payments, subscriptions, invoices and the customer portal.
• Our website hosting and email delivery providers: serving the site and sending account emails.
• Google: advertising measurement, as described above.
• A notification service that alerts us when a new membership is bought (it receives the amount and the buyer’s email).

Some of these providers are in the United States or other countries. Where the law requires it, transfers are protected by safeguards such as the European Commission’s standard contractual clauses.

6. How long we keep it

We keep your account data while your account exists. If you ask us to delete your account, we delete it within 30 days, except payment and invoice records that we must keep for tax and accounting purposes (usually up to 10 years). Site statistics are deleted when they are no longer needed for our reports, and at the latest when you ask us to delete your account. Technical logs are kept for a short time by our providers.

7. Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or California law), you can ask to access, correct, delete or receive a copy of your data, object to or restrict how we use it, and withdraw any consent you gave. Write to info@1000feetabove.com and we will reply within 30 days. You can also complain to your local data protection authority.

8. Children

Music Secrets is not directed at children under 13, and we do not knowingly collect their data. Younger students should use the course with a parent or guardian who holds the account.

9. Security

Data is sent over encrypted connections (HTTPS), access to our database is restricted, and passwords are never stored in plain text. No system is perfectly secure, so please use a strong, unique password.

10. Changes

We may update this policy. The date at the top shows the latest version, and we will tell you by email about important changes.