App privacy notice

This notice covers the Riprova app, on Android and in a browser, and the account you make in it. The website and its waitlist have their own privacy notice. The terms for using the app are in the terms of use.

Who is responsible

Riprova is run by Jon Rottenbury, 25 Springbank Road, Birmingham B15 2HF, United Kingdom, who is the data controller for the app. Write to hello@ritornomusic.app about anything in this notice.

What the app collects, why, and on what basis

Everything below is data you or your teacher or guardian put into the app. We collect nothing in the background: no location, no contacts, no advertising identifiers and no analytics.

Your account. Your email address, a password (kept only as a one-way hash, so we cannot read it), your role, your display name and your date of birth. We use these to let you sign in and to apply the rules that depend on age. Your encryption keys are kept in a form that only your password or recovery code can open. After a wrong password we keep a count and the time of the failed tries so that guessing is slowed down. Our basis is the contract to provide the app (UK GDPR Article 6(1)(b)). For a child under 13 the contract is made by their parent or guardian. For the failed-try count the basis is legitimate interests (Article 6(1)(f)): protecting accounts.

Your practice diary, goals and repertoire. Practice sessions (when, how long, tempo, and any notes you type), the pieces and goals you add, and your instrument. Basis: the contract (Article 6(1)(b)). Please do not put health or other sensitive details in the free-text notes; the app does not need them.

Recordings. Audio you record is encrypted on your device before it is uploaded, so we and our providers cannot listen to it. We hold the encrypted file and its title, notes, length and whether you marked it a keeper. Basis: the contract (Article 6(1)(b)).

Sharing. Nothing you make is visible to a teacher or guardian until you choose to share it, one kind of thing at a time. We keep a record of what you chose to share and with whom, and, for a shared recording, a key that lets that one person open it. Basis: the contract; your choice to share is your instruction to us.

Guardians. A guardian is linked to a young person's account by an invitation to their email address, which they confirm. We keep the invitation, the link and when it was confirmed, a recovery key for the guardian, and the messages a teacher and a guardian send each other about a student. Basis: the contract. The guardian link is a safeguarding measure for young people, and is not a request for consent under Article 8.

Teachers. A teacher must have a current Enhanced DBS check before they can link to a student or comment. We keep the result (verified or not), the date of the check and its expiry, who verified it, the link between teacher and student, and the comments the teacher writes on a student's entry or recording. Our basis for the DBS result is legitimate interests (Article 6(1)(f)): keeping young people safe. Because a DBS result concerns criminal records we also need a condition under the Data Protection Act 2018, and we are still confirming which. Basis for the link and comments: the contract.

A safeguarding log. We record that a safeguarding event happened (a link made or removed, something shared or stopped, and the like), when, and the internal ids involved. It holds no contact details. Basis: legitimate interests (Article 6(1)(f)): being able to show that the safeguards worked.

Who may sign up. While the app is in testing, sign-up is limited to a list of email addresses we have invited. Basis: legitimate interests (Article 6(1)(f)): keeping a closed test closed.

Who the app is for

The app is for musicians of any age and the teachers and guardians who support them. A child under 13, or anyone who has not given a date of birth, cannot use it until a parent or guardian has been linked and has confirmed. Someone aged 13 to 17 can keep their own diary but needs a confirmed guardian before a teacher can be linked. Adults aged 18 or over need no guardian. Teachers cannot link to a student or comment until their DBS check is verified. A teacher's comment is a note on one practice entry or recording; there is no private chat between a teacher and a student. Conversation is possible only between a teacher and a guardian.

Who handles it for us

• Supabase stores the app's data and runs sign-in. Our project is hosted in London. Supabase also reports some transfers to the United States and Singapore for its own operations. The transfer is covered by the standard contractual clauses and UK addendum in its data processing addendum.
• PowerSync keeps your data in step between your devices and the server. Our instance is in its EU region. We are still confirming the safeguard that covers the transfer; we will update this notice when we have.
• Cloudflare delivers the web version of the app. It processes data on a worldwide network, so data may be handled outside the United Kingdom. The transfer is covered by the standard contractual clauses and UK addendum in its data processing terms, or by the UK extension to the EU–US Data Privacy Framework.
• Resend sends the app's emails: sign-up confirmation, password reset and guardian invitations. It processes data in the United States. The transfer is covered by the standard contractual clauses in its data processing terms and its certification to the EU–US Data Privacy Framework with the UK extension.
• Zoho hosts the mailbox, if you email us. We are still confirming where Zoho processes that mail and the safeguard that covers it; we will update this notice when we have.

These companies act on our instructions and may not use the data for their own purposes. Nobody else receives it, except where the law requires. Apart from them, the only people who see your data are the teachers and guardians you chose to share it with.

How long we keep it

• Account, diary, goals and repertoire: for as long as the account exists. We have not yet built a button to delete an account. Until we have, write to us and we will delete it by hand (see "Your rights"), apart from the records described below.
• Recordings: a recording you have not marked a keeper is deleted a year after it was made. A keeper stays until the account is deleted.
• Sharing choices: for as long as the account exists. Stopping sharing keeps the record of the choice and its time.
• Teacher comments and messages between a teacher and a guardian: these can never be edited or deleted, so that a safeguarding record is never lost. For now we keep them until the student they concern turns 21, even after an account is closed. That period is provisional: we are still confirming it and the legal ground for keeping them, and will update this notice when we have.
• A teacher's DBS result: we are still confirming how long it is kept.
• The safeguarding log: three years at most. The automatic deletion that enforces this is not built yet.
• Failed-password counts and the sign-up list: we have not yet set a period for these and will update this notice when we have.
• Resend's delivery log: Resend states that it keeps email and log data for 30 days on its standard plans.
• Cloudflare's logs of visits: Cloudflare sets these periods itself and does not state one figure; its policy is at cloudflare.com/privacypolicy.
• Emails to us: kept for as long as needed to answer you and to keep a record of any complaint or request.

Cookies and storage on your device

The web app stores your sign-in and your own data in your browser so that it works offline. That storage is needed to give you the service you asked for. The app uses no advertising or analytics cookies.

Your rights

You can ask us to:

• tell you what we hold about you and give you a copy;
• correct anything that is wrong;
• delete it;
• restrict how we use it;
• give it to you in a form you can reuse;
• stop using it where we rely on legitimate interests (you can object).

A parent or guardian can ask for these on behalf of a child. We have not yet built buttons for deleting an account or exporting your data, so for now ask by email and we will do it by hand. Some of these rights apply only in certain cases, and the records that can never be deleted (above) are one. We reply within one month. See also the complaints and requests page.

Complaints

Tell us first if you can: see the complaints page, which says how and how quickly we reply. You can also complain at any time to the Information Commissioner's Office at ico.org.uk.

Version 2026-10-07. Last updated 7 October 2026.