Effective date: 26.07.2026 · Last updated: 20.10.2026
This privacy policy explains how Repertuvar (the "App", "we") collects, uses and protects your personal data through its mobile application and the repertuvar.app website. Repertuvar is a tool built for musicians to manage their repertoire, with particular support for Turkish music.
repertuvar.app is a product developed and operated by StageFlow B.V., The Netherlands. In this policy, "we" means StageFlow B.V.
The controller of your personal data is:
When you sign in with Google or Apple, we receive your email address and name from the identity provider (with Apple you can choose to hide your email address). When you sign up with email and password, you enter these details yourself; your password is never stored in plain text, only as a one-way hash by our authentication service. You may add further details yourself, such as the display name shown on your profile.
Data you enter while using the App: pieces (title, makam, usul, form, lyrics, chords), setlists, your personal chord sheets, the groups you belong to and your group memberships, your conversations with our support team (in-app messages; users cannot message each other) and the announcements and notifications you receive.
We also store preferences linked to your account: your favourite pieces (so they look the same on every device), your music preferences (the kinds of music you play, chosen at sign-up or in Settings; used only to highlight pieces that suit you, never to hide any) and your app language.
Technical data required for the App to work (session tokens, data stored locally on your device for offline use). The App shows no advertising and uses no third-party tracking or analytics cookies.
We measure usage on our own infrastructure in order to improve the service and to plan our regional promotion. Regional promotion uses aggregate counts only (for example, how many users there are in a city); there is no personalised advertising or targeting, and the data is not sold. To determine the coarse location your IP address is sent to the geolocation service named below; apart from that, this data is not transferred to any third party.
Inside the App: the name of the page opened, the page it was reached from, session ID, user ID, device type (mobile/desktop), platform, time zone, and a coarse location derived from the IP address (country, region, city). The IP address itself is not stored. To determine the coarse location, the IP address is sent to a third-party geolocation service (ipwho.is) at most once a day; the result is cached on the device for a day.
You can turn it off: when you switch off Settings › Usage statistics, neither usage records nor location lookups are sent from that device. This choice is per device.
On the marketing site (repertuvar.app): the address of the page opened
(including a campaign tag if the link has one, e.g. utm_source=instagram),
the referring site and device type. No user ID, cookie or location data is collected
here; visitors are not identified.
Sign-up source: to see which promotion channels work, where you first came to the site from (only the name of the referring site, e.g. google.com, and a campaign tag if the link has one) and the date of that first visit are kept in your browser for up to 30 days. If you sign up on the marketing site, this is written to your account once and removed from your browser; it is deleted together with your account. If you do not sign up, it is never sent anywhere.
When you buy Repertuvar Pro through the App Store or Google Play, the payment is processed by Apple or Google; we have no access to your card or payment details. To link your subscription to your account and show its status correctly (trial, active, cancelled, expired), we receive the following from the store, through our subscription validation service RevenueCat: the plan you bought; purchase, renewal and expiry dates; trial status; store transaction IDs; and the store country, price and currency. If your account has been given Repertuvar Pro Gift, we keep a record of that too.
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account and providing the service | Performance of a contract (Art. 6(1)(b)) |
| Running setlist and group features | Performance of a contract |
| Syncing your favourites across your devices and highlighting pieces that suit your music preferences | Performance of a contract |
| Sending invitation and notification emails | Performance of a contract / legitimate interest |
| Validating your subscription and turning Pro on and managing it for your account | Performance of a contract (Art. 6(1)(b)) |
| Security and prevention of misuse | Legitimate interest (Art. 6(1)(f)) |
| Preventing subscription abuse (e.g. one subscription used on several accounts) | Legitimate interest (Art. 6(1)(f)) |
| Measuring and improving how the service is used, and seeing which promotion channels work | Legitimate interest (Art. 6(1)(f)) |
| Legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not sell your data. We use the following service providers (processors) in order to deliver the service:
These providers process data only to the extent needed to provide the service and strictly on our instructions.
Your data is stored primarily on Supabase servers in the European Union. That said, some providers — Google (sign-in), Resend (email delivery), RevenueCat (subscription validation) and Apple/Google (distribution and purchases) — may process data outside the European Economic Area (for example in the United States). Such transfers are covered by the safeguards required under the GDPR, for example Standard Contractual Clauses.
We keep your account information and the content you create for as long as your account is active. Specific retention periods apply to usage measurement records:
| Data | Retention |
|---|---|
| Account information and content you create (even when Pro is not active) | Until you delete your account |
| Subscription and purchase records | Until you delete your account; deleted then, including your record at RevenueCat |
| Accounting records (aggregate sales reports from Apple and Google, containing no personal identifiers) | Statutory period (7 years) |
| User ID, session ID, city and region in in-app usage records | Deleted after 30 days |
| Usage records in full | Deleted after 180 days |
| Daily aggregate counts (users, sessions and page views per country, region, city and platform; contain no identifiers) | Indefinitely |
| Marketing site visit records (contain no identifiers) | 180 days |
When your trial or subscription ends, your content is not deleted; it is kept until you delete your account. Only data we are legally required to retain falls outside these periods.
You can delete your account yourself from within the App, under Settings → Delete My Account. Deletion takes effect the moment you confirm it, and permanently removes your account, your personal setlists, your group memberships, your personal chord sheets, your messages, your favourites and your music preferences; your user ID is also removed from usage records. If the App is not installed on your device, you can do the same by signing in at app.repertuvar.app and going to Settings → Delete My Account. You may also request deletion by writing from your account's email address to privacy@repertuvar.app.
Two kinds of shared content are deliberately preserved, because other people's work depends on them:
Deleting your account does not cancel your App Store or Google Play subscription; cancel it first so you won't be charged. When your account is deleted, your subscription records are deleted too; Apple and Google keep their own purchase records under their own policies.
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent you have given. Contact us to exercise any of these rights.
You also have the right to lodge a complaint with a data protection supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
The App uses local storage on your device (IndexedDB) so that it can work offline, and the technical storage required to keep you signed in. On the marketing site, a session key that lives only until the tab is closed is used so that the same visit is not counted twice. We use no marketing or third-party tracking cookies.
The App is not directed at children under 13, and we do not knowingly collect data from anyone under 13; if we become aware of such an account, we delete the account and its data. Users aged 13 or older who are below the age at which they can consent to the processing of their personal data on their own in their country (between 13 and 16 in the European Union, depending on the country) use the App with the consent of a parent or guardian. If you are a parent or guardian, you can write to privacy@repertuvar.app to access, correct or delete your child's data.
We take reasonable technical and organisational measures to protect your data — for example restricting access through authentication and row-level security rules, and encrypting data in transit. No system is 100% secure, but we take security seriously.
We may update this policy from time to time. For significant changes we will notify you in the App or on the website. The current version is always published on this page.
For any question or request regarding privacy and data protection: privacy@repertuvar.app
For other support requests (account, subscriptions, technical issues): support@repertuvar.app (Support page)