Privacy Policy
Last updated: 22 September 2026
1. Who we are
RiffReady is a guitar practice application operated by RiffReady Pty Ltd (ACN 700 828 397), a company registered in Australia ("RiffReady", "we", "us", "our"). Our registered address is 23-25 Greenwood Close, Buderim QLD 4556.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the rights you have over it. It applies to the RiffReady website, web application, and mobile applications (together, the "Service").
For the purposes of the EU/UK General Data Protection Regulation, RiffReady Pty Ltd is the data controller for personal information processed through the Service.
Contact: play@riffready.com.au
2. Information we collect
a. Information you give us
- Account information: email address, username, password (stored only as a cryptographic hash — we never see or store your plain-text password), and optionally a profile picture.
- Audio you upload: the audio files you choose to upload for analysis, and any file metadata they contain (such as title, artist, and album tags).
- Corrections and feedback: chord corrections, reports, and any support messages you send us.
- Optional survey responses: if you choose to tell us about your playing experience, musical interests, or goals.
b. Information generated by your use of the Service
- Practice packs and derived data: the chord timings, tempo, key, structure, lyric alignment and related analysis produced from audio you upload, plus your settings for each song (such as capo position and playback preferences).
- Usage information: which features you use, generation counts and credit usage, and error diagnostics.
- Technical information: IP address, browser and device type, operating system, and approximate location inferred from IP (country/region level only).
c. Payment information
Subscription payments are processed by Stripe. We do not receive or store your full card number. We receive limited billing information from Stripe such as your subscription status, plan, billing period, the last four digits of your card, and country.
d. Children
The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.
3. Why we use your information, and our legal bases
| Purpose | Information used | Legal basis (GDPR) |
|---|---|---|
| Create and operate your account | Account information | Performance of a contract |
| Analyse audio you upload and generate practice packs | Uploaded audio, derived data | Performance of a contract |
| Store your library and settings so you can return to them | Derived data, settings | Performance of a contract |
| Process subscriptions and enforce plan limits | Account, usage, billing information | Performance of a contract |
| Provide support and respond to your reports | Support messages, account information | Performance of a contract / legitimate interests |
| Keep the Service secure, prevent abuse and fraud | Technical and usage information | Legitimate interests |
| Improve and debug the Service | Usage information, error diagnostics | Legitimate interests |
| Improve chord and analysis accuracy using corrections you submit | Corrections, derived chord data | Legitimate interests |
| Personalise recommendations and content | Optional survey responses, usage information | Consent (for survey data) / legitimate interests |
| Send service emails (e.g. password resets, billing notices) | Account information | Performance of a contract |
| Send optional product updates or marketing | Email address | Consent (opt-in; withdraw any time) |
| Comply with legal obligations | As required | Legal obligation |
We do not sell your personal information, and we do not use it for behavioural advertising or cross-context tracking.
4. How your uploaded audio is handled
This is the part most specific to RiffReady, so we want to be plain about it.
- You upload audio you own or otherwise have the right to use. You confirm this when you upload (see our Terms of Service).
- To generate a practice pack, your audio is processed by us and by specialist third-party services acting on our behalf (see §5). This processing is automated and is initiated by you.
- We store your uploaded audio and the resulting practice pack so you can use them. Retention depends on your plan — see §7.
- Derived musical data may be cached and reused. Chord labels, timings, tempo, key and structure are factual descriptions of a recording rather than copies of it. Where another user uploads the same recording, we may serve previously computed analysis rather than re-processing it. This means analysis derived from a recording you uploaded may be used to serve another user's pack for the same recording. Your audio file itself is never shared with, or made accessible to, other users.
- We do not publish, distribute, or make your audio available to anyone else.
5. Who we share information with
We share information only with service providers who help us run the Service, and only as needed:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Sydney, Australia |
| Vercel | Application hosting | Global edge network |
| Modal | Audio processing compute | United States |
| Music.AI | Chord, beat and key detection | United States / Brazil |
| ACRCloud | Song identification from a short excerpt of the uploaded audio | Global |
| Cloudflare (R2) | Storage of uploaded audio and separated backing tracks | Global |
| Anthropic | AI-generated text used in packs (e.g. song facts, coaching content) | United States |
| Stripe | Payment and subscription processing | Global |
| Resend | Transactional email | United States |
We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition or sale of assets (in which case we will notify you).
International transfers. We are based in Australia and use providers in the United States and elsewhere. Where we transfer personal information out of the EU/UK, we rely on Standard Contractual Clauses or another lawful transfer mechanism. Where we disclose personal information overseas as an Australian entity, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles (APP 8).
6. Cookies and similar technologies
We use only what the Service needs to function:
- Essential: authentication and session cookies, security tokens.
- Preferences: your settings, such as capo overrides and playback preferences.
- Analytics: none at present — used in aggregate to understand feature usage.
We do not use advertising or cross-site tracking cookies.
7. How long we keep information
| Data | Retention |
|---|---|
| Account information | While your account is open |
| Uploaded audio | Free: 30 days from upload (your practice pack, chords and lyrics are kept). Pro: retained while your subscription is active, and for 30 days after it ends (after that the audio is deleted; your practice pack, chords and lyrics are kept). |
| Practice packs and derived data | While your account is open; derived musical data may be retained in anonymised, non-account-linked form after deletion (see below) |
| Payment records | 7 years, as required by Australian tax and corporations law |
| Support correspondence | 24 months |
| Server and security logs | 24 months |
When you delete your account: we delete your account information, uploaded audio, and your library, and cancel any active subscription. We retain (a) payment records where legally required, and (b) anonymised, aggregated musical analysis data not linked to you or your account.
8. Your rights
Regardless of where you live, you can:
- Access the personal information we hold about you
- Correct inaccurate information (username, email and profile picture are editable in-app)
- Delete your account and associated data, from within the app or by contacting us
- Object to or restrict certain processing
- Withdraw consent where we rely on it (e.g. marketing, survey data)
- Export a copy of your data in a portable format
- Complain to us, or to a privacy regulator
If you are in the EU/UK, these rights arise under the GDPR, and you may complain to your national supervisory authority.
If you are in Australia, you may complain to us first; if unsatisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
If you are in California, you have the rights to know, delete, correct, and opt out of sale or sharing of personal information (we do not sell or share it), and not to be discriminated against for exercising those rights.
To exercise any right, email play@riffready.com.au. We respond within 30 days.
9. Security
We protect your information with encryption in transit (TLS) and at rest, hashed passwords, row-level database access controls so users can only reach their own data, scoped storage access, and least-privilege administrative access.
No system is perfectly secure. If a data breach occurs that is likely to cause serious harm, we will notify affected users and the relevant regulators as required by the Notifiable Data Breaches scheme (Australia), the GDPR (72 hours), and other applicable laws.
10. Changes to this policy
We may update this policy as the Service or the law changes. We review it at least annually. If changes are material, we will notify you by email or in-app before they take effect, and update the "Last updated" date above.
11. Contact
RiffReady Pty Ltd — ACN 700 828 397 23-25 Greenwood Close, Buderim QLD 4556 play@riffready.com.au