Overview
Cadent ("we," "us," or "our") operates the website and mobile application at cadent.online (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By using Cadent, you agree to the collection and use of information in accordance with this policy.
Information We Collect
Account Information
- Email address — used for authentication and account recovery
- Display name — the name visible to others on the leader board (filtered for profanity)
- Instrument — optional, shown on your profile and leader board
- Account type — student or teacher
Practice Data
- Practice sessions — duration, song name, optional notes, timestamp
- Streak data — consecutive practice days and current multiplier
- Points earned — calculated from practice time and streak multipliers
- Leader board visibility preference — whether you appear on the student leader board
Child-Specific Data (Under 13)
- Parent/guardian email — collected only for students under 13, used solely for consent verification
- Consent token — a one-time UUID link shared manually by the student with their parent. This token is deleted after the parent approves or denies consent.
- Consent status — tracks whether parental consent has been granted, denied, or is pending
Payment Information
Subscription payments are processed through Stripe. Cadent does not store credit card numbers, bank details, or full payment information on our servers. Stripe provides us with a tokenized customer ID and subscription status only.
Technical Data
- Browser type, operating system, and device identifiers (collected by Supabase Auth)
- IP address (used for security and fraud prevention)
- App usage patterns (pages visited, features used)
How We Use Your Information
- Provide the Service — authenticate your account, store practice data, calculate streaks and points
- Share with teachers — when you generate a share link, your teacher can view your practice history, streaks, and points for the purposes of music instruction
- Leader board display — your display name, instrument, points, and streak appear on the leader board unless you opt out
- Process payments — handle subscription billing through Stripe
- Communicate with you — account verification, password reset, service announcements
- COPPA compliance — verify parental consent before collecting data from children under 13
Information Sharing
We do not sell, rent, or trade your personal information to third parties. We share data only in the following circumstances:
- Supabase — our database and authentication provider (hosted in the United States). Supabase processes and stores your data on our behalf under a Data Processing Agreement.
- Stripe — our payment processor (United States). Stripe handles all payment card data directly. We receive only a tokenized customer ID and subscription status.
- Teacher sharing — when you explicitly share your profile with a teacher via a share link, that teacher can view your practice data, streaks, and points. You can revoke access at any time.
- Legal requirements — we may disclose information if required by law, subpoena, or other legal process.
We do not use your data for advertising. Cadent has no ads, no ad networks, and no third-party tracking for advertising purposes.
Children's Privacy (COPPA)
Cadent is designed for music students, including those under 13. We comply with the Children's Online Privacy Protection Act (COPPA) and the 2025 COPPA Final Rule:
- Age gate — during sign-up, we ask whether the user is 13 or older. Users under 13 are directed to the parental consent flow before their account is fully activated.
- Parental consent — we require verifiable parental consent before collecting personal information from children under 13. Our consent flow uses a one-time UUID token link that the student shares with their parent. The parent reviews what data is collected and approves or denies consent.
- No email required for consent — the consent link is generated by the student and shared manually with their parent (text, email, or in person). We do not send emails to parents as part of the consent process.
- Consent token deletion — the UUID consent token is deleted immediately after the parent approves or denies consent. It cannot be reused.
- Feature gating — students with pending or denied consent have restricted access to social features (leader board, sharing). Full access is restored after parental approval.
- No voice or biometric data — Cadent does not collect, store, or process voice recordings, photographs, or biometric data from any user.
- Data minimization — we collect only the data necessary to provide the Service and nothing more.
Parents may review, modify, or delete their child's information at any time by contacting us at privacy@cadent.online.
Data Retention and Deletion
- We retain your account data for as long as your account is active.
- You may request account deletion at any time by contacting privacy@cadent.online.
- Upon account deletion, we remove your profile, practice sessions, songs, and share links from our database within 30 days.
- Anonymized, aggregate data (e.g., total practice minutes across all users) may be retained for analytics purposes and cannot be linked back to you.
Data Security
- Encryption in transit — all data is transmitted over HTTPS/TLS
- Encryption at rest — Supabase encrypts all stored data using AES-256
- Authentication — passwords are hashed and never stored in plaintext
- Row-level security — database policies ensure users can only access their own data unless sharing is explicitly enabled
No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
Cookies and Tracking
Cadent uses minimal cookies necessary for the Service to function:
- Authentication cookies — required to keep you logged in (set by Supabase Auth)
- Service worker cache — stores app shell files for offline use (PWA functionality)
We do not use advertising cookies, tracking pixels, or third-party analytics cookies.
Your Rights
You have the right to:
- Access — request a copy of your personal data
- Correct — update inaccurate information in your profile
- Delete — request full account and data deletion
- Opt out — hide your profile from the leader board at any time via the visibility toggle
- Revoke consent — parents can deny or revoke consent for a child under 13 at any time
To exercise any of these rights, contact us at privacy@cadent.online.
Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (for account holders) or by posting a notice on our website at least 30 days before the changes take effect. Continued use of the Service after changes constitutes acceptance of the updated policy.