Privacy Policy
1. Who we are
Attacca is a sheet music app for the public-domain classical repertoire, available on iPhone, iPad, and the web. It is published by an independent developer. Contact us at feedback@attacca.fm with any questions about this policy or your data.
2. What we collect
2a. Account information
Browsing the catalog is open and anonymous. To download scores or sync your library, you create a free account by signing in with Google, Apple, or an email address. When you do, we collect your email address and a user identifier. Sign-in and account security are handled on our behalf by Clerk, an authentication provider. We use this information to operate your account, apply your free monthly download allowance, manage any subscription, and sync your library across your devices.
2b. Subscriptions and payments
Attacca offers an optional paid subscription. If you subscribe, the payment is processed entirely by Apple (for in-app purchases) or Stripe (on the website). We never receive or store your card or bank details. We store only your subscription status and a reference identifier from the payment provider, so we know whether your account is active.
2c. Your library
For subscribers, we record which catalog scores you have added to your library, keyed to your account, so the same library appears on every device you sign in to. For free accounts we record only the number of downloads used in the current month, to apply the free-tier allowance.
2d. Your own files
If you subscribe, the files you create or import (blank manuscripts, scanned scores, and the annotations you draw on scores) are stored in our cloud storage so they sync across your devices. These files are private to your account; no other user can access them. On a free account, these files stay only on your device.
2e. Search queries (anonymized)
When you search, your query text is sent to our server to return results, and may be processed by an AI service to interpret typos and nicknames. We log searches that return no results, in aggregate, so we can improve the catalog. These logs contain only query text and a counter, never your name, account, or any way to identify you or link one search to another.
2f. Diagnostics (none)
Attacca includes no third-party analytics or advertising SDKs: no Firebase, Mixpanel, Crashlytics, Google Analytics, or Facebook SDK. We do not transmit usage patterns or behavioral data to advertisers or data brokers.
3. What we don't collect
- No payment details. Card and bank information goes directly to Apple or Stripe; we never see it.
- No tracking. We don't follow you across apps or websites, we share nothing with advertising networks, and we don't use the advertising identifier (IDFA).
- No contacts, location, or biometrics. We don't request your contacts or location, and we don't use Face ID or Touch ID.
4. Permissions the app requests (and why)
4a. Camera
Only if you choose to scan a physical score with the document scanner. The scan is processed on your device and converted to a PDF. If you are a subscriber, that PDF is stored in your private cloud storage so it syncs to your other devices (see 2d); otherwise it stays only on your device.
4b. Microphone
Only if you choose to use the built-in tuner or record yourself practicing. Audio is processed entirely on your device and stored locally. We never upload audio recordings to our server or any third party.
5. Where your data lives
5a. On your device
Your downloaded scores, annotations, recordings, bookmarks, and favorites are stored in the Attacca app on your device. Deleting the app removes this local copy.
5b. On our servers
Our infrastructure runs on Cloudflare: the catalog and your stored files live in Cloudflare R2, and your account, library, and subscription records live in a Cloudflare D1 database. Cloudflare also logs requesting IP addresses briefly for standard security and abuse protection; we access these only for security investigation and do not link them to your account.
5c. Service providers
We rely on a small set of providers to run Attacca, each acting only on our instructions: Clerk (sign-in), Apple and Stripe (payments), and Cloudflare (hosting and storage). We do not sell or rent your information to anyone.
6. Score files
Every score in Attacca's catalog is verified as public domain in the United States through our multi-gate review process. They are sheet music PDFs, with no copyrighted material or recordings.
7. Children
Attacca is rated for all ages. It has no chat, no advertising, no social features, and no in-app browsing of the open web. We do not knowingly collect personal information from children under 13.
8. Your rights and deleting your data
You can manage your account from the Settings screen in the app (tap your profile photo). To delete your account and everything associated with it (your email, library records, subscription record, and any files you have stored with us), email feedback@attacca.fm from your account's email address, and we will delete it within 30 days. You can also remove the locally-stored copy at any time by deleting the app.
Depending on where you live, you may have rights to access, correct, or export your personal data. Contact us at the address above and we will respond within 30 days.
9. International users
Attacca is available worldwide and is operated from the United States; your data may be processed there and in other countries where our service providers operate. We handle personal data consistent with the principles of the GDPR (EU), UK GDPR, CCPA/CPRA (California), and PIPEDA (Canada).
10. Changes to this policy
If we materially change what we collect or how we use it, we will update this page and note the change in the app's release notes. The "Effective" date above reflects the most recent revision.