Privacy Policy

Last Updated: November 23, 2025

1. Information We Collect

1.1 Account Information

All Users

• Email address
• Username
• Password (stored securely using industry-standard hashing)
• First and last name
• Profile picture (optional)
• City and country (optional)
• Account type (student, teacher, or administrator)

Teacher Accounts

Teachers may provide additional professional information:

• Professional bio and profile tagline
• Teaching experience (years) and methodology
• Institution affiliation
• Degrees, certifications, and qualifications
• Professional affiliations (e.g., NATS, MTNA)
• Publications
• Specializations and vocal styles taught
• Student levels taught (beginner to professional)
• Studio type (in-person, online, hybrid)
• Teaching availability and languages
• Hourly rates and trial lesson rates
• Voice sample recordings
• Video introduction (YouTube/Vimeo links)
• Website URL and booking links (e.g., Calendly, Acuity)
• Social media links
• Public contact email or phone (optional)
• Teaching materials and documents (PDF, DOCX, TXT)

Student Accounts

For students added by teachers:

• Name and email address
• Student ID (assigned by teacher)
• Auto-generated username and password (sent via email)
• Profile picture (optional)
• Vocal range and voice type (discovered during onboarding)
• Group tags assigned by teacher

1.2 Voice Recordings and Audio Data

As a vocal training platform, we collect and process audio data including:

• Voice recordings: Your vocal practice attempts for each exercise
• Vocal range assessment: Your lowest and highest notes (MIDI number and musical notation)
• Voice type classification: Soprano, mezzo-soprano, alto, tenor, baritone, or bass
• Background noise profile: Environmental audio characteristics to improve analysis accuracy
• Teacher voice samples: Demonstration recordings uploaded by teachers
• Onboarding recordings: Initial vocal assessments during account setup

1.3 Practice Activity and Session Data

We track detailed practice activity:

• Session start and end times
• Duration of practice (minutes/hours)
• Exercises practiced and skill areas worked on
• Playthrough count (times listening without recording)
• Recording count (attempts analyzed)
• Session status (in progress, completed, abandoned)
• Total practice minutes (daily, weekly, monthly)
• Practice frequency and last practice date
• Daily practice streaks

1.4 Communication Data

Messages and notifications including:

• Direct messages between teachers and students
• Broadcast messages from teachers
• Practice reminders and assignment notifications
• Recognition and encouragement messages
• System notifications
• Message read status

1.5 User Settings and Preferences

• Display preferences (dark mode)
• Microphone selection and audio input settings
• Noise reduction level (0-100)
• Accuracy sensitivity (0-100)
• Exercise approach (standard, adaptive, challenging)
• Auto progression settings
• AI feedback style (constructive, encouraging, technical)
• Notification preferences (badges, personal, newsletter, exercises)

1.6 Payment Information

For subscription services:

• Billing information processed securely through Stripe
• Subscription plan and billing cycle
• Payment history and transaction records
• Next billing date

We do not store complete credit card numbers on our servers. All payment processing is handled by Stripe in compliance with PCI-DSS standards.

1.7 Technical Information

• IP address
• Browser type and version
• Device information and user agent
• Session data and timestamps

1.8 Feedback and Support Data

When you contact us:

• Name and email address
• User type (teacher, student, other)
• Bug reports (title, description, steps to reproduce, severity)
• Feature requests (title, description, use case, priority)
• General inquiries (subject, message)

2. AI-Powered Analysis (Q-Orb System)

Our Q-Orb analysis system uses artificial intelligence to analyze your vocal recordings and generate objective performance metrics.

2.1 Vocal Metrics Collected

For each recording, we analyze and store:

• Pitch Accuracy: Deviation from target notes measured in cents (hundredths of a semitone)
• Timing Precision: Deviation from target timing measured in milliseconds
• Note Precision: Percentage of clean note boundaries (attack and release)
• Voice Instability: Unwanted pitch fluctuations during sustained notes
• Vibrato Irregularity: Consistency of vibrato oscillation measured in Hz deviation
• Overall Performance Score: Composite score from 0-100%

2.2 Analysis Visualizations

• Piano roll visualizations showing pitch accuracy over time
• Note-by-note performance breakdowns
• Grouped notes analysis
• Historical trend charts

2.3 Personalized Baselines and Goals

The system automatically:

• Establishes personalized performance baselines based on your recordings
• Sets adaptive improvement goals
• Adjusts baselines based on your progress (e.g., relaxes by 10% after consecutive failed attempts)
• Tracks week-over-week and monthly improvements

2.4 Additional AI Features

• Automatic key signature detection from audio
• Audio separation (isolating vocals from instrumentals for YouTube imports)
• Personalized feedback and suggestions
• Exercise recommendations based on skill level

3. How We Use Your Information

3.1 Primary Uses

• Provide services: Analyze vocal recordings, track progress, and deliver personalized feedback
• Improve accuracy: Refine pitch detection and analysis algorithms
• Personalize experience: Adapt exercises and goals to your skill level
• Facilitate teaching: Enable teachers to monitor student progress and provide instruction
• Process payments: Manage subscriptions and billing
• Communicate: Send service updates, notifications, and respond to inquiries

3.2 Research and Improvement

We may use anonymized and aggregated data for:

• Academic research on vocal training effectiveness
• Improving our analysis algorithms and AI models
• Developing new features and exercises
• Understanding usage patterns to improve the platform

This research data is stripped of all personally identifiable information and cannot be traced back to individual users.

4. How We Share Your Information

4.1 Service Providers

We share data with trusted third-party services necessary to operate EchoVQ:

• Stripe: Payment processing and subscription management
• Amazon Web Services (AWS S3): Secure storage for audio recordings, images, and documents
• SendGrid: Transactional email delivery (account notifications, invitations)
• OpenAI: AI-powered vocal analysis and feedback generation
• Google: OAuth authentication services
• YouTube: Video and audio retrieval for song exercises
• Redis: Task queue management for audio processing

4.2 Legal Requirements

We may disclose information when required by law, court order, or to protect our rights, safety, or the safety of others.

4.3 Business Transfers

If EchoVQ is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4.4 No Sale of Personal Information

We do not sell your personal information to third parties.

5. Teacher-Student Data Sharing

EchoVQ facilitates educational relationships between teachers and students. Understanding how data is shared in this context is important.

5.1 What Teachers Can See

If you are a student linked to a teacher's account, your teacher can access:

• Your practice sessions, including dates, duration, and exercises practiced
• All your vocal recordings and analysis results
• Your performance metrics and progress over time
• Your vocal range and voice type
• Exercise completion status and success rates
• Practice frequency and engagement patterns
• Messages exchanged with the teacher

5.2 What Teachers Can Do

• Assign exercises and set visibility for individual students
• Send messages, reminders, and recognition
• View recordings and provide feedback
• Organize students using tags and groups
• Access "student view" to see the platform as you see it

5.3 Privacy Protections

• Teachers cannot see data from students not linked to their account
• Teachers must have a student's exact email address to add them; the student receives an email verification before being linked
• Your data is not shared with other students

6. Public Teacher Profiles

Teachers can create public profiles visible to anyone on the internet.

6.1 Information That May Be Public

When a teacher enables their public profile, the following may be visible:

• Name and profile picture
• Profile tagline and bio
• Location (city/region)
• Teaching experience and credentials
• Specializations and student levels taught
• Studio type and availability
• Rates and booking information
• Contact information (if provided)
• Website and social media links
• Voice sample recordings
• Video introduction
• Recent custom exercises (up to 6)

6.2 Information That Is Never Public

• Student roster and student data
• Student analytics and recordings
• Private messages
• Payment and subscription information

7. Third-Party Services

7.1 YouTube Integration

EchoVQ allows you to create exercises from YouTube videos. When you use this feature:

• You provide a YouTube video URL
• We extract video metadata (title, channel, thumbnail, duration)
• We download and process the audio to separate vocals from instrumentals
• The original YouTube video remains on YouTube's servers

This feature requires YouTube authentication via our Chrome Extension (see Section 8).

7.2 External Embeds and Links

Teacher profiles may include:

• Embedded YouTube or Vimeo videos
• Links to external booking services (Calendly, Acuity)
• Links to personal websites and social media

These external services have their own privacy policies.

7.3 Google OAuth

If you sign in with Google, we receive:

• Your email address
• Your name
• Your profile picture

We use PKCE (Proof Key for Code Exchange) for secure authentication.

8. Chrome Extension (EchoVQ YouTube Connector)

Our Chrome Extension enables YouTube integration for song exercises.

8.1 What the Extension Does

• Only activates when you explicitly click to connect YouTube
• Collects YouTube and Google authentication cookies from your browser
• Sends these cookies (encrypted) to EchoVQ to enable video downloads
• Displays connection status

8.2 Permissions Required

• Cookies: Access to YouTube.com and Google.com cookies
• Storage: Local storage for extension state
• Host permissions: youtube.com, google.com, echovq.com

8.3 Data Handling

• Cookies are encrypted using Fernet (AES-128) before transmission
• Credentials are stored per-user on EchoVQ servers
• Credentials automatically expire after 24 hours
• You can disconnect at any time from your account settings
• Disconnecting immediately deletes your stored YouTube credentials

8.4 What the Extension Does NOT Do

• Track your browsing history or activity
• Access any data outside the connection process
• Run in the background when not in use
• Collect data from other websites

9. Data Security

We implement industry-standard security measures to protect your data:

• Password security: All passwords are hashed using secure algorithms with Django's password validators
• Encryption: YouTube credentials encrypted with Fernet (AES-128); payment data hashed with SHA-256
• Transport security: HTTPS encryption for all data transmission
• Cookie security: HTTPOnly and SameSite=Lax flags on session cookies
• CSRF protection: Protection against cross-site request forgery attacks
• Access controls: Role-based permissions for teachers, students, and administrators
• Audit logging: Session switch audits track when teachers access student views

10. Data Retention

10.1 Active Accounts

• Account data: Retained while your account is active
• Voice recordings: Retained while your account is active
• Practice history: Retained indefinitely to show progress over time
• Messages: Retained while accounts are active

10.2 After Account Deletion

• Account data: Retained for 90 days to allow for account recovery, then deleted
• Voice recordings: Deleted with account
• Payment records: Retained as required for tax and legal compliance

10.3 Subscription Cancellation

If you cancel your subscription but keep your account, your data (students, exercises, analytics) is preserved. You can resubscribe at any time without losing your history.

10.4 Soft Deletion

When exercises are removed or unassigned, historical practice data is preserved using soft-delete to maintain your complete practice history.

10.5 Anonymized Research Data

Anonymized vocal analysis data (stripped of all personally identifiable information) may be retained indefinitely for academic research on vocal training effectiveness.

10.6 YouTube Credentials

Automatically expire and are deleted after 24 hours.

11. Cookies and Browser Storage

11.1 Essential Cookies

• Session cookies: Maintain your login state (expire when browser closes or after 2 weeks if remembered)
• CSRF tokens: Protect against cross-site request forgery

11.2 Browser Storage

• localStorage: Authentication tokens for API access
• sessionStorage: Temporary session data

11.3 No Third-Party Analytics Cookies

We do not use third-party analytics services like Google Analytics, Hotjar, or Mixpanel. We only track internal metrics necessary for service operation.

12. Your Rights

12.1 All Users

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update inaccurate information via your account settings
• Deletion: Request deletion of your account and associated data
• Withdraw consent: Opt out of optional data collection
• Disconnect services: Remove YouTube integration at any time

12.2 European Union Residents (GDPR)

Under the General Data Protection Regulation, EU residents have additional rights:

• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

Our legal basis for processing includes: contract performance, legitimate interests, and consent.

12.3 California Residents (CCPA)

California residents have the right to:

• Know what personal information is collected
• Request deletion of personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising privacy rights

12.4 Australian Residents

We comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached your privacy rights.

13. Children's Privacy

EchoVQ may be used by children under 13 in educational contexts.

13.1 When Children May Use EchoVQ

• A teacher invites them through an educational institution
• A parent or guardian creates and manages their account

13.2 Parental Consent

For users under 13 (or 16 in the EU):

• Parental or guardian consent is required for account creation
• Parents can review, modify, or delete their child's information by contacting us
• We collect only information necessary for the educational service

13.3 COPPA Compliance (United States)

We comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13 without verifiable parental consent.

13.4 Teacher Responsibility

Teachers who add student accounts represent and warrant that they have obtained all necessary parental or guardian consent for students under the applicable age threshold in their jurisdiction.

13.5 Limited Data Collection for Children

For accounts identified as belonging to children under 13:

• We collect only information necessary for the vocal training service
• We do not use children's data for marketing purposes
• We do not enable public profiles for children

14. International Data Transfers

EchoVQ is operated by ECHO VQ PTY LTD in Australia. Your information may be transferred to and processed in countries other than your own, including:

• Australia: Our primary operations
• United States: Cloud services (AWS), payment processing (Stripe), AI services (OpenAI)

We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where required by GDPR.

15. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by:

• Posting the new policy on this page with an updated "Last Updated" date
• Sending an email notification for material changes
• Displaying a notice in the application

Your continued use of EchoVQ after changes constitutes acceptance of the updated policy.

16. Contact Us

For privacy-related inquiries, data requests, or concerns:

• Email: [email protected]
• Support: [email protected]
• Company: ECHO VQ PTY LTD
• Country: Australia

We aim to respond to all privacy requests within 30 days.

---

Summary of Data Practices

Browser Permissions Required