Privacy Policy

This policy explains how CueFlip for iPhone and iPad handles your information, and what this website does. CueFlip’s core score-reading, audio, annotation and performance features run on your device and do not send their data to us. The optional referral programme uses this website for invitation verification, points and reward delivery as described in section 8a. If a page turns at the wrong moment, you can choose to send us a report of that performance, as described in section 8b.

CueFlip is made by CueFlip Team (“we”, “us”). Where this policy describes information we actually receive — including what Apple passes on, what you send us by email, what you choose to tell us in the survey, the limited identifiers used by the referral programme, and the page-turn reports you choose to send — we are the data controller for the purposes of the UK and EU General Data Protection Regulation.

1. What stays on your device

Everything CueFlip creates or imports is written to the app’s private container on your device. None of it is transmitted to us unless you choose to send a page-turn report (section 8b), and the app itself never sends anything to us.

• Rehearsal recordings. When you teach CueFlip a piece, it records you playing it and keeps that recording so the app can rebuild its acoustic model later.
• Acoustic features. The numerical fingerprint the app derives from your recording in order to follow along.
• Score PDFs and page thumbnails, copied into the app when you import them.
• Your annotations, including anything you draw with Apple Pencil.
• Your page-turn markings, performance history, and app settings.
• Performance records. While you perform, CueFlip keeps a record of what the microphone heard and how the app followed you and turned the pages, so that you can send it to us if something went wrong. Each record is encrypted as it is written, so that only the CueFlip team can open it — not you, and not CueFlip itself once the performance is over. Records are deleted 7 days after the performance (sooner, oldest first, if together they pass 3 GB) and when their score is deleted for good; they are not included in backups.

The rest of this data is included in your encrypted iPhone or iPad backup if you make one. Deleting the app deletes all of it from the device. We hold no copy and cannot recover it for you.

2. Microphone

CueFlip needs the microphone for its central function: hearing you play, so it can find your place in the score and turn the page at the right moment.

• The microphone is used only while you are recording a rehearsal or running a performance. It is not used in the background, and not while the app is closed.
• Audio captured during a performance is analysed as it arrives. It is also written, encrypted, into that performance’s record (section 1), which stays on your device and is deleted after 7 days.
• The rehearsal recording you deliberately make is saved on your device, and only there.
• No audio leaves your device unless you send it yourself, by sending a page-turn report (section 8b). CueFlip performs no speech recognition and sends nothing to any cloud audio service.

3. Subscriptions

CueFlip offers optional auto-renewing subscriptions. They are sold and administered entirely by Apple.

• Apple handles payment. We never see your card details, billing address, Apple Account, name or email.
• The app checks whether you are subscribed by asking Apple’s on-device StoreKit framework. That subscription check makes no request to CueFlip’s website or referral service and produces no subscription-status record we can see.
• Apple provides us with anonymised, aggregated sales reports, as it does for every developer. These show units and revenue, never the identity of a purchaser.
• Refunds are handled by Apple at reportaproblem.apple.com.

4. Sharing with a nearby device

CueFlip can share Apple Pencil annotations live with another iPad in the same room, so that people can rehearse from the same markings.

• The connection is made directly between the two devices over your local network. It does not pass through our servers and needs no internet connection.
• It happens only when you deliberately pair with someone using a one-time code, and only for as long as you keep the session open.
• What is exchanged is the ink itself, plus a device-generated public key and the display name and colour that identify you in the session.
• Please note the default display name. Unless you change it, CueFlip uses your device’s own name, which on many devices is something like “Anna’s iPad” and therefore contains your name. It is shown to whoever you pair with. You can change it in the app before you pair.
• We receive nothing from this feature whatsoever.

4a. iCloud sync

If you turn it on in Settings, CueFlip Pro can keep your library in step across your own iPhone and iPad using iCloud. It is off until you switch it on, and you can switch it off again at any time.

• Where it goes. Only to your own private iCloud database, in a CloudKit container that belongs to CueFlip but is readable only through your Apple Account. It does not pass through any CueFlip server (there is none), and we cannot see, read or recover it.
• What is synced. Per score: the PDF, the rehearsal recording and its acoustic features, your annotations and layers, page-turn markings, performance history and the score’s settings. Also your folders. Page-turn performance records (section 8b), thumbnails and the app’s own tutorial score are not synced.
• Conflicts and deletion. If two devices change the same part of a score, the app keeps both versions rather than dropping one. A score you delete on one device moves to the Trash on your others, where it stays for 30 days.
• Turning it off stops syncing and leaves the library on each device untouched. Data already in iCloud is kept and managed by Apple; you can remove it in iOS Settings under iCloud. Apple’s own handling of iCloud data is described in Apple’s privacy policy.
• We receive nothing from this feature whatsoever.

5. What we never do

These promises are about the app. The one exception on this website, for visits that arrive from our own ads, is described in section 8c.

• No analytics or telemetry. CueFlip does not report your usage to us, on any schedule, in any form. A page-turn report reaches us only when you send one yourself.
• No third-party SDKs. The app bundles no advertising, analytics, attribution or crash-reporting libraries. Its only dependencies are Apple’s own frameworks.
• No advertising identifier. CueFlip does not use the IDFA and never presents an App Tracking Transparency prompt, because it does not track you.
• The app does no tracking across other companies’ apps or websites, and no profiling.
• The app does not sell or share personal information, as those terms are defined by the California Consumer Privacy Act. We have never done it and the app has no mechanism to.
• No accounts. CueFlip asks for no registration, no username, no password, no email address. The email fields of the survey and of the report page are optional, are on the website rather than in the app, and are not accounts.

6. What Apple gives us

Separate from the optional website features described below, distributing through the App Store means Apple passes a small amount of information to us. We want to be precise about that rather than claim we receive literally nothing.

• Crash and energy diagnostics. If you have switched on Share with App Developers in iOS Settings → Privacy & Security → Analytics & Improvements, Apple may give us crash logs and performance measurements for CueFlip. Apple collects these, not us; they are aggregated and, per Apple, not identifiable to you. You can turn this off for every app in that same iOS setting.
• Aggregated App Store statistics — downloads, retention, and territory-level counts — which Apple shows us in App Store Connect. These are aggregates and never identify a person.
• Ratings and reviews you choose to write publicly on the App Store, under whatever nickname you chose there.

All of the above is collected and processed by Apple under the Apple Privacy Policy. We only see what Apple decides to show developers.

7. If you email us

Writing to us is one way information about you reaches us directly. The others are the optional survey, referral programme and page-turn reports described below.

• We receive your email address, whatever you write, and anything you attach. Please do not send anything you would rather we did not have.
• We use it solely to answer you, and to fix the problem you report.
• Legal basis (GDPR): our legitimate interest in responding to correspondence, Art. 6(1)(f), and where you are a customer, performance of a contract, Art. 6(1)(b).
• Processors. Mail to our cueflip.com addresses is received by Cloudflare’s Email Routing service, which forwards it to our mailbox hosted by Google (Gmail). Google stores the message on its infrastructure and may process it outside your country. Cloudflare and Google act as our processors and apply the Standard Contractual Clauses to such transfers.
• Retention. Support correspondence is deleted within 24 months, or sooner if you ask us to delete it.

8. The survey on this website

This website hosts an optional survey at cueflip.pages.dev/survey, asking what you play and how CueFlip is working for you. It is a page on this site, not a feature of the app: the app contains a link to it, and nothing is sent unless you open that page, fill it in, and press Send.

• What is stored. Only your answers, the language you filled the form in, whether you arrived from the app, the app version if you did, and the date and time.
• What is not stored. No IP address, no User‑Agent, no country, no cookie, no advertising or device identifier, and no account. The survey sets no cookies and loads nothing from a third party. Nothing in a stored answer can be linked back to you, to your device, or to any other answer.
• Keeping it from being flooded. So that the survey cannot be filled with automated submissions, the endpoint counts how many have arrived recently from the same connection. It does that against a salted, shortened digest of the sending IP address — never the address itself, which is not written down anywhere. Those counters live in a separate table that holds no answers, share no column with them, and are deleted within two hours. Nothing in a stored answer is affected by this, and nothing in the counters can be joined back to one.
• Your email address is optional and the form works fully without it. If you provide one, it is used only to reply to that submission. It is never added to a mailing list, and you will not be sent anything else.
• Where it is stored. In a Cloudflare D1 database, on Cloudflare’s infrastructure. Cloudflare acts as our processor and applies the Standard Contractual Clauses to any transfer outside your country. Access to it is limited to us.
• Legal basis (GDPR): your consent, Art. 6(1)(a), given by choosing to submit the form. Because we hold nothing that identifies who submitted an answer, we cannot single out and delete one anonymous submission after the fact — but if you left an email address, write to us and we will delete that submission.
• Retention. Answers are kept while they are still useful for deciding what to build, and no longer than 24 months. Email addresses are removed as soon as the reply is sent.

Like every page here, this website is served by Cloudflare Pages, which processes request metadata such as IP addresses transiently for security and to deliver the page. That happens on any website you visit, we do not receive it, and it is described in the Cloudflare Privacy Policy.

8a. Referral programme on this website

CueFlip’s optional referral programme uses this website to verify invitations, keep a points balance, and deliver App Store reward links. When you verify an invitation, Safari opens CueFlip with a one-time token. CueFlip returns a signed proof together with an Apple-signed App Store transaction record so the website can distinguish a genuine App Store download from a fabricated referral.

• What is stored for an invitation. We store the inviter’s device-generated referral identifier, the verified recipient’s device-generated identifier, a random one-time invitation token, verification timestamps, and a SHA-256 digest of Apple’s stable app-transaction identifier. The digest is used only to prevent the same App Store download from earning referral credit more than once. We do not receive or store your Apple Account name, email address, password, payment information, advertising identifier, or hardware serial number.
• What is stored for points and rewards. Points are calculated from the number of verified invitations. When points are spent, we store the reward selected, the number of points spent, the App Store offer reference used, the issue time, and the short redemption-link token. We do not store the Apple offer-code value in the referral record itself; offer-code inventory is maintained separately in the same reward database.
• What is processed but not retained with a referral claim. During verification the website receives the recipient’s public key, Ed25519 signature, Apple-signed AppTransaction JWS, and StoreKit device-verification identifier long enough to validate the request. The public key, signature, JWS and device-verification identifier are not written to the referral claim.
• Abuse prevention. The public invitation endpoint keeps short-lived rate-limit counters keyed by a shortened SHA-256 digest of the requesting IP address; the raw address is not stored in those counters and expired counters are deleted automatically. Pending invitation tokens expire after 30 days.
• Reward-link visits. A reward link at /r/<token> is logged so we can distinguish a real open from automated link-preview crawlers and investigate abuse. Those visit logs can contain the request time, IP address, User-Agent string, Cloudflare country code, token, and outcome. The logs do not contain your scores, audio, annotations, contacts, or library contents.
• What is never sent. No score, PDF, annotation, recording, microphone audio, performance history, library contents, contact list, or device name is part of referral verification or reward redemption.
• Retention. Successful referral claims and reward-spend records are retained while the programme operates so earned points remain correct and duplicate credit can be prevented. Expired pending tokens and rate-limit counters are periodically removed. Redemption visit logs are retained only for operating and securing the reward system.
• Where it is stored. Referral and reward records are stored in a Cloudflare D1 database on Cloudflare’s infrastructure. Cloudflare acts as our processor.
• Legal basis (GDPR). Where applicable, our legitimate interest in administering and securing the optional referral programme, Art. 6(1)(f), and performance of the referral offer when you choose to participate, Art. 6(1)(b).

8b. Page-turn reports

If CueFlip turns a page at the wrong moment, you can send us a report of that performance from the app (in the reader, ··· → Report a Page-Turn Problem), so that we can find out what went wrong and fix it. Sending one is entirely your choice, and the app itself sends nothing: it saves the report as a file, and you either upload that file on this website at cueflip.com/report or email it to us.

• What a report contains. For the performances you choose: the sound the microphone picked up, and a detailed log of how CueFlip followed you and turned the pages. With them, the recording you taught CueFlip the piece with and what it learned from it, the score’s name and its page-turn marks, and your device model, system and app versions, battery level, and the time. A report does not contain the score’s PDF, your annotations, or anything from other scores.
• Encrypted before it leaves your device. The app seals the report to a key that only the CueFlip team holds, before you ever see the file. This website stores it without being able to open it, and so does Cloudflare; a copy intercepted on the way, or taken from storage, is unreadable.
• What the website stores. The encrypted report, when it arrived and how large it is, and only what you add on the upload page: an optional email address, an optional description of what went wrong, the language of the page, and the app version the link carried. No IP address, User‑Agent or country is stored with a report. So that the upload cannot be abused, the website counts recent uploads from the same connection against a salted, shortened digest of its IP address, in the same counters the survey uses (section 8), deleted within two hours.
• What we use it for. Only to find out why page turning went wrong and to improve it. A report is never shared with anyone else. If you left an email address, it is used only to write to you about that report.
• Retention. We delete a report as soon as we have looked into it, and a rule on the storage deletes every report, with what you added to it, 90 days after it arrived at the latest. An upload you cancel or abandon is discarded within a day. If you email a report instead, we delete the message within the same 90 days.
• Where it is stored. In a private Cloudflare R2 bucket, on Cloudflare’s infrastructure, reachable only by us. Cloudflare acts as our processor and applies the Standard Contractual Clauses to any transfer outside your country. A report you email reaches us as described in section 7.
• Legal basis (GDPR): your consent, Art. 6(1)(a), given by choosing to send the report. You can withdraw it at any time: write to us with the reference the upload page showed you, or from the address you left with the report, and we will delete it.

8c. Ads on this website

We advertise CueFlip, including on Instagram. This section covers only a visit that arrives from one of our own ads, that is, from a link carrying campaign parameters (for example utm_source or Meta’s click identifier fbclid). Any other visit to this website is not measured: the page makes no request to our measurement service, stores nothing in your browser and loads nothing from Meta. The survey, the referral invitation and the page-turn report pages are never measured, whatever brought you to them. The app does none of this.

• What we record about the visit. Which ad, campaign and placement the link named; the pages you viewed; how long the page was visible; how far you scrolled; which parts of the page you saw; which links and buttons you tapped (their destination or label, never anything you type), including the App Store link; script errors and page-speed measurements; your country and region code, taken by Cloudflare from the request; your device type, operating system version, browser, and whether you came through an in-app browser such as Instagram’s; your screen size, language and time zone; and a random visit identifier made in your browser. We do not store your IP address or your User‑Agent text.
• The App Store link. A tap on it goes through this website, which counts the tap and then sends you to the App Store with a campaign tag on the address. Apple reports downloads and purchases back to us, in aggregate, by that tag. That tells us which ad brought a download, not who you are; we cannot connect one person’s download to one person’s visit, and the app reports nothing back.
• Your choice. In the European Economic Area, the United Kingdom and Switzerland we ask first. Until you accept, the visit is counted without any identifier: nothing is stored in your browser, no cookie is set, nothing is sent to Meta. Elsewhere this section and the “Privacy choices” link at the foot of the page are the notice, and you can turn the measurement off there. A Global Privacy Control signal from your browser is treated as a refusal everywhere. Refusing, or turning it off, deletes the identifier described next.
• If you accept, or have not opted out where no opt-in is needed. Your browser stores a random returning-visitor identifier (until you clear site data) and keeps the visit’s details for the life of the tab. We load the Meta Pixel, which sets the cookies _fbp and _fbc and tells Meta when you view the page and tap the App Store link; and our server tells Meta the same events through its Conversions API, with your IP address, your browser’s User‑Agent, and your country and the identifier (both hashed), so that Meta can match them to an account. Meta uses this to measure our ads and to show them to people likely to be interested, under its own privacy policy; Meta decides, as a controller in its own right, what it does with the data it receives. We have switched off the Pixel’s automatic matching of form fields and button text. This is the one place this website shares information about a visit with an advertising company; the California Consumer Privacy Act calls it “sharing”, and the choice above is how you opt out of it.
• Where it is stored. Visit records are kept in a Cloudflare D1 database on Cloudflare’s infrastructure, where Cloudflare acts as our processor. They are deleted after 13 months. Only we can read them.
• Legal basis (GDPR). Your consent, Art. 6(1)(a), for anything stored in or read from your browser and for what is sent to Meta (which also meets the ePrivacy rules); you can withdraw it at any time with the footer link. For the identifier-free count of visits, our legitimate interest in knowing whether our advertising works, Art. 6(1)(f).
• Seeing or deleting a record. A visit record is tied to a random identifier, not to your name. If you want it deleted, email us the value stored as cueflip.uid in your browser’s site data for this website (if you have one); without it we cannot tell which record is yours, and the records delete themselves after 13 months.

9. Permissions you control

Both can be granted or revoked at any time in iOS Settings → Privacy & Security. CueFlip requests no access to your contacts, photos, calendar, location, health data, or files outside the ones you explicitly pick when importing a score.

10. Children

CueFlip is a tool for musicians and is not directed at children under 13 (or the equivalent minimum age in your country). Its core score, audio, annotation and performance features do not send their data to us. The optional website features can receive a survey email address, the pseudonymous referral information, or a page-turn report described above when those features are deliberately used. If you believe a child has sent us personal information through the website or by email, contact us and we will delete it where we can identify the relevant record.

11. Your rights

If you are in the European Economic Area, the United Kingdom, Switzerland, California, or another jurisdiction with comparable law, you have rights over personal data we hold about you: access, correction, deletion, restriction, objection, and portability, and the right not to be discriminated against for exercising them.

In practice this is narrow. The identifiable information we may hold is the correspondence described in section 7, any email address left with a survey answer, the pseudonymous identifiers used by the referral programme, and a page-turn report you sent, with whatever you added to it. Email us and we will act on a valid request within 30 days, free of charge. Your scores, recordings, annotations and performance data remain on your device unless you send a report, and there they are entirely under your control:

• To see or export the data stored by the app: use the export function in the app’s settings.
• To delete the data stored by the app: delete the app. Everything the app created on that device goes with it.
• For website records: email us. For a referral record, include the referral link or device-generated referral identifier if you still have it so we can locate the pseudonymous record without guessing who you are.

If you are in the EEA or UK and believe we have mishandled your data, you may complain to your national supervisory authority.

12. Changes and contact

If we change this policy in a way that materially affects you, we will update the date at the top of this page. If a future version of CueFlip begins collecting a new category of data from the core app, we will update this policy and obtain consent where the law requires it; it will not start quietly.

Questions about privacy, or about this policy:

[email protected]