Privacy Policy

This Privacy Policy explains what information Manuscript (the "Service") collects, how we use and store it, and the choices you have. It applies to your use of the Service and should be read together with our Terms of Service.

Emir Ahmed, sole trader is the operator of the Service and the "data controller" of the personal data described here for the purposes of the EU General Data Protection Regulation ("GDPR") and equivalent laws. You can reach us about privacy at privacy@manuscript.video.

We collect only what we need to provide the Service:

• Account information from Google Sign-In. When you sign in with Google, we receive your name, email address, profile photo, and a Google account identifier. We do not receive your Google password.
• Content you upload. The music scores (MusicXML, MXL, MEI), audio recordings, background images, and project settings you create or upload to the Service.
• Authentication cookie. A secure, httpOnly session cookie that keeps you signed in. It is strictly necessary for the Service to function.
• Billing information. If you subscribe to a paid plan, we keep your subscription status, plan, and a customer identifier issued by Stripe, our payment processor, along with limited billing details such as your billing history. Your card details are collected by Stripe directly and never touch our servers.
• Basic technical data. Standard server and infrastructure logs (such as IP address and request metadata) generated by our hosting and Google/Firebase providers for security and reliability.

We do not use third-party advertising or analytics trackers, and we do not sell your personal information.

We use the information above to:

• Authenticate you and keep your account secure.
• Store your projects and render, sync, and stream your score and audio back to your browser.
• Process payments and manage your subscription, through our payment processor Stripe.
• Operate, maintain, debug, and improve the Service.
• Communicate with you about the Service, including responding to your requests.
• Comply with the law and enforce our Terms, including responding to copyright notices.

Video export is performed entirely in your browser; exported videos are not transmitted to or stored on our servers.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google account data only to provide and improve the sign-in and account features of the Service, do not transfer it except as needed to provide the Service or as required by law, and do not use it for advertising.

Your account data and uploaded files are stored using Google Firebase (Firebase Authentication, Cloud Firestore, and Cloud Storage), acting as our processor under Google's data-processing terms. Billing data is processed by Stripe as our payment processor under its data-processing terms; on our side we store only your subscription status and Stripe customer identifier. We configure our database and file storage in the European Economic Area (EEA) where available. Some data — in particular authentication data managed by Google — may be processed by Google outside the EEA; see "International Transfers" below. Files are served back to you through access-controlled endpoints tied to your account.

We use reasonable technical and organizational measures to protect your information, including encrypted connections and authentication-scoped access. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We do not sell your personal information. We share it only:

• With service providers that operate our infrastructure (notably Google/Firebase) so they can host authentication, data, and files on our behalf.
• With Stripe, our payment processor, so it can process subscription payments and manage billing on our behalf.
• When required by law, legal process, or a valid government or copyright request.
• To protect the rights, safety, and security of the Service, our users, or the public.
• In connection with a merger, acquisition, or sale of assets, subject to this Policy.

We retain your account information and uploaded content for as long as your account is active or as needed to provide the Service. When you delete a project or your account, we delete the associated content, though residual copies may persist transiently or in routine backups for a limited period before being overwritten.

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — to authenticate you, store your projects, and render and return your score and audio (i.e., to provide the Service you signed up for).
• Legitimate interests — to operate, secure, debug, and improve the Service, and to prevent abuse, balanced against your rights.
• Legal obligation — to respond to lawful requests and copyright notices and to comply with applicable law.
• Consent — where we ask for it; you can withdraw consent at any time without affecting prior processing.

If the GDPR (or a similar law) applies to you, you have the right to access your personal data; to have it corrected or erased; to restrict or object to its processing; to data portability; and, where processing is based on consent, to withdraw that consent. You can delete your projects at any time within the Service, and you can request access to or deletion of your account and associated data by contacting us at privacy@manuscript.video. You may also revoke the Service's access to your Google account through your Google account settings.

We will respond to your request within the time required by law. If you believe we have not handled your personal data properly, you have the right to lodge a complaint with your local data-protection supervisory authority, though we'd appreciate the chance to address your concern first.

We aim to keep your data within the European Economic Area (EEA). However, some of our providers — in particular Google/Firebase and Stripe — are established in the United States and may process certain data (such as authentication or billing data) outside the EEA. Where personal data is transferred outside the EEA, we rely on appropriate safeguards, such as the European Commission's adequacy decisions (including the EU–U.S. Data Privacy Framework) and/or Standard Contractual Clauses, as reflected in our providers' data-processing terms.

The Service is not directed to young children. Under the GDPR, the age of digital consent is 16, unless your EU member state has set a lower age (no lower than 13). We do not knowingly collect personal data from children below the applicable age without parental consent. If you believe a child has provided us personal data, contact us at privacy@manuscript.video and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, take reasonable steps to notify you. Your continued use of the Service after the changes take effect constitutes acceptance of the revised Policy.

Questions about this Privacy Policy or your data can be sent to privacy@manuscript.video, or to support@manuscript.video for general support.