Privacy Policy
Last updated: 14 October 2026
Perfect Pitch is a singing and ear-training app for iPhone, iPad and the web (www.myperfectpitch.app), operated by Aya Labs B.V., Reinwardtstraat 70, 1093 HL Amsterdam, the Netherlands ("we", "us"). This policy explains what personal data we collect when you use Perfect Pitch, why we collect it, who we share it with, how long we keep it, and the choices you have. Aya Labs B.V. is the data controller. You can reach us at hello@ayalabs.xyz.
Data we collect
- Account data. You can use Perfect Pitch as a guest. If you create an account we store your email address, the name you give us, and how you signed in (email and password, an email sign-in link, Sign in with Apple, or Sign in with Google). Users in child mode cannot create an account (see Children).
- Data from Google when you use "Continue with Google". We receive your name, email address and profile picture from your Google Account. We request only the basic
emailandprofilepermissions. We do not get access to your Gmail, contacts, Drive, calendar or any other Google data. - Profile and learning data. Your singing goal, how often you want to practise, your age group (you type your age during setup and we keep only the group it falls in, such as 13 to 17), your voice type and vocal range, completed lessons, the results of each exercise, scores, experience points, streaks and settings such as language and time zone. If the app has trouble hearing your microphone, we record technical details about the problem (for example the signal level and the audio device in use) so that we can fix it.
- Microphone audio. Singing exercises use your microphone, with your permission. Your voice is analysed in real time on your own device to detect pitch. We do not upload or store recordings of your singing; only the results (for example the notes you reached and your score) are saved.
- Purchase data. If you subscribe, we store your subscription status, plan, the price you paid, the store you bought through, trial, purchase and renewal dates, and the purchase and transaction identifiers. Payments are handled by Apple (in the iOS app) or, on the website, by RevenueCat and Stripe, which receive your email address to process the purchase. We never see or store your full card number. In the iOS app, when our subscription screen is shown through Superwall, Superwall also receives your subscription status, your App Store country and the App Store purchase records for Perfect Pitch on your device, whether or not you subscribe. Superwall receives no data from users in child mode, apart from the one exception described under Superwall in the iOS app.
- Usage and device data. Your IP address, screens you open, buttons you use, errors, approximate location derived from your IP address (country or city), device type, operating system, browser and language. In the iOS app this includes technical information about the app's network requests, and taps that get no response or are repeated quickly. Amplitude, our analytics provider, receives this usage data together with your user ID and some profile details, such as your vocal range, your goal and whether you have Pro. On the website, in the EEA, the UK and Switzerland, Amplitude receives it only if you allow analytics (see Cookies). From version 1.5.8 of the iOS app, and on the website, our apps do not send Amplitude your name, your email address or your age (see What earlier versions sent).
- Superwall in the iOS app. When the subscription screen during setup is shown through Superwall, Superwall also receives a device identifier, an identifier it creates itself, your user ID in the app, your IP address (from which it estimates your city, region and country) and device information such as model, language, currency, time zone and whether notifications are turned off. It also learns when you open the app and how you use the subscription screen (for example opening or closing it, and starting, completing, failing or restoring a purchase, including a purchase that is waiting for a parent's approval through Ask to Buy). This starts shortly before the subscription screen, so it can also happen if you leave before you see it. Superwall does not receive your age, and it receives nothing from users in child mode. The one exception: if Superwall had already started on a device before child mode began there, then until the app is fully closed it can still send Superwall the device identifier with device information, and once the App Store purchase records on that device, but never the user ID.
- Session recordings and crash reports. Amplitude can record how the app's screens are used in a session (taps, scrolling and what the screen showed) so that we can find and fix problems. In the iOS app it records a random 10% of sessions, starting when the app opens. On the website it records sessions only if analytics is allowed under your cookie choice (see Cookies), and it hides what you type into forms. Amplitude never records sessions in child mode: if you tell us during setup that you are under 13, recording stops at that moment. If the iOS app crashes, Firebase Crashlytics sends us a technical crash report with details such as the device model, system version and app version. It can include our internal ID for your account, but not your name, email address or age.
- Advertising data. If you arrive from an ad, we record the campaign information contained in the link (for example UTM parameters, or a Google, TikTok or Meta click ID) so we can measure which ads work. In the iOS app, if you installed Perfect Pitch from an Apple Search Ads ad, RevenueCat receives the campaign, ad group and keyword of that ad from Apple for the same purpose.
- Notifications. If you allow notifications, we store a push token for your device or browser so that we can send you reminders and messages about your practice, your trial or subscription, and offers. In the iOS app they are delivered by Apple's push notification service, and on the web by your browser's push service. The iOS app also schedules some reminders on your device itself. You can turn notifications off at any time in your device or browser settings.
- Email delivery. When we email you, our email provider tells us whether the email was delivered, bounced or was reported as spam, and we note in our analytics (Amplitude) that we sent you an email or notification. Our servers make this note, so it is also made if you did not allow analytics on the website. It is never made for users in child mode, once their answer has reached our servers. We do not track whether you open our emails. Links to our subscription page are marked as coming from an email, so our analytics can see that a visit or purchase started from an email.
- Your voice report email. On the website you can leave your email address to get your voice report. We store it, and we also send you a five day singing course and emails about Perfect Pitch Pro, unless you unsubscribe.
- Referrals. If you invite a friend or use an invitation, we record the invitation code and the accounts it connects, so that we can give the reward.
- Messages. Anything you send us by email or through in-app feedback, including a screenshot if you attach one, and the device and app version the feedback came from.
- What earlier versions sent. Version 1.5.7 and earlier versions of the iOS app, and earlier versions of our website, sent your email address and the age you typed to Amplitude, and your age group to RevenueCat. Those versions of the iOS app also sent Amplitude the name on your account when you signed up or signed in with an email address or with Apple, and their session recordings could show the name and email address displayed in Settings. Session recordings made by earlier versions of our website could show the name and email address in Settings and the answer to the age question. Our website also sent your email address to Mixpanel (see How long we keep data). Until 14 October 2026, RevenueCat also passed the details it held to Amplitude with records of purchases and subscription events, so your age group, and the email address you gave when paying on the website, could reach Amplitude that way. RevenueCat no longer sends anything to Amplitude. We are removing the age and age group that our apps set on Amplitude profiles, and the age group from RevenueCat. From version 1.5.8, the iOS app removes your name, email address, age and age group from your Amplitude profile when you open it, including the copies of your age group and email address that RevenueCat passed on. If you do not open version 1.5.8 or later of the iOS app, for example because you use only the website, a name or email address that earlier versions or RevenueCat put on your Amplitude profile stays there until that profile is deleted; you can ask us to remove it sooner. We ask Amplitude to delete all data of users who told us they are under 13, once their answer has reached our servers. Amplitude cannot change past events, so older Amplitude events and session recordings of other users can still contain this data until they are deleted (see How long we keep data).
How we use your data
- To provide the app: create and secure your account or guest profile, save your progress and sync it between your devices.
- To personalise lessons to your voice type, range, goal and age group (for example, to suggest a comfortable starting range).
- To process subscriptions and free trials and to give you access to paid features.
- To understand how the app is used, fix problems and improve lessons.
- To measure the performance of our advertising.
- To send service emails and notifications (for example sign-in links, password resets, trial and renewal reminders and payment problems) and, unless you have unsubscribed or turned notifications off, emails and notifications about your practice and offers for Perfect Pitch Pro, such as discounts. We choose these offers based on your subscription history and how you use the app, for example after you close the subscription screen or after a subscription has ended. Users in child mode get no offers, once their answer has reached our servers.
- To answer your support requests and to meet legal obligations.
Google user data (your name, email address and profile picture) is used to create your Perfect Pitch account, sign you in, show your name in the app, and send you the emails described in this policy. We do not use it for advertising and we do not sell it. We share it only with these service providers: Supabase (database and sign-in), Resend (sending emails), and RevenueCat and Stripe (your email address, when you buy on the website). From version 1.5.8 of the iOS app, and on the website, we do not send it to Amplitude or to any other analytics or advertising provider; for earlier versions, see What earlier versions sent. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Legal bases (EEA and UK)
- Contract: creating your account or guest profile, saving and syncing your progress, providing lessons and paid features, processing purchases, and sending messages that belong to your subscription, such as trial, renewal and payment reminders.
- Legitimate interests: keeping the service secure and preventing fraud; understanding how the app is used and fixing problems (usage analytics in the iOS app and on our servers, page speed measurement on the website, session recordings in the iOS app, crash reports and microphone diagnostics); showing and improving the subscription screen (Superwall); measuring which ads bring new users (including Apple Search Ads attribution); and sending you emails and notifications about your practice and offers for Perfect Pitch Pro. You can object at any time; see Your choices and rights.
- Consent: in the EEA, the UK and Switzerland, analytics and advertising cookies on the website (Amplitude, including its session recordings, Google Analytics and Google Ads); and notifications, which you allow in your device or browser settings.
- Legal obligation: keeping payment and tax records and answering lawful requests from authorities.
Who we share data with
We do not sell your personal data. We share it with the service providers below, which process it on our behalf and only on our instructions, and with a few companies that decide for themselves how they use it: Apple and Google when you sign in with them, Apple when you buy through the App Store, and Google when it measures our ads. Stripe processes card payments on the website for us, and also uses payment data for its own purposes, such as preventing fraud and meeting its legal duties.
| Provider | Purpose |
|---|---|
| Supabase | Database, sign-in, server functions, and hosting of files and lesson videos |
| Apple | Sign in with Apple, App Store purchases, push notifications and Apple Search Ads attribution on iOS |
| Google (Sign in with Google) | Signing you in, if you choose it |
| RevenueCat | Subscriptions, purchase records and checkout on the website |
| Stripe | Card payments on the website. Stripe also uses payment data for its own fraud prevention and legal duties. |
| Superwall (United States) | Showing and testing the subscription screen in the iOS app, not for users in child mode (with one exception) |
| Google Fonts | A font on the subscription screen shown through Superwall in the iOS app |
| Amplitude | Product analytics and session recordings. Our apps send it nothing in child mode (see Children). On the website in the EEA, the UK and Switzerland, it runs only if you allow analytics (see Cookies). |
| Google Firebase (Crashlytics) | Crash reports from the iOS app |
| Google Analytics and Google Ads | Website analytics and advertising measurement (see Cookies) |
| Vercel | Website hosting and measuring how fast pages load (Speed Insights) |
| Resend | Sending emails and telling us whether they were delivered |
| Contentful | Delivering blog posts and their images |
| jsDelivr | Loading the pitch detection model for the Audio to MIDI tool on the website |
| Your browser's push service (for example Google, Apple, Mozilla or Microsoft) | Delivering notifications on the web |
| Mixpanel | Website analytics and session recordings until October 2026. We no longer use it. |
We may also disclose data if required by law, to enforce our Terms of Service, or to prevent fraud and protect the security of the service. If Aya Labs B.V. is involved in a merger or sale, your data may be transferred as part of that transaction.
International transfers
Supabase stores our database in Frankfurt, Germany, and Amplitude stores our analytics data in its EU data centre. Other providers in the table above, such as Superwall, RevenueCat, Firebase, Google, Resend and Vercel, may process data outside the European Economic Area, mainly in the United States. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us at hello@ayalabs.xyz for a copy of the safeguards for a specific provider.
How long we keep data
We keep personal data only for as long as we need it for the purposes in this policy:
| Data | How long |
|---|---|
| Account, profile and learning data | As long as your account exists. When you delete your account, we delete it from our database straight away and from our database backups within 30 days. |
| Guest profiles (no account, including users in child mode who have no account) | We delete a guest profile automatically once it has not been used for 12 months. Opening the app or the web app with it starts the 12 months again. Only what you do counts as use: reminders or other messages we send do not restart the 12 months. The cleanup runs every night, so a guest profile is deleted within a few days after the 12 months end. We delete it the same way as an account: from our database straight away and from our database backups within 30 days, and we ask RevenueCat and Amplitude to delete their data about it. We do not delete a guest profile this way if it has a purchase, a subscription or a free trial, took part in a referral, or if we have an email address for it; we keep those until you ask us to delete them. You can ask us to delete any guest profile at any time. |
| Purchase records | In our database and at RevenueCat: until you delete your account or guest profile. If a website subscription is still renewing when you delete your account, or the RevenueCat record is also linked to another account, RevenueCat keeps that record. Payment records for website purchases in our Stripe account: 7 years after the purchase, because Dutch tax law requires it. Apple keeps its own records of App Store purchases. |
| Usage data in Amplitude | 24 months. When you delete your account, or we delete an unused guest profile, we ask Amplitude to delete all data about you, which Amplitude does within 30 days. For users who tell us they are under 13, we ask for this deletion once their answer has reached our servers. You can also ask us to delete your Amplitude data at any time. |
| Session recordings (Amplitude) | 30 days, unless we save a recording to look into a problem. A saved recording stays until we remove it. |
| Crash reports (Firebase Crashlytics) | 90 days. |
| Data Superwall receives | We have not yet agreed a deletion period with Superwall. Deleting your account does not reach Superwall automatically. Email us and we will ask Superwall to delete the data linked to your account and device. |
| Google Analytics | At most 14 months for data linked to cookies or user IDs. |
| Data Mixpanel collected on our website | We will delete it in Mixpanel by 31 December 2026. You can ask us to delete your data there sooner. |
| Records of the emails and notifications we sent you | As long as your account or guest profile exists. Resend, which sends our emails, keeps its own log of each email for 30 days. |
| The email address you left for your voice report | As long as the guest profile or account it was left with exists, also after you unsubscribe. We have not yet set an automatic deletion period for it; we delete it on request. |
| Unsubscribes and spam complaints | We keep the email address and the reason after you delete your account, for as long as we send emails, so that we never email that address again. |
| Push tokens | Until you delete your account or guest profile. We stop using a token as soon as it stops working. |
| Referral records | The invitation code and the link between the two accounts: until either account is deleted. The record of a reward: kept after either account is deleted. It holds our internal IDs for the two accounts, not a name or email address. We have not yet set an automatic deletion period for it; we delete it on request. |
| Support emails and feedback | 24 months after we receive them. Feedback sent in the app, and any screenshot attached to it, is deleted sooner if you delete your account or we delete your guest profile. You can ask us to delete support emails sooner. |
| Technical logs at our hosting providers (Supabase, Vercel), which include IP addresses | Up to 30 days. |
Your choices and rights
- Withdraw consent at any time where we rely on it, for example under Cookie settings on the website. This does not affect processing that happened before.
- Object at any time to our use of your data for direct marketing, including offers by email and notification: email us and we will stop. You can also object to processing based on our legitimate interests.
- Delete your account at any time from Settings in the iOS app or the web app. A guest profile, including one in child mode, has no delete button: email us and we will help you find it and delete it. Deleting your account does not cancel a subscription; cancel it first (see section 12 of our Terms).
- Access, correct, export or erase your data, or object to or restrict our processing, by emailing hello@ayalabs.xyz. We answer within one month.
- Disconnect Google at any time from your Google Account under Third-party apps and services.
- Sign in with Apple can be stopped for Perfect Pitch at any time in your Apple Account settings, under Sign in with Apple.
- Microphone access can be withdrawn in your device or browser settings.
- Notifications can be turned off at any time in your device or browser settings.
- Emails: every product email has an unsubscribe link.
- You have the right to complain to your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens.
Cookies and similar technologies
The website and web app store a few things in your browser that they need to work: your sign-in, your settings and progress, your cookie choice, and whether child mode is on. These are always on. Two other kinds depend on your choice:
- Analytics: Amplitude's product analytics (which pages and features are used) and its session recordings, and Google Analytics. With analytics allowed, Amplitude and Google Analytics also receive our internal ID for your account, so that we can connect what you do on the website to your account, and ad results to sign-ups and purchases.
- Advertising: Google Ads measurement, which tells us which ads brought visitors, sign-ups and purchases.
In the EEA, the UK and Switzerland, both start off and a banner asks you first. We decide where to show the banner from your device's time zone, and Google also applies this default from its own location lookup. Because the time zone decides, the banner also appears, with both choices off, for European time zones outside these countries (for example in Turkey or Ukraine) and on devices whose time zone names no country, such as UTC. Until you allow analytics, Amplitude does not start: it stores nothing in your browser and receives nothing from the website, and what you did before you allowed it is never sent later. Until you allow analytics or advertising, the website does not load Google's tag at all, so Google receives nothing from it. If your device's time zone is outside Europe while you are in one of these countries, the tag does load, but Google's own location lookup keeps all its storage denied: it sets no cookies and receives only basic signals without cookies or ad click identifiers. Amplitude has no such lookup, so in that case it runs as it does elsewhere until you turn analytics off. Everywhere else both start on, and you can turn them off.
Amplitude does not run in child mode (see Children). It uses Amplitude's EU data centre. It keeps an identifier for your browser, and where your visit came from, in cookies, and events waiting to be sent in your browser's storage. When you turn analytics off, Amplitude stops and the website deletes Amplitude's cookies and what it stored in your browser (in Firefox before version 126, some of it stays until you clear the site's data). If you allow analytics again, Amplitude gets a new identifier for your browser. Vercel, which hosts the website, measures how fast pages load (Speed Insights) for every visitor.
You can change your choice at any time under Cookie settings: in the website footer, in the web app's side column and Settings, or at www.myperfectpitch.app/#cookie-settings. Your choice stays in your browser until you change it or clear your browser data. Once child mode is on, Google's tag is switched off and does not load again in that browser, and no banner is shown (see Children for what can be sent before that). We do not use cookies to build advertising profiles for sale to third parties.
Automated decisions
We personalise lessons to your voice range and progress, but we do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
Additional information for US residents
Depending on the state you live in (for example California), you may have the right to know what personal information we collect, to access, correct or delete it, and to opt out of the "sale" or "sharing" of personal information or of targeted advertising. We do not sell personal information for money. Where our use of advertising measurement tools counts as "sharing" under your state's law, you can opt out under Cookie settings on the website or by emailing us. We will not discriminate against you for exercising these rights. To make a request, email hello@ayalabs.xyz; we may need to verify your identity through your account email. In the last 12 months we have collected the categories of information listed under "Data we collect" above, from you directly and from your use of the app, for the purposes listed under "How we use your data", and disclosed them to the service providers listed above.
Children
Perfect Pitch asks everyone for their age during setup. We keep only the age group, which we use to suggest a comfortable starting vocal range. From version 1.5.8 of the iOS app, and on the website, our apps do not send anyone's age or age group to our analytics, subscription or advertising providers. Earlier versions did (see What earlier versions sent). Children under 13 should use Perfect Pitch only with the permission of a parent or guardian (see our Terms).
If you tell us you are under 13, the app and the website switch to child mode. You keep using Perfect Pitch and see the same plans and prices, but:
- We do not ask for an email address. You cannot create an account or sign in with Apple, Google or an email address, so you stay a guest on your device.
- Our apps send nothing to Amplitude: no usage data, no profile details and no session recordings.
- Superwall receives nothing, apart from the one exception described under Superwall in the iOS app. The subscription screen in the iOS app is shown by RevenueCat instead.
- Once your answer has reached our servers, we send no offers or other promotional messages by email or notification. The app schedules no offer reminders.
- On the website, Google Analytics and Google Ads are switched off, and Pro cannot be bought there. A parent or guardian can buy it in the iPhone and iPad app.
Some data is still needed for the app to work. Progress, scores, settings and the age group are stored on our servers at Supabase under a guest ID. RevenueCat receives the guest ID and what it needs to show plans and handle purchases, and in the iOS app also Apple's attribution information if the app was installed from an Apple Search Ads ad. If the iOS app crashes, Firebase Crashlytics receives a crash report without any name, email address or age. If notifications are allowed, the app can send practice reminders and messages about the child's own subscription, such as a trial that is ending or a payment problem. Purchases in the iOS app are handled by Apple, and Apple's Ask to Buy can send them to a parent or guardian to approve first.
The age question comes a few screens into setup, so Amplitude may already have received usage data from those first screens and, for some sessions, a recording of them. Data that was waiting to be sent at that moment can still arrive. On the website, Google Analytics and Google Ads may also have received page views and, where cookies were allowed, ad click information from those first screens. The same can happen once when a child's profile is opened in a new browser, before the profile has loaded. From then on they are switched off. We ask Amplitude to delete all data about users who tell us they are under 13, once their answer has reached our servers. Child mode stays on for that device or browser, and a later answer does not switch it off. It also starts when someone uses an account or guest profile whose age group is under 13. If the app is deleted or the browser data is cleared, child mode starts again when the age question is answered with an age under 13.
If an account of someone who told us they are under 13 already had an email address before child mode existed, we only send it messages about its own subscription, such as a renewal reminder or a payment problem.
A parent or guardian can ask us to see or delete a child's data by emailing hello@ayalabs.xyz.
Security
We use encryption in transit, access controls and reputable infrastructure providers to protect your data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Changes to this policy
We may update this policy from time to time. We will post the new version on this page and change the date above. If the changes are significant we will tell you in the app or by email.
Contact
Aya Labs B.V.
Reinwardtstraat 70
1093 HL Amsterdam
the Netherlands
Chamber of Commerce (KvK) number 85595020
VAT number NL863677460B01
hello@ayalabs.xyz