Privacy Policy
This policy explains what personal data hitEveryNote (the “Service”) collects, why, and what rights you have. We keep data collection to the minimum needed to run the Service.
1. Who is responsible
The data controller is Fleșter Iulian, operating the website hiteverynote.com as an individual in Romania. For any privacy question you can contact us at contact@hiteverynote.com.
2. What we collect
When you create an account we collect an email address and a nickname (username). Your password is stored only as a secure cryptographic hash — we never see or store it in plain text.
As you use the Service we store gameplay data you generate: scores, levels played, tempo settings, custom bass presets, and your chosen accent colour. We also record which invite you signed up with, to know who invited you.
If you choose to build a drum pattern and make it public, its title, description and content are stored and, while public, visible to anyone. If you sign in with Google, we store the minimum identifier the provider gives us to link that login to your account (and the email it reports, for reference); we don't receive your password from them.
If you use the community features, we store the comments and replies you post, your likes (on comments and patterns), the comments and accounts you report, the notifications generated for you, and — only if you turn messages on in your Profile and confirm you are 16 or older — the private messages you send and receive, plus the list of people you blocked. For moderation we keep a record of warnings and suspensions applied to your account (dates only) for up to 3 months.
If you post in the feature requests board, we store the ideas you submit and the ideas you vote for; the idea, your nickname and the vote totals are public, but not who voted for what. If you use an app or device linked to your account, we store an access token (only its hash) so it can stay signed in.
To keep leaderboards fair, scores are checked automatically (for example, impossible timing or repeated attempts). Suspicious scores may be hidden from the public leaderboards; no other consequence follows automatically, and you can write to us if you think a score was hidden by mistake.
We keep a record of your cookie choice (what you chose and when) in a first-party cookie and, if you are signed in, in your account, as proof of consent.
Our server keeps standard technical logs (such as IP address and browser type) for a short period, for security and to keep the Service running.
We do not collect special categories of data, and we do not run advertising at this time. Third-party analytics (Google Analytics) is used only if you accept it in the cookie banner — see the Cookie Policy.
3. Why we use it (legal basis)
We process your email, nickname and gameplay data to provide the Service you asked for — creating your account, saving your progress and showing leaderboards (performance of our agreement with you). We process technical logs, automatic score checks and community moderation on the basis of our legitimate interest in keeping the Service secure, reliable and fair. Analytics cookies (Google Analytics) and, if we show ads later, advertising cookies are used only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the “Cookie settings” link in the footer; withdrawing does not affect processing done before.
4. What is public
Your nickname and scores may appear on public leaderboards, and any pattern you mark public is visible to anyone with its link or on the community patterns page. Comments and replies are public (visible to visitors without an account) together with your nickname; like counts are public, but not who liked what. Private messages are visible only to you and the other person; they are stored on our server (protected by HTTPS in transit, not end-to-end encrypted) and we do not read them unless required by law or to investigate a report of abuse. Please never post personal data (real name, phone, address) in comments — email addresses are blocked automatically. Your email address is never shown publicly and is never sold or shared for marketing.
5. Sharing
We do not sell your data. We use a hosting provider to run the website; it processes data strictly on our behalf and under confidentiality. If you accept analytics, Google (Google Ireland Limited, with Google LLC in the United States) receives usage data through Google Analytics; Google may process it outside the EEA under the safeguards described in Google’s Privacy Policy. If you choose “Sign in with Google”, Google handles the sign-in on its own page. If we show ads in the future, advertising partners (Google AdSense) will receive data only if you accept advertising cookies, and this policy will be updated first. We may disclose data if required by law.
6. How long we keep it
We keep your account data while your account exists. When you delete your account, we delete your personal data — including every comment you wrote (and the replies under it), your likes, reports, notifications and private messages — except where we must keep limited records to comply with the law. Technical logs are kept only for a short period and rotate out automatically. Your cookie-choice record lasts 180 days, after which we ask again. Google Analytics data is kept by Google for the retention period we configure, never longer than 14 months. Our hosting provider's backups may still contain deleted data until those backups expire (usually within 30 days); they are not used for anything else.
7. Your rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to processing, and to receive a copy in a portable format. You can delete your account and all its data yourself at any time from your Profile page. You can withdraw cookie consent at any time (footer, “Cookie settings”). To get a copy of your data, or to exercise any other right, email contact@hiteverynote.com. You also have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP, dataprotection.ro). We reply within one month. To protect your data, we only act on requests sent from the email address registered on the account.
8. Age
The Service is intended for people aged 16 or over. We do not knowingly collect data from anyone under 16.
9. Security
We protect your data with hashed passwords, encrypted (HTTPS) connections, and access controls. No system is perfectly secure, but we take reasonable measures to keep your data safe.
10. Changes
We may update this policy. Significant changes will be noted on this page with a new “last updated” date.
11. Contact
Questions? Email contact@hiteverynote.com.