Privacy Policy

1. Information We Collect

1.1 Account information

Depending on how you sign in, we collect:

We also store, for each account, information such as an account identifier, your language preference, whether your email is verified, your premium status, and — if you request deletion — the date deletion was requested and scheduled.

If you registered with an email address and password, we send one-time verification and password-reset codes to that address. These codes are short-lived and are not shared with anyone else.

1.2 Learning and practice activity

To show your progress and keep it available across your devices, we record information such as which lessons and practice items you have completed, when you completed them, and which module you are currently working through. This is what powers your progress view and daily practice goal.

We record completion events only. We do not record audio of you playing, and we do not upload individual key presses or performances from the on-screen keyboard.

1.3 Subscription and purchase information

Celyris Premium is sold through the Apple App Store and Google Play. We never receive or store your card details, billing address, or any payment credentials — those remain with Apple, Google, and our subscription platform, RevenueCat.

What we do store is the state of your subscription: whether it is active, cancelled, or expired, which product was purchased, which store it came from, the store’s transaction identifiers, and the relevant purchase, renewal, and expiry dates. We use this to determine whether your account has premium access.

1.4 Technical and diagnostic information

• Server logs. When the app communicates with our servers, we log technical details of the request, including the IP address it came from. IP addresses are also used to rate-limit sign-in and other sensitive requests so the service cannot be brute-forced or abused.
• Sign-in security. We temporarily count failed sign-in attempts for an email address so an account can be locked after too many failures.
• Crash reports. If the app crashes or hits an unexpected error, a diagnostic report is sent to our crash-reporting provider. It contains the error, the app version, the device and operating system type, and basic context about where in the app the error occurred. We do not attach your name or email address to crash reports.

1.5 Information stored on your device

Some information stays on your phone and is not sent to us:

• Sign-in tokens, held in your device’s secure storage (iOS Keychain / Android Keystore) rather than ordinary app storage. Reinstalling the app discards the previous install’s tokens and signs you out.
• A temporary local cache of lesson and progress data, so the app opens quickly and remains usable on a poor connection.
• Your app settings, such as language and keyboard preferences.
• Downloaded lesson audio and backing tracks.

Uninstalling the app removes all of this from your device.

1.6 Analytics

We use Firebase Analytics, a service provided by Google, to help us understand how the Celyris app is used so we can improve it. Firebase Analytics automatically collects:

• App usage and interaction data (screens viewed, features used, session length)
• Device and app information (device model, operating system version, app version, language settings)
• Approximate location, derived from IP address (city/region level — your IP address itself is not stored)
• A randomly generated installation identifier tied to your app install, not to your name, email, or account

This data is processed by Google in accordance with the Google Privacy Policy and Firebase’s Data Processing Terms. We do not use Firebase Analytics for advertising, and it is not linked to your advertising identifier or used to track you across other companies’ apps or websites.

Analytics data collected in a development or testing build of the app is not sent to Google; only data from the version of the app you download from the App Store or Google Play is collected.

2. What We Do Not Collect

To be explicit, Celyris does not collect:

• Audio recordings. The app never records from your microphone. On iOS you may see a microphone usage description listed in the app’s information — this is required by Apple only because the audio library we use to play piano sounds and backing tracks also contains recording functionality that Celyris does not use. No recording takes place, and no microphone permission is requested while you use the app.
• Precise location data, such as GPS coordinates or your device's precise location.
• Your contacts, photos, camera, calendar, or files.
• Advertising identifiers. Celyris contains no advertising SDK and no cross-app or cross-site tracking.
• Payment card details.

The Android app requests only two permissions: internet access, and in-app billing.

We do not sell your personal information, and we do not share it for behavioural advertising or other cross-context targeting.

3. How We Use Your Information

If you are in the European Economic Area or the United Kingdom, our legal bases for processing are: performance of a contract (your account, lessons, progress, and subscription), legitimate interests (securing the service, preventing abuse, fixing faults, and improving the app), consent where we specifically ask for it, and compliance with a legal obligation where the law requires it. Where we rely on legitimate interests, you have the right to object — see section 8.

4. Who We Share Information With

We share personal information only with service providers who help us operate Celyris, and only to the extent each of them needs it. Our providers currently include:

These providers act on our instructions and are not permitted to use your information for their own purposes. This list may change as our infrastructure evolves; we will keep this policy up to date.

We may also disclose information where we are required to do so by law or legal process, or where we reasonably believe disclosure is necessary to protect the rights, safety, or security of Celyris, our users, or the public. If Celyris is ever involved in a merger, acquisition, or sale of assets, account information may be transferred as part of that transaction, and we will notify you before your information becomes subject to a different privacy policy.

We do not sell personal information.

5. International Transfers

Celyris is operated from Indonesia, and our service providers operate internationally. Your information may therefore be processed in countries other than your own, including countries whose data protection laws differ from those where you live. Where required by law, we rely on appropriate safeguards for such transfers, including the European Commission’s standard contractual clauses.

6. How Long We Keep Information

• Account and learning data are kept for as long as your account remains open.
• Deleted accounts are held for a short grace period after you request deletion, currently 7 days, during which you can restore the account by signing back in. After that period, your account and its associated records — profile, lesson and practice history, subscription records, and sessions — are permanently deleted.
• One-time verification and reset codes, and failed sign-in counters, expire automatically after a short period.
• Sign-in sessions expire automatically, and are ended immediately when you sign out, change your password, or delete your account.
• Server logs and crash reports are retained only as long as needed for security and troubleshooting.

We may retain certain information beyond these periods where we are required or permitted to do so for legal, tax, billing, security, or fraud-prevention purposes, or where it remains temporarily in backups until those backups are cycled out.

7. Security

We use technical and organisational measures appropriate to the risk, including:

• Industry-standard password hashing — passwords are never stored, transmitted, or accessible to us in readable form
• Encryption in transit for all communication between the app and our servers
• Short-lived access tokens, with sessions revoked on sign-out, password change, or account deletion
• Secure device storage for your sign-in credentials
• Rate limiting and account lockout on sign-in and other sensitive requests
• Protected access to lesson media, so content cannot be downloaded in bulk or hot-linked
• Server-side verification of sign-in tokens and of subscription notifications from our payment providers

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We work to protect your information and to limit what we hold to what the app genuinely needs.

8. Your Rights and Choices

You can, at any time:

• See and update your profile — change your display name in the app’s profile settings.
• Set or change your password, or reset it by email if you have forgotten it.
• Delete your account — Profile → Settings → Delete Account. Deletion is scheduled after a short grace period, and you can cancel it within that window by signing back in.
• Manage or cancel your subscription through your Apple App Store or Google Play account settings. Cancelling a subscription does not delete your account, and deleting your account does not automatically cancel a store subscription — please cancel it in the store as well.
• Revoke Celyris’s access to your Google or Apple account from your Google Account or Apple ID settings.
• Request a copy of your data, or ask us to correct or delete it — email [email protected] and we will respond within the time required by applicable law.

Depending on where you live, you may also have the right to object to or restrict certain processing, to data portability, to withdraw consent at any time without affecting processing already carried out, and to lodge a complaint with your local data protection authority. We will not discriminate against you for exercising any of these rights.

9. Children’s Privacy

Celyris is not directed at children under 13, and we do not knowingly collect personal information from them. If you are under 13, you may use Celyris only with the consent and supervision of a parent or guardian, who is responsible for the account. If you believe a child under 13 has provided us with personal information, please contact [email protected] and we will delete it.

Some regions set a higher minimum age for consent to data processing — for example, up to 16 in parts of the European Economic Area. Where that applies, parental consent is required up to that age.

10. Third-Party Links

The app links to external pages, including this policy, our Terms of Use, third-party open-source licences, and your store’s subscription management screen. These open in an in-app browser but are governed by the privacy policies of the sites concerned, not by this one.

11. Changes to This Policy

We may update this policy as the app changes. When we do, we will revise the “Last updated” date above, and for material changes we will provide notice in the app or by email before the change takes effect. Continuing to use Celyris after a change takes effect means you accept the updated policy.

12. Contact Us

For questions, requests, or complaints about this policy or your personal information:

• Legal entity: Jacky Rusly
• Email: [email protected]
• Address: Jakarta, Indonesia