Privacy notice — preview draft
Operator: Sunghwan Yoo · Contact: TBD · Effective date: TBD
This notice describes the current Muturn preview. Cloud features are optional; you can read and organise scores on one device without an account.
On your device
Guest scores, source files, setlists, annotations and reading places are stored in browser storage (IndexedDB). Language and theme preferences are remembered locally. The service worker caches the app for offline use. Clearing site data can remove these copies; keep your originals. Local imports are not automatically uploaded.
Sign-in and cookies
Google sign-in provides your Google subject identifier, name and e-mail address to create and recognise your account. We do not store Google access or refresh tokens. A random session is held in an HttpOnly, SameSite=Lax cookie (Secure on HTTPS), lasting up to 30 days. Only its hash is stored in the database. A separate short-lived HttpOnly cookie protects sign-in. Signing out revokes the current session; account deletion revokes all sessions. There are no advertising or analytics trackers in the app.
Cloud libraries and teams
When you choose to upload your library, source files, score metadata, setlists, annotations and sync history are processed on Cloudflare D1 and private R2 storage. Team libraries are visible to invited members after they join; owners and leaders manage content and access. Private annotations and reading places are account-scoped. Team annotation layers are shared with members. Team member lists include names and e-mail addresses. An optional invitation e-mail is a reference for the leader; it is not matched against the recipient’s identity and no invitation e-mail is sent. Anyone with a public share link can see the selected service order, keys and notes, but the link never exposes score files or score pages. Treat invite, share and live-session codes as private.
Listening and live sessions
Microphone permission is optional and used for page following on the device. The normal listening feature does not upload microphone recordings. Hosted team live sessions relay score content and reading positions through Cloudflare Durable Objects to authorised members. Position, mode, expiry and score frames can persist through hibernation. Sessions expire after 12 hours, or 30 minutes after the leader disconnects, whichever comes first. Expiration prevents rejoining; an expired object may keep a tombstone.
MuseScore conversions
Submitting an .mscz conversion uploads your file to private R2 and job metadata to D1. An operator-run conversion machine downloads it and runs MuseScore Studio; normal completion or failure cleans its temporary files. A hard crash may leave temporary files for manual removal. Completed or failed inputs are removed immediately. Remaining job inputs and outputs use a 30-day R2 lifecycle; results may become unavailable after expiry. Job metadata remains until account deletion.
Retention and deletion
You can sign out, delete local records and delete your account in Settings. Transfer team ownership first if required. Account deletion removes the account, identities, sessions, memberships and personal library records, file grants, sync history and job metadata. It does not erase team content belonging to the team or browser-local copies. Deduplicated R2 library bytes may still be needed by other owners. Unreferenced library bytes are retained privately without automatic garbage collection; account deletion revokes access and is not immediate physical erasure of those bytes. Job bytes follow the 30-day lifecycle. Local Node storage requires manual cleanup.
Infrastructure and requests
Cloudflare provides hosting, D1, R2 and Durable Objects; Google provides sign-in. Conversion files also reach the operator-run conversion machine. Requests necessarily expose network information to the hosting provider. Rate limits use an account ID, or an IP address when signed out. Preview Workers Observability is disabled to avoid retaining URLs containing sign-in and link codes in invocation logs. This does not promise that Cloudflare keeps no infrastructure data. We do not sell your data.
Questions and choices
Use the published contact below for privacy or deletion questions once available. Keep backups and remove site data separately on shared devices. This draft will be updated when processing changes; review the published effective date before using the public service.