Legal

Privacy Policy

Last updated September 29, 2026

Contrapunctus ("the game") is made by Jeharli ("we", "us"). Jeharli is the controller of the personal data described here. This policy covers the game on every platform, its online services (api.contrapunctus.jeharli.com) and this website. We collect as little as the game needs to work, we never sell personal information, and we do not build advertising profiles.

In short

You can play without an account. A random guest identifier saves your progress.
Playing offline sends nothing. Lessons, downloaded levels and the built-in piano work without a connection.
Ads, if shown, are non-personalised unless you switch personalised ads on.
Classes share a student's results with their teacher and nobody else.
You can delete everything at any time, in the game or by email.

What we collect

Every player (guest)

The first time the game goes online it creates a guest player so progress, currency and purchases can be saved. We store:

a random installation identifier created by the game (not a hardware identifier and not the advertising identifier);
your platform (for example "android" or "ios"), app version and the language you use in the game;
game progress: levels played, scores, stars, accuracy, experience, streaks, currency balances, items you own and levels you mark as favourites.

If you create an account

your email address and a securely hashed password, or the identifier provided by Sign in with Apple or Google Sign-In (and the email they share with us, if any);
the display name, username, avatar and biography you choose;
levels you publish, your votes on levels, reports you send and the creators you follow.

Classes (Education)

Teachers and assistants: the classes you create, their names, codes, assignments, announcements, stickers and settings.
Students: the classes you join, your results on assigned levels (completion, accuracy, stars, score, attempts, time practised, partial progress) and any stickers you receive.

Purchases

Payments are handled entirely by the App Store or Google Play. We never see payment details. To deliver what you bought, we receive and store the product, the store's transaction identifier, and the purchase or subscription status.

Notifications

If you allow notifications, we store your device's push token and the notification categories you chose (Settings → Notifications), so we can send game news, reminders and class updates. You can turn categories off at any time.

Gameplay of community levels

When you play a community level, the game reports that it was played, whether it was completed and the score, so levels can be ranked. This is linked to your player.

What we do not collect

We do not collect your location, contacts, photos, microphone or camera input. The score files you import into the editor stay on your device unless you publish them. The game has an "analytics" switch in Settings → Privacy. It is off by default, and the game currently sends no analytics either way.

How we use it

to run the game: saving and syncing progress, delivering purchases and rewards, showing community levels, profiles and classes (the contract with you);
to keep the community and the game fair: moderating reported levels, checking results against the music's real length, and preventing cheating and abuse (our legitimate interest);
to send in-game news and messages, push notifications you allowed (your consent) and account emails such as sign-in codes and password resets (the contract). We do not send marketing email.

Advertising

The free game may show an advertisement between games, and optional rewarded ads you choose to watch. Ad-free and Classroom Unlimited remove them. Ads are served by Google AdMob, which may collect device information and, where you allow it, your device's advertising identifier, under Google's privacy policy. Ads are non-personalised unless you yourself switch on personalised ads (Settings → Privacy): personalised advertising is opt-in, never on by default. You can also limit ad tracking in your device settings. Ads are limited to content suitable for teens and older.

We use a few service providers, only to run the game, under contracts that limit their use of the data:

Hosting: our servers run on Render (United States) and Hetzner (European Union). Backups and downloadable content are stored on Cloudflare R2.
Email: sign-in codes and password resets are sent through Resend.
Push notifications: delivered through Apple Push Notification service and Firebase Cloud Messaging.
Stores and sign-in: Apple and Google, for purchases and for Sign in with Apple / Google.
Advertising: Google AdMob, as described above.

We disclose data otherwise only when the law requires it.

What others can see

If you publish levels, your display name, username, avatar, biography, published levels, their play counts and votes, and your follower counts are public. Guest players have no public profile. In a class, the teacher and assistants see their students' names and results; students see their classmates' names and the class news.

Children and schools

Contrapunctus is made for music learners of all ages, and many play it in music lessons.

A child can play, take lessons and join a class with its code without an account and without giving us any contact information.
Publishing levels, following creators and creating an account are meant for players old enough to agree under their local law (13 in the United States, up to 16 in parts of the EU), or with a parent's permission.
Schools and teachers: when you use classes with students under the age of digital consent, you confirm that you have the authority of the school or the consent of a parent to do so, as required where you teach. Student data in a class is used only to run that class. It is never used for advertising and never shared beyond the class. A teacher can remove a student, and a student (or parent) can leave a class or delete the player at any time.
If you believe a child has given us personal information without the permission they needed, contact us and we will delete it.

Storage, transfers and security

Data is transferred over encrypted connections and stored on the providers above, in the United States and the European Union. Where data leaves the EU or UK, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision. Passwords are hashed, sessions are signed and bound to the device, and access to the servers is restricted. If a breach ever affects you, we will tell you and the authorities as the law requires. To report a security issue, write to us (see security.txt).

How long we keep it

We keep your data while you use the game. Guest players inactive for 24 months may be deleted. Deleting your account erases it within 30 days, backups included. Purchase records are kept for as long as accounting law requires, without your profile.

Your choices and rights

Access and correction: edit your profile in the game (Extras → Account), or ask us for a copy of your data.
Deletion: delete your account at any time in the game (Extras → Account → Delete account) or by following these steps. Levels you published stay playable without your name unless you ask us to remove them too.
Objection, restriction and portability under the GDPR and UK GDPR, and the rights to know, delete and correct under the CCPA/CPRA and other US state laws. We do not sell or "share" personal information for cross-context advertising.
Withdrawing consent: switch off personalised ads or notifications in the game's settings at any time.
Complaints: you may complain to your data protection authority. We would like to hear from you first.

This website and cookies

This website sets no cookies and contains no trackers or analytics. Fonts, images and videos are served from this site itself, so opening a page contacts no third party. Your light or dark theme choice is remembered in your browser's local storage and never leaves your device. The news list and shared-level pages read public data from our API. The "try it" demo runs entirely in your browser and stores nothing.

Changes

We will post changes to this policy on this page. For significant changes, we will announce them in the game's News before they apply.

Contact

Questions, requests or complaints: [email protected]. We reply within 30 days.