Privacy Policy
Last updated: August 2026
1. Who is responsible for your data
MyFretboardTrainer (“we”, “us”) is the data controller for the personal data described here. You can reach us about anything in this policy - including any of your rights below - at myfretboardtrainer@gmail.com.
Operator: Jiří Batko, Šafaříkovy sady 2774/7, 301 00 Plzeň, Czech Republic. This is a small independent project, not a company with a dedicated data-protection officer, and is not required to appoint one.
2. What we collect, and why
We deliberately collect as little as possible. Specifically:
| Data | When | Why |
|---|---|---|
| Your email address | When you sign in with a magic link, or when you buy Pro through Buy Me a Coffee | To identify your account, send the sign-in link, and grant Pro access |
| Sign-in activity (last sign-in time, number of sign-ins) | Each time you sign in | Support and abuse prevention (e.g. confirming an account was accessed) |
| Technical event records - your email address, IP address, and the browser/device string your browser sends | When you request a sign-in link, when a link is opened, and when something goes wrong on the server | To keep sign-in working and secure. These records are what let us tell your own click apart from an automated one - mail providers and browsers open links in the background to scan them, which used to consume people's sign-in links before they could use them, and without this we could not see it happening. Not used for tracking, profiling or advertising, and deleted automatically (see section 7). |
| Your practice data - exercise results, program progress, saved exercise options, speed-challenge runs | As you use the trainer while signed in | To show your progress, blind spots, and saved settings across visits |
| Leaderboard nickname | Only if you choose to set one | To display your best speed-challenge results on the public leaderboard. Setting a nickname is optional; until you do, you do not appear on the leaderboard. |
A single sign-in cookie (mft_session) | While you are signed in | Strictly necessary to keep you logged in. It is not used for tracking or advertising. |
We do not sell your data, we do not use it for advertising, and we do not build profiles about you.
Support access. If you contact us about a problem with your account, we may sign in to view it in a temporary, read-only mode to investigate and help. This access is limited to resolving your request, is logged, and never lets us change your data.
3. Legal bases
- Performing our agreement with you (GDPR Art. 6(1)(b)) - for your account, sign-in, Pro access, and saving your practice data and settings.
- Our legitimate interests (Art. 6(1)(f)) - for keeping the service secure, monitoring for errors, diagnosing sign-in problems, preventing cheating on the leaderboard, and understanding aggregate, anonymous usage.
- Your consent (Art. 6(1)(a)) - where it applies, such as choosing to publish a nickname on the leaderboard. You can withdraw consent at any time by removing your nickname or contacting us.
4. Cookies and analytics
We use only one cookie - the mft_session sign-in cookie described above - and it is strictly
necessary, so no consent banner is required for it.
For usage statistics we use Umami, a privacy-focused analytics tool that is cookieless and does not collect personal data or track you across sites. Because it stores no personal data, it needs no consent.
5. Who we share data with
We use a small number of service providers (“processors”) to run the site. They only process data on our behalf and under contract:
- Supabase - hosts our database (your account and practice data), in the European Union.
- Netlify - hosts the website and serverless functions; its server logs may briefly process your IP address for security and delivery.
- Buy Me a Coffee - processes Pro payments. Your card details go to them, never to us; we only receive the email tied to your purchase. See their own privacy policy.
- Umami - cookieless, anonymous usage analytics.
- Axiom - stores the technical event records described in section 2 (including your email address and IP address when you sign in) so we can keep sign-in working and investigate errors, in the European Union.
- Sentry - error monitoring for the website in your browser, configured not to store your IP address or personal data.
6. International transfers
Your account, your practice data and the technical event records in section 2 are all stored in the European Union. Some of our other providers (for example Netlify, Umami, Sentry, and Buy Me a Coffee) may process data outside the European Economic Area, such as in the United States. Where that happens, the transfer is covered by appropriate safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
7. How long we keep it
- Sign-in links expire after 15 minutes. A sign-in session lasts 30 days, and using the site while signed in extends it - so you are not signed out while you keep practising, and if you stop, it expires 30 days after your last visit.
- Technical event records - including the email address and IP address described in section 2 - are kept for 30 days and then deleted automatically.
- Your account and practice data are kept while your account exists, so your progress is there when you return.
- You can ask us to delete your account and everything tied to it at any time (see below). Deletion is complete - all your practice data, progress, and challenge runs are removed with the account.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- correct it if it is wrong;
- have it deleted (“right to erasure”);
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw any consent you have given.
To exercise any of these, email myfretboardtrainer@gmail.com. We will respond within one month. You also have the right to complain to your local data-protection authority - in the Czech Republic that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ).
9. Children
The service is not directed at children under 16, and we do not knowingly collect their data.
10. Changes to this policy
If we change how we handle your data, we will update this page and its “last updated” date.