Privacy notice

How NoteAdapt handles your information

Last updated 15 October 2026

NoteAdapt is a web tool that helps music teachers adapt sheet music for their students. It is run by KaoTechnologies LLC, a Massachusetts company. Questions or requests: [email protected].

The short version

• We don't store the music you upload. It is read in a temporary folder that is deleted straight away. While you work, a copy is held only in our server's memory, never saved to its storage. We can't give an adapted sheet back to you later, so print or download anything you want to keep.
• One exception: a picture attached to a feedback report shows the page you were working on, and is kept for about 30 days.
• We never ask for a student's name. Students have no accounts and never sign in.
• No advertising and no tracking tools. We don't sell your information, we don't share it for marketing, and we don't use it to train artificial-intelligence models.
• We keep a small amount of account information so you can sign in, and simple totals of how you use the site.

What we collect

If you ask for access

Your name and email address, the date you asked, the country you live in, where you teach and a short note about your teaching. Please leave students' names out of your note. We use these to decide on your request, to email you about it and, if the answer is yes, to set up your account. When a request arrives, the site may email your name, email address and where you teach to the person who reviews requests.

If your request is approved, where you teach and your note are deleted from the site, and your name and email address become your account, whether or not you go on to set a password. If it is declined, the request is deleted from the site. A request we have not answered yet stays until we decide. Emails about your request stay in our mailbox like any other email until we delete them.

If you ask for a quote

The name of your school, district or organisation, your name and email address, the number of seats, the date, and, if you choose to give them, your role and a short note. We use these to prepare and send your quote and to email you about it. When a request arrives, the site emails those details to the person who prepares quotes, and sends you a confirmation. A quote request stays on the site until we delete it, which we do once the quote has been dealt with or on your request.

If you buy a seat

You pay on Stripe's own page, not ours. Stripe collects your card details and your billing address and keeps them under its own privacy policy; we never see your card number. Stripe tells our site that the payment went through and sends us your name, your email address, your billing address, the amount and the tax. We keep a record of the sale — your name, your email address, the country and state in your billing address, the amounts, the date, the account the seat was put on, and Stripe's reference numbers — because tax law requires a seller to keep one. We use your email address to set up your account (or to find the account you already have), to tell you when your seat ends, and to write to you about the order if something needs checking. A refund is made by us in Stripe; if it includes the card's last four digits in what it sends us, we read only what we need and keep none of it.

If you have an account

• Your name, your email address, your sign-in name (usually your email address) and the date the account was created.
• Your password, stored only in a scrambled form that can't be turned back into the password, and the date you last set it.
• What kind of account it is, whether you have set it up yet, and whether it has priority in the queue for reading music.
• If your school district arranged your access, which district and when you were admitted.
• If you are on a trial, how long it lasts and when it ends.
• That you confirmed you are 18 or older, when you did, and on which page.
• If we send you a setup or password-reset link, a scrambled copy of the link until it is used or expires.
• Administrators only: the details needed for their second sign-in step.

The music you upload

Your file travels over an encrypted (HTTPS) connection, through Cloudflare, to our server. There it is read by the music-recognition software in a temporary folder, which is deleted as soon as reading finishes. Nothing from your music is saved to our server's storage: not the file, its name, the title of the piece or the notes in it.

While you work, our server holds pictures of your pages and the notes it found in its working memory, so you can edit and export. If you open a PDF longer than 60 pages, the file itself is held there too so you can page through it. This memory is never saved to storage. It is cleared when you sign out, and after about 90 minutes without activity.

The music-recognition software keeps a short technical log of each read: when it ran and whether it worked. These logs are not linked to your account and are erased whenever we update the site.

You are signed out after 90 minutes without activity.

How the site is used

For each account we keep running totals of how many times you signed in, uploaded, exported, and made a skills sheet or a creative sheet, together with the times of your first and most recent activity. We also note which instruments you chose and whether you colour by pitch or by string. Nothing about the music itself is recorded. NoteAdapt's administrators can see these totals for each account. They stay for as long as you have the account and are deleted with it.

Separately, we keep daily totals for the whole site, not tied to any account, for about 120 days.

If you send feedback from inside the app

• What you write, exactly as you typed it, with your name, your sign-in name, the time and the kind of report you picked.
• Technical details that help us reproduce a problem: your settings, page and note counts, zoom level, the size of your browser window, light or dark theme, your browser's type and language, the version of the app, and the last few error messages. We automatically remove quoted text and anything that looks like a file name from these details.
• A picture of the page you are looking at, including your music. It is included unless you untick the box. You see it first and can remove it before you send.

Pictures are deleted automatically about 30 days after you send them. The written report is kept until newer reports replace it (we keep the most recent 400), unless you ask us to delete it. If your account is deleted, your name and sign-in name are removed from your reports and any picture still attached is deleted; what you wrote and the technical details stay. When a report arrives, the site also emails us an alert with your name and the first few lines you wrote. That email stays in our mailbox until we delete it.

Please don't include information about students in a report or a picture.

If you email us

We keep your message for as long as we need it to answer you and to keep our records straight. Email is held in our mailbox at Google, not on our own server.

From every visit

Cloudflare, the network service our site runs behind, handles every request on its way to our server. It sees your IP address and the pages you request, what you send passes through its systems, and it keeps its own logs. Before it shows the request-access form, Cloudflare also checks that your browser is not an automated program, and sets a security cookie when you pass.

Our server uses your IP address, in memory and for a few minutes only, to limit repeated sign-in, password-reset and access-request attempts. It does not save it. It also keeps a basic log of which pages were requested and whether that worked, to run and secure the site. The code in a setup or password-reset link is left out of that log, and the log is cleared whenever we update the site.

What we don't do

• We don't ask for information about students. No part of the site asks for a student's name, and class-set copies are labelled by their settings, not by student. If a student's name is written on a page you upload, it is handled exactly like the rest of that page.
• We don't show advertising and we don't use analytics or tracking tools from other companies. Besides Cloudflare and Google, described below, the only company that handles anything of yours is Stripe, when you buy a seat.
• We don't sell your information or share it for marketing.
• We don't use anything you give us to train artificial-intelligence models, and we don't send it to any outside AI service.
• We don't take payments on this site: a seat is paid for on Stripe's page, and we hold no card details.

Cookies and your browser

We use only what the site needs to work and stay secure.

• A sign-in cookie keeps you signed in. It holds your sign-in name, your name, your account type and the time of your last activity. It is limited to this site and is not used for advertising or to follow you to other sites. It stops working after 90 minutes without activity, and signing out removes it. Otherwise your browser keeps it for up to 14 days, so sign out when you finish on a shared computer.
• Administrators only: an administrator who ticks "remember this device" at the second sign-in step gets a cookie that skips that step on the same browser for 30 days.
• Cloudflare's security cookie is set when your browser passes its check on the request-access page. It tells people from automated traffic and is not used for advertising.
• One small note in your browser's own storage remembers that you closed the "nothing is saved" message in the app. It holds nothing about you and is never sent to us.

There are no advertising cookies.

Who else is involved

• Cloudflare carries everything between you and our server, including the files you upload, and routes email sent to our addresses.
• Google (Gmail) delivers the emails the site sends: to you (that we received your request, our decision, invitations, activation links, password resets, quote confirmations and, if you buy a seat, the message about it) and to us (alerts that someone asked for access, asked for a quote, sent feedback, or bought a seat). It also holds the mailbox that receives your emails to us.
• Stripe, if you buy a seat: it takes the payment on its own page, collects your card details and billing address under its own privacy policy, sends you its receipt, and tells our site the payment went through, with your name, email address, billing address and the amounts. Refunds and disputes are handled there too.

The site itself runs on servers we operate ourselves in the United States, not on a commercial cloud. No other company receives your information. We may disclose information if the law requires it.

If you give us a quote or a photograph for the front page, we publish it there with your name and role, only with your permission, and take it down when you ask.

How long we keep it

• Your account and its usage totals: for as long as the account exists, including after a trial ends. Ask us and we will delete both.
• An access request: until it is approved or declined, as described above.
• A quote request: until we delete it, once the quote has been dealt with or at your request.
• The record of a seat you bought: for as long as tax law requires us to keep a record of the sale — at least three years after the sales-tax return covering it is filed. It is kept when the account is deleted, because the record has to name the buyer.
• Uploaded music: the temporary folder is deleted when reading finishes. The working copy in our server's memory is cleared when you sign out, and after about 90 minutes without activity.
• Adapted sheets: not saved. Print or download to keep them.
• Site-wide daily totals: about 120 days.
• Feedback pictures: about 30 days. Feedback text: until newer reports replace it, or sooner if you ask. Your name comes off it when your account is deleted.
• Emails: in our mailbox until we delete them. Ask and we will delete yours.
• Our server's logs: cleared whenever we update the site. Cloudflare keeps its own logs for its own period.
• Backups: we back up the site's data every week and keep the three most recent backups on servers we operate, so information deleted from the site normally leaves the backups within about three weeks. Feedback pictures are left out of the backups.

Keeping it safe

The site is served only over an encrypted connection (HTTPS), through Cloudflare. Passwords are stored scrambled, and administrators sign in with a second step. No system is perfectly secure. If a security problem exposes your information, we will tell you without unreasonable delay.

Children and students

NoteAdapt is for adult educators. Every account holder confirms, when the account is set up or the next time they use the site, that they are 18 or older; the site does not work until they have. Students don't have accounts and never sign in, and we don't knowingly collect information from anyone under 18. If you believe a child has given us information, write to [email protected] and we will delete it.

Where your information is handled

NoteAdapt is operated from the United States, and the information we hold is stored there. Cloudflare and Google run worldwide networks, so it may pass through other countries on the way.

NoteAdapt is built for teachers in the United States. If you write to us or ask for access from another country, the details you send are sent to and kept in the United States, and we may not be able to offer you an account yet.

Your choices

You can ask to see, correct or delete the information we hold about you, including your account, a feedback report or picture, and emails you have sent us. Email [email protected] from the address on your account, or tell us enough to find you. We will answer as soon as we can, and within 30 days.

Changes

If this notice changes, we will update this page and the date at the top.

← Back to the start page