Clariva Privacy Policy

# Clariva Privacy Policy

Version: 2026-09  
Effective date: 2026-09-30

This policy explains which personal data Clariva processes, why, on what legal basis, who receives it, how long it is kept, and which rights you have. It applies to the Clariva apps for iOS and Android, the website www.clariva.com and the related services. Please also read the Clariva Terms and Conditions.

## 1. Who is responsible

The controller for the processing described here is:

Christoph Eggimann  
Sonnhaldestrasse 25c  
4912 Aarwangen  
Switzerland  
E-mail: support@clariva.com

Clariva is run by Christoph Eggimann as a private individual. For all questions about your data and to exercise your rights, write to **support@clariva.com**.

The controller is established in Switzerland, so the Swiss Federal Act on Data Protection (FADP) applies. Because Clariva is also offered to people in the European Union and the European Economic Area, the EU General Data Protection Regulation (GDPR) applies to their data as well. The legal bases below are given in GDPR terms.

## 2. Summary

- Clariva records and analyses your instrumental practice. To do that, we process your recordings, the musical analysis derived from them, your profile and what you share with other users.
- We do not sell your data, show advertising, or track you across other apps or websites.
- Your recordings and the analysis derived from them are also used to develop and improve Clariva's own analysis models (section 6).
- Our servers are in Germany. Sign-in, push notifications and crash reports use Google Firebase, which can involve transfers to the USA (section 9).
- You can delete individual activities at any time and request deletion of your account in the app (section 11).

## 3. What data we process

**Account and sign-in.** An account identifier, your e-mail address, and, if you sign in with Google or Apple, the name and e-mail address that provider passes on (Apple lets you hide your e-mail address). Passwords are handled by Google Firebase Authentication; we never see them.

**Profile.** The display name, profile picture, instrument and other information you add to your profile, and your privacy and notification settings.

**Practice sessions and audio.** The audio you record, and the analysis Clariva derives from it: notes, pitch, timing, articulation, intonation, loudness, analysis features, practice statistics, and the title, notes and visibility you give a session. Manual activities (for example a concert or a lesson) with the details you enter.

**Passages.** Passages you create, their optional passage recordings, your attempts at passages, scores and leaderboard entries, and challenges you send or receive.

**Social features.** Whom you follow and who follows you, follow requests, blocks, applause, comments, social posts with their pictures, and the notifications that result from them.

**Push notifications.** A push token for your device, the platform (iOS or Android) and the app version, so that notifications reach you and match what your app can show.

**Terms and privacy acceptance.** Which versions of the Terms and this policy you accepted, when, from which app version and in which language.

**Messages to us.** Feedback, reports of content or users, account deletion requests and e-mails you send us, with whatever they contain.

**Technical and security data.** When the app talks to our servers, the servers log the request: time, requested address, result, the app build and your account identifier. Our web server additionally logs IP addresses. This is needed to run the service securely, find errors and stop misuse.

**Usage statistics.** From those server requests we compute statistics about how Clariva is used: how many people use it per day, which app versions are in use, retention after sign-up, which features are used, and from which countries. Users appear in them only under a pseudonym (a salted cryptographic hash of the account identifier that cannot be turned back into it without the secret key, which never leaves the server). The country is looked up from the IP address using a local database; the IP address itself is not stored for this. The app contains no analytics or advertising tool.

**Crash reports.** If the app crashes or hits a serious error, Firebase Crashlytics receives a report: the error and where in the app it happened, device model, operating system and app version, and your account identifier, so that we can find and fix the problem.

**Data on your device.** The app stores your sessions, recordings and settings on your device so that it works offline. Apart from what is synchronised as described here, that data stays on your device.

We do not intend to process special categories of personal data (such as health data). Please do not enter such data in free-text fields. Recordings may capture more than your instrument, for example voices in the room; please keep that in mind before you record.

## 4. Why we process it, and on what legal basis

**To provide Clariva** (GDPR Art. 6(1)(b), performance of the contract): creating and running your account, analysing your recordings, storing and synchronising your data, showing your statistics and progress, the social features (feed, profiles, follows, applause, comments, passages, leaderboards, challenges), notifications about activity that concerns you, and support.

**Legitimate interests** (GDPR Art. 6(1)(f)): keeping the service secure and available, preventing and investigating misuse, moderating reported content (server logs, reports); understanding how Clariva is used so we can improve it (the pseudonymous usage statistics); finding and fixing errors (crash reports); occasional notifications that people you follow were active (you can switch these off in your profile); developing and improving Clariva's analysis (section 6); and establishing, exercising or defending legal claims. Our interest in each case is running, securing and improving Clariva; we have weighed it against your interests and limited the data to what these purposes need.

**Legal obligations** (GDPR Art. 6(1)(c)): keeping records where the law requires it, and answering lawful requests from authorities.

**Your permission on the device**: the app asks for access to the microphone and for permission to send notifications through your device's own settings. You can withdraw both there at any time; recording then no longer works, or notifications stop.

## 5. What other users see

Other users see your display name and profile picture, and everything you give a visibility that includes them: sessions, activities, passages and their recordings, comments, applause and your place on leaderboards. You choose the visibility of each item (private, followers, public). Comments and applause you leave on other people's activities are visible to whoever can see that activity.

## 6. Developing Clariva's analysis (model training)

Clariva's note detection and analysis are machine-learning models, and they get better only by learning from real playing on real instruments. We therefore use the recordings made with Clariva, the analysis features and results derived from them, corrections you make, and basic context such as the instrument, to develop, train, test and improve Clariva's own analysis models. This is part of how Clariva works and is covered by the Terms (section 6).

- Legal basis: our legitimate interest in improving Clariva's analysis, from which all users benefit (GDPR Art. 6(1)(f)).
- This happens on our own systems. We do not sell this material, pass it to others to train their models, or use it to train general-purpose AI models.
- For this purpose we may keep recordings and derived data for longer than they are shown to you in the app, as long as your account exists.
- When you delete an activity or your account, its recordings and data are removed from the training material as well (section 8). Models that were already trained are not undone, but they do not contain your recordings in a form from which they could be retrieved.
- You have the right to object to this use (section 11). If you do, we will exclude your material from future training. If you do not want your recordings used this way at all, you can also stop using Clariva and delete your account.

## 7. Who receives data

We use the following service providers, who process data on our behalf and only according to our instructions:

- **Hetzner Online GmbH**, Industriestrasse 25, 91710 Gunzenhausen, Germany: hosting. Our servers are in Hetzner's data centre in Nuremberg, Germany.
- **Google** (Google Ireland Limited, Dublin, Ireland, and Google LLC, USA) via **Firebase**: sign-in (Firebase Authentication, and Google Sign-In if you use it), delivery of push notifications (Firebase Cloud Messaging) and crash reports (Firebase Crashlytics).
- **Apple** (Apple Distribution International Ltd., Ireland, and Apple Inc., USA): Sign in with Apple if you use it, and delivery of push notifications to iPhones.
- Our **e-mail provider**, for messages you send to support@clariva.com.

Apple and Google also process data as independent controllers when you download the app from their stores, under their own privacy policies.

Other users receive what you share with them (section 5). Beyond that we disclose data only where the law requires it, or where it is necessary to protect the rights and safety of users or of Clariva.

## 8. How long data is kept

- **Account and content**: as long as your account exists.
- **Activities you delete** disappear from the app at once. A copy is kept for **30 days** as a safety net against mistakes, then deleted. This also applies to the recordings and data kept for model training.
- **Account deletion**: after you request it, your account and data are deleted within **30 days**; safety copies made during the deletion are removed after another 30 days at the latest. Passage recordings you attached to shared passages stay with the passage until you remove them or the passage (see Terms, section 7a).
- **Server logs**: at most **90 days**; web server logs with IP addresses: **14 days**.
- **Pseudonymous usage statistics**: the per-user daily records for **26 months**; the counts derived from them contain no personal data.
- **Crash reports**: **90 days** at Firebase Crashlytics.
- **Push tokens**: until your account is deleted, another account signs in on the same device, or the token stops working.
- **Records of your acceptance of the Terms and this policy**: as long as your account exists, and afterwards only as long as needed to defend legal claims.
- **Messages to us**: as long as needed to handle them, and for reports and deletion requests as long as needed to document how they were handled.
- **Backups** of the server may contain deleted data until they are overwritten in rotation.

## 9. Transfers outside Switzerland and the EU/EEA

Our servers are in Germany, which Switzerland recognises as providing adequate protection. Google and Apple may process data in the USA and other countries. For transfers to the USA we rely on the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, under which Google LLC and Apple Inc. are certified, and on the providers' standard contractual clauses approved by the European Commission and recognised by the Swiss FDPIC.

## 10. Automated decisions

Clariva analyses your playing automatically, and scores and leaderboards are computed automatically. None of this produces legal effects for you or similarly significantly affects you; there is no automated decision-making within the meaning of GDPR Art. 22.

## 11. Your rights

You have the right to **access** your data, to have it **corrected**, to have it **deleted**, to **restrict** its processing, to **data portability** (receive the data you provided in a common format), and to **withdraw** any consent with effect for the future.

**Right to object:** where we process your data on the basis of legitimate interests (section 4, including model training in section 6), you have the right to object at any time for reasons arising from your particular situation. Send your objection to support@clariva.com.

Most of your data you can see and change in the app. You can delete sessions and other activities yourself, switch off follower notifications in your profile, and request account deletion under Profile → Delete account (or by e-mail, see www.clariva.com/delete-account). For everything else write to support@clariva.com; we answer within 30 days and may ask you to confirm that the account is yours.

You also have the right to lodge a complaint with a data protection supervisory authority. In Switzerland that is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. In the EU/EEA you can contact the authority in the country where you live or work.

## 12. Children

Clariva is intended for people aged 13 and over. The app stores rate it accordingly. If you are younger than the age at which you can consent to data processing where you live, you may use Clariva only with the permission of a parent or legal guardian. If we learn that a child under 13 has an account, we delete it.

## 13. Security

We protect your data with appropriate technical and organisational measures: encrypted connections (HTTPS), verified sign-in tokens for every request, access restricted to what is needed, and a server that accepts requests only through a protected gateway. No system is completely secure, but we work to keep the risk low and to act quickly if something goes wrong.

## 14. Changes to this policy

We update this policy when Clariva or the law changes. The version and effective date are shown at the top. When the changes are important, the app asks you to read and accept the new version.

## 15. Contact

Christoph Eggimann, Sonnhaldestrasse 25c, 4912 Aarwangen, Switzerland  
support@clariva.com