Privacy policy

• Account info — your name, email, instrument, institution, a short bio, and a headshot photo, if you add one. Date of birth is collected once, only to confirm pilot participants are adults, and is never shown to anyone, including other users.
• What you send or receive — video recordings, timestamped marks and comments on them, voice notes, dictated comments, demonstration clips, file and link attachments, and the reply messages between a student and their reviewer.
• Sign-in info — a securely hashed password if you set one, or, if you choose to sign in with Google or Facebook, the name, email, and account ID they share with us. We never see or store your Google or Facebook password.
• Usage data — things like how long a review takes, how many marks a review has, and which features get used, so we can tell what about the product is actually working.

• To run the core loop: getting a recording from a student to their reviewer(s) and the feedback back.
• To turn a dictated voice comment into text, we send that short audio clip to OpenAI’s Whisper transcription API. It’s used only to produce the text; we don’t use it to train anything.
• To email you — always tied to something you or someone pairing with you did (a sign-in link, “your reviewer now has your recording,” “your review is back,” a password reset). We never send marketing email, and never email you because of something someone else did to you without your own action starting it.
• To understand overall usage and improve the product.

A recording and its marks are visible only to you and whichever reviewer(s) you sent it to — never anyone else, and there’s no public directory or search that lets someone find a person on Notare without already having their email or a direct link. A reply thread is private to its two participants. If a recording has Ensemble Mode turned on, its reviewers can see each other’s marks and comments as they’re added — that sharing only happens when Ensemble Mode is explicitly turned on for that recording, and is enforced at the database level, not just hidden in the interface.

We use a small number of service providers to run Notare, each only for the specific job listed:

• Mux — video hosting, processing, and playback.
• OpenAI — transcribing dictated voice comments (Whisper API).
• Cloudflare R2 — storage for voice notes, photos, and file attachments.
• Resend — sending the transactional emails described above.
• PostHog — product usage analytics.
• Neon and Vercel — database and application hosting.
• Google / Facebook — only if you choose to sign in that way.

We don’t sell personal data, and we don’t use it for advertising — Notare doesn’t run ads.

Deleting something in Notare (a project, a piece, a submission) hides it from your view rather than erasing it immediately — the same way most of us would rather recover an accidental delete than lose real feedback for good. To request that your account or data be permanently removed, see how to delete your data.

Passwords are hashed, never stored as plain text. Video, photo, and file access goes through short-lived signed links, not permanent public URLs. Access between different people’s data is enforced at the database level, not only in the app’s interface.

Notare isn’t directed at children. Sign-up requires a date of birth, and anyone under 18 is turned away before an account is created — we may support younger students later, with a parent or guardian’s consent, but that isn’t built yet.

This is a small, active pilot, and this page may be updated as the product changes. Anything material will be communicated directly to active participants.

Questions, or a request to see, correct, or delete your data: hello@getnotare.com.