Privacy Policy
Last updated: September 29, 2026.
Who Is Responsible
This Privacy Policy explains how PlayTheory handles your personal data. The controller is Excellence Online B.V. (PlayTheory and Musiciangoods are its brands), Crooswijkseweg 108, 3034 HP Rotterdam, the Netherlands; the full company details are listed below. For any privacy question or request, email playtheory@musiciangoods.com.
Company details
Excellence Online B.V. · PlayTheory is a brand of Excellence Online B.V.
- Chamber of Commerce (KvK):
- 96799765
- VAT:
- NL867766402B01
- Registered address:
- Crooswijkseweg 108, 3034 HP Rotterdam, Netherlands
What We Collect
Account data: your email address, display name, username, avatar and, if you sign in with Google or Apple, the basic profile those services share. Learning data: lessons, exercises and games you complete, XP, streaks, accuracy, mistakes, practice settings and lesson ratings. Social data: friends, friend requests, blocks and notifications. Subscription data: your plan, its status and payment history (card details are handled by Stripe; we never see them). Messages you send to the AI tutor, support or an issue report, including any screenshot you attach. Feedback you choose to send, such as a rating, reasons and a comment in the "How is PlayTheory working for you?" question, is stored with your account to improve PlayTheory and kept as long as you have an account. Technical data: device and browser type, approximate region, and error reports. Sign-up source: when you create an account we store once where you came from: the campaign tags in the link you used (such as utm_source), the website that referred you, the first page you opened and your country as derived from your IP address (the IP address itself is not stored); whether you arrived through an ad click is stored only as yes or no, and only with your marketing consent. Creator referral: if you arrive through a PlayTheory creator's link or use a creator's discount code, we record which creator referred you. With your consent: usage analytics and session recordings, marketing cookies and ad click IDs, marketing emails and push notifications.
Microphone and MIDI
Some exercises can listen through your microphone to hear which notes you play. The sound is analysed on your own device in real time; it is never recorded, uploaded or stored. MIDI input is also processed only on your device. Your browser asks for permission first and you can withdraw it at any time in your browser settings.
Why We Use It and Legal Bases
To provide the Service, your account, your progress, social features, the AI tutor and your subscription (performance of our contract with you). To send service messages such as receipts, security notices and important changes (contract and legal obligation). To keep the Service secure, prevent abuse and fix errors (our legitimate interest in a safe, working Service). To learn which channels bring learners to PlayTheory, using the sign-up source described above (our legitimate interest in measuring our own marketing; you can object at any time by emailing us). To pay creators a commission on the members they refer (our legitimate interest in running our creator programme); a creator only ever sees totals, such as how many members they referred and what they earned, never your name, email address or activity. For usage analytics and session recordings, marketing cookies and ad measurement, marketing emails, reminder emails and push notifications (your consent, which you can withdraw at any time). To keep payment and tax records (legal obligation). We do not sell your data and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who We Share It With
Within PlayTheory, other signed-in learners see your username, avatar and learning totals (XP, lessons completed and streak); only your friends also see your first name and more of your progress. Outside PlayTheory, we use these service providers, each under a data-processing agreement and only for the purpose mentioned: Supabase (database, login and file storage; servers in the United States); Vercel (website hosting); Stripe (payments and subscriptions); Klaviyo (email delivery and marketing emails); OpenAI (answers from the AI tutor; your messages are sent without your name or email and are not stored by OpenAI for training); ElevenLabs (generating lesson narration from lesson texts, no personal data); PostHog (usage analytics and session recordings, only with your consent; text you type is hidden); Sentry (error reports without names or email addresses); SiteGround (our email for support and issue reports); Shopify (the Musiciangoods shop cart when you shop). With your marketing consent, Meta receives information about visits and sign-ups through the Meta Pixel and, when you start a trial, become a member or make a payment, our server tells Meta that this happened (Meta Conversions API), with the plan's amount and currency and your email address in hashed (SHA-256) form, so Meta can measure our ads. Meta is jointly responsible with us for that collection. With your marketing consent, Google also receives information about visits, sign-ups and completed checkouts through the Google Ads tag; no name, email address or account ID is sent to Google, and Google is jointly responsible with us for that collection. Without your marketing consent nothing is sent to Meta or Google. If you sign in with Google or Apple, those companies process your sign-in under their own privacy policies. Browser push notifications are delivered through your browser maker's push service.
Transfers Outside the EU
Several providers above are based in, or process data in, the United States. Where a provider is certified under the EU–US Data Privacy Framework we rely on that adequacy decision; otherwise we use the European Commission's Standard Contractual Clauses with additional safeguards. You can ask us for a copy of the relevant safeguards.
How Long We Keep It
Account, learning and social data: as long as you have an account; when you delete your account we delete it, including your profile at our email provider, within 30 days (backups roll over within a further 30 days). Payment and invoice records: 7 years, as Dutch tax law requires. In-app notifications: 180 days. Usage analytics events: 13 months. Session recordings: 30 days. Sign-up source and creator referral: as long as you have an account. Daily usage counters: 90 days. Payment webhook logs: 90 days. Support messages and issue reports: 24 months. Marketing consent records: as long as the consent applies, plus the period needed to prove it.
Cookies and Similar Technologies
Necessary: storage that keeps you signed in, remembers your settings and your cookie choice; always on. Analytics (PostHog, including session recordings): only if you allow it. Marketing (Meta Pixel, Google Ads tag, ad click IDs such as fbclid and gclid): only if you allow it. In the EU/EEA, the UK and Switzerland nothing optional runs before you choose, and "Reject all" is as easy as "Accept all". Elsewhere, where the law works with notice and opt-out, analytics and marketing are on from your first visit; we tell you so, and you can switch them off at any time. You can change or withdraw your choice at any time via "Cookie settings" at the bottom of the page or in Settings. Fonts are served from our own servers.
Your Rights
You have the right to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent at any time without affecting earlier processing. You can download your data and delete your account yourself in Settings, and switch off marketing emails and notifications there. For anything else, email playtheory@musiciangoods.com; we answer within one month. If you are unhappy with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
Security
We protect your data with encryption in transit, access rules in our database that limit each account to its own data, server-side checks for payments and progress, and by giving staff and providers access only where needed. If a data breach is likely to put your rights at risk, we notify the authority and, where required, you.
Children
PlayTheory is intended for people aged 16 and over. Younger learners may only use it with a parent's or guardian's permission. If you believe a child has given us personal data without that permission, contact us and we will delete it.
Changes to This Policy
We update this policy when the Service or the law changes. We tell you about important changes by email or in the app before they apply. The date at the top shows the current version.
Contact
Privacy questions or requests: playtheory@musiciangoods.com, or Excellence Online B.V., Crooswijkseweg 108, 3034 HP Rotterdam, the Netherlands.