Privacy policy

Felix Kohler, 55 rue Grignan, 13001 Marseille, is the controller of the processing described here, within the meaning of article 4(7) of Regulation (EU) 2016/679 (GDPR). You can reach the controller at mail@musictheory.center.

No data protection officer has been appointed, and none is required: the conditions of article 37 GDPR are not met — this is not a public authority, the site monitors nobody on a large scale, and it processes no special-category data.

The site remembers a handful of settings in your browser's local storage. They stay on your device, they are never sent to the server, and no other site can read them.

Storing a setting that you yourself chose is strictly necessary to provide the service you asked for, and is therefore exempt from consent under article 82 of the French Data Protection Act and the CNIL’s guidance on trackers. That is why you are not asked to accept anything: there is nothing here to accept, and a banner asking permission for exempt storage would be asking a question with no legal effect.

To erase all of it, clear this site’s data in your browser. The site keeps working; it simply forgets what you had chosen.

The site uses Cloudflare Web Analytics, which counts page views, referrers, countries and browser families in aggregate. It is the only third-party script on the site, it is served by the same host that already serves the pages, and it is what tells the publisher which articles are worth writing more of.

It sets no cookie, reads nothing from your browser’s storage, and builds no identifier — it cannot follow you between sessions, and it cannot follow you to any other site. Nothing it records is linked to the messages you send or to a newsletter address.

The legal basis is the legitimate interest of the publisher in knowing whether the site is read (article 6(1)(f) GDPR). Because no information is stored on or read from your device, article 82 of the French Data Protection Act does not apply and no consent is required — which is why, again, there is no banner.

The first time you play something, your browser fetches piano samples from tonejs.github.io, a public archive published by the Tone.js project. That request reaches GitHub, and like any web request it carries your IP address and user-agent.

Nothing else is sent, no cookie is set, and the request happens only if you ask to hear something. If you never press play, your browser never contacts it.

Serving a web page means a server receives the request. Cloudflare, Inc. therefore processes your IP address, the address requested, the date and time, and your browser’s user-agent string, for as long as its own retention policy provides.

The purpose is to deliver the pages and to keep the site available and protected against attack and abuse. The legal basis is the legitimate interest of the publisher in operating and securing the site (article 6(1)(f) GDPR).

These records stay with the host. The publisher does not export them, does not cross-reference them with anything, and builds no profile from them.

The feedback form collects your message, and a name and an email address if you choose to fill those in. They are used for one thing: reading what you wrote and answering it.

The legal basis is the legitimate interest in replying to people who write in (article 6(1)(f) GDPR), and your consent for the contact details you volunteer. Giving a name or an address is optional; leave them blank and the message is anonymous.

Messages are kept for as long as the exchange needs and at most twelve months after the last one, unless a longer period is necessary to establish, exercise or defend a legal claim.

If you sign up, your address is sent to Brevo, which emails you a confirmation link. Until you click that link nothing happens: you are not on any list, and the address is not kept. That is double opt-in, and the click is the record of your consent.

This site stores no list of its own. The address goes from the form to Brevo and is never written down here — not in a file, not in a database, not in a log. The one copy that exists is the one Brevo holds.

The purpose is to tell you when a new chapter or lesson is published, and nothing else. The legal basis is your consent (article 6(1)(a) GDPR), which you may withdraw at any moment — every message carries a one-click unsubscribe link, and using it deletes the address. Addresses that are never confirmed are dropped rather than kept.

The one-click course poll that used to sit beside the sign-up has been withdrawn and is not coming back in that form. Its endpoint refuses every request.

Two processors, both under article 28 GDPR and both bound by contract to act only on the publisher’s instructions: Cloudflare, Inc., which serves the site and relays the contact form to the publisher’s inbox, and Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, SIREN 498 019 298), which holds the newsletter list and sends its mail. Brevo sees an address only if you sign up.

Brevo is a French company and stores the list on servers in the European Union, so no transfer outside the EU is involved in the newsletter. The host, by contrast, runs a worldwide network, so a page may be served to you from outside the European Union; such transfers are covered by the standard contractual clauses adopted by the European Commission and, where applicable, by the EU–US Data Privacy Framework.

Nothing is ever sold, rented, exchanged or passed to an advertiser. Data may be disclosed to a public authority only where the law obliges it.

Articles 15 to 22 of the GDPR give you the right to:

Write to mail@musictheory.center. You will get an answer within one month, as article 12(3) GDPR requires — extended by two months if the request is complex, in which case you are told within the first month and why.

Proof of identity is asked for only where there is real doubt about who is making the request, and nothing more than necessary is asked for.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or cnil.fr.

The site is served over HTTPS only. It keeps no register of readers and no password that could leak, and it collects the least it can in the first place — which is the one protection that cannot fail. This is what article 32 GDPR asks for, at the scale of this site.

Should a breach nevertheless occur and present a risk to your rights, the CNIL is notified within 72 hours and, where the risk is high, so are you (articles 33 and 34 GDPR).

This is a music-theory reference, not a service aimed at children. There is no account to open, so no child’s consent to an information-society service is ever collected within the meaning of article 8 GDPR and article 45 of the French Data Protection Act.

This policy changes when the site does, and the date at the top of the page says when it last did. Any change that widens what is collected is published here before it takes effect.

This policy is published in English, French and Spanish; should the versions diverge, the French one prevails.