Privacy Policy

DFS Academy (“we,” “our”) cares about your privacy. This page explains what information we collect when you use dfsacademy.org and the DFS Academy app, why we collect it, who we share it with, and the choices you have.

1. Information we collect

Information you give us

• Account details: your name, email address, and password (stored hashed — we never see it in plain text).
• Profile information you choose to add: instruments you play, skill level, city/state, date of birth, gender. All optional.
• Payment information: handled directly by Stripe. We never see or store your card number — Stripe gives us back a customer identifier and a subscription status.
• Content you create: recordings you save, beats you build, practice notes, community posts.

Information collected automatically

• Usage data: which pages you visit, which lessons you complete, when you practice. Used to power features like streaks and the practice journal.
• Device info: browser, operating system, screen size — used to debug issues and optimize layouts.
• Cookies and local storage: we store your session, preferences (haptics, default tempo), and a build identifier so we can detect outdated app versions. We do not use third-party advertising cookies.

2. How we use your information

• To create and manage your account.
• To process subscription payments through Stripe.
• To send transactional email — welcome, payment receipts, password reset.
• To save your practice progress, streaks, and journal entries.
• To improve the app — fix bugs, prioritize features, measure performance.
• To enforce our Terms of Service.

3. Who we share information with

We share only what is needed to operate the service. We do not sell your information.

• Supabase — hosts our database and authentication. Your account record lives here.
• Stripe — processes payments. Stripe's privacy policy applies to that data.
• Resend — delivers our transactional email.
• Cloudflare R2 — stores audio files you upload.
• Vercel — hosts the website and serverless functions.
• PostHog (if enabled) — product analytics.
• Sentry (if enabled) — crash and error reporting.
• Law enforcement — only when required by valid legal process.

4. How long we keep it

We keep your account information for as long as your account is active and for a reasonable time afterward in case you come back. You can delete your account at any time by emailing hi@dfsacademy.org; we'll remove your profile, progress, and content within 30 days, except for records we are legally required to retain (e.g. payment receipts for tax purposes).

5. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information; to opt out of certain uses; and to lodge a complaint with a regulator. California residents have additional rights under the CCPA; residents of the EU / UK have additional rights under the GDPR. To exercise any of these rights, email hi@dfsacademy.org.

6. Children

DFS Academy is for users 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has signed up, email us and we will delete the account.

7. Security

We use industry-standard protections — HTTPS everywhere, hashed passwords, row-level security on our database, and a small number of administrators with access. No system is perfectly secure, but we take this seriously and will notify affected users in the event of a breach involving personal information.

8. Changes to this policy

We may update this policy from time to time. When we make material changes we will post the new version here and update the “Last updated” date at the top. If you continue using the service after a change, you accept the updated policy.

9. Contact

Email hi@dfsacademy.org with any privacy questions or requests.