Privacy policy
Last updated: 29 September 2026.
NodaLab stores what it needs to give you an account and keep what you build in it, and nothing else. Here is the whole list.
What is stored
- Your account: the name and e-mail address you gave, your password as a hash that cannot be turned back into it, your language and theme, a profile picture if you added one, and the last day you used the app signed in.
- What you build: your saved projects and collections, the MIDI files you upload, the pictures you send to your image library, the voicings, scale types and chord types in your theory library, the groups you own or belong to, the messages you post in a shared project's discussion or in a group's conversation, and who you share with.
- A picture you send is brought down to 2048 pixels at most on its longest side and re-encoded by your browser before it leaves it, which drops its metadata — a phone photo's location, its camera, its date — and the server takes out whatever is left of them before keeping it. It is seen by you, by whoever you share it with, and by anyone who may open a project showing it.
- Your workspace: which sections are open and the project you were editing, so the app reopens as you left it.
- If you signed up and have not followed the link mailed to you yet: the sign-up itself, with the same name, address, password hash and the answers you chose (how you heard of NodaLab, where you are with music, what for), deleted after a day if the link is not followed.
- If someone generated an invitation link for you: the link itself, until it is used, revoked or lapses after two weeks. It holds the role it grants, who issued it and which group you will join, and nothing about you.
- The reports you send — about the app, from your account page, and about something somebody else keeps — a picture, a project, a message, a MIDI file or a theory definition — with the Report button shown beside it: what you wrote, what it is about, and the answer an admin writes back. An admin sees them with your name and address; you follow them, and can delete any of yours, under Feedback on your account page.
- When the app fails in your browser, it tells the server by itself: the error's message, the lines of the application's code it went through, which build of the app it was and which page was open — the name of a page of NodaLab's, an article or an account section, never which project. Nothing says whose browser it was: no account, no address. An admin reads them to fix the app; one that does not happen again for thirty days is deleted.
- For every page of the site, how many different people opened it each day. To count you once rather than at every reload, the server keeps for the day a mark standing for your visit: your address and browser hashed under a secret it draws at random each day and never writes down. That mark cannot be turned back into your address, cannot be matched with the one you leave the next day, and is deleted as soon as the day is over. What is left, and kept, is the count: no address, no browser, no account.
Why
To run the account you opened and the features you use: signing in, saving, sharing with the people you chose. And to improve the app: an admin sees the last day each account was used. Nothing is used for advertising, profiling or resale, and nothing is handed to anyone else.
Moderation
To keep the site within the law, an admin can open every picture, every project and every conversation stored here, private ones included, and remove anything an account stores: a picture, a project, a message, a MIDI file or a theory definition — and delete an account. Removing one of yours, or your account, takes a reason, which is mailed to you. Anyone with an account can point content out to the admins with the Report button shown beside it.
Cookies
One cookie, set when you sign in, keeps you signed in for fifteen days. It is technical and carries no tracking. The demo and the public pages set none; they remember your language and theme in your own browser only.
Third parties
Instrument sounds are served by the application itself, so playing a project contacts nobody else. A picture a project shows from another site is not loaded at all: a placeholder stands in for it, so that site never learns you opened the project. The one exception is a video: a project showing one embeds YouTube's player and loads, from youtube.com, the script that drives it, and your browser then talks to YouTube directly, which sees your address and applies its own policy. The mails the application sends — carrying the link that opens the account you signed up for, carrying the link you asked for when you forgot your password, telling you, when somebody signs up with your address, that it already has an account, and telling you why an admin removed something of yours or deleted your account — leave through Brevo (Sendinblue SAS, France), which relays them and sees your name and address for that purpose only. The application itself sends nothing anywhere else.
How long
As long as your account exists. A project you delete waits thirty days in your trash, where you can restore it, then is deleted. A sign-up whose link is not followed is deleted after a day. A link to choose a new password is deleted once used, and within the hour if it is not. The mark that tells one visit from a reload is deleted the day after it was left; the page counts themselves are kept for four hundred days.
Your rights
You can read and change your name, e-mail address, password and picture from your account page at any time, and delete your account there: it removes everything listed above, at once and without a copy being kept, except for backups of the whole database, which are overwritten within a few weeks. For anything else — access, correction, a complaint — write to {contact}. You may also lodge a complaint with the CNIL, the French data protection authority.