Legal
Privacy Policy
Last updated: August 9, 2026
Score to Video is made and operated by Teeny Signals. In this policy, "Teeny Signals," "we," "us," and "our" all mean Teeny Signals, and "you" means the person using the service. We collect as little as the service can run on: enough to keep your account and credits straight, enough to carry a project's alignment between your devices, and product analytics you can turn off. Your PDF, audio, and MusicXML files never reach our servers at all.
1. What we collect
Account details. Your first and last name, your email address, and a hashed version of your password. We also record that you accepted the Terms of Service and whether you asked for the newsletter.
Project working data. Project names, page crops, timing marks, and other alignment information, so a project can follow you between devices. This is data about your project, not the music itself: see section 3.
Purchase records. Which credit packs you bought, when, and how many credits you have left. Payments run through Polar, so we never see or store your full card number: see section 5.
Support messages. Whatever you send us through the support form, along with the email address you give so we can reply.
Product analytics. We use PostHog to understand how the studio is used. See section 6 for what it collects and how to switch it off.
Security and server logs. Sign-in and sign-up pages are protected by Cloudflare Turnstile, and our servers keep short-lived logs that include IP addresses, used to stop abuse and to debug failures.
2. How we use your data
To run your account and verify your email, to sync your project's alignment data, to track and apply your credits, to answer support requests, to keep the service secure and working, to meet tax and accounting obligations for purchases, and to improve the product based on aggregate analytics. If you opted in, we also send an occasional newsletter and credit-sale email, and every one of those has an unsubscribe link.
We do not sell your personal data, and we do not use it to serve you advertising.
Where the GDPR or UK GDPR applies, our legal bases for each purpose are:
| Purpose | Legal basis |
|---|---|
| Accounts, email verification, project sync, and credits | Performance of our contract with you (Article 6(1)(b)) |
| Payments and required transaction records | Performance of our contract and compliance with legal obligations (Articles 6(1)(b) and 6(1)(c)); see section 5 |
| Security logs, fraud prevention, abuse prevention, and debugging | Our legitimate interests in keeping the service secure and reliable (Article 6(1)(f)) |
| Responding to support requests | Performance of our contract where needed to provide the service, and otherwise our legitimate interest in helping users (Articles 6(1)(b) and 6(1)(f)) |
| Newsletter and credit-sale emails | Your consent (Article 6(1)(a)), which you may withdraw at any time using the unsubscribe link |
| Product analytics outside the EU and UK | Our legitimate interest in understanding and improving the service (Article 6(1)(f)); you may opt out as described in section 6 |
3. Your files, and what actually lives where
Stored on our servers: your account details, your credit balance, and your project's working data (project names, crops, timing marks, and other alignment information).
Stored only on your device: every file you import. PDFs, audio recordings, and MusicXML files are cached in your browser (IndexedDB), the alignment and cropping happen in your browser, and the finished video is rendered by your own computer. None of it is uploaded to us, and we could not hand it back to you if we wanted to.
Score to Video is not a storage provider, a backup service, or an archive. Do not keep your only copy of anything here. Browser storage can be erased at any time by clearing site data, private browsing, low disk space, or moving to another computer, and files erased that way are gone for good. The alignment data on our servers is a convenience rather than a guarantee, and it too can be lost, corrupted, or deleted. We make no guarantee that any of your data will be preserved, recoverable, or accessible at any time. Keep your own backups.
4. Third parties
- Polar Software Inc. ("Polar") is our billing and checkout provider and acts as the merchant of record for every purchase: it runs the checkout, takes payment, handles subscriptions and one-off orders, calculates and remits sales tax and VAT, and issues receipts and refunds. Its own payment sub-processors, including Stripe, handle the card transaction itself. Section 5 covers this in detail.
- Cloudflare hosts the site, stores account, credit, and project alignment data, delivers our email, and provides the Turnstile anti-bot check.
- PostHog is our product analytics provider and receives the usage data described in section 6 from visitors outside the EU and UK, unless they have opted out. Its privacy policy is at posthog.com/privacy.
Each of these providers handles data under its own privacy policy and only for the purposes above. We may change providers as the service evolves. We do not pass your data to anyone else except where the law requires it.
International transfers. Cloudflare, PostHog, Polar, and some of their sub-processors are based in the United States or may process data outside the EU and the UK. Where transfer safeguards are required, transfers rely on an applicable approved mechanism, such as the European Commission's Standard Contractual Clauses and the UK Addendum, or the EU–US Data Privacy Framework where applicable.
5. Payments, billing, and Polar
Because Polar is the merchant of record, it is the seller on your receipt and the party that collects your payment details. We never receive your full card number; our own records show only that an order completed and how many credits it granted.
What is shared with Polar. The data below is collected by Polar at checkout or passed to it so an order can be attributed to your account:
- Your name.
- Your email address.
- Your billing address, and the country and postal code needed to work out sales tax or VAT.
- Payment information. Card details go directly to Polar and its payment sub-processors; neither we nor Polar's dashboard receives your full card number, only the card type, the last four digits, and the expiry.
- A tax or VAT identification number, if you provide one for a business purchase.
- Purchase and transaction history: orders, amounts, currency, dates, refunds, and the account identifier we send so the credits land in the right place.
Sub-processors. Polar uses its own payment sub-processors, including Stripe, Inc., to process the card transaction and to run fraud and risk checks. Those providers handle your payment data under their own terms and privacy policies.
Legal basis. Where the GDPR or UK GDPR applies, we process this data to perform our contract with you (Article 6(1)(b)): taking payment and granting the credits you bought is the contract itself, so no separate consent is needed for transactional data. Keeping the resulting records is processing for compliance with a legal obligation (Article 6(1)(c)), and fraud prevention rests on our legitimate interests (Article 6(1)(f)). This is a different footing from analytics, which are optional and covered in section 6.
Retention. We and Polar keep transaction records for as long as tax, accounting, and financial-reporting law requires us to, which in most jurisdictions is six to seven years from the end of the tax year in question. That obligation outlives your account: closing it does not erase records we are required to keep.
Polar's handling of your data is governed by its own privacy policy, which you should read if you want to see what happens downstream: polar.sh/legal/privacy. Stripe's is at stripe.com/privacy.
6. Analytics, cookies, and opting out
We use PostHog, a third-party product analytics service, to see how the studio is used in aggregate: which features get used, which steps people get stuck on, and what breaks. It is product research, not a profile we sell or trade.
What it collects. Pages viewed and time on them; interactions such as clicks, form submissions, and button presses; technical details such as browser, operating system, device type, screen size, and language; the site or campaign link that referred you; and errors the app hits. Password and payment fields are excluded from capture.
Cookies and local storage. PostHog sets a cookie and writes to your browser's local storage to hold a randomly generated visitor identifier and a session identifier, so repeat visits from the same browser can be counted as one visitor rather than many. That identifier is a random string, not your name or email, and the cookie can persist for up to a year. Your opt-out choice is stored the same way. This is separate from the strictly necessary cookie that keeps you signed in, which is always set and is not analytics.
IP address and regional routing. Cloudflare receives your IP address as our hosting and security provider and determines the request's country at its edge. That Cloudflare result controls whether PostHog is allowed to initialize. For visitors outside the EU and UK who have not opted out, the analytics request reaches PostHog and may be used to derive an approximate location. We do not use it to identify you personally.
Analytics are optional, and turning them off costs you nothing: every feature of Score to Video works exactly the same either way.
Opting out yourself. Visit /optout and analytics stop for that browser. Nothing further is sent to PostHog from it. The choice is stored in your browser, so repeat it on each browser or device you use, and set it again if you clear your browser data.
EU and UK visitors. If Cloudflare's country result places the request in the European Union or the United Kingdom, PostHog is not initialized. No analytics cookie or local storage entry is set, and no request or IP address is sent to PostHog. You do not have to do anything, and we do not ask you to consent to something we are not collecting.
7. Keeping and deleting your data
Account, credit, and project alignment records are kept while your account exists. Purchase and transaction records are kept for the period tax and accounting law requires, as described in section 5, even after an account is closed. Cloudflare and PostHog retain server logs and analytics data under their default service settings rather than a longer period set by us. Those defaults are currently no more than 7 days for Cloudflare Workers logs and one year for PostHog analytics on its free tier. We expect to keep email communications, including support requests, indefinitely unless you ask us to delete them, subject to any record we must keep for legal, security, or dispute-resolution purposes.
You can ask us to delete your account and the personal data attached to it, or to send you a copy of it, by contacting support. Depending on where you live, you may also have the right to correct your data, object to how we use it, or complain to your local data protection authority. Deleting your account does not touch the files on your device, since those were never ours to delete. Note that deleting your account forfeits any credits on it: see the Terms of Service.
8. Children
Score to Video is not intended for children under 13 (under 16 in the EU and the UK). If you believe a child has given us personal data, contact us and we will remove it.
9. Changes to this policy
We will update this page when our practices change, and the date at the top will always show the most recent revision. Teeny Signals decides, at its sole discretion, whether a given change is significant enough to warrant emailing account holders; many revisions will be posted here without a separate notice.
10. Contact
Teeny Signals is the data controller for the personal data described in this policy. Questions or requests can be sent to legal@scoretovideo.com or through support. See also our Terms of Service.