Legal
Privacy Policy
Last updated: August 21, 2026
Score to Video is made and operated by Teeny Signals. In this policy, "Teeny Signals," "we," "us," and "our" all mean Teeny Signals, and "you" means the person using the service. We collect as little as the service can run on: enough to keep your account and credits straight, enough to carry a project's alignment between your devices, and product analytics you can turn off. Your PDF, audio, MusicXML, and image files never reach our servers at all.
1. What we collect
Account details. Your first and last name, your email address, and a hashed version of your password. We also record that you accepted the Terms of Service and whether you asked for the newsletter.
Project working data. Project names, page crops, timing marks, and other alignment information, so a project can follow you between devices. This is data about your project, not the music itself: see section 3.
Purchase records. Which credit packs you bought, when, and how many credits you have left. Payments run through Polar, so we never see or store your full card number: see section 5.
Affiliate program data. If you join the affiliate program, your referral code and a record of the purchases attributed to your link. If you follow someone's affiliate link, a referral marker in your browser and, should you buy, a note on the order that it came through that link. Section 7 sets out both sides in full.
Support messages. Whatever you send us through the support form, along with the email address you give so we can reply.
Product analytics. We use PostHog to understand how the studio is used. See section 6 for what it collects and how to switch it off.
Security and server logs. Sign-in and sign-up pages are protected by Cloudflare Turnstile, and our servers keep short-lived logs that include IP addresses, used to stop abuse and to debug failures.
2. How we use your data
To run your account and verify your email, to sync your project's alignment data, to track and apply your credits, to answer support requests, to keep the service secure and working, to meet tax and accounting obligations for purchases, and to improve the product based on aggregate analytics. If you opted in, we also send an occasional newsletter and credit-sale email, and every one of those has an unsubscribe link.
We do not sell your personal data, and we do not use it to serve you advertising.
Where the GDPR or UK GDPR applies, our legal bases for each purpose are:
| Purpose | Legal basis |
|---|---|
| Accounts, email verification, project sync, and credits | Performance of our contract with you (Article 6(1)(b)) |
| Payments and required transaction records | Performance of our contract and compliance with legal obligations (Articles 6(1)(b) and 6(1)(c)); see section 5 |
| Security logs, fraud prevention, abuse prevention, and debugging | Our legitimate interests in keeping the service secure and reliable (Article 6(1)(f)) |
| Responding to support requests | Performance of our contract where needed to provide the service, and otherwise our legitimate interest in helping users (Articles 6(1)(b) and 6(1)(f)) |
| Running the affiliate program for people who join it | Performance of our contract with you (Article 6(1)(b)); see section 7 |
| Attributing a referred purchase and applying the referral discount | Our legitimate interests in operating the referral program, crediting affiliates accurately, and preventing referral fraud (Article 6(1)(f)), together with performance of our contract in giving you the discount you sought by following the link (Article 6(1)(b)) |
| Newsletter and credit-sale emails | Your consent (Article 6(1)(a)), which you may withdraw at any time using the unsubscribe link |
| Product analytics outside the EU and UK | Our legitimate interest in understanding and improving the service (Article 6(1)(f)); you may opt out as described in section 6 |
3. Your files, and what actually lives where
Stored on our servers: your account details, your credit balance, and your project's working data (project names, crops, timing marks, and other alignment information).
Stored only on your device: every file you import. PDFs, audio recordings, MusicXML files, and any watermark logo image (PNG, JPEG, WebP, or SVG) are cached in your browser (IndexedDB), the alignment and cropping happen in your browser, and the finished video is rendered by your own computer. None of it is uploaded to us, and we could not hand it back to you if we wanted to.
Score to Video is not a storage provider, a backup service, or an archive. Do not keep your only copy of anything here. Browser storage can be erased at any time by clearing site data, private browsing, low disk space, or moving to another computer, and files erased that way are gone for good. The alignment data on our servers is a convenience rather than a guarantee, and it too can be lost, corrupted, or deleted. We make no guarantee that any of your data will be preserved, recoverable, or accessible at any time. Keep your own backups.
4. Third parties
- Polar Software Inc. ("Polar") is our billing and checkout provider and acts as the merchant of record for every purchase: it runs the checkout, takes payment, handles subscriptions and one-off orders, calculates and remits sales tax and VAT, and issues receipts and refunds. Its own payment sub-processors, including Stripe, handle the card transaction itself. Section 5 covers this in detail.
- Cloudflare hosts the site, stores account, credit, and project alignment data, delivers our email, and provides the Turnstile anti-bot check.
- PostHog is our product analytics provider and receives the usage data described in section 6 from visitors outside the EU and UK, unless they have opted out. Its privacy policy is at posthog.com/privacy.
Each of these providers handles data under its own privacy policy and only for the purposes above. We may change providers as the service evolves. We do not pass your data to anyone else except where the law requires it.
International transfers. Cloudflare, PostHog, Polar, and some of their sub-processors are based in the United States or may process data outside the EU and the UK. Where transfer safeguards are required, transfers rely on an applicable approved mechanism, such as the European Commission's Standard Contractual Clauses and the UK Addendum, or the EU–US Data Privacy Framework where applicable.
5. Payments, billing, and Polar
Because Polar is the merchant of record, it is the seller on your receipt and the party that collects your payment details. We never receive your full card number; our own records show only that an order completed and how many credits it granted.
What is shared with Polar. The data below is collected by Polar at checkout or passed to it so an order can be attributed to your account:
- Your name.
- Your email address.
- Your billing address, and the country and postal code needed to work out sales tax or VAT.
- Payment information. Card details go directly to Polar and its payment sub-processors; neither we nor Polar's dashboard receives your full card number, only the card type, the last four digits, and the expiry.
- A tax or VAT identification number, if you provide one for a business purchase.
- Purchase and transaction history: orders, amounts, currency, dates, refunds, and the account identifier we send so the credits land in the right place.
- If you bought through an affiliate link, the single-use discount code applied to the order and a marker identifying the referring affiliate's account, so the discount is honored and the referral can be credited. See section 7.
Sub-processors. Polar uses its own payment sub-processors, including Stripe, Inc., to process the card transaction and to run fraud and risk checks. Those providers handle your payment data under their own terms and privacy policies.
Legal basis. Where the GDPR or UK GDPR applies, we process this data to perform our contract with you (Article 6(1)(b)): taking payment and granting the credits you bought is the contract itself, so no separate consent is needed for transactional data. Keeping the resulting records is processing for compliance with a legal obligation (Article 6(1)(c)), and fraud prevention rests on our legitimate interests (Article 6(1)(f)). This is a different footing from analytics, which are optional and covered in section 6.
Retention. We and Polar keep transaction records for as long as tax, accounting, and financial-reporting law requires us to, which in most jurisdictions is six to seven years from the end of the tax year in question. That obligation outlives your account: closing it does not erase records we are required to keep.
Polar's handling of your data is governed by its own privacy policy, which you should read if you want to see what happens downstream: polar.sh/legal/privacy. Stripe's is at stripe.com/privacy.
6. Analytics, cookies, and opting out
We use PostHog, a third-party product analytics service, to see how the studio is used in aggregate: which features get used, which steps people get stuck on, and what breaks. It is product research, not a profile we sell or trade.
What it collects. Pages viewed and time on them; interactions such as clicks, form submissions, and button presses; technical details such as browser, operating system, device type, screen size, and language; the site or campaign link that referred you; and errors the app hits. Password and payment fields are excluded from capture.
Session recordings. Inside the studio only, at /app, PostHog records a playback of the session so we can see where an edit goes wrong. It is heavily masked: every piece of text on the page and everything you type is replaced with blocks before anything leaves your browser, so the recording shows layout and interaction rather than content. Your score is never recorded: the pages of music are drawn on a canvas, and canvas content is excluded. Recording does not run on any other page: not the homepage, not the pricing section, not the sign-in or sign-up forms, and not your account page. Opting out below stops it along with everything else.
Cookies and local storage. PostHog sets a cookie and writes to your browser's local storage to hold a randomly generated visitor identifier and a session identifier, so repeat visits from the same browser can be counted as one visitor rather than many. That identifier is a random string, not your name or email, and the cookie can persist for up to a year. Your opt-out choice is stored the same way. This is separate from the strictly necessary cookie that keeps you signed in, which is always set and is not analytics, and from the referral cookie described in section 7, which is set only if you follow an affiliate link.
IP address and regional routing. Cloudflare receives your IP address as our hosting and security provider and determines the request's country at its edge. That Cloudflare result controls whether PostHog is allowed to initialize. For visitors outside the EU and UK who have not opted out, the analytics request reaches PostHog and may be used to derive an approximate location. We do not use it to identify you personally.
Analytics are optional, and turning them off costs you nothing: every feature of Score to Video works exactly the same either way.
Opting out yourself. Visit /optout and analytics stop for that browser. Nothing further is sent to PostHog from it. The choice is stored in your browser, so repeat it on each browser or device you use, and set it again if you clear your browser data.
EU and UK visitors. If Cloudflare's country result places the request in the European Union or the United Kingdom, PostHog is not initialized. No analytics cookie or local storage entry is set, and no request or IP address is sent to PostHog. You do not have to do anything, and we do not ask you to consent to something we are not collecting.
7. The affiliate program
The affiliate program is optional, and it has two sides: people who join it and share a referral link, and people who follow such a link. The Terms of Service govern how the program works and make clear that we may change or end it, and the discount it offers, at any time. This section is only about the data involved.
If you join as an affiliate. We store a flag that you are in the program and a randomly generated five-digit referral code, which forms your public link. We also keep a record of each purchase attributed to that link: the order, an internal identifier for the buyer's account, the email address they used at checkout, whether it earned you a credit, whether it was later refunded, and when. That record is what your dashboard totals are calculated from, and the checkout address is how we tell one customer from another — it is what lets us count a repeat buyer once and detect self-referral and other misuse. The address is held for that purpose only; it is never shown to the affiliate (see below).
What affiliates can and cannot see. Your dashboard shows counts and nothing more: how many customers have purchased through your link, and how many credits you have earned. It never shows who those people are. We do not give affiliates the names, email addresses, locations, purchase amounts, or any other personal data of the people they refer, and there is no way to work backwards from the totals to an individual.
If you follow an affiliate link. Visiting a referral link sets a first-party cookie in your browser (st_ref). It holds only the public five-digit code of the affiliate whose link you followed, lasts up to 30 days, and is readable only by this site. It is not an analytics cookie and does not profile you: its sole job is to apply your discount and to attribute a purchase if you make one, so it is set regardless of any analytics opt-out. You can remove it at any time by clearing this site's data in your browser, and removing it simply means no discount and no attribution. Following a link is not tied to your identity, and we do not tell the affiliate that you personally visited.
If you then buy credits. We record on the order that it came through that affiliate's link, and we ask Polar to create a single-use discount code tied to your account, valid for 24 hours. We store that code, its expiry, and the referral code it came from, so a repeat attempt within those 24 hours reuses the same code instead of issuing another. Polar receives the discount code along with the checkout data described in section 5. The affiliate is credited from the attribution record only; they receive no information about you.
Retention. Program membership and your referral code are kept while your account exists. Attribution records are kept while the account they relate to exists and for as long as the underlying transaction records must be kept under section 5, since they explain why a credit was granted. Expired discount-code records are kept only until they are replaced by a newer one for the same account. Leaving the program does not by itself erase the records of credits already earned.
8. Keeping and deleting your data
Account, credit, and project alignment records are kept while your account exists. Purchase and transaction records are kept for the period tax and accounting law requires, as described in section 5, even after an account is closed. Cloudflare and PostHog retain server logs and analytics data under their default service settings rather than a longer period set by us. Those defaults are currently no more than 7 days for Cloudflare Workers logs and one year for PostHog analytics on its free tier. We expect to keep email communications, including support requests, indefinitely unless you ask us to delete them, subject to any record we must keep for legal, security, or dispute-resolution purposes.
You can ask us to delete your account and the personal data attached to it, or to send you a copy of it, by contacting support. Depending on where you live, you may also have the right to correct your data, object to how we use it, or complain to your local data protection authority. Deleting your account does not touch the files on your device, since those were never ours to delete. Note that deleting your account forfeits any credits on it: see the Terms of Service.
9. Children
Score to Video is not intended for children under 13 (under 16 in the EU and the UK). If you believe a child has given us personal data, contact us and we will remove it.
10. Changes to this policy
We will update this page when our practices change, and the date at the top will always show the most recent revision. Teeny Signals decides, at its sole discretion, whether a given change is significant enough to warrant emailing account holders; many revisions will be posted here without a separate notice.
11. Contact
Teeny Signals is the data controller for the personal data described in this policy. Questions or requests can be sent to legal@scoretovideo.com or through support. See also our Terms of Service.