Vicino Labs
Chiave

Privacy Policy

Effective 2026-11-12Version 1.1Operator Vicino Labs

Chiave, made by Vicino Labs, is an app for writing, scanning and transposing scores. Its basic features need no account; your scores, your edits and the original scanned page images are stored only on your device. Only when you use score scanning, Ask Chiave or the optional sign-in (welegato ID) does anything go through our server (EU) and the services below. Here is exactly what the app handles.

1. Data controller

The operator's address and contact details are at the end of this document and in the Impressum.

Vicino Labs is the “controller” under the EU General Data Protection Regulation (GDPR) for any personal data processed in connection with this app.

2. Summary

  • Every feature works without signing up. Scores, edits and original scanned page images stay on your device and are not uploaded to any cloud.
  • With score scanning (optional) the app cuts each page on your device into small strips of about 2 bars and sends them through our server to Google Gemini to read the notes. Strip images and recognised results are not stored on the server.
  • To count pages for your plan, only a hash of a device identifier is stored on our server.
  • No ad networks and no analytics or tracking tools. The link at the bottom of the screen on the Free plan is our own banner for welegato, a service of the same company.
  • Signing in with a welegato ID is optional. If you sign in, account data is handled under the welegato privacy policy.
  • Questions you ask Ask Chiave go through our server and Google Gemini. Questions are not stored.
  • Writing by sound turns microphone sound into notes on your device only; the sound is never sent or stored. The app does not use your location.

3. Data stored on your device

  • Scores you write or scan, and your edits and transpositions
  • The original page images you picked for scanning
  • App settings
  • On iPhone and iPad a random device number in the Keychain, on the web a random number stored in the browser (see “Plans and device identifier” below)

This data stays in the app's storage on your device and is not sent to us, except for the strip images sent for scanning (below). There is no cloud storage or sync. It is deleted when you remove a score or uninstall the app. The device number in the iPhone/iPad Keychain, however, exists to stop the free trial from being repeated after reinstalling, so it may remain after the app is deleted. Legal basis: providing the app's features (Art. 6(1)(b) GDPR).

4. Camera, photos and files

The app asks for the camera, or lets you pick photos from your album or a PDF file, only when you choose pages to scan. The images you pick are stored on your device and do not leave it, except for the strip images sent for scanning (below).

5. Microphone (writing by sound)

The app asks for the microphone only when you turn on writing by sound. Your singing or playing is read on the device, in very short pieces, for pitch and length only and turned into notes; the sound is not kept as a recording and is not sent to our server or anywhere else. Legal basis: providing the feature you asked for (b).

6. Score scanning (optional)

Score scanning is optional and runs only when you pick pages (camera, photo album, PDF) and start a scan.

  • What is sent: the app cuts each page on your device into small strip images of about 2 bars and sends these strips to our server.
  • Processing: our server (Supabase Edge Function, EU) forwards each strip to Google's Gemini API, which reads the notes; the result is sent back to your device. We use the paid API; Google does not use this data to train its models.
  • Not stored: strip images and recognised results are not stored on our server.
  • Kept on the server: only a hash of the device identifier, the time, the AI model name, a success flag and token counts. Retention period: deleted after 90 days.

Legal basis: providing the feature you asked for (Art. 6(1)(b) GDPR); for the server log, our legitimate interest in running the service and preventing abuse (f). Google processes data under the Google Privacy Policy.

7. Ask Chiave

When you ask the assistant, your question, the app language, the name of the screen you are on, a few recent messages and, when you ask inside a score, the score's key signature, time signature, clef and the name of the note before the insert point go to our server and the Google Gemini API to write the answer. Questions are not stored.

To keep it free with up to 30 questions a day, a hash of the device identifier, the time, the question length, the language and the kinds of suggested actions are kept for 30 days to prevent abuse, then deleted. Legal basis: providing the feature you asked for (b), preventing abuse (f).

8. Reporting an AI answer

If an Ask Chiave answer seems offensive or wrong, you can report it. Only then do the reported answer, the reason you chose, your comment, the app language and version and a hash of the device identifier go to our server, and our team gets a notification mail. Reports are used only for review and to improve the AI, and are kept for 180 days, then deleted. To prevent abuse we accept up to 10 reports a day per device. Legal basis: our legitimate interest in improving the service and handling inappropriate AI output (f).

9. Plans and device identifier

Plans are counted in scanned score pages. To count pages and to stop the free trial from being repeated by reinstalling the app, a device identifier is used.

  • Identifier: ANDROID_ID on Android, a random number stored in the Keychain on iPhone and iPad, a random number stored in the browser on the web.
  • Stored on the server: not the identifier itself but only an irreversible SHA-256 hash (“chiave:” + identifier), together with page usage counts and your plan. No name, email or phone number is needed.
  • Retention period: deleted one year after your last scan. Records of paid subscriptions are kept for as long as tax law requires (up to 10 years).

Legal basis: providing your plan (b), preventing abuse of the free trial (f).

10. Purchases and subscriptions

Pro and Pro+ subscriptions are bought through Google Play or the App Store. The store handles payment and card details; we never receive them. The store's processing falls under the Google Privacy Policy or the Apple Privacy Policy.

11. welegato ID (optional)

Every feature of Chiave works without signing in. If you sign in, you use an account of welegato, run by the same company (the welegato ID).

  • Account data (email, name, sign-in method Apple, Google, Kakao or email, account number) is processed under the welegato privacy policy. An ID created in Chiave is marked “signed up in Chiave”.
  • While you are signed in, the app also sends a sign-in token to the score scanning server so it can check whether a plan has been set for that ID. Scores, scan images and edits are not linked to the ID.
  • For email sign-up and sign-in, Cloudflare Turnstile checks browser signals to stop automated sign-ups (Cloudflare privacy policy). Apple, Google and Kakao sign-in fall under those companies' policies.
  • If you choose “Continue with Apple” on iPhone or iPad, we receive the name and email confirmed by Apple. If you choose “Hide My Email”, we receive only a relay address created by Apple.
  • Deleting the ID in Settings › My ID › Manage ID deletes the welegato account (for all Vicino Labs apps). Scores on the device stay.

Under welegato's terms, only people aged 16 or over can sign in. Legal basis: providing the feature you chose (b).

12. Service providers (processors) and transfers

  • Supabase — server (Edge Function), database and sign-in (welegato ID), EU data centre (Frankfurt, Germany) (policy)
  • Google — Gemini API (score scanning, assistant), Google Play payments, Google sign-in
  • Apple — App Store payments, Sign in with Apple (iPhone, iPad)
  • Kakao — Kakao sign-in
  • Cloudflare — protection against automated email sign-ups (Turnstile)

Where these providers process data outside the EU (e.g. in the USA), this is based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

13. The welegato banner and external links

On the Free plan a link to welegato (a music platform of the same company, welegato.com) is shown at the bottom of the screen. It is our own link, not an ad network or tracking tool. Settings contains links to the store pages of other Vicino Labs apps and to welegato.com.

Links open in your browser or store only when you tap them. The banner link carries utm parameters (such as utm_source=chiave) that only say the visit came from the app, with no value that identifies you. Once open, that site's policy applies — welegato privacy policy.

14. Sharing and export

When you export a score as PDF, PNG image, MusicXML or editable file, it goes — only if you choose to — through your device's share sheet or file picker to the app, place or person you pick.

15. Data we don't collect

Unless you sign in, we receive no account data such as name, email or phone number. The app does not use location, contacts or advertising ID, and contains no analytics SDK and no ad network.

16. Children

The basic features have no age limit. Signing in with a welegato ID is only possible from age 16; under 16, please use score scanning or Ask Chiave with a parent's consent. Children should use external links together with a parent.

17. Your rights

  • Access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR)
  • Lodge a complaint with a supervisory authority — e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW) or the authority where you live

Scores and scan images are only on your device, so deleting them in the app or uninstalling the app removes them. Records of your device hash on our server are deleted on request to contact@vicinolabs.com.

18. Changes to this policy

We may update this policy when the law or the app changes; changes and the effective date are posted on this page.

19. Contact

For questions about data protection, please contact us.

Trading name
Vicino Labs (sole proprietorship, Einzelunternehmen)
Owner
Jeong-Hwan Lee
Address
Ruhrallee 41, 44139 Dortmund, Germany
Email
contact@vicinolabs.com
Impressum
vicinolabs.com/impressum