Privacy Policy

JazzBass.app (Jazz for Orchestral Bassists) is a music education application. Students practice daily jazz harmony assignments on an on-screen piano and fingerboard, and their teacher sees what they have completed and where they need help. The assignment features are used in classes run by a teacher at a school. Chord Café is also available as a public game.

Many students are under 18. The application is built to collect as little about students as possible, and it uses student information only to provide this instruction to the student's school.

What we collect from students

• Google account identifier. Students sign in with Google. The application asks Google only for the account's unique identifier. It does not request, and Google does not send, the student's name, email address, or photo.
• First name and last initial. The student types this (for example, "Maya R.") once, the first time they join a class, so the teacher can tell students apart. Students cannot change it afterward. It is the only name stored for a student.
• Class membership. Students join a class with a code from their teacher. They are never added by email address.
• Practice data. Assignment answers and whether they were correct, accuracy, drill times, practice times the student reports with an optional short note, and units completed.
• Pass-off results. Students submit pass-off videos to their teacher through Canvas, not through this application. After reviewing a video in Canvas, the teacher can record here that the student passed, the student's time, and an optional comment.
• Activity logs. Sign-ins, pages visited, buttons pressed, and application errors, with the IP address and browser type, for troubleshooting and security.

We do not collect a student's full name, email address, student ID number, address, phone number, date of birth, photos, audio, video, or location beyond what an IP address implies. Students cannot upload files.

Optional Chord Café leaderboard

The public game can be played without joining its leaderboard. To participate, players choose a nickname from preset playful words, with a random suffix. No real name, email address, school, or password is requested. The leaderboard publicly displays the nickname and the best score submitted for each game level. Each score is shared only when the player selects the share button; school assignments and practice results are never published to this board.

A separate browser cookie remembers a random game identity for up to one year. Leaderboard records are not linked to school accounts, and leaderboard requests are excluded from the application's school activity logs. The hosting server still receives ordinary connection information, such as IP addresses, in its access logs. This is pseudonymous participation, not a guarantee that a person can never be identified.

On shared devices, players should use “Switch player” before another person plays. Clearing cookies or changing devices creates a new identity; there is no password recovery or cross-device sign-in. “Delete my leaderboard entries” removes the current nickname and its scores from the live leaderboard. Switching players leaves previous scores public. For deletion after losing access to a browser identity, contact us with the nickname. Schools should review and authorize public leaderboard participation under their own policies.

Teachers and administrators

Teacher and administrator accounts sign in with Google and store the person's name and Google email address, which is how an administrator grants teacher access.

How student information is used

Student information is used only to run the application for the student's school: presenting assignments, tracking progress, showing results to the student's teacher, and keeping the service working and secure.

• We do not sell or rent student information.
• We do not show advertising, and we do not use student information for targeted advertising.
• We do not build profiles of students for any purpose other than the instruction their school has chosen.
• We do not use third-party analytics or tracking services.
• We do not send student information to any AI service.
• Student information is not used for development or testing. Testing uses made-up accounts.

Who can see student information

• The student sees their own work and progress.
• The student's teacher sees progress for students in that teacher's active classes. Other students cannot see a student's work.
• The website operator and sole developer (Chris Paul) can access all data in order to run, support, and secure the application. Only the operator can read the activity logs.

School account and assignment information is shared with no one else, except the hosting provider described below, or when required by law. The optional game leaderboard publishes only the game nickname and scores described above.

Service providers

• Amazon Web Services (AWS) provides the server, in the US West (Oregon) region, on which the application and its PostgreSQL database run. All student information is stored on that server in the United States. AWS also keeps daily server snapshots in the same region; the seven most recent are retained. AWS processes this data only as our hosting provider, under its standard Data Processing Addendum, and does not use it for its own purposes.
• Google provides sign-in. It receives the sign-in request and returns only the account identifier described above.
• Cloudflare provides DNS (the lookup that turns jazzbass.app into the server's address). Website traffic does not pass through Cloudflare.

Fonts, scripts, and every other part of the site are served from our own server rather than from third-party services.

Cookies

The school account features use a session cookie that keeps a person signed in. It expires after 7 days without use. The browser also remembers one practice setting (whether to move to the next question automatically) on the student's own device; it is never sent to us. The game also uses the separate identity cookie described above, and a session cookie to protect leaderboard requests. There are no advertising or third-party tracking cookies.

Security

• All traffic between the browser and the application is encrypted with HTTPS.
• The database is not reachable from the internet; only the application on the same server can connect to it.
• Administrative access to the server and database is limited to the operator.

If student information is ever accessed without authorization, we will notify the affected school promptly, and within any timeframe required by Utah law or by our agreement with that school, so that the school can notify families.

Retention and deletion

A student's information is kept while the student is in a class that uses the application. When a school or teacher asks, we will delete a student's account and all of the student's practice data, pass-off results, and activity log entries within 30 days. When a school stops using the application, we will delete its students' information within 30 days of its request, or as its agreement with us requires. Deleted information leaves the server snapshots within seven days after deletion.

Schools, parents, and students

Student information belongs to the student's school, and we handle it as a service provider under the school's direction, consistent with FERPA, the Children's Online Privacy Protection Act (COPPA), and the Utah Student Data Protection Act. The school authorizes students' use of the application for educational purposes. Parents and eligible students may ask to see, correct, or delete a student's information through the student's teacher or school, or by writing to us directly.

Changes to this policy

If we change how student information is collected or used, we will update this page and its effective date, and notify the schools using the application before the change takes effect. We will not use student information already collected in a materially different way without the school's consent.

Contact

Questions or requests about privacy: Denisse Vallecillos, denisse@jazzbass.app.