Privacy policy

Effective date: 26 October 2026 · Applies to: the KeyFall Piano™ app for Windows, keyfallpiano.com and the members area, KeyFall Piano Live lessons.

The short version

Who we are

KeyFall Piano is made and run by Kevin Wilkinson, trading as KeyFall Piano, a sole trader in England. Address: 41 High Street, Langford, Biggleswade, Bedfordshire, SG18 9RU, United Kingdom. Email: support@keyfallpiano.com. We are the "controller" of the personal data described here under UK data-protection law (the UK GDPR and the Data Protection Act 2018). We have applied to register with the Information Commissioner's Office and will show the registration number here as soon as it is issued.

Payments are taken by Lemon Squeezy, LLC as the merchant of record; they are the controller of your payment details (see "Buying").

What we collect and why — by what you are doing

1. Visiting keyfallpiano.com

Our site runs on Cloudflare. Like every web server it sees your IP address, browser type and the pages you ask for, in short-lived security logs. Our site also writes a few lines of its own when something goes wrong or when it tidies up (a failed email, the daily clean-up's count), and these are kept for a few days: 3 on our present plan, never more than 7. A line can include the web address that was being asked for, a teacher–pupil pairing's id, and an email address (a parent's, or the account's own) with all but its first letter hidden. Only KeyFall Piano's owner can see them. We run no analytics, no advertising and no tracking cookies. We set two cookies, and only for signing in: kf_web keeps you signed in to the members area (set when you sign in on the site, or open it from the app), and kf_lesson lets one live lesson open in your browser from the app, for that lesson only. Neither is readable by other sites or used for tracking, and neither holds personal details. Your browser's own storage keeps small things on your device only: preferences such as day/night mode, a message you've started but not sent, the Fingering Coach's camera settings, and, if you join the notify-me list, a note that you did. We don't read them.

Our pages load their typefaces from our own server; no request goes to a third party when you open them.

"Notify me" list. If you leave your email to hear when we launch, we first email you a link to confirm it's you. Until you press it, we keep the address for two days at most, then delete it. Once you confirm, we keep the email address, the date and the country it came from, send you one launch email with an unsubscribe link, and delete the list afterwards. Nothing else is kept.

2. Creating an account and signing in

An account is an email address. To sign in we email you a six-digit code that lasts ten minutes; we store only a scrambled version of the code (scrambled with a key only our server holds) and of the sign-in token, never a password. With the account we keep: when it was created and last used, an optional display name, your licence and purchases, the start date of your free week, and a list of the computers you have signed in from (a random installation id and a label made of the operating system and the computer's name — so you can recognise them). A sign-in made on the website lasts up to 400 days on a computer you keep using; you can sign out at any time. A sign-in opened from the KeyFall Piano app (its ✉️ or 🎓 button) lasts until that browser is closed, and 12 hours at most. A live lesson opened in the browser from the app uses a link for that one lesson: it signs the browser in to nothing else, works once, and ends with the lesson (or 30 minutes after it's opened, if the lesson hadn't started yet).

To stop people guessing codes or sending floods of email, our server also keeps a scrambled form of the connection address asking (scrambled with a key only our server holds), for a day at most, against the sign-in, code, teacher-adding and problem-report limits.

Why: to run your account, your free week and your purchases (contract with you), and to spot abuse of the free week and of the code limits (our legitimate interest).

3. Using the app on your computer

Everything the app knows about a player is stored on your computer: each profile's name, nickname, date of birth (used for age-appropriate content and the 18+ purchase gate), optional photo (its hidden details, such as where it was taken, are removed when you pick it), a scrambled PIN, practice history, achievements, settings, and any recordings you make (in Documents › KeyFall Piano › My Music). Nothing in this section is sent to us unless you sign in (see backups), report a problem, or hand us a file yourself. The app does send its own random installation id when it starts, so it can find a licence key or account already linked to this computer; it carries nothing about you. Uninstalling the app leaves your recordings and profile folder in place; you can delete them yourself.

Automatic updates: the app asks our server for the update feed shortly after it starts and every four hours, downloads a new version in the background and asks whether to restart now or install it when you next close the app. That request carries the app version and nothing about you.

Licence check: when you are signed in, the app confirms your licence with our server when it needs to (during the free week, near a renewal, or after a lapse) and otherwise about once a week (your sign-in token and the installation id). It keeps working offline for 30 days between checks.

Optional piano sounds: the HD and Studio piano sounds download from the Internet Archive (archive.org) and a public code host, who see your connection's address like any website.

4. Cloud backup of profiles (when you are signed in)

If you sign in, the app backs up the player profiles on that computer to your account (if another account signed in on it before yours, its profiles are backed up to yours only if a grown-up ticks them) — the same profile files described above, except the PIN, which never leaves your computer, including the name, date of birth and photo of each profile, and the name of the computer it was backed up from — when a player logs out of their profile and when the app closes, and whenever you press Back up now. This is so a family can move to a new computer, or restore after a disaster. Backups are stored on Cloudflare (database and file storage). Ask us and we delete a backup, or all of them. Deleting a profile in the app, while signed in, asks whether to delete its backup and any page it shared too; say yes and they're deleted then, or as soon as the computer is next online. If you would rather not have any backup, do not sign the app in on that computer — the free Grade 1, and any themes or packs you have bought, still work.

5. Buying something

When you buy the annual subscription, a theme or a pack, the checkout is Lemon Squeezy's: they collect your name, card details, billing address and email, charge you, work out VAT, issue the receipt and handle refunds. When you buy, Lemon Squeezy tells our server about the order. We keep only what we need to unlock what you bought — your email address, the order or subscription id, what was bought, its status and renewal date — and nothing else from it. We never see your full card number. To save you typing, the app passes the email you are signed in with into the checkout, with your account's id, so the purchase reaches your account even if you change the email there. Lemon Squeezy's own privacy policy: lemonsqueezy.com/privacy.

If you buy with an email that has never signed in, we create an account for it so the purchase has somewhere to live; signing in with that email later finds it.

6. Teachers and pupils (the members area)

A teacher creates a pairing code; a pupil enters it on their account, with the learner's date of birth. We use the date of birth only to decide whether the learner is under 18 and do not store it there. If the learner is under 18, we ask for a parent or guardian's email and send that parent a link to approve or refuse the teacher; nothing is shared until they approve. Once paired, the teacher and pupil can exchange messages, files (MIDI and MusicXML, and PDFs and videos, which for under-18s wait for the parent's OK), scheduled lessons and lesson results; the teacher can keep private notes about each pupil's progress; a teacher can subscribe to their lesson diary as a calendar feed protected by a secret link. A video you upload keeps any details your phone or camera saved in it, such as where it was filmed; turn off location in your camera app if you'd rather it didn't. The teacher sees the pupil's chosen label, not their email. When a parent approves a teacher, we keep that parent's address against the account even after the pairing ends, so that the next time a teacher is added to the account, that parent is told. A code meant for a grown-up — to approve a video or a note on an under-18 page, or to set a grown-up PIN — also goes to a parent who approved a teacher on the account.

The parent's approval link opens a page showing the conversation between the teacher and the pupil (the latest 500 messages), at any time, and a button that removes the teacher and deletes every file, message, recording and lesson recap between them, and their notes on your child's shared page are removed too.

7. Live lessons (KeyFall Piano Live)

A live lesson sends your camera, microphone and the notes you play to the other person, and theirs to you, over an encrypted connection between the two computers. Where the two computers cannot connect directly, Cloudflare relays the video and sound (it cannot read them); notes played and the teacher's tools pass through KeyFall Piano's own server for that lesson and aren't kept. No screen sharing takes place. The Fingering Coach in a lesson sends the teacher numbers describing hand position, never the picture. The teacher's page also gets the learner's grade piece list and the piece they open, so the teacher can follow along.

Recordings. Lessons with a pupil under 18 are always recorded — for the pupil's protection, so a parent can see exactly what happened. The teacher's browser records the lesson (both pictures, the sound and the notes) and sends it to our file storage as it goes. A lesson that can't be recorded ends, and if a lesson's recording doesn't reach us, the pupil's parent is told by email. Adults may switch recording off. We keep the newest ten recordings and the newest thirty lesson recaps (a log of notes and events, not pictures) for each teacher–pupil pair, and any the teacher, the pupil or the parent has starred to keep (a parent's star stays until the parent takes it off). Removing the pairing deletes all of them, except that when a teacher removes a pupil under 18, the lesson recordings are kept for the pupil's parent alone for 30 days, then deleted. Recordings are visible to the teacher, the pupil and the pupil's parent, and to nobody else unless the law requires it.

Parents. When a lesson with an under-18 starts, the parent is emailed at once with a link to watch silently (the parent's own camera and microphone are never used) and a link to their review page, where they can stop the lesson (if that email ever can't go, the lesson's start is written into the messages their page shows). Both screens show "Parent watching" while they do.

8. Sharing a public page or music (optional)

You can publish a progress page (a web address you choose to share) with a display name, grade, scores and milestones, and optionally a short performance clip. For anyone under 18 the page is always pseudonymous: no real name, no photo, no join date or country, and any clip must first be approved by the account holder with a code we email. Visitors can leave comments with a name they type; we keep a scrambled version of the commenter's IP address, mixed with the page's address, only to limit comment spam. The account holder can remove comments and unpublish the page at any time. Unpublishing removes the page and its clip; its comments are kept hidden and come back if the page is published again. Delete a comment to remove it for good.

Members can also share their own pieces (MIDI / MusicXML) in the members' music pool. Shared pieces show no name: each one says "by A member".

9. Reporting a problem

The Report a problem button in the app sends us: what you typed, the app version, your Windows version, graphics card, the installation id, and the last lines of the app's own log files, with names taken out (your Windows user name, the computer's name, your folders and every profile's name). Tick boxes add a picture of the window (unticked to start) and the profile's name (unticked); recent console messages and any crash details start ticked, and you can untick them. The report also carries technical details about the computer and the app — memory, processor type, the app's and its engine's versions, the screen you were on, the last two runs' log lines — and our server adds the country your connection comes from. Reports come to us by email, and nowhere else. We keep them while we work on the problem, and delete them by hand within a year.

Children

KeyFall Piano is designed to be used by children, and we take the ICO's Children's code as our guide: the least data, the safest default, and a grown-up in the loop.

• Accounts are held by adults. A child plays through a profile on a parent's or teacher's account. We do not ask children to create accounts or to consent to anything. If a child does sign in with their own email, the same parent-approval rules apply before any teacher can reach them.
• A child's date of birth is kept on your computer (and in your account's backup if you sign in), and is used only to keep intense visuals age-appropriate, to gate purchases to adults, and to tell whether a learner is under 18 when a teacher is involved. Our website can only go by what it has been told. If a child's profile was never backed up while its date of birth said a child, the website has nothing to go by, so please set the grown-up PINs and keep each profile's date of birth right.
• Teachers: no teacher can reach a child under 18 until a parent has approved by email; the parent can see everything shared, is emailed when every lesson starts (or, if that email can't go, sees its start in the messages), can watch, can stop it, and can end it all with one button. PDFs and videos sent to an under-18 wait for the parent's OK.
• Lessons with under-18s are always recorded and kept for the parent to review, as described above.
• Public pages for under-18s never show a real name or photo. If a profile's page was ever a child's, we keep a note of that (only that), so it can't later become a grown-up's page without a grown-up's code.
• No advertising, no profiling, no location tracking, no selling of data, for anyone.

If you are a parent and want to know what we hold about your child, or want it deleted, email us — see "Your rights".

Who we share data with

We use a small number of companies to run the service. They act on our instructions and may not use the data for themselves.

And the people you choose to work with: your teacher or pupil (and their parent), the visitors of a page you publish, and other members if you share a piece in the pool. We will disclose data if the law or a court requires it, or to protect a child from harm. If KeyFall Piano is ever sold, your data goes with it under this policy and you will be told.

Some of these companies are in the United States. Where data leaves the UK we rely on the UK's adequacy decisions (including the UK Extension to the EU-US Data Privacy Framework) or the ICO's International Data Transfer Addendum with each company.

How long we keep things

We do these by hand when you ask, or on the dates above.

Keeping it safe

Everything travels over HTTPS or encrypted WebRTC. Sign-in codes, sign-in tokens and teachers' pairing codes are kept only in a scrambled form, scrambled with a key only our server holds: we can check a code you type against it, but nobody can read the code back from it. The link in a parent's approval email and a teacher's calendar-feed link are long random keys, kept as they are, so keep those emails as safe as a key. A parent can make a new link at any time on their review page, which stops the old one at once, along with every watch link and video link made from it. Lesson recordings sit in private storage, reachable only through your account or the parent's link. No system is perfect; if we ever learn of a breach that puts you at risk we will tell you and the ICO without delay.

Your rights

You can ask us at any time to see the data we hold about you or your child, correct it, delete it, restrict or object to how we use it, or receive a copy in a portable form. Email support@keyfallpiano.com from the address on the account (or from the parent email on a pairing) and say what you want. We reply within 30 days, and deleting an account removes the account, backups, purchases record, pairings, pages and lesson material together — purchases cannot be restored afterwards, so we will confirm before we do it.

If you are unhappy with how we have handled your data, please tell us first; you also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.

The legal bases, for completeness

Running your account, purchases, lessons and backups: performance of a contract with you. Keeping the service safe, preventing abuse of the free week, improving the app from problem reports: our legitimate interests, balanced against yours. Parent approvals, the launch email, and optional features you switch on: consent, which you can withdraw. Tax records: legal obligation. Children's data is processed only under the adult account holder's contract and the parent's approval, never on a child's own consent.

Changes

We will post changes here with a new effective date and, for anything that matters, tell account holders by email or in the app.

Kevin Wilkinson trading as KeyFall Piano · 41 High Street, Langford, Biggleswade, Bedfordshire, SG18 9RU, United Kingdom · support@keyfallpiano.com