Privacy Policy

This Privacy Policy explains how Best Day Labs ("we", "us", or "our") handles your information when you use the Keys mobile application (the "App").

1. Video imports & audio transcription

When you share or paste a video link, our servers download the audio from the source (TikTok, Instagram, YouTube, etc.) and pass it to third-party machine-learning services — primarily Modal, with Replicate used as a fallback — to extract the piano part as MIDI. The same processing applies when you use related features such as vocal removal or piano-cover generation. That audio is stored privately while it is being processed — it is never publicly accessible, never listed in the Keys catalogue, and never shared with other users. It is kept only as long as needed to transcribe the song and deliver it to your device, and is deleted automatically within 24 hours. The resulting MIDI and note data are returned to your device and saved to your library. If you play the song, a copy of the audio is cached on your own device for offline playback; you can remove it by deleting the song from your library.

Transcriptions stay in your own library. Keys no longer publishes user transcriptions to a public catalog.

2. Microphone (Learn Mode)

Learn Mode listens through your device microphone to detect which notes you play. Audio captured by the microphone is processed entirely on your device — it is never uploaded, recorded, or stored anywhere. The microphone is only active while Learn Mode is enabled.

3. Camera & photos (sheet music scanning)

If you use the sheet music scanning feature, the captured image is sent to our processing service (Modal), where optical music recognition software reads the notes. The image is processed in the request and discarded; we do not retain uploaded sheet music images. If you select a profile photo from your Photo Library, that image is stored locally on your device and is not uploaded to our servers.

4. Account & sign-in

Keys signs you in anonymously through Supabase Auth so your library and votes can sync across devices. We do not collect a password, email address, or name at sign-in, and we do not use Sign in with Apple. Your display name and profile photo are not shown to other users.

5. The Keys catalog

The catalog in Keys consists of public-domain works selected by us. It does not contain user-submitted transcriptions: the ability to publish to a community catalog has been discontinued, and transcriptions previously contributed by users have been removed from our servers.

6. Subscriptions

Keys is a paid subscription app. All payments are processed by Apple through the App Store; we do not receive or store your payment information. Subscription status is checked via Apple's StoreKit framework.

7. Local data

Your song library, playback preferences, achievements, and playback history are stored locally on your device using Apple's SwiftData framework. This data is not transmitted to us.

8. Third-party services

We use the following third parties to operate the App. Each handles your data according to their own privacy policies:

• Apple — App Store, StoreKit, and subscription billing.
• Supabase — anonymous authentication, database, file storage.
• Modal — piano transcription models and sheet-music optical recognition (primary).
• Replicate — piano transcription machine-learning models (fallback).
• Railway — hosting for our backend servers that process video imports.
• PostHog — pseudonymous product analytics (see section 9).
• TikTok — advertising attribution and ad-performance measurement (see section 9).

9. Product analytics

We use PostHog, a privacy-respecting product analytics service, to understand how the App is used in aggregate — for example, which features are popular, where users encounter errors, and how the import flow performs. The events we record describe interactions (e.g. "import succeeded", "learn mode started") and are keyed to your app-generated, pseudonymous Supabase user ID; PostHog may also process technical metadata such as device type and IP address as part of delivering the service. This information is pseudonymous rather than fully anonymous, because the app-generated ID is persistent. Through PostHog we do not collect screen recordings, full keystroke logs, precise location data, contacts, or browsing history outside the App.

Advertising and attribution. We use the TikTok Business SDK to measure how our own advertising performs — for example, whether an install or subscription followed from a TikTok ad. With your permission (requested through Apple's App Tracking Transparency prompt), this includes your device's advertising identifier (IDFA); if you decline, attribution falls back to non-identifying signals. We use this only to measure and improve our own marketing, not to build advertising profiles, and you can change your choice at any time in iOS Settings → Privacy & Security → Tracking.

10. Data retention

We keep information only as long as needed for the purposes described in this policy:

• Imported audio — stored privately during processing and deleted automatically within 24 hours.
• Sheet music images — processed within the request and not retained.
• Account data — retained until you delete your account or request removal of your data, after which it is deleted from active systems within a reasonable period (subject to routine backup cycles).
• Analytics events — retained by PostHog in aggregate for product-improvement purposes.

11. International users & data transfers

We operate from the United States, and our service providers may process your information in the United States and other countries. If you access the App from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your jurisdiction.

12. Your privacy rights (GDPR & CCPA)

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete, or port your data, and to object to or restrict certain processing. Because Keys is designed around anonymous, on-device, and pseudonymous data, the personal information we hold about any individual is limited.

You can delete your Keys account and associated catalog data at any time by emailing us at the address below, and we will delete it from our active systems. We will not discriminate against you for exercising these rights.

We do not sell your personal information. Other than the advertising-attribution data described in section 9 — which is shared with TikTok only with your App Tracking Transparency consent and solely to measure our own ads — we do not share your personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

13. Children's privacy

Keys is not directed to children under 13, and we do not knowingly collect personal information from children under 13. While the App carries a 4+ content rating (meaning its content is suitable for general audiences), it is intended for use by individuals aged 13 and older. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Effective" date above will reflect the most recent update. Continued use of the App after changes means you accept the revised policy.

15. Contact

If you have any questions about this Privacy Policy or wish to exercise a privacy right, please contact us at support@bestdaylabs.com.