Privacy Policy

Effective date: September 22, 2026

Notalo ("we", "us") at notalo.xyz adds note names to sheet music you upload. This policy explains what information we handle, why, and the choices you have. Notalo is free to use and is funded by advertising.

1. Uploaded sheet music

• Files you upload (PDF, JPG, PNG) are used only to produce the labeled result you download.
• Uploads and results are processed in memory or in a temporary folder and are deleted automatically — the result is kept for up to 30 minutes after processing so you can download it and the practice MIDI, then removed. We do not keep copies, build a library of your scores, or use your files to train models.
• A small preview image of the first page may be held for up to 10 minutes so the result page can show it, then it is deleted.

2. Account information (optional)

You can use Notalo without an account. If you choose to sign up we store:

• Your email address and a salted hash of your password (never the password itself), or the Google account identifier if you sign in with Google.
• Whether your email has been verified, and a login session cookie (valid for 30 days).

We use this only to let you sign in and to send verification or password-reset emails. We do not send marketing email. You can ask us to delete your account at any time (see Contact).

3. Server logs and abuse prevention

Like most services we keep short-lived technical logs (IP address, time, request path, error messages) to keep the service running and to limit abuse (for example, per-IP rate limits on uploads). These are not linked to your uploaded files' content.

4. Cookies, analytics and advertising

We use the following third-party services, which may set cookies or use similar identifiers in your browser:

• Google Analytics — anonymous usage statistics (pages viewed, approximate location, device type) that help us understand how the site is used.
• Google AdSense — displays the ads that fund Notalo. Google and its partners use cookies to serve ads based on your prior visits to this and other websites. This may include personalised advertising. You can opt out of personalised advertising at Google Ads Settings or, for other vendors, at aboutads.info. Google's own use of data is described at How Google uses information from sites that use its services.
• Google Sign-In — only if you choose to sign in with Google.
• Google Fonts — the site's web fonts are loaded from Google's servers, which receive your IP address as part of the request.

A single first-party item (your preferred display language) is stored in your browser's local storage. You can clear or block cookies in your browser settings; the core upload feature works without them.

5. Children

Notalo is not directed at children under 13 (or the minimum age in your country) and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.

6. Where data is processed

Our servers are hosted by Amazon Web Services in the Asia Pacific (Seoul) region. Google services listed above may process data in other countries under their own safeguards.

7. Security

All traffic uses HTTPS. Passwords are stored only as salted hashes. Uploaded files never persist beyond the processing window described above. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Your rights

Depending on where you live you may have the right to access, correct, delete or export your personal data, or to object to certain processing. Email us and we will respond within 30 days. You can also stop using the service at any time; no data other than what is described above is retained.

9. Changes

We may update this policy as the service changes. The effective date at the top will be updated, and material changes will be noted on the home page.

10. Contact

Questions or deletion requests: [email protected]