Name: Sho Ayuba

Contact: sho.yuba48@gmail.com

Concert record data is stored locally on your device. For optional ad removal, we collect purchase history and user identifiers via RevenueCat. When you use Apple Sign In, we receive only the minimal authentication information Apple provides.

Our website (maestlog.app) collects minimal data:

• Contact Form: When you submit a contact inquiry through our website, we collect your name, email address, subject, and message content. This information is processed by Resend Inc. (US) for email delivery and stored for support purposes for up to 2 years.

• Language Preference: We store your language preference in your browser's local storage to provide a consistent experience. This data never leaves your device.

• Third-Party Services (Website):

  - Resend (Email delivery): Privacy Policy at https://resend.com/legal/privacy-policy

  - Google Fonts (Typography): Privacy Policy at https://policies.google.com/privacy

We process information under GDPR Article 6 as follows:

• Ad removal purchase history via RevenueCat: contract performance, required to verify your purchase and restore access
• Authentication information via Apple Sign In: consent, provided when you sign in
• AI image analysis via Gemini: consent, provided when you upload an image for analysis
• Contact form submissions: consent, provided when you submit a message

Concert record data is stored only on your device. MaestLog works offline for core logging features, with limited server communication for payment verification, authentication, and AI analysis.

Concert record data is not shared with third parties and remains on your device.

We use the following services to provide app and website functionality:

• RevenueCat Inc. (USA) - purchase verification

  Data shared: purchase history, app_user_id

  Purpose: verify and restore the optional ad removal purchase

  Privacy Policy: https://www.revenuecat.com/privacy

• Apple Inc. (various countries) - authentication and App Store purchases

  Data shared: authentication tokens and purchase processing data handled by Apple

  Purpose: Apple Sign In, App Store purchase, and restore flow

  Privacy Policy: https://www.apple.com/legal/privacy/

• Firebase Functions / Google LLC (USA, asia-northeast1) - server-side verification and AI request handling

  Data shared: anonymous app_user_id and request metadata

  Purpose: purchase verification and secure AI analysis requests

  Privacy Policy: https://policies.google.com/privacy

• Gemini AI / Google LLC (USA) - AI image analysis

  Data shared: uploaded images temporarily and app_user_id

  Purpose: automatic extraction of concert information from tickets or programs

  Important: images are processed temporarily and not permanently stored

  Privacy Policy: https://policies.google.com/privacy

• Resend Inc. (USA) - email delivery for the website

  Data shared: name, email address, and message content

  Purpose: contact form message delivery

  Privacy Policy: https://resend.com/legal/privacy-policy

• Google Fonts - website typography

  Data shared: font requests, which may include IP address

  Purpose: website font delivery

  Privacy Policy: https://policies.google.com/privacy

All data is stored locally using Apple's SwiftData framework (iOS 17+) with iOS's standard security measures. Authentication tokens are securely stored in iOS Keychain. Enable device encryption and use Face ID/Touch ID for enhanced security.

We retain different types of data for the following periods:

• Concert record data: retained on your device until you delete it
• Authentication tokens: stored until you sign out or uninstall the app
• Ad removal purchase history via RevenueCat: retained according to RevenueCat policies and accounting requirements
• Contact form submissions on the website: retained for up to 2 years after inquiry resolution
• Gemini AI image data: processed temporarily and deleted immediately after analysis, not permanently stored

Local data: You control concert data stored on your device. You can view, edit, export, or delete it in the app, and deletion is permanent.

GDPR rights for EU residents include access, rectification, erasure, portability, objection, and complaint to a supervisory authority.

Server-side data deletion request:

1. Email sho.yuba48@gmail.com with the subject "Data Deletion Request"

2. Include your RevenueCat app_user_id from Settings > About in the app

3. We will process the request within 30 days

Deleted data may include Firebase verification records, contact form submissions if applicable, and temporary Gemini AI processing data. RevenueCat purchase records may be retained for accounting or legal requirements.

All users can use AI to analyze ticket and program images. Free users may be asked to watch a rewarded ad before each scan, while users who bought ad removal can skip that ad.

• Data transmitted: ticket or program images only, such as JPEG, PNG, or WEBP, resized before upload
• Data recipient: Firebase Cloud Functions and Google Gemini 2.5 Flash API
• Data retention: transmitted images are deleted immediately after processing and are not permanently stored
• Security: communications use HTTPS, and API keys are protected by Firebase Cloud Functions
• User control: manual data entry remains available without AI analysis

Users can import concert information from web pages using the browser Share menu.

• Data transmitted: the shared page URL and text content for analysis
• Data not transmitted: personal browsing history, cookies, and unrelated personal information
• Data recipient: Firebase Cloud Functions and Google Gemini 2.5 Flash API
• Data retention: transmitted web content is deleted immediately after processing
• User control: the feature starts only when you explicitly share a page to MaestLog

You can search for works on external music services (YouTube, Apple Music, Spotify) directly from the concert detail screen.

• Data Transmitted: Only the search query (composer name and work title) is passed to the selected music service via URL scheme. No personal information, listening history, or device identifiers are transmitted.
• Data Recipient: Search queries are sent directly to the selected music service (YouTube/Google LLC, Apple Music/Apple Inc., or Spotify/Spotify AB) via their respective URL schemes. MaestLog does not act as an intermediary.
• User Control: A music service selection dialog is shown each time you tap a program item. You choose which service to use for each search.

MaestLog is rated 4+ on the App Store and is suitable for all ages. Core concert logging stores data locally and does not collect personal information.

Features that may involve personal information, such as App Store purchases, contact form submissions, and optional Apple Sign In, should be used by children under parental guidance. We do not knowingly collect personal information from children under 13 without verified parental consent.

Concert record data remains on your device without international transfer.

Some service data may be transferred internationally:

• RevenueCat Inc. (USA): ad removal purchase information, protected by contractual and technical safeguards
• Google LLC (USA): Firebase Functions and Gemini AI request handling, protected by Google privacy safeguards
• Apple Inc. (various countries): authentication and App Store purchase processing, protected by Apple privacy safeguards

You can request more information about these safeguards by contacting sho.yuba48@gmail.com.

California residents have rights under the CCPA and CPRA.

Personal information categories collected in the past 12 months may include identifiers such as Apple ID or RevenueCat identifiers, email address from contact forms, and commercial information such as ad removal purchase records.

We do not sell personal information and do not share personal information for cross-context behavioral advertising. Third-party processing is limited to service providers such as RevenueCat, Apple, Firebase, Gemini, and Resend.

To exercise your rights, email sho.yuba48@gmail.com with the subject "CCPA Request".

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date.