PIANUMERO
Privacy notice
This notice says what personal data Pianumero processes, why, for how long, and your rights, as the Swiss Federal Act on Data Protection (FADP) requires — and the EU General Data Protection Regulation (GDPR) where it applies.
1. Who is responsible
Loïc Berthod, Rte de Nax 43, 3979 Grône, Switzerland — contact@pianumero.com.
2. Without an account
You can play every song without an account. Then no personal data is stored about you:
- Anonymous counts. The site counts, per song and per day, how many times it is listened to, started, started again, finished, or stopped before the end (page left or started over, and at which quarter): numbers only, without any cookie or identifier. Your IP address is used in memory for at most one hour to limit abuse, and is never written anywhere. Purpose: knowing which songs are used, to choose the next ones.
- Your tries on a song page, anonymously. When you open a song, the page draws a random number that exists only on that page (nothing is stored in your browser; reloading the page draws a new one). With it, the server records each try on that page, one after the other: the song and verse, when it started and ended, how many notes you reached and how many mistakes, whether it was finished, started over or left, whether you listened first, and your device type (phone, tablet or computer). Nothing links these records to you, your IP address, your account or your other pages. They are erased after 13 months. Purpose: seeing where players get stuck, to make the songs easier to learn. (Where the GDPR applies: legitimate interest, art. 6 para. 1 let. f GDPR.)
- Anonymous visit counts, without cookies. Each page tells our own server (in Switzerland) which page was
seen, for how long, at what hour, from which site you came (only its name, e.g. « instagram.com »), the tag of the
link you followed if it has one (
utm_source,utm_campaign,ref), and your device type (phone, tablet or computer), browser, system, language and time zone. To count a person once a day, the server makes a scrambled code from your IP address and your browser's identification string, mixed with a random key of the day; this code and the key stay in the server's memory only, are never written to disk, and are replaced with the first visit of each new day. Only totals per day are kept (for example « 12 visitors from Instagram on 27 September »), never a list of visits or visitors. Since 12 October 2026, your browser also keeps four small numbers in its local storage (pn_v: the day of your first visit, the day of the last one, how many days you came, and how many days since the one before): no identifier, nothing that is sent anywhere but a word, « new » or « back », and a group (« after 1 day », « after 2–6 days », « after 7 days or more »), which only adds to the day's totals. Purpose: knowing whether people come back. Your IP address is also used in memory, for about an hour, to limit abuse. Purpose: knowing how many people visit, from where and on which devices, to improve the site. (Where the GDPR applies: legitimate interest, art. 6 para. 1 let. f GDPR.) - In your browser. The stars you earn while logged out are kept in your browser (local storage,
pn_pending: the song, the stars, the mistakes and the time) until you log in, log out or clear it; they are sent only if you log in or create an account. While a tab is open, it also keeps the list of the songs finished in it (pn_done, deleted when the tab is closed), to count anonymously how many people play a second song, and whether the links to our YouTube, Instagram and Facebook pages were already offered (pn_follow, same), and whether the email form was already shown (pn_news_asked, same). Those links are plain links: nothing is loaded from these networks before you click. - No tracking without your OK. No advertising, no social network plugin, no fonts loaded from another company. Google Analytics is used only if you accept it (see section 3).
3. Measuring visits (Google Analytics) — only if you accept
At a break in your first visit (after about 20 seconds on a page, or once you have played a song), a banner asks whether we may measure visits. Only if you click « Accept », the site
loads Google Analytics 4. It then sets cookies (_ga, _ga_*, kept up to 2 years) holding a
random identifier, and sends Google the pages you visit, how you came, your device, browser and approximate
location (country, region, city — derived from your IP address, which Google Analytics 4 does not store). Purpose:
knowing how many people visit, from where and on which devices, to improve the site and choose the next songs.
Advertising features and Google signals are turned off.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be processed by Google LLC in the United States. Google LLC is certified under the Swiss-US and EU-US Data Privacy Frameworks, which Switzerland and the EU recognise as giving adequate protection (FADP art. 16). Google's privacy policy: policies.google.com/privacy.
If you click « Decline », nothing is loaded from Google and no Google cookie is set. You can change your mind at any time: Cookie settings (also in the footer of every page); declining afterwards removes the Google cookies from this site. Legal basis where the GDPR applies: your consent (art. 6 para. 1 let. a GDPR).
4. With an account
One account for Pianumero and Typiano. Typiano (playtypiano.com), a sister site by the same publisher, runs on the same server with the same accounts: you can log in on either site with the same email and password. What you play on each site is kept apart and shown on that site only; My data downloads both, and deleting your account deletes it on both.
| Data | Why | How long |
|---|---|---|
| Email address | To log you in; to answer you if you write | Until you delete your account |
| Name you choose | To greet you | |
| Password | To log you in. Only a scrypt hash is stored, never the password itself | |
| Progress: best stars, mistakes, time, number of plays per song; the songs you finish with their date and the site you played them on; the site where you created your account | To show your progress, recent songs and streak of days on each site; to count new accounts per site | |
| Session (a random token; only its hash is stored) | To keep you logged in | 60 days, or until you log out |
| Date of your last visit | To count active accounts | Until you delete your account |
| Your answer to « Email me when new songs are added » (yes or no, when, and where: sign-up, account page or unsubscribe link) | To email you only if you said yes, and to be able to show it | Until you delete your account |
| If you said yes: a random unsubscribe key | For the unsubscribe link in each email | Until you unsubscribe or delete your account |
New songs by email — only if you ask. The box is not ticked unless you tick it, at sign-up or on your account page. Before the first email, we send one message to confirm that the address is yours; only then do we email you, once a month at most, when new songs are added: nothing else, no advertising for others. Every email says who sends it and has a link to unsubscribe in one click; you can also untick the box on your account page at any time. The emails are sent from our own mailbox, contact@pianumero.com, hosted by Infomaniak in Switzerland; no mailing service gets the addresses. (Where the GDPR applies: your consent, art. 6 para. 1 let. a GDPR.)
Without an account. After a song, or on the book's page, you can also give only your email address to get
the new songs, with two free songs to print, given once you confirm the address. We keep
that address, when and where you gave it (the end of a song, or the book's page), a random key for the links of the emails, and when you
confirmed it; nothing else, and the same rules as above apply (one email to confirm first, then once a month at
most, an unsubscribe link in each). If the address already has an account here, the box of that account is ticked
instead. Unsubscribing deletes the address at once.
For every email we send, we keep a record (the address, the date, the kind of email, its subject and text, and
whether it was delivered to our mail server) for two years, as the record of what we sent to whom; it stays after an
unsubscription or the deletion of an account, and is used for nothing else. Your browser also remembers that you gave an address
(pn_news, local storage), so that the form is not shown to you again.
Legal basis where the GDPR applies: the performance of the service you asked for (art. 6 para. 1 let. b GDPR). Your data is never sold, rented, shared with third parties or used for advertising. There is no profiling and no automated decision about you.
5. Security logs and backups
To protect the site, the server records failed logins and refused requests, with the IP address and, for a failed login, the email address that was typed. These records are erased after 30 days. The database is backed up every night on the same server, readable only by the administrator; each backup is erased after 14 days — so data you deleted disappears from the backups within 14 days. (Where the GDPR applies: legitimate interest in the security of the service, art. 6 para. 1 let. f GDPR.)
6. Who else sees your data
The site's administrator (Loïc Berthod) sees the list of accounts (name, email, dates, totals) to run the site and answer you. The host, Infomaniak Network SA (Geneva, Switzerland), stores the data on our behalf as a processor. If you accept Google Analytics, Google receives the visit data described in section 3, possibly in the United States. Nobody else. Your account data is never transferred abroad: it stays in Switzerland.
TikTok. The site's administrator posts Pianumero's own videos to the Pianumero TikTok account from a private page of this site. For that, the TikTok account is connected once with TikTok's login: we keep its name, picture, account identifier and the access keys TikTok gives (encrypted on our server), and a list of the videos posted, only to post our videos. Disconnecting the account deletes the keys and withdraws the access at TikTok. No visitor's data is ever sent to TikTok.
If you buy the book (25 Easy Songs by Numbers): the payment is made on Stripe's
payment page and the book is sold by Link, Stripe's payment service (Stripe Payments Europe, Ltd., Dublin, Ireland, and
its group, possibly also in the United States), which collects your card, email and billing address under its own
privacy policy, charges the tax of your country and sends your
receipt. Pianumero never sees your card. Stripe tells us, and we keep, only what is needed to deliver the book and
answer you: the order number, your email, your country, the amount and currency, whether you were logged in, the
page you came from (?ref=), and how many times the book was downloaded. These are kept as long as your
download link must work, and at most 10 years (Swiss accounting rules). (Where the GDPR applies: performance of the
contract, art. 6 para. 1 let. b GDPR.)
7. Cookies and storage in your browser
One cookie only, pn_session, set when you log in: it keeps you logged in, is strictly necessary for
the account to work, is sent only to our own server (secure, not readable by scripts) and is deleted when you log
out. No cookie is set if you do not log in. The site also keeps, in your browser, the stars earned while logged out
(see section 2), the days of your visits (pn_v, see section 2: only dates and counts, no identifier),
your choice about Google Analytics (pn_consent, so that the banner is not shown again), and, if you
bought the book, its download links (pn_book, to show them again on /book). Google Analytics cookies are set only if you accept them (section 3). You can clear all of this at any time
in your browser's settings.
8. Security
Encrypted connections (HTTPS with HSTS), passwords stored as scrypt hashes, sessions stored as hashes, limits on login attempts, access to the server restricted to its administrator, and a content security policy that lets no script from elsewhere run on the site (Google Analytics excepted, and only after your consent).
9. Your rights
- Access (FADP art. 25): My data, on your account page, downloads everything your account holds.
- Portability (FADP art. 28): the same download, in a common machine-readable format (JSON).
- Correction (FADP art. 32): change your name on your account page; for anything else, write to us.
- Deletion: Delete my account, on your account page, erases your account and all your progress at once.
- Withdrawing your consent: for Google Analytics, at any time with Cookie settings at the bottom of every page; for the emails about new songs, with the link in each email or on your account page.
- Objection and restriction (where the GDPR applies, art. 18 and 21 GDPR): you can object to the anonymous statistics based on our legitimate interest, or ask us to restrict a processing, by writing to us.
- You can also write to contact@pianumero.com for any request; we answer within 30 days.
- You can complain to the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, in the EU, to your national data protection authority.
10. Children
The site is for everyone, children included, and can be used without an account and without giving any address. A child under 16 should create an account or sign up for emails only with the agreement of a parent or guardian, and children under 13 should not give us an email address at all: the email box after a song is marked for grown-ups. If you think a child under 13 gave us an address, write to contact@pianumero.com and we delete it.
11. Changes
If this notice changes, the new version is published here with its date.
Last updated 2026-10-28. Legal notice · Terms of use