PIANUMERO
Privacy notice
This notice says what personal data Pianumero processes, why, for how long, and your rights, as the Swiss Federal Act on Data Protection (FADP) requires — and the EU General Data Protection Regulation (GDPR) where it applies.
1. Who is responsible
Loïc Berthod, Rte de Nax 43, 3979 Grône, Switzerland — contact@loicberthod.ch.
2. Without an account
You can play every song without an account. Then no personal data is stored about you:
- Anonymous counts. The site counts, per song and per day, how many times it is listened to, started and finished: numbers only, without any cookie or identifier. Your IP address is used in memory for at most one hour to limit abuse, and is never written anywhere. Purpose: knowing which songs are used, to choose the next ones.
- In your browser. The stars you earn while logged out are kept in your browser (sessionStorage) until you close the tab or log in; they are sent only if you log in or create an account.
- No tracking without your OK. No advertising, no social network plugin, no fonts loaded from another company. Google Analytics is used only if you accept it (see section 3).
3. Measuring visits (Google Analytics) — only if you accept
When you first come, a banner asks whether we may measure visits. Only if you click « Accept », the site
loads Google Analytics 4. It then sets cookies (_ga, _ga_*, kept up to 2 years) holding a
random identifier, and sends Google the pages you visit, how you came, your device, browser and approximate
location (country, region, city — derived from your IP address, which Google Analytics 4 does not store). Purpose:
knowing how many people visit, from where and on which devices, to improve the site and choose the next songs.
Advertising features and Google signals are turned off.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be processed by Google LLC in the United States. Google LLC is certified under the Swiss-US and EU-US Data Privacy Frameworks, which Switzerland and the EU recognise as giving adequate protection (FADP art. 16). Google's privacy policy: policies.google.com/privacy.
If you click « Decline », nothing is loaded from Google and no Google cookie is set. You can change your mind at any time: Cookie settings (also in the footer of every page); declining afterwards removes the Google cookies from this site. Legal basis where the GDPR applies: your consent (art. 6 para. 1 let. a GDPR).
4. With an account
| Data | Why | How long |
|---|---|---|
| Email address | To log you in; to answer you if you write | Until you delete your account |
| Name you choose | To greet you | |
| Password | To log you in. Only a scrypt hash is stored, never the password itself | |
| Progress: best stars, mistakes, time, number of plays per song; the songs you finish with their date | To show your progress, recent songs and streak of days | |
| Session (a random token; only its hash is stored) | To keep you logged in | 60 days, or until you log out |
| Date of your last visit | To count active accounts | Until you delete your account |
Legal basis where the GDPR applies: the performance of the service you asked for (art. 6 para. 1 let. b GDPR). Your data is never sold, rented, shared with third parties or used for advertising. There is no profiling and no automated decision about you.
5. Security logs and backups
To protect the site, the server records failed logins and refused requests, with the IP address and, for a failed login, the email address that was typed. These records are erased after 30 days. The database is backed up every night on the same server, readable only by the administrator; each backup is erased after 14 days — so data you deleted disappears from the backups within 14 days. (Where the GDPR applies: legitimate interest in the security of the service, art. 6 para. 1 let. f GDPR.)
6. Who else sees your data
The site's administrator (Loïc Berthod) sees the list of accounts (name, email, dates, totals) to run the site and answer you. The host, Infomaniak Network SA (Geneva, Switzerland), stores the data on our behalf as a processor. If you accept Google Analytics, Google receives the visit data described in section 3, possibly in the United States. Nobody else. Your account data is never transferred abroad: it stays in Switzerland.
7. Cookies and storage in your browser
One cookie only, pn_session, set when you log in: it keeps you logged in, is strictly necessary for
the account to work, is sent only to our own server (secure, not readable by scripts) and is deleted when you log
out. No cookie is set if you do not log in. The site also keeps, in your browser, the stars earned while logged out
(see section 2), and your choice about Google Analytics (pn_consent, so that the banner is not shown
again). Google Analytics cookies are set only if you accept them (section 3). You can clear all of this at any time
in your browser's settings.
8. Security
Encrypted connections (HTTPS with HSTS), passwords stored as scrypt hashes, sessions stored as hashes, limits on login attempts, access to the server restricted to its administrator, and a content security policy that lets no script from elsewhere run on the site (Google Analytics excepted, and only after your consent).
9. Your rights
- Access (FADP art. 25): My data, on your account page, downloads everything your account holds.
- Portability (FADP art. 28): the same download, in a common machine-readable format (JSON).
- Correction (FADP art. 32): change your name on your account page; for anything else, write to us.
- Deletion: Delete my account, on your account page, erases your account and all your progress at once.
- You can also write to contact@loicberthod.ch for any request; we answer within 30 days.
- You can complain to the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, in the EU, to your national data protection authority.
10. Children
The site is for everyone, children included, and can be used without an account. A child under 16 should create an account only with the agreement of a parent or guardian.
11. Changes
If this notice changes, the new version is published here with its date.
Last updated 2026-09-25. Legal notice · Terms of use