1. What we collect
Guest play: unfinished music, editor preferences and tutorial progress may be stored locally in your browser. We store a randomly generated browser identifier for daily submission recovery and, when browser privacy settings allow, visit counting. This identifier is not your name or email, but it can recognise the same browser until its data is cleared.
Optional accounts: when you sign up using email and password or Google, our authentication provider, Supabase, processes your email address, an account ID and information required to manage your session and email verification or password recovery. Google sign-in additionally involves Google. We do not receive your Google password; email account passwords are sent directly to Supabase Auth. We also store the username you choose.
My Sketches: if you save an officially submitted composition to your account, Supabase stores its date, score, title and related submission information. Database access controls restrict the account library to its owner. Submitted sketches in My Sketches are read-only. Signing out does not erase this information.
Official submissions: when you submit a completed daily puzzle, its score, date and puzzle title are saved in private Vercel Blob storage with a share identifier. Anyone who has your link can view and listen to that composition, without signing in. Treat share links as public-by-link rather than private. We do not publish a browsable directory of submissions.
Feedback and contact: we privately store the text, category and date of messages and optional ratings you submit. General enquiries may include an optional email address for a reply; a privacy or data request requires a reply address. Please do not send passwords or unnecessary sensitive information.
2. Analytics and browser storage
Our own optional analytics count visits, puzzle starts, completed submissions, shares and views of shared compositions. We turn the browser identifier into a keyed hash before storing analytics events. These reports are not intentionally joined with account emails, names or full compositions. We honour Global Privacy Control and Do Not Track signals, which disable optional analytics events from that browser. Previously saved analytics opt-out preferences continue to be respected.
Local storage also keeps in-progress music and limited navigation or preference information. Supabase uses browser session storage to keep you signed in. The website uses necessary security and short-lived rate-limit cookies in certain flows, including administrator sessions and submission cooldowns. You can clear local browser data, but this does not delete server-side accounts, saved compositions, feedback or share links.
3. Why we use information
We use this information to make the puzzle work, publish the daily challenge, save and retrieve your submissions, authenticate accounts, display your saved sketches, respond to messages, troubleshoot bugs, prevent abuse and understand overall usage. We do not currently sell personal information or run third-party advertising through Musical Sketch.
4. Hosting and other providers
Musical Sketch is hosted on Vercel, with Supabase for authentication and account data. Fonts, notation software, music samples and the Google sign-in widget may be loaded from third-party services, including Google, jsDelivr and external audio hosts. Such requests can disclose standard browser information, such as IP address and device/browser details, to those providers. Hosting and security logs follow the providers' own retention practices and are not part of our first-party analytics deletion schedule.
Our Supabase production database is hosted in Sydney, Australia. Some infrastructure, authentication, content delivery, support or other processing may occur outside Australia, including in the United States, depending on the provider and service used. See the linked providers' privacy information for more details.
5. How long information is kept
First-party analytics event records are scheduled for deletion after approximately 90 days. Feedback and contact records (including reply addresses) are scheduled for deletion after approximately 180 days. These are scheduled cleanups, not guaranteed exact deletion dates, and platform logs may have different retention periods.
Account records and My Sketches remain until deletion is arranged. Official shared compositions are not automatically deleted, so their links can continue to work. Published and draft puzzle schedules are also kept separately. Backups, where available, can have separate retention and restoration cycles.
6. Access, correction and deletion requests
You can sign out, clear this site's browser storage, or ask us to review, correct or delete account-related information, saved sketches, feedback or shared compositions. We may need to verify ownership of an account or control of a share link before acting. Automatic self-service deletion is not available at present.
If you want to ask what we hold or request deletion, use our private contact page and choose Privacy or data request. Include a reply email so we can respond, but never include your password or recovery codes. For anonymous submissions, include the share link relevant to your request if possible.
7. Contact and privacy concerns
Musical Sketch is operated from Australia. Send privacy enquiries, concerns or complaints through our private contact form. We will review the request and, when a reply address is supplied, respond or ask for information needed to verify the request. If applicable, you may also consult the Office of the Australian Information Commissioner for information about Australian privacy complaints.
Contact us about privacy General contact
Last updated 27 October 2026. We may update this notice when the website's features or data practices change.