Privacy Policy

Version 1.2 · effective October 29, 2026

Parnaso is an app to learn and practice counterpoint. It is designed to use as little personal data as possible: you can use it without an account, and in that case none of your data leaves your device. This policy explains, in plain language, what data we process when you create an account, why, where it is stored and how to exercise your rights.

1. Who is responsible

The owner of the database and data controller is Leo Carosa E.I.R.L. (Peruvian taxpayer ID / RUC 20613689819), a company operating under the trade name “Parnaso”, domiciled at the registered tax address on file with SUNAT, Peru (public lookup by RUC at e-consultaruc.sunat.gob.pe). Privacy contact: privacidad@parnaso.app.

The “Parnaso Users” database will be registered with the National Registry of Personal Data Protection of Peru’s National Authority for Personal Data Protection; this policy will be updated with its registration code.

2. If you use Parnaso without an account

Your exercises, your progress and your preferred language are stored only on your device. We do not receive or see them. Parnaso uses no advertising, no analytics tools and no cross-app tracking.

If you later create an account or sign in to one, that progress is not uploaded to the cloud: it stays on your device, separate from the account's progress.

If you uninstall the app, that data is erased from the device and cannot be recovered.

Microphone and MIDI keyboard (Parnaso Maestro): if you turn on microphone input, the app analyzes sound on the device itself only to recognize the note you sing or play. It does not record audio, store it or send it to any server; you can withdraw the permission in your phone settings. Connecting a MIDI keyboard does not send any data off the device either.

3. What data we process if you create an account

Account data: your email address, your password (stored in encrypted form by our provider; we never see it), an internal user ID and whether you confirmed your email.

Practice data: the exercises you write and save (notes, species, mode, review result, dates and daily-challenge streak).

Technical security data: our authentication provider records data such as your IP address and device type when you sign in, to protect your account from unauthorized access.

If you use the Complaints Book (Libro de Reclamaciones): the data the law requires on the form (name, ID document, address, phone, email and, if you are a minor, those of your parent or representative) and the details of your claim or complaint. You can file it with or without an account. A copy of your forms is also kept on your device so you can consult them.

We do not process sensitive data. To use the app with an account we do not ask for your name, date of birth or location.

4. Why we use it and on what legal basis

To create and maintain your account, back up your exercises in the cloud and sync them across your devices. Legal basis: performance of the contract you accept when creating the account (Article 14(5) of Peruvian Law No. 29733; Article 6(1)(b) GDPR).

To send you strictly necessary emails: confirmation of your address and password recovery. We do not send advertising.

For the security of the service and fraud prevention. Legal basis: the same contract and, in the European Union, our legitimate interest (Article 6(1)(f) GDPR).

To handle claims and complaints filed in the Complaints Book and keep the forms for the legal period. Legal basis: compliance with a legal obligation (Peruvian Consumer Protection Code, Articles 150 to 152).

Parnaso’s checker reviews your exercises automatically and gives them a score. It is a teaching tool: it has no legal effects, does not significantly affect you, and we do not profile you.

5. If you do not give us your data

Email and password are required to have an account. If you prefer not to provide them, you can use Parnaso without an account: the only thing you lose is the cloud backup.

6. Who else accesses your data

Google LLC, through its Firebase service (authentication and database), acts as our data processor: it stores and processes data on our behalf and under our instructions, with security and confidentiality commitments (Firebase Data Processing and Security Terms). We require it to protect your data at least to the level described in this policy.

If you buy a subscription in the future, payment is processed by Apple (App Store) or Google (Google Play) under their own privacy policies. We do not receive your card details.

We do not sell, rent or share your data with third parties for advertising. We would disclose it to an authority only if a law or a court order requires it.

7. International data transfers

Account data is stored on Google servers located in the United States (a multi-region setup that keeps copies in several data centers so that nothing is lost). This is a cross-border transfer of personal data.

The transfer is necessary to provide the service you request (Article 15(4) of Law No. 29733) and, in addition, you expressly consent to it when you create your account. For users in the European Union, the transfer relies on the standard contractual clauses approved by the European Commission, incorporated into Firebase’s data processing terms (Article 46 GDPR).

8. How long we keep it

For as long as your account is active. If you delete your account, we immediately erase your exercises and your account from our database; our provider’s backups are deleted in their normal cycle, within at most 180 days. Deleting the account from the app also erases that account’s copy of your exercises on that device; what you did without an account is kept, and you can erase it from “My exercises” or by uninstalling the app.

Complaints Book forms are kept for two (2) years from their filing, as required by the Complaints Book Regulation, and then deleted.

9. Your rights and how to exercise them

You may request information about the processing, access your data, rectify it, erase it, object to its processing and request its portability. In the European Union you may also request restriction of processing and withdraw your consent at any time.

The fastest way to erase your data is in the app itself: Account › Delete my account. You can also write to privacidad@parnaso.app from your account’s email address, stating which right you wish to exercise.

We will respond within the legal deadlines: in Peru, 8 business days for requests for information, 20 business days for access and 10 business days for rectification, erasure or objection; in the European Union, within one month.

If you believe we did not handle your request properly, you may lodge a complaint with Peru’s National Authority for Personal Data Protection or, if you live in the European Union, with the supervisory authority of your country.

10. Minors

Anyone can use Parnaso without an account, since no personal data is processed that way. To create an account you must be at least 16 years old. If we discover an account belonging to someone under that age, we will delete it.

If you are a parent or guardian and believe your child created an account, write to privacidad@parnaso.app.

11. Security

Data travels encrypted between your device and the servers. Each account can only read and write its own exercises, thanks to access rules in the database. The service’s administrative accounts are protected with two-step verification.

If a security incident affecting your data occurs, we will notify the authority and, where applicable, you, within the deadlines required by law.

12. Changes to this policy

If we change this policy (for example, when adding subscriptions or crash-diagnostics tools), we will publish the new version with its date and notify you in the app before it takes effect. If the change requires your consent, we will ask for it.