Privacy notice

The app (the student app Leggio-Music Practice and the teacher app Leggio-Teacher) is used by several music schools, fully separated from each other: every school sees only its own data. The schools are the controllers of their teachers’ and students’ data (they may add their own notice); Fortepixel processes these data on the school’s behalf, as a processor. Fortepixel is the controller of the registering school contact’s data (name, e-mail address) and of content reports. A private teacher without a school (individual account) is likewise the controller of their own students’ data. Billing and payment data for paid subscriptions are processed by Fortepixel as an independent controller.

This notice is available in seven languages. The Hungarian version is authoritative; if a translation differs from it, the Hungarian version prevails.

1. Operator (Fortepixel)

Name

Péter Szabó, sole proprietor, trading as Fortepixel

Address

Bodza utca 3., 2141 Csömör, Hungary

Registration no.

62883656 (Hungarian register of sole proprietors)

Contact

hello@fortepixel.hu

2. What data do we process on the server?

• The student’s name or nickname and instrument (entered by the teacher)Purpose: So the teacher knows whose practice it is; the instrument sets the range of the practice monitorKept until: Until the teacher or the student deletes it
• The student’s phone identifier (only its hash)Purpose: Linking the phone to the teacherKept until: Until the student signs out or is deleted
• The student’s own sign-in, if they set one up: the chosen username and the password hash (bcrypt)Purpose: So that after signing out (e.g. siblings sharing a phone) they can sign back in without a new code; their teacher also sees the username to help if they forget itKept until: Until the student changes it, the teacher disconnects their phones, or the student is deleted
• Practice data: start and end time, time spent in the practice view, detected instrument playing time, number of notes played, gradual-metronome tempos, the piece, warning signsPurpose: The teacher’s supervision of practiceKept until: 120 days, or until the student is deleted
• The practice plan of an assignment (set by the teacher: bars, tempo, daily minutes, steps) and the steps the student has ticked offPurpose: So the student knows what and how to practise, and the teacher sees how far they have got in the taskKept until: Until the teacher withdraws the assignment, or until the student is deleted (the student’s ticks are deleted with them)
• The teacher’s message to the student after a lesson (text, time), and when the student first saw itPurpose: Feedback and tasks for the student after the lesson; the teacher can see it arrived. Replies are not possibleKept until: 180 days (the latest 30 per student), or until the teacher deletes it, or until the student or the teacher is deleted
• Parent link (if the teacher creates one): a hash of the secret code and the time it was createdPurpose: So that a parent can view the child’s practice, assignments, the teacher’s messages and the game results without signing in, read-only. We store nothing about the parentKept until: Until the teacher revokes it or creates a new one, or until the student or the teacher is deleted
• Motivation (the teacher can turn it off per student): the weekly goal settings (how many days, how many minutes a day, leaderboard on/off), the badges earned and when, the current weekly streak, and per school year the total playing time and the number of practice daysPurpose: Weekly goal, streak and badges to encourage practice; the end-of-year certificate can be made from this (the teacher’s phone creates it as a PDF; it is not stored on the server)Kept until: Badges and streak until the student is deleted; the school-year summary is kept for the current and the previous school year (also after the 120-day practice data is deleted), at most until the student is deleted
• Music theory game results (if the teacher enabled them): which game, level, correct answers out of all, duration, timePurpose: So the teacher sees what goes well and what needs practiceKept until: 120 days, or until the student is deleted
• Game settings (set by the teacher: on/off, level)Purpose: Which games appear for the student, at which difficultyKept until: Until the teacher changes them, or until the student is deleted
• “Practising now” signal: time, piece, whether an instrument sounds, tempo, the name of the last notePurpose: So the teacher sees live who is practisingKept until: Until the end of practice, at most 1 hour
• Notification address: the push address of the phone’s browser – in the Android app installed from Google Play, the app’s notification ID (Firebase) and the app language (only if the student asks for notifications)Purpose: A signal to the phone when the teacher assigns a new scoreKept until: Until notifications are switched off, the student signs out or is deleted
• Scores uploaded by the teacher (PDF, or a PDF made on the phone from photos / scanned images – without the photos’ hidden metadata such as location) and audio filesPurpose: Assigning to students (only students it is assigned to can download it)Kept until: Until the teacher deletes it
• The teacher’s markings on the score (lines, circles, short texts – e.g. fingering), per piecePurpose: So the student sees next to the score what to pay attention to (they only get their own teacher’s markings, on the assigned piece)Kept until: Until the teacher deletes them, or until the piece or the teacher is deleted
• Score report: the school, the piece (and its title), the reason, the optional comment, the time – the reporter is not storedPurpose: Filtering infringing or inappropriate content (Fortepixel may block the piece)Kept until: 180 days after it was handled, or until the school is deleted
• The teacher’s name (added by the school admin)Purpose: The teacher signs in with it, and their students see it (“Your teacher: …”)Kept until: Until the admin or the teacher deletes it – all their students, scores and assignments are deleted with it
• The school’s name, school code, logo and colour palette, plan (trial, monthly or annual subscription, free test), student tier and validity, Fortepixel’s notePurpose: Separating schools, sign-in, the school’s branding and keeping track of subscriptionsKept until: Until the school is deleted (the admin can delete the logo at any time)
• The name and email address of the registering contact person (for an individual account, the teacher)Purpose: Notice about the end of the trial, quote and invoice, contactKept until: Until the school is deleted
• For paid subscriptions (card payment or bank transfer order): billing details (name, address, tax number if any, email address), the plan, the amount, the date and status of the order and the payment, the invoice number; for card payments, Barion’s payment and recurring-payment identifiers – we never receive card detailsPurpose: Collecting the subscription fee (for cards, also the automatic renewal), issuing the invoice, recording the payment, confirmations and notices by email (e.g. of a failed charge)Kept until: Successful payments: 8 years (accounting obligation under the Hungarian Accounting Act, s. 169) – even after the school or account is deleted; failed or abandoned payment attempts and withdrawn or unpaid orders: 180 days; the recurring-payment identifier: until cancellation or deletion of the account
• Hashes of the passwords of the operator, the admin, the teachers and students who set up their own sign-in (bcrypt), hashes and encrypted copies of one-time sign-in and join codes, and hashes of sign-insPurpose: So that only the owner of an account can sign in; so that the teacher / admin can show an issued code again until it is used (without a new code)Kept until: Until the password is changed; a code for 7 days or until used; a sign-in for 30 days (the operator’s for 8 hours)
• A pseudonymised hash of the IP address (the address cannot be recovered)Purpose: Protection against password and code guessing, mass registration and mass reportingKept until: At most 24 hours

Who sees what? Every teacher sees only their own students’ data (not other teachers’ students, scores or assignments); a student sees only their own data and their teacher’s name. The teacher also sees the username of a student’s own sign-in – not the password. The school admin sees the teachers’ names, the number of their students, the names of the students who have joined a teacher (who use the app), and the school’s number of active students – no other student data (practice, log, instrument, code). Fortepixel’s operator page shows the schools’ names, plans, validity, the contact person, the number of teachers and students, and the score reports – no names and no practice data. The school admin (for an individual account, the teacher) also sees their own subscription, payments and billing details; Fortepixel’s operator page also shows paying subscribers’ billing details and payments (to issue invoices). If the teacher creates a parent link, whoever knows the link (the parent) can see, without signing in and read-only, the school and teacher name, the student’s name and instrument, the practice time of the last 14 days, the assigned pieces (with due date, plan and ticked steps), the teacher’s 3 latest messages and the overall game results – but not the warning signs, the phone or the sign-in details. The link is shown only when it is created; the teacher can revoke it at any time. If the teacher turns on the leaderboard for a student, the teacher’s students on the leaderboard see each other’s nicknames and their number of practice days and minutes this week – nothing else. The parent view also shows the weekly goal, the streak and the badges.

Language: the app sends the chosen language with every request so that the server answers in the same language (e.g. error messages). The server does not store it.

Legal basis: for students’ data, consent (GDPR Art. 6(1)(a)); for students below the age of digital consent (16 in Hungary), the parent’s consent (GDPR Art. 8). Consent can be withdrawn at any time: the student can delete all their data in the app, or the teacher deletes it with one tap. For the contact person’s data, preparing and performing the contract (GDPR Art. 6(1)(b)); for reports, the legitimate interest of filtering infringing content (GDPR Art. 6(1)(f)). For billing and payment data: performance of the contract (GDPR Art. 6(1)(b)); for keeping them: a legal obligation (GDPR Art. 6(1)(c), Hungarian Act C of 2000 on Accounting, s. 169).

Trial, subscription: a registered school or private teacher can try the app free for 7 days. After that they can subscribe by card (renewing automatically, cancel any time) or by bank transfer against an invoice – the terms are set out in the Terms and Conditions (in Hungarian: app.fortepixel.hu/aszf/). If the trial or subscription expires, the data stays unchanged and can be viewed, but nothing new is recorded (new students, scores, assignments, practice).

3. Deleting your account and data

Every account and all data can be deleted from within the app, in one step, permanently – you do not need to contact anyone:

• Student (Leggio-Music Practice): tap your name at the top → Delete my data → confirm. Your name, instrument, practice log, game results, phone link, own sign-in (username, password) and notification address are deleted – from the server and from the phone.
• Teacher (Leggio-Teacher): tap your name at the top → Delete my account → your password. Your account, your students (with their practice logs), your uploaded scores and assignments are deleted. For an individual account (no school), this deletes the whole account, and the card subscription stops renewing.
• School (school admin): on the admin page → Delete the school → the admin password. All data of the school is deleted: teachers, students, scores, logs, logo, reports.
• Only from the phone (data stays on the server): Sign out on this phone – in the student app all student data is removed from the phone.

If you cannot use the app (e.g. the phone was lost), write to hello@fortepixel.hu with the name of your school and your name; after verification we delete the data within 30 days at the latest and confirm it. A teacher can also delete a student’s data with one tap.

After deletion no data is kept (we keep no backups). The server’s technical log (IP address, time) is kept by the hosting provider for a few weeks at most. The exception is the accounting data of successful subscription payments (billing details, amount, date): by law we must keep these for 8 years.

4. The microphone

The tuner and the practice monitor analyse the microphone only on the phone. No sound is recorded, stored or sent anywhere – only the numbers above reach the server (e.g. “18 minutes of playing, 140 notes”). The microphone is only used if the student switched it on (at first start or in Settings – where it can be switched off at any time), and even then only in the practice view and in the tuner.

5. Notification about a new score

Only works if the student switches it on in Leggio-Music Practice (and can switch it off in the same place, by tapping their name). The notification is delivered by the maker of the phone’s browser through its own push service (Google on Android, Apple on iPhone, Mozilla in Firefox, Microsoft in Edge). Our server sends an empty signal there: no name, no title, no other content – the text “You have a new score” is displayed by the phone itself, in the language chosen in the app. The service therefore only sees that the phone received a signal at that time. In the Android app installed from Google Play, the app itself receives the notification through Google’s messaging service (Firebase Cloud Messaging) – so it arrives even if the phone has closed the app in the background. For this our server stores the app’s notification ID and sends only the app language along with the signal (so the phone shows the text in that language). Here notifications switch on by themselves when the student allows them in Android’s permission prompt; they can be switched off the same way by tapping their name, or blocked in the phone’s settings.

6. Automatic estimate – not a decision

The practice monitor automatically estimates how long an instrument was played and flags unusual patterns (e.g. the same single note for minutes). This is a hint, not evidence and not a grade: any consequence is always decided by the teacher, after talking to the student. The estimate can be wrong (e.g. whistling or a recording may look like playing).

7. What stays on the device

We set no cookies ourselves (section 8 covers Barion’s fraud-prevention code, which may set cookies). The browser’s own storage (localStorage, IndexedDB, cache) keeps:

• settings (e.g. metronome tempo, instrument, note naming, last opened tab, light or dark appearance, sound and microphone on/off; in the app installed from Google Play, also whether the browser has microphone permission) and the chosen language (shared by the two apps; in the student app also in the cache, for the notification text);
• in the student app: the phone identifier, the student’s name and instrument, the list of assigned pieces (with the teacher’s markings), downloaded scores and audio (for offline practice), practice reports not yet sent, the own practice log, the game settings and game results not yet sent, and whether notifications were requested (the browser also keeps its own push subscription for this; in the app installed from Google Play, the app’s notification ID); and whether an own sign-in has been used on this phone (this stays after signing out so that the sign-in form starts with it – without any name). The phone remembers the username and password only if the student saves them in their own password manager. Also the ticked-off steps of an assigned task, until they reach the teacher. Also the teacher’s most recently downloaded messages (readable offline too). The latest weekly goal, streak and badges (and which badges the student has already seen);
• in the teacher app: the sign-in identifier, the teacher’s name, the last used school code (so it need not be typed again) and scores downloaded for preview, and, on returning from the card payment page, the payment identifier while the app checks it (cleared when the tab is closed);
• in both apps: the school’s name, logo, colour palette, plan and validity (so they show without internet);
• an accompaniment file chosen on the Tools tab.

These are needed for the app to work; nobody else can access them. On sign-out, the student app removes all the student data above and the school data from the phone, and notifications stop; the teacher app removes the sign-in, the school data and the downloaded scores (the school code stays). Settings, the language and the own accompaniment file stay; they can be removed by clearing the site/app data in the browser (or phone) settings.

8. What there is not

No analytics, no ads, no social plugins. The student app connects to no external server, and the teacher app only to the Barion fraud-prevention code described below (fonts are local too); apart from this Barion address, the server’s security policy (CSP) blocks every external connection. The only exception is the notification in section 5, if switched on: then our server sends an empty signal to the push service of the phone’s maker (in the Android app from Google Play: to Google Firebase Cloud Messaging, for which it also requests an access token from Google). When a new score report arrives, Fortepixel receives a short e-mail (without the content of the report). For card payments, payment takes place on Barion’s page (the app redirects there), and our server communicates with Barion (starting, checking and renewing payments); for a successful payment Fortepixel receives an email with the details needed for the invoice, and for a failed renewal the subscriber receives an email. For a bank transfer order, Fortepixel receives an email with the details needed for the invoice, and the customer receives a confirmation of the order and of the payment’s arrival.

Barion fraud prevention (Base Barion Pixel): card payments require that Barion’s fraud-prevention code runs on the pages that offer payment – in the teacher app, on the start page, on the page for teachers and on the T&C page. It loads from pixel.barion.com and sends technical data to Barion (address of the opened page, time, browser and device characteristics, IP address); for this, Barion may also set cookies on its own domain. Its purpose is to detect abuse (e.g. payment with a stolen card); legal basis: the legitimate interest of Fortepixel and Barion (GDPR Art. 6(1)(f)). Barion processes the data under its own privacy notice (barion.com). It is not used for advertising or marketing: Barion’s “full” (marketing) pixel is not switched on. The student app and the parent page contain no such code.

9. Processors and payment provider

Rackhost Zrt., Tisza Lajos körút 41., 6722 Szeged, Hungary (company reg. no. 06-10-000489) – operator of the server (and of the hello@fortepixel.hu mailbox). Like every web server, it keeps a short technical log of requests (IP address, time, requested address), which we use for nothing else.

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – only for the Android app installed from Google Play: the Firebase Cloud Messaging notification service (the app’s notification ID and the empty signal). Google acts under the Firebase data processing terms; data may also be processed outside the EU (in the USA), on the basis of the EU–US Data Privacy Framework and standard contractual clauses.

Barion Payment Zrt. (company reg. no. 01-10-048552; an e-money institution supervised by the Hungarian National Bank) – only for card payments: processing the payment and recurring charges. It receives the billing name, the email address and the payment details (item, amount, identifier). Card details are processed by Barion as an independent controller under its own privacy notice (barion.com); Fortepixel has no access to them.

10. Your rights

You may request access to your data, rectification, erasure, restriction of processing, and you may object; consent can be withdrawn (GDPR Arts. 15–21, Art. 7(3)). Write to hello@fortepixel.hu – we reply within one month. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): Falk Miksa utca 9–11., 1055 Budapest, Hungary, ugyfelszolgalat@naih.hu, +36 1 391 1400 – or with the data protection authority of your EU country of residence.

Effective: 21 October 2026