Privacy Policy
Last updated: November 2026
Who is responsible
Keybloom is created and operated by S. D. Kostopoulou, who is the data controller. Contact: keybloomprivacy@protonmail.com.
What we collect
Playing the instruments needs no account and sends no data: all sound is made in your browser. If you create an account we store your email address, a securely hashed password, your display name and the melodies you choose to save.
Shared melodies and uploads
You can upload melodies, audio recordings, sheet-music images and PDFs. Uploads are private by default. If you choose public, anyone can view the upload and your display name on your personal page. Submitting to the main collection makes the upload public and sends it for administrator review. Administrator public uploads appear directly in the main collection. You can make your uploads private or delete them; previously downloaded copies cannot be recalled, and existing file links may remain usable for up to one minute.
Why and on what basis
We use this data only to provide your account and keep your saved melodies (performance of a contract, GDPR Art. 6(1)(b)), and to keep the service secure (legitimate interest, Art. 6(1)(f)). We do not sell data, show ads or profile visitors.
Cookies and browser storage
Keybloom uses no tracking or advertising cookies. Your browser stores only your language choice and, if you sign in, your login session. Both are strictly necessary and need no consent. Fonts are served from our own site, not from third parties.
Who processes the data
Accounts and melodies are stored with our managed cloud hosting provider, encrypted in transit and at rest. If you sign in with Google, Google handles that sign-in under its own privacy policy.
How long we keep it
We keep your data for as long as you have an account. When you ask us to delete your account, your profile and saved melodies are erased.
Your rights
You may access, correct, export or delete your data, object to or restrict its processing, by emailing keybloomprivacy@protonmail.com. You may also complain to a data protection authority, in Greece the Hellenic Data Protection Authority (www.dpa.gr).