Privacy Policy

This Privacy Policy explains how Main Act handles personal information when you use Main Act Artist, including its website, native apps, accounts, support, billing, and the Vocals, Songwriting, Repertoire schools. Main Act determines why and how this product information is used; payment, app-store, identity, and other providers also handle information for their own stated purposes.

Information comes from three places:

• You provide it: email address, display name, support messages, profile choices, educator-pilot details, files or writing submitted to a chosen feature, and anything you intentionally publish.
• The product creates it: practice progress, saves, feature state, consent and communication choices, security records, and technical events generated as you use Main Act.
• A provider returns it: sign-in identity details, payment or app-store status, message-delivery events, fraud signals, and diagnostic context needed to complete a service.

Main Act does not collect every category on every visit. The feature, choice, and sign-in state determine what is involved.

When you practise, Main Act may store exercise history, scores, comfort ratings, belt and XP progress, streaks, challenge results, saved reflections, repertoire records, drafts, and feature state needed to resume your work. Signed-in progress and saved work may be stored in Firebase so it can be recovered or used across supported Main Act experiences.

Some drafts, preferences, caches, anonymous results, and continuity receipts remain only in your browser or app unless the feature says they sync. Clearing browser or app data can remove those device-only records, and an account export cannot include a record that never left that device.

Public pitch and range tools analyze microphone input live in your browser and do not record or upload that live audio. A recording feature may store a take locally or upload it to your account only when the feature explicitly offers and confirms that save.

Lyrics, drafts, reflections, prompts, and other writing you submit to a cloud critique, AI-assisted response, or account-save feature cross the wire for that chosen action. The interface must distinguish a device-only draft from an account save or provider-assisted response.

Main Act also downloads its own lesson audio, stems, images, and narration for playback and may cache those product assets on your device.

Optional product analytics can include page and feature use, session starts and completions, campaign or referral attribution, browser locale, experiment, plan or belt context, timestamps, and a session identifier. When you are signed in, analytics events can include your account ID. Main Act does not write optional product analytics before you allow it, and you can change that choice in Account privacy controls.

Separately, Main Act counts a few first-lesson steps, such as starting the lesson, finishing it and opening sign-up, as anonymous totals. Each count holds only the step, the app, whether it was the website or the iPhone app, and the date. It has no account, device, session or referral identifier, and nothing is stored on your device for it.

When configured, error and performance diagnostics may run to protect reliability and security. Diagnostic reports can include technical context, the page where an error occurred, recent interaction breadcrumbs, and your account ID or email when signed in. Main Act redacts authentication-token fields from diagnostic URLs. Choosing “Essential only” turns off optional product analytics; it does not disable strictly operational security or error logging.

Optional product analytics does not contain selected audio files, microphone audio, passwords, full card numbers, or the text of private training answers.

Main Act stores the email categories you choose and delivery history needed to send, suppress, troubleshoot, and measure account, practice, educational, and billing messages. If provider-level open or click tracking is enabled, Resend can report that a message was opened or a link was clicked; Main Act records the event time and click count against that send. Email software and privacy protections can make those signals incomplete or inaccurate.

If you enable push, Main Act stores an FCM device token with app, platform, limited user-agent, creation and refresh timestamps. Notification preferences can include your timezone, quiet hours, opt-out, prior prompt, and recent-send state so reminders respect timing and frequency controls. Turning push off from Account marks the preference off and deletes registered Main Act push tokens.

Use Account communication controls to change optional email and notification choices. Necessary security, account, receipt, and payment-state messages may still be sent where needed to operate the service.

Main Act uses first-party storage to remember your analytics choice across supported Main Act experiences. Browser local storage, session storage, IndexedDB, native app storage, and caches may hold preferences, temporary handoff receipts, training continuity, downloaded lesson assets, and other device-only state.

Email/password sign-in is handled through Firebase Authentication. If you choose Google or Apple sign-in, that provider receives the sign-in interaction and returns the identity details needed to authenticate your Main Act account. Firebase may process email address, user agent, IP address, and security information to provide authentication and prevent abuse.

Main Act does not use third-party advertising cookies in Main Act Artist, does not sell personal information, and does not share it for cross-context behavioural advertising.

Main Act uses service providers to operate the product. Their processing is governed by contracts and their current privacy commitments:

• Firebaseauthentication, cloud data, functions, push
• Stripecheckout, billing, fraud prevention
• Anthropicchosen AI critiques, debriefs, and file reading
• Resendtransactional and opted-in email
• Sentryerror and performance diagnostics
• Appleoptional sign-in, app distribution, store billing
• Googleoptional sign-in, app distribution, store billing

When you intentionally use an AI critique, debrief, or sheet-reading feature, Main Act sends the submitted text or file and limited context needed to answer through its server to Anthropic. As of this policy date, Anthropic says standard commercial API inputs and outputs are not used to train its models unless the customer opts in and are normally deleted from its backend within 30 days, subject to safety, legal, or different contractual exceptions. Do not submit secrets or personal information the coaching task does not need.

Payment and app-store providers may collect transaction, device, and fraud-prevention information directly. Main Act receives the payment status and transaction details needed to manage access, not your full Stripe card number.

• provide accounts, lessons, tools, progress, purchases, and supported cross-device continuity;
• process payments, manage access, and send necessary service messages;
• provide an AI-assisted or cloud feature when you deliberately request it;
• respond to support, access, export, correction, objection, and deletion requests;
• detect abuse, protect accounts, debug failures, prevent fraud, and maintain security;
• send educational or product email when you have opted in, with an unsubscribe control; and
• understand and improve product use when optional analytics is allowed.

Where EEA or UK data-protection law applies, the legal basis depends on the purpose: contract for requested account, product, and purchase services; consent for optional analytics and optional marketing; legitimate interests for proportionate security, fraud prevention, reliability, support, and service improvement; and legal obligation where records or action are required by law. If processing relies on consent, you can withdraw it for the future without changing the lawfulness of earlier processing.

Signed-in users can use Account privacy controls to export account data, change optional analytics, correct profile information, manage communications, and open the permanent deletion workflow. Read the deletion boundary before removing an account. For anything the product cannot resolve, prepare a privacy request; no query text is copied into the draft.

Depending on where you live and whether the relevant law applies, you may have rights to know or access personal information, correct it, delete it, receive a portable copy, object to or restrict certain processing, withdraw consent, opt out of sale or sharing, or lodge a complaint with a data-protection authority. Main Act will not discriminate against you for exercising an applicable privacy right. Identity verification may be required, and an authorized agent may need to show authority to act for you.

If you choose to publish a profile, leaderboard entry, shared result, referral handle, or another public artifact, the preview identifies the fields that can become visible, such as display name, school, belt, XP, streak, or a selected result. Review that preview before publishing and avoid information you do not want public.

Private training answers, support messages, billing details, selected analysis audio, microphone input, unpublished drafts, and private notes are not added to a public profile by default. Main Act may remove public material to enforce the Terms, protect safety, or honor a valid request.

Main Act generally keeps account and synced practice information while your account is active. The operational Firestore analytics collection is swept for events older than 90 days; events already exported to reporting systems may follow a separate configured retention schedule. Inactive push tokens are scheduled for pruning after about nine months, and invalid tokens are removed after failed delivery. Provider systems and backups can follow their disclosed or configured deletion windows.

An account deletion request starts a guarded workflow that removes inventoried account, practice, public-profile, analytics, message-queue, shared-artifact, file-storage, cache, and authentication records. If a provider or storage cleanup is still pending, the product locks account data and reports that state instead of claiming deletion is complete. Device-only Main Act storage is cleared on the device that completes deletion; clear other devices separately.

Some records may be retained when reasonably necessary for security, fraud prevention, legal obligations, dispute resolution, or backup rotation. Aggregated or de-identified information may be retained when it can no longer reasonably identify you. Main Act uses HTTPS, access controls, provider security controls, token redaction, and guarded server workflows, but no system can promise absolute security.

The Service is not directed to children under 13, and Main Act does not knowingly collect personal information from a child under 13. If Main Act learns that an under-13 child supplied account information without an applicable parent or guardian process, it will take steps to remove it. Contact Main Act Support if you believe a child provided personal information.

Main Act and its providers may process information in the United States and other countries where they operate. Where applicable law requires a transfer safeguard, the responsible provider uses an approved mechanism such as contractual protections.

Main Act may update this policy as the product, providers, or law changes. The effective date at the top identifies the current version. Material changes will be communicated when applicable law requires notice.