Compangon — Privacy Note (beta)
Last updated: 2026-10-13 · governs the public beta · plain-language, EU-facing.
Compangon is a local-first desktop app. Your music — scores, manuscripts, compositions — lives on your machine, and we never collect it on our own. When you compose, the relevant passage goes to the AI model provider you connected, under your own key, and that provider's terms apply to what is sent. If you run a model on your own computer instead, the passage stays on your computer. Nothing about your music leaves your device unless you ask for it — a composition, or a composition report you choose to send. Apart from that, nothing leaves your device but the minimal records below, and only as described.
What goes to your model provider. When you compose, analyse or chat, Compangon on your computer sends the request directly to the provider you connected, under your key: the passage of the score in play, the piece's manuscript notes, your composer profile and your message. It never passes through our servers, and we cannot see it. What the provider does with it is governed by your agreement with them; some providers use API input to improve their models by default, so check the terms of the one you connect. A model on your own computer sends nothing.
On shared Wi-Fi. Compangon and the app you compose in talk to each other over the network. Because of the different technologies used, some of what they exchange might be visible to other users of that network. On Wi-Fi you don't trust, close the app you compose in when you are done. Your saved files are not affected.
What we collect
| What | When | Why |
|---|---|---|
| Install and launch counts — app version, release channel, operating system, and your country and region | When the installer finishes, and when the app starts | To see how many people use Compangon, and where. Nothing in it identifies you or your computer |
| Install record — a random ID for this install, app version, operating system, language | Only if you say yes to usage analytics or to sharing notation snippets | To tell one install from another |
| Account — your email and a hashed password | Only if you create an account | To sign you in |
| Profile — name, country, role, genres, how you heard about us | Only if you fill it in. All optional | To know who Compangon is for |
| Product-update emails — your email address, your app language, and the profile details you filled in | Only if you tick Email me product updates and have confirmed your email | To send you occasional emails about new features and releases |
| Crash and error reports — what broke in Compangon and where, no identifiers | When something breaks — only after you say yes, when the app asks on the next start | To fix what breaks |
| Usage analytics — which parts of the app you use, and your country and region | Only if you say yes | To decide what to build next |
| Your music — scores, manuscripts, compositions | — | Never collected on our own. It goes only to the model provider you connected, under your own key, or stays on your computer — see above |
| Composition reports — a composition you rate, with the passage and notes it was written from (lyrics removed) | Only if you turn reports on and press send on one you have read. Off by default | To see what went well or wrong, and compose better |
| Notation snippets — a fragment of notation a composition got wrong | Only if you turn them on. Off by default | To fix the composition engine |
| Feedback — what you write or rate, plus anything you attach, and which AI model you were using. A quick rating in the chat also notes what had just happened, such as a composition you accepted or one that failed | When you press Send, or when you tap an answer to the app's quick question in the chat | To read it, act on it, and tell you when it ships |
| Website visits — the page you open, the page you came from, your country and region, and the kind of browser and device | When you visit compangon.com. No cookies, and nothing that recognises you on a later visit | To see how many people visit and how they find Compangon, and to tell visitors from automated traffic |
What is personal. The counts identify nobody, and neither do the crash reports. The rest is yours: your account details, because we need them to run the account you asked for; the install record, analytics, crash reports, composition reports, snippets and product-update emails, because you said yes (your consent) — and you can say no again anytime in Settings → Privacy & data, or, for the emails, with the link in any of them; feedback, because you sent it to be read, and visits to this website, because we want to know how people find Compangon (both our legitimate interest). Analytics and feedback are linked to your install and, once you sign in, to your account — except a quick rating in the chat, which is linked to neither. A visit to this website is linked to nothing — not to the app, not to an account, not to your next visit — so we cannot pick out your own visits; you can object to the counting anytime (see Contact). To see where Compangon is used, we work out the country and region in the install and launch counts and in website visits from the address your connection comes from. We don't store the address with them, and you can object to this too (see Contact).
Please don't put sensitive personal details in a feedback report — we don't need them, and we delete them if we find them.
What a crash report contains
Two different kinds of data get sent, for two different reasons:
Crash & error reports. Off until you say yes; you are asked once, on the start after something goes wrong. Sent to our own EU server (not a third party). Legal basis: your consent. The record identifies nobody, and we ask before sending it. Every report contains only:
- a failure category (for example, a composition that failed, a crash, a lost connection) — one of a fixed list;
- an optional error code — our own controlled failure vocabulary (for example, a request too long for the model), never free text;
- coarse context — app version, whether it is a test or a release build, and your operating system (Windows, macOS or Linux);
- a count and timestamp.
When what broke was a composition Compangon was writing, the record also says which part of our own program failed, and nothing else:
- the name of the error type and the stage it happened in (for example, planning);
- the kind of composition being written and the build of the app;
- up to five names of the program parts involved — each one a piece of Compangon's own code and the function inside it.
Those names are labels we wrote into our own program. They say where Compangon broke; they say nothing about what you were writing, and they are not a copy of anything on your computer.
The record contains no install ID, user pointer, IP address, error message, file path, bar numbers, prompt, chat, manuscript, or any notation — yours or generated. The error's own words and its full traceback stay on your machine, in Compangon's local log folder; only the short list of program-part names above is ever sent. Our server does not store the caller's IP against the record. Nothing that could single someone out is ever added to it.
Usage analytics. Linked to your install — which features you use, which models you have set up, and diagnostics. Opt-in only. If you have opted in, a crash may additionally appear here, linked to your install.
Where it's stored (data residency)
Your account and install records, composition reports, crash and error reports, notation snippets, usage analytics, website visits, feedback reports and our verification email are all stored on servers in the EU.
Who can reach it. Some of the providers running these services are based outside Europe, or have staff there keeping them running, and the network carrying your connection is worldwide — which the law counts as sending data out of the EU, even though it is stored here. Each of them is covered by a European Commission adequacy decision or by its standard data protection clauses; write to [email protected] for a copy.
Who receives it. A few providers handle the data for us: our hosting provider in the EU, which runs our server and database; a network provider that delivers this website, routes every connection to our server, and protects both from attacks; our analytics provider; the service that sends our verification emails and, if you asked for them, our product-update emails; and the provider of our support mailbox, where feedback reports also arrive. When you compose, your request goes from your computer to the model provider you connected — see above.
How long we keep it (retention)
- Account + install data — until you delete your account (see Your rights).
- Product-update emails — your address and the details sent with it stay on our mailing list until you unsubscribe.
- Crash & error reports — 90 days, then aggregated and purged. The records of a broken composition, which name only parts of our own program, are kept 180 days, because a failure pattern is only visible across several app versions. As neither carries an identifier, they cannot be tied back to you for deletion — they simply age out.
- Notation snippets — 90 days, then deleted. They carry no identifier, so like the crash reports they simply age out.
- Usage analytics — up to 12 months, then removed.
- Website visits — up to 12 months.
- Composition reports — 90 days, then deleted whole. You can delete all of them sooner, from the app, and deleting your account deletes them too.
- Feedback reports — kept while we work on what you reported, and deleted within 24 months of the report being closed. A copy of each report sent from the feedback form also arrives in our support mailbox by email, so that a person reads it; that copy is deleted on the same schedule. A quick rating in the chat is not emailed, and is deleted within 24 months of arriving. Deleting your account removes the feedback you sent, along with any screenshots and attached conversations.
- Deleting your account removes your account and email and de-identifies your install records (the anonymous install row may remain for install-count integrity, no longer tied to you); your analytics identity is reset.
Your rights
In Settings you can, anytime:
- download your data — your account, your install records and the feedback you sent, as a file;
- correct your profile, or delete your account and your data — permanently, which cannot be undone;
- download or delete all your composition reports;
- turn analytics and crash & error reports on or off, and take back any consent you gave.
These switches are also how you restrict our use of your data, or object to it — for crash and error reports, just turn them off.
You can also lodge a complaint with a data-protection authority.
Nothing is required to use Compangon; an email address is needed only for an account. No decisions about you are made automatically.
Contact
Compangon UG (haftungsbeschränkt) (see the Imprint) is responsible for your data. For questions, or a data request you can't complete in the app, write to [email protected].