Privacy Policy

1 Information We Collect

a) Information You Provide Directly

• Contact Form submissions: first name, last name, email address, subject, and message text when you use our contact form.

b) Information from Google Sign-In

When you sign in with Google, we receive:

• Your Google display name
• Your email address
• Your profile photo URL
• A unique Google User ID (UID)

We do not receive or store your Google password.

c) Composition Data

• Local compositions: notation data you create is stored in your browser's local storage.
• Cloud-synced compositions: if you are signed in, your compositions may be saved to Google Cloud Firestore under your user account.

d) Automatically Collected Data

• Usage analytics: we may use privacy-respecting analytics to understand general usage patterns (e.g. page views, feature usage). We do not track individual behaviour profiles.
• Device and browser information: standard HTTP headers such as browser type, operating system, and screen resolution may be logged by our hosting provider (Firebase Hosting).

2 How We Use Your Information

We use the information we collect to:

• Provide the Service: authenticate your identity, sync compositions across your devices, and deliver core App functionality.
• Communicate with you: respond to messages you send through the contact form.
• Improve the App: identify bugs, understand which features are most useful, and guide development priorities.
• Ensure security: detect abuse, prevent spam, and protect data integrity.

3 Google Sign-In & OAuth

Tabla I/O uses Google OAuth 2.0 ("Continue with Google") as its sole authentication method. When you click "Continue with Google," you are redirected to Google's own sign-in page. We never see or handle your Google password.

We request only the following OAuth scopes:

• email — to identify your account
• profile — to display your name and photo in the App

You can revoke Tabla I/O's access at any time from your Google Account Permissions page.

4 Cookies & Local Storage

The App uses the following client-side storage mechanisms:

• localStorage: stores your theme preference, unsaved composition data, and custom dictionary mappings. This data never leaves your device.
• Firebase Auth session tokens: if you sign in with Google, Firebase stores a secure session token in an IndexedDB entry to keep you logged in across page reloads.
• Service Worker cache: the App caches static assets locally for offline access and faster loading via a Service Worker.

We do not use third-party tracking cookies. We do not run advertising scripts. No cross-site trackers are embedded in the App.

5 Data Storage & Security

Cloud-synced compositions and account data are stored in Google Cloud Firestore, hosted on Google's infrastructure. Data is encrypted in transit (TLS) and at rest. Firestore Security Rules restrict each user's data to their own authenticated account.

While we implement industry-standard safeguards, no method of electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data to the best of our ability.

6 Data Retention

• Account data (name, email, UID) is retained for as long as your account exists.
• Cloud compositions are retained until you delete them or request account deletion.
• Local data (localStorage) persists on your device until you clear your browser data.
• Contact form messages are retained only as long as needed to respond and resolve your enquiry, after which they are deleted.

If you delete your account or request data deletion, we will remove all associated cloud-stored data within 30 days. Residual copies in encrypted backups may persist for up to 90 days before being automatically purged.

7 Third-Party Services

We rely on the following third-party services, each governed by their own privacy policies:

• Firebase (Google Cloud): hosting, authentication, and database — Firebase Privacy Policy
• Google OAuth: sign-in — Google Privacy Policy

8 Payments & Subscriptions

Tabla I/O offers a free tier and a paid Pro subscription (₹299/month or ₹2,499/year). Payments are processed securely via Razorpay. We do not store your payment card details — all transactions are handled directly by Razorpay in accordance with their privacy policy. Your subscription status is stored in our database solely to determine your plan tier and feature access.

9 Your Rights Under Indian Law

If you are a resident of India, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") protect your personal data. Under these provisions, you have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate or incomplete data.
• Withdraw consent for processing your data at any time — though this may affect your ability to use certain features.
• File a grievance with our Grievance Officer (details below) if you believe your data has been mishandled.

Additionally, once the Digital Personal Data Protection Act, 2023 (DPDPA) is fully enforced, you will have further rights including the right to erasure and the right to nominate another person to exercise your data rights. We will update this policy to reflect any new obligations as they come into effect.

10 Your Rights Under the GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) grants you the following rights:

• Right of Access: request a copy of all personal data we hold about you.
• Right to Rectification: ask us to correct inaccurate data.
• Right to Erasure ("Right to Be Forgotten"): request deletion of your personal data.
• Right to Restrict Processing: ask us to limit how we process your data.
• Right to Data Portability: receive your data in a structured, machine-readable format.
• Right to Object: object to data processing based on legitimate interest.
• Right to Withdraw Consent: withdraw consent at any time where processing is based on consent.

Our lawful bases for processing are consent (when you sign in or submit the contact form) and legitimate interest (to maintain and improve the App).

To exercise any of these rights, email us at kaustnbh@gmail.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.

11 Children's Privacy

Tabla I/O is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

12 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. For material changes, we will make reasonable efforts to notify you — for example, through a banner in the App or an email to the address associated with your account. Your continued use of the App after changes are posted constitutes acceptance of the revised policy.

13 Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or your personal data, please reach out: