Effective Date: 17 October 2026
This Privacy Policy describes how enScore ("we", "us", "our") collects, uses, stores, and protects your personal information when you use our application. enScore is available for iOS, iPadOS, macOS, Android, and Windows, and is operated by Jonathan Vardouniotis, trading as enScore (ABN 76 556 821 750). By installing or using enScore, you consent to the practices described here.
We are committed to handling your data in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the EU and UK General Data Protection Regulations, and the California Consumer Privacy Act, where applicable.
We only collect data necessary to provide the features you use. The lists below are exhaustive — we do not collect anything beyond them.
If you use enScore without signing in, we do not collect any personal data. Your library, annotations, and bookmarks remain on your device only.
If you sign in with a different provider using the same, verified email address as an existing enScore account, we link the new sign-in to that existing account rather than creating a duplicate — this is what lets a purchase or library made under one sign-in method follow you if you later sign in a different way.
ios / ipados / macos / android / windows)This is used to label devices in your account and to attribute synced changes to the correct origin device.
enScore lets you attach a link to an existing recording of a piece — on YouTube or Apple Music — so you can play it back next to the score. We do not see or store the recording itself.
enScore uses YouTube API Services. When you use enScore's YouTube features, Google also collects and processes data under the Google Privacy Policy, and you agree to the YouTube Terms of Service. In detail:
Apple Music links work the same way through Apple's MusicKit: the request goes directly to Apple, and enScore stores only the song ID, title, artist, duration, and artwork URL with the score on your device. If you enable Sync, only the song ID (and your storefront) and your own settings for it are stored in your synced library; the title, artist, duration and artwork are never sent to our servers.
We use two privacy-oriented third-party services to keep enScore working:
Neither service is used for advertising, and neither is sold or shared onward for advertising purposes.
enScore can suggest a title and composer for a score you import, to save you retyping it. This has two parts:
You can turn the cloud-assisted engine off at any time in Settings; the on-device engine keeps working regardless.
Redeeming a physical or digital enScore coupon happens on our website, not in the app. That flow collects the email you sign in with there, and a hashed (not raw) copy of your IP address, used only to prevent abuse of the redemption system. The same hashed-IP approach is used to rate-limit sign-in attempts generally — we do not retain your raw IP address for this purpose.
The Store (the Store tab in enScore, and the website at store.enscore.app) is where enScore sells digital sheet music from publishers, together with public-domain and free editions. Browsing the Store works without an account; buying or getting an edition needs an enScore account (there is no guest checkout). The Store runs on its own Supabase project, separate from the one that holds your synced library. It does not hold your annotations, your library contents, or your own PDFs. It recognises you by checking your existing enScore sign-in with our authentication service; it does not create a second account for you.
For each reader, the Store keeps:
If you sign in on store.enscore.app, your browser keeps a standard sign-in session (see Section 9). Signing out there is local and does not sign you out of your apps.
Payment — Stripe. enScore (Jonathan Vardouniotis, trading as enScore) always provides the edition and the licence to it; who sells you the purchase transaction depends on where you buy from. For most countries enScore is the seller and Stripe processes the payment as our processor: on its own secure checkout page it collects your name, email address, card or other payment details and billing address, calculates the applicable VAT, GST or sales tax for us (Stripe Tax), sends your receipt on our behalf, and processes the refunds we issue and any disputes, under Stripe's privacy policy. For buyers in countries whose law requires a foreign seller to register for tax from the first sale, where enScore is not registered (currently Albania, Angola, Armenia, Aruba, the Bahamas, Bahrain, Bangladesh, Cameroon, Chile, Colombia, Georgia, Guinea, India, Kazakhstan, Kenya, Kyrgyzstan, Laos, Mauritania, Mexico, Moldova, Montenegro, Morocco, North Macedonia, Oman, Peru, Saudi Arabia, Senegal, Serbia, South Korea, Tajikistan, Tanzania, Türkiye, the United Arab Emirates, the United Kingdom, Uruguay, Uzbekistan and Vietnam), the transaction is sold through Link, a Stripe service, which acts as the merchant of record (Stripe Managed Payments; the transaction is processed by a Stripe acquiring affiliate, for example Stripe Payments Australia Pty Ltd): Stripe collects the same details, calculates, collects and remits the tax, sends your receipt, offers you a Link account to manage your orders, and handles transaction support, refunds and disputes, as an independent controller under Link's privacy policy and Stripe's privacy policy; you can ask Stripe/Link to delete its records of your purchases, and Stripe tells us when you do. To decide which applies we use the country your connection comes from, and Stripe tells us the country of your billing address. To create a checkout we send Stripe the editions in your order, their prices, your enScore account ID and a checkout reference (never your sign-in details), and, so you do not have to type it, your verified email address (we do not keep it after the checkout is created). Stripe tells us about your payment, refunds and disputes (the order details listed above, the country of your billing address, the tax charged or withheld, and Stripe's fees); it does not give us your card details.
In-app purchases — Apple and Google. If you buy an edition in the enScore app through the App Store or Google Play, Apple or Google sells it to you and handles the payment under its own privacy policy. We receive the purchase record from them (a transaction reference, the product, the price, the storefront country, and any refund or cancellation) so we can issue your licence, and revoke it if the purchase is refunded. To match a purchase to your order, the app gives Apple a random order ID, and gives Google a one-way hash of your enScore account ID; neither includes your name or email address.
Protected editions — watermark and copying controls. Publishers choose, edition by edition, how an edition is protected. On a protected edition:
To apply each edition's regional availability, we use the country your request appears to come from, at the time of the request. We do not otherwise track your location. We keep no per-reader download history other than the licence and device records above and aggregate, non-identifying counters (for example, the number of completed downloads). Our hosting providers (Supabase and Cloudflare) keep standard technical request logs, which can include IP addresses, for a limited period set by those providers, for security and operations; we do not use them to build a record of what you read or download.
Publisher referrals and attribution. A publisher can share a referral link (a link of the form enscore.app/r/ followed by the publisher's name, or a Store link carrying a publisher reference). When you follow one, the Store records the click: the publisher, the time (set by our server), a keyed hash of your browser's user-agent, and a keyed hash — not the raw address — of your IP address. Following the same link from the same address and browser within 10 minutes counts once, and an address that creates more than 30 new clicks in an hour is throttled. A click ID is kept in first-party storage on your device. If you then create an enScore account within 7 days of that click — or, with no referral, make your first Store action (a free Get or a purchase) within 24 hours of creating your account — we record once, for your account, which publisher brought you. That publisher then earns a bonus of 20% of enScore's net revenue from your enScore Pro and Sync purchases for 12 months. To work out the bonus we ask RevenueCat, using your account ID, for the amounts of those purchases. Publishers see only counts and amounts, never your identity. Referral clicks contain only the keyed hashes described above, never your raw IP address or browser details.
Membership and institutions (not currently switched on). The Store includes a Store membership and school/orchestra seat features that are built but switched off. If we switch them on, we will also record, for membership reading only, the number of minutes per day you spend reading each membership edition (a daily total per edition, with no page numbers or times of day, capped at 240 minutes a day across editions) to share membership revenue between publishers, and an institution's seat assignments by email address. We will update this policy before doing so.
Support. When you tell us "I bought it but can't see it", enScore staff can look up your orders, licences, devices and last licence check. Staff cannot see your annotations or library, because they are not in the Store. Publishers receive aggregate sales by country and product; they never receive reader names or emails.
Aggregate usage and errors. We count Store events (for example, Store opened, edition viewed, checkout started, purchase completed) in TelemetryDeck without personal data, and report Store errors to Sentry (error type and edition ID, never keys or personal content).
Publishers sign in to the publisher portal at portal.enscore.app by invitation only; portal accounts are separate from reader accounts. For portal users we keep: your email and display name; your role and the publishers you belong to; your second sign-in factor (passkey or authenticator app) and recovery codes; the browsers you chose to trust (a label, a hash of the browser's user-agent, and dates); security-alert emails we send (new browser sign-in, second factor added or removed, recovery code used, payout details changed); an audit log of actions taken in the portal (with before and after values and a hashed IP address); the date, person and hashed IP address of any publisher-agreement acceptance; catalogue import jobs; and, for payouts, the account holder's name, the last four characters of the bank account number, the payout currency and country, and the full bank details, which are stored encrypted. Statements and royalty records contain amounts, not reader identities.
We use your data only for the purposes described below. We do not sell, rent, or share your data with third parties for advertising or marketing purposes.
| Data | Purpose |
|---|---|
| Email + name | Account creation and sign-in |
| Authentication tokens | Verifying your identity for sync requests |
| Library data (incl. linked-media links and audio attachment settings, but not the audio files) | Storing and synchronising your library across your devices |
| Device data | Distinguishing your devices in account management |
| Purchase data | Verifying access to paid features, across every platform you sign into |
| Store licences, orders, devices and reader profile | Selling and delivering editions you buy or get, applying device limits and regional availability, showing your purchases on every device, support, and tax/accounting records |
| Name or email shown in a protected edition's watermark | Deterring unauthorised copying of a protected edition |
| Referral clicks and attribution (keyed hashes, account ID) | Crediting the publisher who introduced you, and preventing abuse |
| Publisher-portal user data | Running publisher accounts, security, payouts and statements |
| A page-1 image + filename (only if you use cloud-assisted detection) | Suggesting a title/composer for that one score; discarded immediately after |
| Crash diagnostics (Sentry) | Finding and fixing bugs |
| Usage analytics (TelemetryDeck) | Understanding which features are used, in aggregate, to prioritise development |
We do not use your library data for advertising, for training machine-learning models, or for any purpose beyond providing the features described above.
enScore relies on the following service providers ("Sub-processors"):
| Provider | Purpose | Location | Privacy Policy |
|---|---|---|---|
| Supabase | Database (Postgres) and file storage for synced library | Japan (Tokyo) | supabase.com/privacy |
| RevenueCat | Subscription state and entitlement management | United States | revenuecat.com/privacy |
| Anthropic | Reads a score's first page to suggest a title/composer (only if you use cloud-assisted detection) | United States | anthropic.com/privacy |
| Sentry | Crash and error reporting | United States | sentry.io/privacy |
| TelemetryDeck | Aggregate, privacy-oriented usage analytics | See their policy | telemetrydeck.com/privacy |
| Apple | App Store payments, Sign in with Apple, Apple Music playback (if you link a recording) | Various | apple.com/legal/privacy |
| Sign in with Google; Google Play billing and Play Services (Android); YouTube playback (if you link a recording) | United States | policies.google.com/privacy | |
| Amazon | Sign in with Amazon; Amazon Appstore billing (if purchased there) | United States | amazon.com/privacy |
| Huawei | Sign in with Huawei (HUAWEI ID) | Varies by region | consumer.huawei.com/en/privacy |
| Microsoft | Microsoft Store billing (Windows) | United States | privacy.microsoft.com |
| Supabase (a separate project for the Store) | Database (Postgres) for Store licences, orders, devices, catalogue and publisher-portal data | Japan (Tokyo) | supabase.com/privacy |
| Stripe | Payment processor for Store purchases where enScore is the seller (most countries): payment, tax calculation (Stripe Tax), receipts, refunds, disputes; through Link, merchant of record of Store purchase transactions for buyers in countries whose law requires a foreign seller to register for tax from the first sale (currently Albania, Angola, Armenia, Aruba, the Bahamas, Bahrain, Bangladesh, Cameroon, Chile, Colombia, Georgia, Guinea, India, Kazakhstan, Kenya, Kyrgyzstan, Laos, Mauritania, Mexico, Moldova, Montenegro, Morocco, North Macedonia, Oman, Peru, Saudi Arabia, Senegal, Serbia, South Korea, Tajikistan, Tanzania, Türkiye, the United Arab Emirates, the United Kingdom, Uruguay, Uzbekistan and Vietnam) (Stripe Managed Payments; enScore grants the licence): payment, tax, receipts, transaction support, refunds, disputes | United States and [REGION — confirm] | stripe.com/privacy |
| Cloudflare | Encrypted storage (R2) and delivery of Store files, public catalogue images and data, hosting of the Store and portal websites | [REGION — confirm] | cloudflare.com/privacypolicy |
| Resend | Sending publisher-portal invitation and security-alert emails | [REGION — confirm] | resend.com/legal/privacy-policy |
Your synced library files are stored encrypted at rest by Supabase Storage. Database access is gated by Row-Level Security (RLS) policies that ensure only your account can read or modify your own rows; no other user — including us, in normal operation — can read your synced content. Store data is held in a separate Supabase project in the same Tokyo region, and Store files in Cloudflare R2 (encrypted).
Your synced library and account data are stored in Japan (Tokyo) by Supabase; our other service providers operate primarily in the United States. By using enScore's cloud features, you consent to the transfer of your data to Japan and the United States. Store data is stored in Japan (Tokyo); Store files are held by Cloudflare at [REGION — confirm]; and Stripe (including Link), which processes Store purchase transactions (and, through Link, sells them to buyers in the countries named above), processes payment data in the United States and [REGION — confirm]. Our providers commit to appropriate safeguards (Standard Contractual Clauses or equivalent) where required by EU/UK/Australian privacy law.
You can view and edit your synced library directly within enScore. You can view your account email within enScore's account/sync settings.
You can delete your data in three ways:
Ledger records that exist to satisfy tax, fraud-prevention, or "a redeemed code must stay redeemed" obligations (see Data Retention below) are anonymised rather than deleted when you delete your account — they no longer identify you, but the transaction itself isn't erased from our accounting records.
Store records after you delete your account. The Store runs separately from your enScore account, so deleting your enScore account removes your Store records the next time a nightly clean-up job runs, rather than instantly. The job checks with our sign-in service whether each Store account still exists, and erases the records of those that do not (if the check cannot be completed, it erases nothing). It erases your licences (so you lose access to editions you bought with that account), devices, reader profile, carts, checkout hand-offs and any membership reading minutes. It anonymises (removes the link to you from) your orders, which we keep as tax and accounting records, your referral attribution, your membership and receipt records, and any audit-log entries that name your account. The royalty ledger holds no reader identifier. Stripe keeps its own records of your payments under its privacy policy. You can also ask us to delete Store records by emailing the address below.
To exercise any of these rights, contact us at support@enscore.app.
| Data | Retention period |
|---|---|
| Active account data | While your account exists |
| Soft-deleted library items (in Recently Deleted) | 30 days, then permanently purged |
| YouTube search results cached on our server | Served for up to 24 hours; deleted after 30 days |
| YouTube / Apple Music link metadata stored with a score on your device (title, channel or artist, duration, artwork URL); never stored on our servers | While the link exists; expires after 30 days and is re-fetched on next use |
| Removed links and recording settings (in Recently Deleted) | 30 days, then permanently deleted from your devices and our servers |
| Hashed IP addresses used for rate-limiting | 7 days |
| Account data after a deletion request | Erased immediately |
| Purchase / entitlement records (legal/tax retention) | Up to 7 years, in line with Australian tax record-keeping requirements — anonymised after account deletion, not identifying you |
| Store licences, devices, reader profile, carts and checkout hand-offs | While your account exists; erased by the nightly clean-up after you delete your account. Checkout hand-off tokens are valid for 10 minutes. |
| Store orders (tax and accounting records) | Kept after account deletion with the link to you removed; up to 7 years |
| Referral clicks and their keyed hashes | While needed for publisher attribution and the publisher's referral-bonus accounting, up to 7 years; they hold no raw IP address or browser details |
| Publisher-portal trusted browsers | 30 days (7 days for administrators), or until revoked |
| Publishers' original uploaded files awaiting processing | Deleted after 30 days |
| Publisher-portal account, audit-log and payout records | While the publisher relationship continues, then as long as accounting, tax and legal record-keeping requires (up to 7 years) |
We protect your data with:
sendDefaultPii disabled on our crash-reporting SDK, so crash reports do not carry your IP address or account details by defaultAdditionally, for the Store: purchased files are AES-256-GCM encrypted at rest, with keys wrapped to a key held only by your device; licences are digitally signed by the Store and checked on your device; file links are signed and expire after 10 minutes; and publisher-portal accounts require a second sign-in factor.
No system is perfectly secure. If you believe your account has been compromised, contact us immediately.
enScore is not directed to children under 13 (or the digital consent age in your jurisdiction, where higher), and we do not knowingly collect personal data from children below that age at sign-up. We recognise many enScore users are students of all ages using the app for lessons, ensembles, or practice; we do not collect any data specifically about, or targeted at, a user's age, and account creation does not require or record a birthdate. If you believe a child has provided us with personal data in a way that concerns you, please contact us and we will address it.
enScore is a native application (iOS, iPadOS, macOS, Android, and Windows) and does not use cookies or cross-site tracking of its own.
Information stored on your device. enScore stores your library, annotations, settings, linked-media metadata (see "Linked media" above), authentication tokens (in the platform's secure credential store), and a randomly generated installation identifier for analytics and crash reporting on your device. Where enScore embeds an official third-party player so you can play a linked recording (YouTube or Apple Music), that embedded content is served directly by Google or Apple within a sandboxed web view on your device and may place, access, or recognise its own cookies or local storage there under the Google Privacy Policy or Apple's privacy policy — enScore does not read or use those. Uninstalling enScore removes all of this from your device.
The enScore website at enscore.app may use minimal first-party analytics (e.g. page-view counts) for site-improvement purposes, and uses a bot-verification check (Cloudflare Turnstile) on the coupon-redemption page. No cross-site advertising tracking is performed.
The Store websites. If you use store.enscore.app, your browser stores a sign-in session created by our sign-in library, your language choice, your cart, and (if you followed a publisher referral link) a referral click ID in first-party storage on enscore.app; these are used only to run the Store and are not used for advertising. The publisher portal sets a strictly-necessary, HttpOnly cookie if a user chooses to "trust this browser" for a limited number of days. Stripe's checkout page, which the Store's checkout sends you to, sets its own cookies under Stripe's privacy policy.
We may update this Privacy Policy from time to time to reflect changes to the service, applicable laws, or our data practices. The "Effective Date" above reflects the most recent revision. Where the changes are material, we will provide reasonable notice via the app, by email, or on our website. Continued use of enScore after a change constitutes acceptance of the new Policy.
For privacy questions, data subject requests, or to report a privacy concern: