Children and Younger Users
Before a child signs up
Public music resources can be explored without an account. Our signup page asks for an age range before showing account fields. Visitors who select under 13 are directed to a parent or guardian without submitting child account details through that signup form.
Under-13 accounts require verified parent permission through the parent signup process, where that service is enabled. The current process uses two email codes, with a one-minute wait after the first confirmation. If parent verification is unavailable, under-13 signup cannot be completed. Children under 13 should not submit personal details through contact or report forms or join public leaderboards. Asking an adult for help, checking a box or using an adult's email is not itself verified parental consent.
Child-account privacy and parent approval
Parent-managed accounts will not appear on public leaderboards. Turning 13 will not remove parental controls automatically; the verified parent must approve removal.
Birthday choices
Birthday celebrations are optional. Ages 13+ can supply only a private month and day.
Child signup does not ask for instrument or experience information. Parents may skip birthday collection with one button; it is not required to finish permission. If a parent chooses to add a child birthday, they supply the full date privately for age safeguards; without it, restrictions remain until the parent confirms eligibility.
Birthday details are never published, and playing the song has a separate preference.
Private child accounts
Parent-managed child profiles stay off public leaderboards. Signup requests a login email, generated private nickname and authentication credentials; saved learning and game progress support the account. It does not ask children for an instrument or experience level.
Optional birthdays
Celebrations and the birthday song are optional. For ages 13+, celebrations need only a month and day. If a parent supplies an under-13 birthday, the year supports age safeguards. Birthday information is not published.
Parent requests
Where enabled, requests go to the parent email saved on the account. Private management links expire after 30 minutes and can be used once. Parents may open them on another device without entering the child's password. Changing a birthday does not remove parental controls; an account upgrade requires separate parent confirmation of age 13+.
Parent messages are delivered through Resend, which processes the recipient email and message for delivery. Supabase stores private parent-account links and request records. Review or deletion links record a request for manual handling; opening a link does not automatically export or delete account data. Contact our privacy inbox to specify review, deletion, withdrawal of permission or stopping further collection. We may confirm parental authority before disclosing data or making changes. Admin test links do not change real account data.
If you believe we already hold personal information about a child under 13, please contact openscoresmusic1@gmail.com to request review, deletion or an end to further collection. Do not send passwords, identity documents or additional child details in your initial message.
OpenScores Hub respects the privacy of its visitors and users.
Many public areas of OpenScores can be used without creating an account,
including public music resources, educational pages, and other features
that do not require saved progress.
An account is required for personalized features that save information
to your profile, including the OpenScores Dashboard and certain progress,
practice, achievement, and account features.
OpenScores uses Supabase to provide account authentication and related
account services. When you create an account or log in, information such
as your email address, password, and account information is processed
through Supabase.
Your password is used for authentication and is not displayed publicly
on OpenScores.
The OpenScores Dashboard and other account-specific pages require you
to be logged in before they can be accessed.
Progress and Activity Data
When you use logged-in OpenScores learning and practice features,
OpenScores may save information connected to your account so that
your progress can appear in your Dashboard and related features.
This may include information such as:
- XP earned through OpenScores activities
- Practice streaks
- Skill attempts, accuracy, and overall progress
- Achievements or awards you unlock
- Your equipped award
- Practice Planner information
- Practice Journal activity
- Roll an Instrument collections, currencies, upgrades, scratch tickets and game progress
- Account identifiers and recent activity timestamps for active-user counts
- Other progress needed to provide personalized account features
This information is used to provide features such as saved progress,
achievements, personalized practice, statistics, and your Dashboard.
The OpenScores leaderboard is designed so that users do not have to
display their real name, email address, or profile photo.
Users with an OpenScores account can choose whether they want to join
the leaderboard. If you choose to participate, your public leaderboard
profile may display:
- A nickname you choose
- Your equipped award
- Your XP
- Your practice streak
- Your overall progress
- Your primary instrument, only if you choose to show it
Your real name and email address are not used as your public leaderboard
identity. You can choose to hide your instrument or remove your profile
from the leaderboard through your account settings.
Leaderboard nicknames should not contain email addresses, phone numbers,
website links, or other personal contact information.
Public leaderboard:
People may be able to view participating leaderboard profiles without
logging in. Only the information that a participating user chooses or
allows to appear on the leaderboard should be treated as public.
OpenScores uses third-party services to provide certain website
functions.
Supabase is used for account authentication, account information,
saved progress, and other database-powered OpenScores features.
Web3Forms is used to process submissions from certain contact or report
forms. Information entered into those forms is transmitted through
Web3Forms so that it can be delivered to OpenScores.
Vercel hosts the site. Google Fonts and external asset providers, including CDN services, may receive IP addresses and request information when assets load. Hosting and account services may also keep operational and security logs. Optional Vercel visitor-analytics scripts have been removed from our pages.
Third-party services may process information according to their own
privacy practices and policies.
OpenScores contains links to external websites and services, including
YouTube, Instagram, Google Drive, and other resources.
Once you leave OpenScores and visit another website, that website's own
privacy policy and practices apply. OpenScores is not responsible for
how external websites collect or use information.
Volunteer Applications
The Outreach contact form accepts applications from people aged 13+ and adults. Volunteer fields include school, grade, instruments and experience, interests, general availability, service-hour needs, reasons for applying, an adult reference’s name and email, and parent/guardian approval status. Please obtain a reference’s permission before providing their contact details. Do not send a home address, detailed daily schedule, passwords, identification documents, medical records, or a child’s personal details.
Web3Forms processes the submission and delivers it to the OpenScores inbox. The information is used to assess and reply to applications and coordinate appropriate school-supervised activities; it is not a public profile. A form checkbox is not verified parental consent or approval to work with children. Any school checks and required adult approvals must be completed separately.
Request correction or deletion at openscoresmusic1@gmail.com. The retention schedule below covers applications and related correspondence.
Retention and Deletion
Retention depends on the purpose of each record. Expiration of a code or link prevents its use; it does not itself delete the stored record. The schedule below is a manual operating schedule. Automatic cleanup and provider backup/log deletion have not been verified as enabled.
- Unfinished parent-verification requests
- Requests expire after 7 days. Review and remove expired, unclaimed requests within 7 further days. Code validity is 15 minutes; approval and management links last 30 minutes.
- Completed parent-verification challenges
- Remove challenge secrets and unnecessary duplicate details after use. The prepared cleanup function minimizes consent-linked requests after 1 hour and removes completed non-ledger requests after 7 days; it must be installed and scheduled separately.
- Child account and learning records
- Keep only what supports the active account and parent-approved features. Review accounts with no activity for 12 months; contact the parent when contact remains authorized and delete unnecessary records within 30 days after that review. Do not retain child information indefinitely because the account might return.
- Parent review, withdrawal, or deletion requests
- Handle through the privacy inbox after checking parental authority. Aim to complete action within 30 days of verification, stop further collection when permission is withdrawn, and explain any necessary exception or delay. Opening a request link does not delete data.
- Volunteer applications
- Delete unsuccessful, withdrawn, or uncompleted applications and reference details within 90 days after closure. For active volunteers, keep only coordination records needed for the role and delete unnecessary personal details within 90 days after it ends.
- Other contact messages
- Delete unnecessary messages within 90 days after the inquiry is resolved. Do not preserve attachments or a full correspondence history when a minimal record is enough.
- Consent evidence, security records, processors, and backups
- Keep a minimal record only where needed to administer permission, handle a specific dispute, or meet an identified legal obligation. Restrict access, record the reason and review date, and remove it when that purpose ends. Provider-specific backup and log periods still need confirmation; no fixed automatic deletion period is promised for those systems.
Parents may request review, correction, deletion, withdrawal of permission, or an end to further collection at openscoresmusic1@gmail.com. Do not send passwords or identity documents in the initial message. This schedule requires manual follow-through; it is not a claim that a background deletion service is running.
Cookies and Browser Storage
OpenScores uses local storage and session storage for functions such as Supabase login sessions, theme and sound preferences, saved activity settings, game state, and temporary parent-verification state. Some features may keep progress on the device before an account is connected. Authentication and embedded third-party services may also use their own storage.
You can clear site data or block storage through your browser settings. Doing so can sign you out, reset preferences, and erase progress saved only on that device. Use account controls to manage server-held data; clearing browser storage does not delete an account.
Embedded video, externally hosted documents, fonts, and other third-party resources may receive connection data when loaded and may use their own cookies or storage. Their privacy policies apply to their services. OpenScores does not use this storage for behavioral advertising.
Do Not Track
OpenScores does not display advertisements. OpenScores does not currently change its behavior in response to a browser’s Do Not Track signal. This does not change the privacy practices described here. We do not sell personal information or use behavioral advertising. Third-party sites and embedded services control their own responses to browser signals.
Public Profiles for Ages 13+
Creating a social profile makes its username, display name, earned badge, bio, selected instruments, genres, favorite pieces, Teacher/Student tags, and follower/following information public where those features are enabled. Profiles have no private setting. Use a nickname and do not add contact details or links. Teacher/Student tags are self-selected and do not verify qualifications.
Parent-managed child accounts are not eligible for social profiles. Public-profile eligibility does not publish your email, birthday, password, private practice records, or parent information. Leaderboard participation is a separate account choice.
Report a Security Concern
Email openscoresmusic1@gmail.com with the affected page, a description and safe reproduction steps. Please do not include passwords, secret keys, or another person’s data. Stop if you encounter personal information. Do not access other accounts, disrupt services, or publish private data to demonstrate a problem. Reporting a concern is not permission to test other people’s accounts and does not promise a bounty.
This Privacy Policy may be updated as OpenScores grows, adds new account
features, changes how progress is stored, adds new community features,
or changes the services used to operate the website.
The date at the top of this page will be updated when significant
changes are made.