Privacy policy

Updated 26 October 2026

This policy explains what data the Soitilo app and the soitilo.com website process, what for, where it is kept and for how long. It is based on Article 13 of the EU General Data Protection Regulation ((EU) 2016/679).

  • The account is meant for an adult: an adult creates the account and adds children as learners. A child’s learner profile is not an account of its own, and no email address or other contact details are stored in it.
  • Microphone sound is processed only on the device. It is never recorded or sent anywhere.
  • The app and the website have no ads, analytics or tracking.
  • The server is in Germany, in the EU.
  • You can export your family’s data or delete it.

1. Controller and contact

Nettiteeri Oy (business ID 3331525-2, Finland)
Email: tuki@soitilo.com

Send questions and requests about your data to this address.

2. What data we process

The adult’s account

Family

Subscriptions

Invitations and teachers

A family’s admin can invite the family’s second admin or a teacher by email. For an invitation we store:

The code in the invitation link is stored only as a hash. The invitation email has the inviter’s name but no learner’s name. A teacher has an account of their own, with the same data as an adult’s account. For a teacher we also store which learners of which family have been shared with them, the inviter’s name and the account that invited. A teacher is not a member of the family.

A teacher sees the shared learners in the browser, in the teacher view, read only: the learner’s name, the inviter’s name, the chapter, the last day of practice, whether the profile is resting, the skill states the app has worked out (played with support or on their own, stuck) and the stars and badges of library songs (in time, with both hands). If the family’s device may not have sent the latest practice yet, the view says so without telling anything about the devices. A teacher does not see play events, the family’s other learners or anything about the family’s adults.

Learners

The adult adds the family’s learners, usually children. For a learner we store:

We do not ask for a date of birth, a photo or contact details.

Play events and progress

For every time a learner plays, except hymns and Songs of Zion (below, On the device), we store which piece and task was played, in which way (listening, practice or playing), with which input (the on-screen piano, a keyboard connected with a USB cable, or the microphone), when and in which time zone, how it ended, and for each note whether it was hit and by how many milliseconds the timing was off. Hints given are stored too. When an adult opens a stage of the learning path by hand, we store which stage was opened and when. We also store the learner’s skill state and the state of the stages of the learner’s learning path (which stages are done and which is current), and the library songs the learner has earned stars for, with their names, stars and badges, except hymns and Songs of Zion. The app computes these from the events. We also store which device’s sign-in sent each event.

Devices

Each device signed in to the account gets its own sign-in token. Its name is “Soitilo Android” or “Soitilo iOS”, and it records when it was last used and the app version it was last used with. The app does not read the owner’s name, and it sends the device model only with feedback (see Feedback).

An adult can pair another device of the family, for example the children’s game phone, as a family device without their own credentials. The adult’s app asks for a one-time six-character code that is valid for 10 minutes. The server stores only a hash of the code, with the family, the account that asked for it and when it ends, and deletes them when the code is used or a new code is asked for. The paired device gets its own sign-in token on the account of the adult who asked for the code. Its name is as on other devices, and it records when it was paired, when it was last used and the app version. A family device can play and sync the learners’ data, but cannot buy, export or delete data, or manage the family’s adults or devices. The family’s admins see the names, pairing times and last use times of the family devices in the app and can remove a device. Pairing and removing are recorded in the audit log: the account, the family, the identifier of the device’s token and the time, never the code.

Technical data

Feedback

A signed-in adult can send feedback from the app. We store the message (up to 2,000 characters), the account that sent it, the family the account was in at the time, when it was sent, and the device data the app sends: the app’s version and build, the operating system and its version, the device model, the language, the screen size and the play method. The app adds no learner data; the message holds only what the adult writes in it. If we reply, the reply goes by email to the account’s address, and each reply and its time are stored with the feedback.

Feedback can be turned into a ticket in the provider’s own ticket system, Teeri-ERP, which runs on the same server as the service. The ticket gets the message, the device data, when it was sent and a link to the feedback in the service’s administration, not the sender’s email address, account or family.

Contacting us

When you email us, we process your email address, your name if you give it, and the content of your message.

On the device

The app also stores the learners and play events on the device, so that practice works without a network connection. The notes a learner plays in the My melody task (the keys and their timing, no sound) are stored only on the device and are not sent to the server. The learner’s song path (children’s songs, Songs of Zion or hymns) and spiritual choices, that is an interest in spiritual songs and hymns or Songs of Zion chosen as extra songs, and every time a hymn or a Song of Zion is played and its stars, also stay on the device only, because they could tell the family’s beliefs. So they do not move to the family’s other devices and are not in the export or seen by a teacher. All of these are deleted when the family is deleted in the app or another family’s account signs in on the device, and when the app is removed from the device. The sign-in token is kept in the device’s secure storage. The code for the adult area is stored on the device only as a salted hash.

3. What the data is used for, and on what basis

The app computes a learner’s skill state from the play events to choose the next exercises. This has no legal or similarly significant effects (Article 22). The data is not used for advertising, and it is not sold.

An account needs an email address and a password or a Google account, and a learner needs a name, a picture and an age group. Without them the service cannot be used. No law requires you to give the data.

4. Children’s data

The account is meant for an adult: an adult creates the account and adds children as learners. A child’s learner profile is not an account of its own. The family’s settings and data are in the adult area, which opens with the adult’s own code.

An admin can share the learners they choose with a teacher. The teacher does not see the family’s other learners. The admin can change what is shared or remove the teacher at any time, and the access ends at once. Deleting a learner also ends a teacher’s access to it.

A learner’s name can be a nickname. The app can say the learner’s name aloud with the device’s own speech synthesis, which works without a network connection. The name is not sent to an online speech service.

5. Microphone

When the microphone is the input, the app listens to the piano and recognises the notes in the device’s memory. The sound is never recorded or sent anywhere. Only the play event goes to the server: which notes were hit and how the timing went, just as when playing on the on-screen piano.

6. No ads, no tracking

The app has no ads, analytics, error reporting or other third-party services that would collect data, except the logging of Google’s billing library described in section 7. We learn about crashes only from the app stores’ own reports (Google Play and the App Store), which the stores collect under their own policies and the device’s settings.

The website loads nothing from other sites and uses no tracking or advertising cookies. Only the password reset page, the invitation page, the teacher view and our own people’s sign-in to the service’s administration set the session cookies their forms and sign-in need.

7. Where the data is and who processes it

These companies process the data on our behalf as processors. The data is not disclosed to anyone else, except to authorities when the law requires it.

If you sign in with Google, Google Ireland Limited identifies you as a controller in its own right, under its own terms and privacy policy, and knows that you signed in to Soitilo. We receive from Google only the data described in section 2 and send Google no data about the learners.

Subscriptions are sold and billed by Google Play. Google Ireland Limited processes the payment and the buyer’s data as a controller in its own right, under its own terms and privacy policy. With the purchase the app gives Google the family’s random identifier, and the server sends Google the purchase’s identifier and the app’s package name to check the purchase. When a family asks support to cancel or refund a subscription, the server sends Google the purchase’s identifier and the request to cancel or refund it. Google’s notifications about changed subscriptions reach the server through Google Cloud Pub/Sub. When an adult opens the subscription view, the app connects to Google Play with Google’s billing library, which logs its billing calls (whether they succeeded or failed) and connection problems; Google uses this information under its own privacy policy to improve the library and its support for errors.

The service’s administration

Only our own people, the owner and support, see a family’s data in the service’s administration, to handle support requests. Signing in to the administration needs a password and two-step verification, or a passkey that asks for the device’s PIN or biometrics every time. Support sees the email addresses, roles and account creation times of the family’s adults, the names, use times and app versions of the devices’ sign-in tokens and whether a device is a family device, the learners’ names, states and creation times, when the server last received a learner’s play event, and the family’s invitations (address, role, learners, when sent and until when) and teachers (address, the learners they see, when they joined). To handle a support request, support can open why the app adapted for a learner: which skill is stuck or why the learner got a detour, and the times, tasks, modes, endings and counts of notes right first time of the attempts that led to it, but not the notes played. The owner and support also see feedback with the sender’s email address and device data, and can reply to it, close it and turn it into a ticket. The owner can carry out a deletion request that came by email there. Every view and deletion of a family’s or a learner’s data, and every view, reply, closing and ticket of feedback, is recorded in an audit log, as are family devices paired and removed in the app: who looked or changed, which family, learner or feedback, and when. The log holds only identifiers, no names or other data, except that a change to access given without a purchase records, for access until a day, its old and new plan and last day, and for a payment exemption, whether it was turned on or off.

The owner and support also see the aggregates described in section 3 (developing the service) in the administration. They have no names, identifiers or rows of a single family or learner, so viewing them is not recorded in the audit log.

Transfers outside the EU and EEA

8. How long the data is kept

Backups

The database is backed up every night. The server keeps every backup of the last 7 days, then one a week until 2 months old, and then one per half-year until 12 months old. The encrypted copy in Dropbox is kept the same way, and a copy deleted from Dropbox can still be restored for 30 days. In addition, the weekly backup of the whole server is kept for 4 weeks.

Data deleted from the service can therefore remain in backups for at most 12 months and 30 days. Backups are used only to restore the service after a failure.

9. Your rights

Under the GDPR you have the right to

Send your request to tuki@soitilo.com from your account’s email address. We answer without undue delay and within one month at the latest (Article 12).

If you think the processing of your data breaks data protection law, you can lodge a complaint with a supervisory authority. In Finland it is the Data Protection Ombudsman: Office of the Data Protection Ombudsman, PL 800, 00531 Helsinki, Finland, tietosuoja@om.fi, tietosuoja.fi. You can also complain to the authority of the EU country where you live.

10. Children in the United States (COPPA)

This section tells parents in the United States how we handle the data of children under 13 under the Children’s Online Privacy Protection Act (COPPA) and its rule (16 CFR part 312).

Operator: Nettiteeri Oy, Viereläntie 4 A, 90630 Oulu, Finland, phone +358 44 280 9861, email tuki@soitilo.com.

What a child’s use stores on the server. A child has no account of their own: an adult creates the account and adds the child as a learner. A child is never asked for an email address, phone number, address, date of birth or photo. The server stores the learner’s name or nickname, profile picture (one of the app’s own pictures), age group and settings that the adult gives, and from the child’s practice the play events (which song and task, in which way, when, which notes were hit and how the timing went, the hints given), the skill states, the state of the path’s stages and the stars and badges of library songs (in more detail in section 2). It also stores the device’s sign-in token and which device’s sign-in sent each event, and the web server’s log records the IP address and the app’s identifier of every request.

What the data is used for. We use the data only to provide the service: for sign-in, for syncing the data between the family’s devices, for fitting the exercises to the child’s skills and, if the adult chooses so, for the teacher view. We also compute aggregates from it to develop the service, with no individual child’s data in them (section 3), and support can look at it when handling the family’s support request (section 7). The data is not used for advertising and is not sold, and the app has no ads or third-party analytics. The data is on the server and in its backups, which only the processors named in section 7 handle on our behalf.

The teacher view. Only an adult of the family can invite a teacher, and the adult chooses which learners the teacher sees. The teacher sees a read-only summary of the shared learners in the browser: the learner’s name, the inviter’s name, the chapter, the last day of practice, whether the profile is resting, the skill states (played with support or on their own, stuck) and the stars and badges of library songs. The teacher does not see play events, the family’s other learners or anything about the family’s adults. The adult can change what is shared or remove the teacher in the app at any time, and the access ends at once.

Microphone. Microphone sound never leaves the device: the app recognises the notes in the device’s memory, and the sound is never recorded or sent anywhere (section 5).

A parent’s rights. As a parent you can at any time review your child’s data and stop its further collection:

Retention. A child’s data is kept as section 8 says: as long as the learner and the family exist, and the family is deleted when it has not been used for 24 months. Deleted data can remain in backups for at most 12 months and 30 days.

11. Changes

We update this policy when the service or the processing of data changes. The date of the update is at the top of the page.

Back to top