1. Introduction
Harmoniva ("we," "our," or "us") is operated by H&P LLC, a Delaware limited liability company with offices at 8 The Green STE B, Dover, DE 19901, United States. This Privacy Policy describes how we collect, use, disclose, and protect information about you when you use our website at harmoniva.app and any related services (collectively, the "Service").
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree to this policy, please do not use the Service.
This policy applies to all users of harmoniva.app, including free users, premium subscribers, teachers, and school administrators.
2. Information We Collect
Account Data
When you create an account, we collect your name, email address, and a password hash (passwords are never stored in plain text). If you register via Google OAuth, we receive your name, email address, and profile picture from Google. We also store your selected language/locale and account type (free, premium, teacher, school).
Usage Data
We collect information about how you interact with the Service, including: exercises completed, scores and performance metrics, practice session duration, learning path progress, features accessed, and browser/device information (browser type, operating system, IP address, referring URLs). This data helps us improve the platform and personalize your experience.
Payment Information
If you subscribe to a paid plan, payment is processed by Stripe, Inc. We do not store your full credit card number, CVV, or other sensitive payment details. We receive and store a payment token, your billing name, the last four digits of your card, and your subscription status from Stripe. Stripe's privacy policy governs how they handle your payment data.
Cookies and Tracking Technologies
We use cookies and similar technologies to maintain your session, remember your preferences, and analyze how the Service is used. See Section 7 for details, or review our full Cookie Policy.
3. How We Use Your Information
We use the information we collect to:
- Provide and maintain the Service — authenticate your account, process subscriptions, deliver exercises, and track your progress.
- Improve the product — analyze usage patterns, identify bugs, and develop new features. Activity logs are reviewed in aggregate and anonymized where possible.
- Personalize your experience — our AI-powered learning paths use your practice history to recommend exercises and adapt difficulty.
- Communicate with you — send transactional emails (account confirmation, password reset, subscription receipts), product updates, and, with your consent, promotional communications. You may opt out of marketing emails at any time.
- Analytics and reporting — generate aggregated, non-identifying statistics about platform usage.
- Legal and compliance — meet our legal obligations, enforce our terms, and protect the rights and safety of users and the public.
We do not use your personal data to train third-party AI models or sell behavioral data to advertisers.
4. Data Sharing
We do not sell your personal data. We share your information only in the following limited circumstances:
Service Providers
We share data with trusted third-party service providers who help us operate the Service, including:
- Stripe — payment processing. Your payment data is governed by Stripe's privacy policy.
- OpenAI — powers AI features such as personalized learning path generation. Exercise content and aggregated performance data may be sent to OpenAI's API. We do not send personally identifiable information to OpenAI unless you explicitly interact with an AI feature that requires it.
- Cloud infrastructure providers — hosting and database services under confidentiality agreements.
Legal Requirements
We may disclose your information if required by law, court order, or government request, or to protect the rights, property, or safety of Harmoniva, our users, or the public.
Business Transfers
In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service of any such change in ownership.
5. Data Retention
We retain your account data and practice history for as long as your account remains active. If you delete your account, we will delete or anonymize your personal data within 30 days of your deletion request, except where we are required to retain data for legal or legitimate business purposes (e.g., financial records for up to 7 years as required by law).
Aggregated, anonymized usage data that cannot identify you individually may be retained indefinitely to support product research and analytics.
6. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
All Users
- Access — request a copy of the personal data we hold about you.
- Correction — request correction of inaccurate or incomplete data.
- Deletion — request deletion of your account and personal data.
- Opt-out — unsubscribe from marketing emails at any time via the unsubscribe link in any email or via your account settings.
California Residents (CCPA)
California residents have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at support@harmoniva.app.
EU/EEA and UK Residents (GDPR)
If you are located in the EU, EEA, or UK, you have additional rights including data portability, the right to restrict processing, and the right to lodge a complaint with your local data protection authority. Our legal basis for processing is typically contract performance (to provide the Service) and legitimate interests (product improvement, security).
To exercise any of these rights, contact us at support@harmoniva.app. We will respond within 30 days.
8. Children's Privacy
The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we become aware that we have collected personal data from a child under 13 without proper consent, we will take steps to delete that information promptly.
For users between 13 and 17 years of age, we encourage parental involvement and oversight. In educational contexts (school accounts), we collect only the minimum data necessary and do not display advertising.
For our complete Children's Privacy Notice, see the dedicated section below.
9. Security
We take the security of your data seriously. We implement industry-standard measures including:
- TLS/HTTPS encryption for all data in transit
- Password hashing using bcrypt
- Encrypted database storage
- Access controls limiting employee access to personal data on a need-to-know basis
- Regular security reviews and dependency updates
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and applicable authorities as required by law, within the timeframes specified by applicable regulations (72 hours for GDPR, without undue delay for CCPA). No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
10. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on the Service. Your continued use of the Service after any change constitutes your acceptance of the updated policy.