Security and data

In transit

Everything between your device and Quaverley travels over HTTPS. Certificates are issued and renewed automatically. The API is not reachable over plain HTTP, and the app refuses to send credentials over an unsecured connection.

Accounts

Passwords are stored as one-way hashes, never as text. Sign-in can also use a one-time code sent to your email, or a Google or Apple account, and those providers' own security applies to their part of the sign-in. You can remove a sign-in method from the account page as long as one remains.

On the server

The database and any scores you upload are stored on the production server. Access to that server is limited to the maintainer, by SSH key. A database backup is taken before each deployment and kept on the same server. Uploaded scores are used to build your practice plan and are not published or shared.

Payments

Card details go directly to Stripe and are never stored on Quaverley's servers. For App Store and Google Play purchases, the store handles payment and holds the card details.

Who processes data

• Stripe processes web subscription payments and related receipts.
• The email provider (Postmark or Resend, depending on configuration) delivers transactional and list email.
• The hosting provider runs the virtual private server on which the app and database live.

Nothing is sold, and no advertising or cross-site tracking is used. The privacy page sets out what is stored, why and for how long.

Export and deletion

Write to help@quaverley.com to export your data or delete your account. Deletion removes the account, the scores and the practice record from the live system. Copies in pre-deployment backups are replaced as those backups rotate.

Reporting a vulnerability

Write to help@quaverley.com with enough detail to reproduce the issue. Reports are read promptly, and you will be told what happens next. Machine-readable contact details are at /.well-known/security.txt.

If something goes wrong

If a breach ever affects your personal data, you will be told what happened, what it means for you, and what to do, without waiting to be asked.