Setliner^™ — Privacy Policy

Resumen en español · Résumé en français

Version 1.43 — Effective November 7, 2026

This version describes five things. Free trials (Sections 3.6 and 9): the account and the app-generated device identifier our licensing service already keeps are also used to apply the limits on repeat free trials in Section 5.9 of the End User License Agreement. Section 3.6 now also describes the counters our licensing service keeps to limit how often one network can use it, including how often it can ask for sign-in codes, labelled only with a scrambled form of the network's internet (IP) address and deleted within two days, which it already kept and which earlier versions of this policy did not describe, and it now says the identifier is stored on that device in the app's own storage. Event end times (Section 3.8): in a version of the app that offers it, a team event can have an optional end time, which our team service stores with the event and everyone in the team who can see the event sees. Venues (Section 3.10): in a version of the app that offers it, a set's Venue box and a team event's Place box can list your recent places and saved venues, which the app works out on your device; if you pick one for a team event, only the name shown in the list is copied into the event's place. Goals and Train results (Section 3.10): in a version of the app that offers goals, the goals you set in Practice and in Train, and your Train results, which earlier versions of this policy did not describe, are kept in the app's own storage on your device, and, where goals follow you, the goals and the counts they measure are also saved in your library folder, so they follow your Setliner sign-in to your other devices that use the same library folder, in a folder named by a code rather than your email address, including in your own cloud storage account if you use one; Setliner never receives them. Planning Center import (the short version and Sections 3 and 3.14): in a version of the app that offers it, you can sign in with your own Planning Center account and import a service plan you can see there into a set. The app reads what that import needs directly from Planning Center to your device, keeps the sign-in on the device, sealed by its key store, and sends none of it to us, except a set's name if you attach the set to a Team event, and the plan's date if you create a Team event from the imported plan. While a set holds item notes, descriptions, page titles or the plan title from Planning Center, opening it lets the app check, now and then, that you can still see the plan; that text is removed from the set when Planning Center says you cannot or ends your sign-in, when you disconnect or remove the imported songs, or when 90 days pass with no check that you still can. Nothing else changes.

Version 1.42, of October 31, 2026, had added a short paragraph, At a glance, at the start of the short version, which the app and our website may show translated into Spanish or French, and two sentences at the end of Section 14: this policy is written in English, a part of it we show in another language is a translation for convenience, and if it differs from the English, the English text is this policy; and the short version, including At a glance, summarizes the sections that follow, which govern if they differ. The short version now also names Teams and Audience requests where it says what we receive from your library, and says that we do not sell your personal information or share it for cross-context behavioral advertising, in the words Section 4 uses. Unavailable dates (Sections 3.8 and 11): in a version of the app that offers it, you can add a short note to a day you mark unavailable, and a day the app marks for you in your other teams holds the time the earliest event you accepted that day starts and, only if you also turn on the setting that shows the event's name, that event's name; the people who schedule the team see them, and the team service leaves a note and times out of the check value it keeps against duplicate changes. Nothing else changed.

Version 1.41, of October 31, 2026, had described two additions, automatic away dates across your teams and slides, PDFs and pictures over linked devices (the short version and Sections 3.1, 3.8 and 12). Unavailable dates (Section 3.8): in a version of the app that offers it, a setting you can turn on marks you away in your other teams on the days you have accepted an event, and takes those days back when you no longer have; the people who schedule those teams see the days, and could work out that they came from another Setliner team, though not which team or event. Linked devices (Section 3.1): in a version of the app that offers it, followers can follow slide decks, PDFs and pictures in a set; the leading device sends which item and position is showing, with fingerprints so a follower can tell whether its own copy matches, never the slides, PDFs, pictures, notes, file names, web links or files themselves, and each follower shows its own copy, or a placeholder. The short version and Sections 3.1, 3.8 and 12 changed to match.

Version 1.40, of October 31, 2026, had described two additions, venue contact details and event checklists (the short version and Sections 3.8, 3.10, 9 and 11.1). Venues (Section 3.10): in a version of the app that offers it, a venue can also keep a contact's name, email address and phone number, and a website, which you can open in your own email app, phone app or browser, and you can export your venues to a spreadsheet (CSV) file or import them from one. Like the rest of a venue, they stay in your library folder, and the app never sends them to us. The app does not read your device's contacts and asks for no new permission. Checklists (Sections 3.8 and 3.10): in a version of the app that offers it, each of your sets can have a checklist, and you can save checklist templates; they are kept on your device and in your library folder, and we never receive them, except the lines a planner adds from a template to a team event. A team event can also have a checklist, which our team service stores with the event: each item's text, an optional note, who it is for, and who ticked it and when. Everyone in the team who can see that event sees it, including who each item is for and who ticked it, which can show them who else is on that event. The short version and Sections 3.8, 3.10, 9 and 11.1 changed to match.

Version 1.39, of October 30, 2026, had described one change to practice mode and Record chords (the short version and Sections 3.2, 3.10, 3.12, 7 and 11.1). In a version of the app that offers it, after a take you keep is saved on your device, the app also tries to copy its sound files and details to a folder for takes in your library folder, if you use one, or to another folder you choose in Settings; the take stays on your device too. If that folder is synced, your sync service uploads the copies to its servers and your other devices, and people you share the folder with can open them; Setliner does not send them to us. A take can hold other people's voices, so get the agreement of the people heard on it where the law requires it, or choose a folder that does not sync. Takes kept with an earlier version, recovery copies of recordings you have not saved, score records and the practice log are not copied. The short version and Sections 3.2, 3.10, 3.12, 7 and 11.1 changed to match.

Version 1.38, of October 30, 2026, had added the Canadian province of Québec to the places where accounts, trials, purchases and Teams are not offered (Sections 3.6, 3.7 and 8). In a version of the app that asks it, choosing Canada before you ask for a sign-in code brings one more question, whether you live in Québec; the app asks it only when you choose Canada. The app sends the answer only with that request, and only if it is Yes; we then send no code, and we do not store the answer. In the iPhone and iPad app, the same question comes before an App Store purchase or free trial when the app can tell that your App Store country is Canada; that answer stays on your device until the app is closed, and the app does not send it to us. A website order placed on or after the effective date of that version and billed to an address in Québec, which our server tells from the billing province Polar reports, is refused and refunded in full, as one billed to the EEA or the UK is. It also corrected Section 8: our website checkout asks buyers of some items, not every buyer, to confirm that they are not in the EEA, the UK or Québec, Canada. It also said that, in a version of the app that offers it, Record chords can listen to a tune you hum, whistle or sing instead of an instrument; your voice is analysed on your device into notes and pitch numbers; the sound is kept as a take only if you tick Keep the audio, and Setliner never sends it anywhere (Section 3.12). It also said that, in a version of the app that offers recovery, Record chords tries to keep a recovery copy of a recording, played or hummed, on your device until you save the song, or open a hummed tune in the Song Editor, or confirm that you want to discard it, so that leaving the screen, a call or Setliner closing unexpectedly need not lose it (the short version and Section 3.12). Nothing is shared with anyone new. A recording you have not saved, opened or discarded can now stay on your device in its recovery copy, even after Setliner closes unexpectedly, with no time limit, until you choose. The short version and Sections 3.6, 3.7, 3.12 and 8 changed to match.

Version 1.37, of October 27, 2026, had described one change to Record chords on computers (Section 3.12). Until then, when you saved a song from Record chords on a computer, its box for keeping the recording, Keep the recording, was ticked by default. In a version of the app that offers it, the box on a computer works as it does on a phone or tablet: it is called Keep the audio, and it is unticked unless you turn on its setting, Keep the audio when I save a Record chords chart (Settings > General > Practice; off unless you turn it on). You can change the box each time you save; that does not change the setting. The setting starts off on every computer, including one where you used Record chords before: the app does not turn it on because the old box was ticked. To keep recordings as before, turn that setting on. Recordings you already kept, including any kept because Keep the recording was ticked by default, stay as takes of their songs until you delete them or their song, or use Reset practice data; you can play them back and delete them with the song's other takes. A backup of your home folder, or a library backup that includes kept takes, keeps its own copy until you replace it. A computer with a version of the app that does not offer Keep the audio still shows Keep the recording, ticked by default. Nothing else changed on a computer: the app never writes the recording to a file unless you keep it, holds at most its first 20 minutes in its memory, and lets go of it unless you keep it; a recording you keep stays in the app's own storage on that computer, not in your library folder, and Setliner never uploads it. It changed nothing on a phone or tablet. The short version and Section 3.12 changed to match.

Version 1.36, of October 26, 2026, had described one change to Record chords on phones and tablets (Section 3.12). Until then, Record chords never kept the recording on a phone or tablet. In a version of the app that offers it, when you save a song from Record chords on a phone or tablet, a box, Keep the audio, decides whether the app also keeps the recording as a take of the new song. It starts unticked unless you turn on its setting, and you can change it each time you save. A recording you keep stays in Setliner's private storage on that device and is treated like your other takes: it is not in your library folder, so it does not sync with it or reach a cloud storage provider or a linked device through it, and Setliner never uploads it. It goes into an iPad backup only if you turned on Include practice data in iCloud and computer backups, into a library backup only if you turned on both Include practice data in library backups and Also include kept takes, and never into Android's own backup. While you record and review, the app holds the sound on the device, in its memory or in a temporary file in its private storage; if you leave the box unticked, or discard, cancel or leave Record chords without saving, it is deleted. Setliner sends nothing to us or to anyone else on its own; a recording you keep leaves the device only in a backup you allow to include it, or in a file you send yourself. It changed nothing on a computer. The short version and Section 3.12 changed to match.

Version 1.35, of October 26, 2026, had described one change to our request service and corrected what version 1.32 said about event places. Changing songs (Section 3.13): in a version of the app that offers it, you can change the songs on an audience request list while it is open. The app sends us the whole new list, still only titles and artists, and the list keeps its link and its end time. A song you take off can no longer be asked for; if anyone had already asked for it, our request service keeps it, hidden from the page, with its requests, until the list ends, so that its count still reaches you, and otherwise deletes it at once. It also described the counters our request service keeps to limit how often an account uses it, labelled only with a scrambled form of the account and deleted within two days. Event places (Section 3.8): versions 1.32 to 1.34 said that calendar sync includes an event's place and that changing it counts as changing the event for notifications; neither is so at present. Calendar sync and the app's calendar export do not include places, and changing only an event's place sends no notification. Nothing was shared with anyone new, and nothing was kept longer than before. The short version and Sections 3.8, 3.13, 9 and 12 changed to match.

Version 1.34, of October 26, 2026, had concerned our website only; the app was unchanged and sent nothing new. It changed how our website counts visits by country (Section 13). Until then our server recorded a visitor's country only if our hosting provider reported it, which it does not, so every country was recorded as unknown. From the day it was published, we look up the country from your IP address at the moment of your visit and keep only the country: our visit counter never stores the IP address. The lookup runs on our own server, in a country database we keep there, so your address is not sent to anyone else for it, and the country is added to the daily visit totals as one more count. If the country is in the European Economic Area or the United Kingdom, our server counts nothing from that visit, in addition to the page's own time-zone check. Visits before that version stay counted as unknown, and we do not use the database on our server log. Nothing was shared with anyone new, and nothing personal was kept longer than before. The short version and Sections 5, 9, 11.3 and 13 changed to match.

Version 1.33, of October 26, 2026, had added statistics totals that name no one. From the day it was published, we count: each day, how many times our update list is fetched, almost always by the Windows desktop app, and from how many different networks (Section 3.9), using only entries in our web server's log made from that day (Section 13); each week, how many accounts start a free trial, how many accounts that started one buy that feature, how many purchases are made on our website, how many purchases from the iPhone and iPad app are added to a Setliner account, and how many refunds reach us, whenever the purchase was made (Sections 3.6 and 3.7); and each week, how many audience request lists are opened and how many requests are sent (Section 3.13). Each total goes up when the thing happens and only the number is kept, for about 25 months, so that we can see how Setliner is used and plan our work; the totals name no person, device, account, list or song, and nothing that happened before that version is counted (Sections 5, 9 and 13). The app sends nothing new and still has no analytics, nothing is shared with anyone new, and nothing personal is kept longer than before. The short version and Sections 3.6, 3.7, 3.9, 3.13, 5, 9, 11.3, 12 and 13 changed to match.

Version 1.32, of October 25, 2026, had described what our team service and the app do for team notifications, unavailable dates, event places, venues and tips, linked devices and Record chords, and corrected what version 1.31 had left out. Team notifications (Section 3.8): for each member of a team, our team service keeps a short list of the changes that concern them: that they were added to an event or taken off one, that an event they are on was changed or cancelled, or that its set changed, with which event and when, but never its title, time or contents. The list is deleted after 30 days, and sooner with the membership, the team or the account. Notifications themselves are off until you turn them on, on each device. If you are on an event or schedule for a team, you can also ask to be told when someone on it accepts or declines, and the team service keeps that choice. On Android and computers, the app checks our team service itself; no other company is involved. On iPhone and iPad, in a version of the app that offers it, turning notifications on gives us the push token Apple assigns to that installation, and we ask Apple's push service to deliver a fixed notification, whose words come from the app in your language ("Setliner" and "Your team schedule changed"). We keep the token with your account until you turn notifications off, sign out, leave your last team or delete your account, or until Apple tells us it no longer works, whichever comes first, and never more than 90 days after the app last confirmed it. The Android app declares the notification permission and asks for it only when you turn notifications on. Unavailable dates (Section 3.8): a member can mark days on which they cannot be scheduled; the team service keeps only the first and last day of each range, never a reason, shows them only to that member and to the team's owner, administrators and planners, and deletes them 30 days after their last day, or sooner. Event places (Section 3.8): in a version of the app that offers it, whoever schedules for a team can give an event a place, a line of free text such as a venue's name or address, which everyone in the team who can see that event sees, and which calendar sync includes; Setliner never looks a place up or uses your location. Venues and tips (Section 3.10): the venues you keep, with their notes, and your tip log and payment links stay in your library folder; we never receive them, and Setliner never handles a payment. Linked devices (Section 3.1): in a version of the app that leads sets with slide decks, the leading device sends followers which item and slide it is on, a fingerprint of the deck and a scrambled code for finding it, never the slides, their notes or pictures, or the text, address or name of a blank page, web link or file; each follower shows its own copy of the deck. Record chords (Section 3.12): in a version of the app that offers Hear this spot, a phone or tablet holds the recording on the device while you review it, as a computer already does, at most its first 20 minutes, and drops it when you save, discard, start again or leave Record chords; it is never uploaded, backed up or synced. The short version and Sections 1, 3, 3.1, 3.8, 3.10, 3.12, 7, 9, 11 and 12 changed to match; nothing you had already given us was shared with anyone new, and no notification had been sent through Apple under an earlier version. Some of this was in use before version 1.32 described it, although Section 4 promises that we tell you about new collection first; we are sorry for that. Since October 24, 2026, the team service has kept the notices list and members' unavailable dates; the apps of version 2.2.44 keep venues, a tip log and payment links in your library folder; and the Android app of version 2.2.44 declared the notification permission, although version 1.31 of this policy said it requested none. The notices list and unavailable dates never left our team service, venues and tips never reached us, and each notices entry is deleted after 30 days, so none made before version 1.32 is kept after November 23, 2026; we have used them only as version 1.32 described. Version 1.31 also did not say that a leading device sends followers the text of its cue when you press the cue button, and sends a follower that turned on temporary chart sharing the leader's marks on the charts it shares (Section 3.1); both travel only device to device on your local network.

Version 1.31, of October 25, 2026, had added Section 3.13, Audience requests, for versions of the app that offer them: a performer signed in to a Setliner account can put the titles and artists of songs they choose on a page on setliner.com, and anyone with its link or QR code can tap a song to ask for it, without an account and without being asked for any information about themselves. Our request service records which song was asked for and when, never who asked (our web server's log, Section 13, keeps the IP address and time of each visit and send, but not the song, under our host's own retention policy), and, when the list ends (at most 12 hours after it starts), deletes each request and its time and keeps only the list's songs, the account it belongs to and how many times each song was asked for, until the performer's app has collected them, and in any case no more than 30 days after the end. No request data had been collected under an earlier version. The short version and Sections 1, 3, 5, 7, 8, 9, 11, 12 and 13 changed to match; nothing you had already given us was shared. It also said that MIDI devices need no permission, and that Setliner keeps their names and your MIDI settings on your device and sends MIDI messages only to the devices you choose (Section 3). It described trials and purchases in the iPhone and iPad app (the short version and Sections 3.6, 3.7 and 8): a trial there is a free item from the App Store, which the app times on the device and never sends to us, and you can buy or restore a purchase without signing in, in which case we receive nothing about it until you sign in. It rewrote the age rules in Section 12: accounts are for people 13 and older, and signing in confirms you are; if we learn an account belongs to a child under 13, we delete it; below the age of digital consent where you live, you need a parent's or guardian's permission; and a younger person's purchase needs a parent's approval, such as Apple's Ask to Buy, where earlier versions allowed only adults to buy. It also removed the sentence calling youth teams and young players the users we expect, and said that when we delete an account because it belongs to a child under 13, we also erase what ordinary deletion keeps. It also removed what version 1.30 had said about examples of your playing sent with Send examples, a feature no version of the app has offered. No version of the app has a way to send us examples of your playing, and none has reached us that way. If you email us a training-examples file or a take's sound, it is support material (Section 3.4): we use it only to look into what you reported, and we never add it to a test set or use it to tune or train anything (Section 3.12). If we ever offer a way to send us examples, we will publish a new version of this policy first, and the app will ask for your permission before anything is sent. The short version and Sections 1, 3, 3.12, 4, 5, 6.2, 7, 8, 9, 10, 11 and 12 changed to match; nothing you had already given us was affected. Version 1.30, of October 20, 2026, had said how we handle examples of your playing that you choose to send us (Section 3.12). An adult outside the European Economic Area and the United Kingdom may send us the chords they corrected or confirmed in practice mode, measurements the app makes of the sound around them and, if they choose, short sound clips, with Send examples, in a version of the app that offers it; examples are not accepted by email. It said we would use them only to measure, test and improve how Setliner hears what is played and how it checks a performance after the player stops, never the rules that decide the feedback you get while you play, or a song's chords. It said we would keep them until they were deleted, or for up to 10 years from when we received them, whichever came first, and that they could be deleted at any time with the receipt code the app would show (Sections 3.12 and 9). It also changed how long we keep support email and what you attach to it (Sections 3.4, 3.5 and 9): instead of 12 months after a matter is closed, and a debug log until the problem is resolved, we keep them for as long as we need them to help you and for our own records (to handle a follow-up, show what we told you, or meet a legal or tax duty), no longer than 10 years, and delete them sooner if you ask, by emailing support@setliner.com, unless the law requires us to keep them or a dispute about them is open; we delete support mail by hand. It also corrected Section 1, which had said that nothing from Section 3.12 reaches us, and Section 6.2, which had said that we do not train any model on your content without mentioning these examples, and updated the short version and Sections 3, 4, 5, 7, 8, 9, 10, 11 and 12 to match. Version 1.29, of October 19, 2026, had corrected Section 8, which had said that our checkout does not accept billing addresses in the European Economic Area or the United Kingdom. Section 8 began saying how purchases from there are kept out: our website checkout asks every buyer to confirm that they are not there, and our server grants nothing for a website order billed to one of those countries and refunds it in full. Section 3.7 also began saying that the record Polar sends us of an order includes details you gave Polar, such as your name and billing address, of which our server uses only the country. That corrected how the policy described what our services do: nothing about what we collected, how we used it or your rights changed. Version 1.28, of October 19, 2026, had changed how we tell you about changes to this policy (Sections 4 and 14, and the list of emails in Section 3.6): each new version is posted here with its version number, its effective date and a summary of what changed, and, when an app update includes it, the app shows you that summary once. We email you about a change only if it lets us share your personal information with anyone new, keep it longer, or narrows one of your rights in Section 11, or to ask for your consent to a new use of information we already hold, and then only at the email address tied to your Setliner account, license or order. Earlier versions had also promised an email for a change that expands what we collect or how we use it; version 1.28 removed that promise. Section 3.6 also began listing the email we send when a device is added to or released from your account, which its paragraph on device names already mentioned. Nothing about what we collected or how we used it changed. Version 1.27, of October 19, 2026, had changed Section 13 and the short version: for a visit whose link had no campaign tags, our website began labelling where it came from, from whether the link carried a click identifier added by an advertising platform such as Google or Meta (we note only that one was present, never its value), from the website or app that sent you, sorted into named sources (any other app is counted only as another app), or, when your browser does not say which site sent you, from whether the page is open in an app's built-in browser, told from your user agent (the app's name only). A label does not show whether a visit came from an ad. The site also stopped counting devices that report no time zone or one that names no place, such as UTC. Section 3.7 began saying exactly which visits pass Polar a Meta label, and Section 5 added the basis for the campaign label on a purchase and how to object. Nothing else about the counts changed, and the app collected nothing new. Version 1.26, of October 18, 2026, had added website visit counts to Section 13 and the short version: our website keeps daily totals of page views, video plays and download and Buy clicks, by the campaign or website that sent the visitor and by a few coarse details, for about 25 months; the totals hold no record of any one visit. It set the site not to count visitors in the European Economic Area and the United Kingdom, and nothing is counted when your browser sends the Global Privacy Control signal. It also added to Section 3.7 that a Buy link passes the campaign you arrived from to Polar, our merchant of record, so that we can count purchases by campaign, and added the server log's referring page and the campaign label on a purchase to Section 11.3. Version 1.25, of October 18, 2026, had added free teams to Section 3.8: an account holding a license in its own name, or an active trial, may run one free team of up to five people, the owner and any viewers included, without seats. To check that, the team service reads from our licensing records whether your account holds one and the country you declared. The team's record notes that it is a free team and, for a team started on a trial, the last day of that trial; both go when the team is closed. A paused free team takes no new members, events or assignments until it is covered again, and nothing in it is deleted. It also corrected how you leave a team: you ask its owner or an administrator to remove you, or delete your account (Section 3.8), and said you must be an adult to create or own a team (Section 10). It also removed the one-minute chord changes drill, which Setliner no longer has, from Section 3.12: the tries it saved in earlier versions stay on the device where you practised, are not shown, and are deleted with Reset practice data. Version 1.24, of October 17, 2026, had rewritten Section 3.12 to cover practice mode and Record chords, added them to the short version, and added practice data to Section 3.10: the app listens only while a practice run, input level check or recording you started is going, and analyses the sound on your device. Setliner never sends it anywhere on its own; it leaves your device only if you choose to send it to us. Sound is saved only when you keep a take, or save a song from Record chords on a computer with Keep the recording ticked (it is by default). Setliner keeps a score record of each run long enough to score, a practice log and your drill results, all on the device where you practised. Phone and tablet backups leave them out (on iPhone and iPad, unless you turn that on), a backup of your computer's home folder includes them like your other files, they go into a library backup only if you turn that on, and Settings can reset them. It also removed the two mentions of subscriptions, in Sections 3.6 and 9: Setliner sells only one-time purchases. Version 1.23, of September 27, 2026, had added one thing to Section 3.8: the Teams server stores the name of the setlist attached to an event, so members and synced calendars can see it; never its songs or contents. Version 1.22, of September 26, 2026, had added calendar sync to Section 3.8: if you turn it on for a team, the Teams server gives your calendar app a private link to your upcoming events in that team, and anyone with the link can see them until you turn sync off or make a new link. It also corrected Section 3.10: play history stays in your library folder, so it syncs wherever you sync that folder; we never receive it. Version 1.21, of September 26, 2026, had added one kind of email to Section 3.6: if you started a free trial with your email address, we remind you 10 days and 2 days before it ends, and each reminder has a link to stop them. Version 1.20, of September 26, 2026, had changed how changes to this policy reach you (Sections 4 and 14): a new version takes effect when it is published, with no waiting period, and the app shows you what changed since the version you last saw. Using information we already hold in a new way still needs your consent. Version 1.19, of September 25, 2026, had named Apple in Section 7 as the seller of purchases made in the iPhone and iPad app, which Section 3.7 already described, and had shortened the notice before a change to what we collect or how we use it from 30 days to 15, starting October 25, 2026. Version 1.18, of September 25, 2026, had added to Section 3.7 how purchases made in the iPhone and iPad app work: Apple sells them, and we receive only the receipt Apple signed for each one. Version 1.17, of September 24, 2026, had added Section 3.12: practice mode, when you start it, listens to your instrument through a microphone or audio input you choose and analyses the sound on your device; the sound is never recorded, stored or sent. Version 1.16, of September 24, 2026, had added to Section 13 that our website counts how many times each installer is downloaded, keeping only the totals. Version 1.15, of September 23, 2026, had added to Section 9 how long an account is kept while you belong to a team or have a request to join one waiting, and how long an account that never held a licence or trial is kept. Version 1.14, of September 22, 2026, had corrected one number and changed nothing else about what we collect or how we use it: it dated the list in the short version by this policy's own version, the number at the top of this policy, instead of by an app version number it never tracked. Version 1.13, of September 17, 2026, had said (Section 3.8) that you can be on more than one team and an owner can run more than one, and that an owner's team bundles are one pool serving all of their teams: a seat covers you on any of them and is returned when you leave the last one. Version 1.12, also of September 17, 2026, had added optional names inside a team (Section 3.8): you can set a display name for yourself, the team's owner or an administrator can give you a label, and both are seen by your team. It also corrected Section 3.8 to say that you can be on a team without a seat, and that a team can run on more than one team bundle. Version 1.11, also of September 17, 2026, had changed how you join a team and what a team runs on (Section 3.8): a team needs a team bundle, you join by entering the team's join code in the app and waiting for the owner to approve you, and Setliner no longer emails invitations or assignment notices; what is kept about a request is in Section 9. Version 1.10, of September 16, 2026, had added optional device names: you can type a name for each of your devices so you can tell them apart, and the app tells our licensing service what kind of device it is (Section 3.6), and what happens to both is in Sections 3.1 and 9. Version 1.9, earlier that day, had corrected four statements that did not match what our services do. Version 1.8, of September 15, 2026, had added one disclosure to Section 3.6: to keep you signed in, the app stores your verified email address and a sign-in token on your device, and logging out deletes both. Version 1.7, of September 14, 2026, had answered a fifth independent review with one correction: Section 3.8 no longer says a team's audit trail stops identifying a former member once their account is gone; it says what the audit trail keeps and that those records stay protected. Version 1.6, also of this date, had answered a fourth review with a consistency pass: the transfer commitment in Section 8 is scoped to transfers the law actually restricts, what deleting an account or leaving a team leaves behind is described the same way everywhere, and Section 12 is scoped to use without an account. Version 1.5, also of this date, had answered a third review: it names the small record that survives deleting your account, says what happens to a used invitation, makes the owner of every team responsible for what the team says about its members, and removes the last absolute statements that had exceptions elsewhere. Version 1.4, also of this date, had answered a second review: it says what happens to your licences if you delete your account, how leaving a team is recorded, that Teams never stores or transmits setlist contents, which team roles see what, and makes the transfer wording conditional. It replaces versions 1.3 and 1.2 of the same day and 1.1 of September 13, 2026, which had replaced the policy dated August 13, 2026; previous versions are at https://setliner.com/privacy/archive. It describes the connections the app makes when you ask it to (linked devices, folders synced by a provider you choose, an iOS OneDrive diagnostic), and the services we now operate ourselves: accounts, trials and licensing for paid features, purchases through our merchant of record, teams, and the desktop update check. Section 3 says exactly what each one sends and to whom.

The short version

At a glance. Your library, including your songs, setlists, annotations and recordings, stays on your devices and in folders you control, and Setliner, LLC does not receive it unless you choose to share part of it through Teams or Audience requests (whose page anyone with its link can open), or attach part of it to a support request. Apart from the server log every website keeps (Section 13), we receive only the account, licensing, purchase, Teams, audience-request and update-check information this policy describes, and only when you use those services: for example, your email address, a random device identifier, the record of a purchase, and what you and your teammates put into a team, but not your charts unless you send them to us. On desktop, the app checks for updates, which is on by default and which you can turn off. Linked devices connect directly to each other over your local network. The microphone is used only while practice mode or Record chords is listening. There are no ads, no analytics in the app, no advertising pixels or third-party trackers on our website, and no automatic crash reports, and we do not sell your personal information or share it for cross-context behavioral advertising (Section 4). Our website keeps visit totals, including totals by country looked up from the visitor's IP address at the moment of the visit; the visit counter does not store the address, though, as on any website, our host's server log records each request with its address (Section 13). The totals hold no record of any one visit and are kept for about 25 months. To use your rights over the information we hold, or with any question, write to support@setliner.com (Section 11).

Your library is stored on your own devices by default, and Setliner, LLC does not receive it unless you choose to share part of it through Teams or Audience requests, or attach part of it to a support request (Section 3.4): your songs, setlists, annotations, play history, audience request history, venues, tip log and the checklists on your sets stay on your devices and in folders you control. We receive only the account, licensing, purchase, Teams and audience-request information described below, including the specific things you choose to share through Teams, and only when you use those services. As of version 1.43 of this policy, that is:

• when you ask for a sign-in code, your email address and the country you say you are in, and, only if you choose Canada and say you live in Québec, that answer, which we use only to refuse the sign-in code and do not store (Sections 3.6 and 8);
• a verified email address, a random device identifier and the kind of device it is (such as Windows or Android), when you start a trial or activate a paid feature on your Setliner account, and a name for that device if you choose to type one (Section 3.6); a trial in the iPhone and iPad app comes from the App Store and sends us nothing (Section 3.7);
• a purchase record from Polar, our merchant of record, including the campaign label if the Buy link carried one, when you buy something through our website, or, for a purchase in the iPhone and iPad app, Apple's signed receipt, when you buy or restore it while signed in or sign in afterwards (Section 3.7);
• what you and your teammates put into a team, which is membership and scheduling information, such as events, their places and checklists, and the days members mark unavailable, by hand or automatically, never your charts, and a 30-day list of the changes that concern each member, for team notifications; if you turn those on on an iPhone or iPad, in a version of the app that offers it, also the push token Apple gives that device (Section 3.8);
• the request the desktop app makes when it checks for an update, which is on by default and which you can turn off (Section 3.9);
• if you start an audience request list, in a version of the app that offers it, the titles and artists of the songs you put on it, including songs you add while it is open, and which of them the audience asked for and when, until the list ends, and then only those songs and how many times each was asked for, until your app collects them, at most 30 days (Section 3.13);
• a support email or a debug log, if you choose to send us one (Sections 3.4 and 3.5).

There is no Setliner-operated sync or storage service for your library, no ads, no analytics in the app, no advertising pixels or third-party trackers on our website, and no automatic crash reports, and we do not sell your personal information or share it for cross-context behavioral advertising (Section 4). Our website keeps daily visit totals by where visitors came from, such as an ad campaign or a site or app like YouTube or Facebook, for about 25 months, and totals by country, which our server looks up from the visitor's IP address at the moment of the visit without our visit counter storing the address; the totals hold no record of any one visit, and the site is set not to count visitors in the EEA or the UK (Section 13). Our services also keep a few totals that name no one, such as how many update checks, trials, purchases, refunds and audience requests there were, for about 25 months; unlike the visit totals, these include the EEA and the UK (Section 9).

The app also talks to other things when you ask it to, and only then:

• Linked devices (the Follow feature) connect directly to each other over your local network so one device can lead a set and the others follow along. If you turn on temporary chart sharing, selected charts are sent to those devices too.
• A cloud storage provider you point the app at (such as Google Drive or OneDrive) syncs the files in that folder under its own policy.
• On iPhone and iPad, an optional OneDrive sign-in diagnostic contacts Microsoft while it runs.
• Video links you add to a song open in your browser or music app.
• The Customer Support button opens your own email app addressed to us.
• In a version of the app that offers it, Planning Center import signs in with your own Planning Center account and reads the service plan you choose, directly from your device, and, while you are signed in, opening a set you imported from it can check that you can still see the plan; none of it reaches us (Section 3.14).

Practice mode and Record chords, where available, listen through a microphone or audio input only while a practice run, input level check or recording you started is going, and analyse the sound on your device. Setliner never sends it to us on its own; it leaves your device only if you send it to us, or when a sync service uploads the copy of a take you keep from a synced folder (below). They save sound only when you keep a take, or save a song from Record chords with its box for keeping the recording ticked: in a version of the app that offers Keep the audio, on any device, that box is Keep the audio, unticked unless you turn on its setting; on a computer whose version does not offer it, the box is Keep the recording, ticked by default, and on a phone or tablet whose version does not offer it, Record chords never keeps the recording. While you record and review, Record chords holds the recording on your device only; Setliner itself never uploads or syncs it. In a version of the app that offers recovery (one that asks to recover a recording after Setliner closes unexpectedly), it also keeps a recovery copy on your device while you record, so that leaving the screen, an interruption or Setliner closing unexpectedly need not lose it; Setliner deletes that copy when you save the song or confirm that you want to discard the recording, start again, switch between playing and humming or close without saving. In earlier versions, a recording you do not keep is deleted when you save, discard or leave it. Your takes, including recordings you keep, and practice history stay on the device where you practised or recorded, or in a library backup you choose to make; Android's own backups always leave them out, iPhone and iPad backups leave them out unless you turn that on, a backup of your computer's home folder includes them, and Settings can delete them (Section 3.12); in a version of the app that offers goals that follow you, your goals and how many minutes you practised on each recent day are also saved in your library folder (Section 3.10). In a version of the app that offers it, the app also tries to copy each take you keep to a folder for takes in your library folder, if you use one, or to another folder you choose; if that folder is synced, your sync service uploads the copy as it does your other files, and deleting the take in Setliner may not delete that copy (Section 3.12, copies of kept takes). In a version of the app that offers it, Record chords can also listen while you hum, whistle or sing a tune: your voice is analysed on your device into notes and pitch numbers; like an instrument recording, the recording stays on your device, in a version of the app that offers recovery with a recovery copy in a file there and no time limit, until you open the result in the Song Editor or confirm that you want to discard it; the sound is kept as a take only if you tick Keep the audio, and Setliner never sends it to us; a take kept this way is copied like your other takes.

Here is how that can be checked rather than taken on trust. The Android app declares the INTERNET permission, the CAMERA permission, the RECORD_AUDIO (microphone) permission and the POST_NOTIFICATIONS (notification) permission, and the iPhone and iPad app declares microphone access (NSMicrophoneUsageDescription); the Android app also declares WAKE_LOCK and the permissions its background scheduler adds, and the iPhone and iPad app camera and local network access for linked devices (Section 3.1), none of which gives access to your data; the camera is used only to scan a linked-device invitation, the microphone only while practice mode or Record chords is listening, and notifications only after you turn on team notifications. On Android, iPhone, iPad and Mac, the app asks for microphone access the first time practice mode or Record chords needs to listen. A network monitor will show local discovery and linked-session traffic on your local network; connections to Microsoft only while the OneDrive diagnostic runs; your cloud storage app uploading files in a synced folder, including copies of kept takes; a connection to our licensing service only when you start a trial (other than a trial from the App Store in the iPhone and iPad app), activate, name or deactivate a device, buy or restore a purchase in the iPhone or iPad app while signed in, sign in after making one, or the app renews an entitlement; on desktop, a periodic request to our update server unless you turn automatic checks off; connections to our team service while you use Teams; in a version that offers Planning Center import, connections to Planning Center while you sign in to it, import a plan, open a set you imported from it, or disconnect; and, in a version that offers Audience requests, connections to our request service while a request list you started is open. Nothing else leaves the app, apart from what you yourself put in an email to us or share through your device's share sheet.

Anything we might collect in future remains subject to the notice commitment in Section 4. Section 6 lists the services we do not offer; nothing in it is active.

1. Who we are

Setliner, LLC ("we," "us," "our") makes Setliner, an application for organizing and displaying chord charts and song files. Who is responsible for which information is set out under Roles below.

Contact: support@setliner.com · 12042 SE Sunnyside Rd, Unit #2160, Clackamas, OR 97015

Roles: we are the controller for the information in Sections 3.4 to 3.7, 3.9 and 3.13 (support correspondence, debug logs, accounts, licensing, purchase records, update requests and audience requests). A team belongs to its owner, whether that is a church, a band or one person: the owner and the administrators they appoint decide what goes into it, the owner is the controller of that information, and we process it only on the owner's behalf under Section 11 of the End User License Agreement and our Data Processing Addendum at https://setliner.com/dpa/, which applies to every team owner. What stays on your devices (Sections 3.1 to 3.3, 3.10 and 3.12) never reaches us and has no controller on our side. Anything from it that you choose to send us, such as a file attached to a support email (Section 3.4), does reach us, and we are its controller. Polar is an independent controller for the checkout it runs (Section 3.7). We are also the controller for the push tokens of team notifications and for sending them through Apple's push service (Section 3.8); the list of changes those notifications are about is part of the team's information, as are the days members mark unavailable and the places of events.

2. What this policy covers

This policy covers the Setliner desktop and mobile applications and any online services we operate for them. It does not cover third-party services you may use alongside Setliner — such as a cloud storage app you keep your song files in, or the app store you downloaded us from. Those have their own policies.

3. What the app connects to today

The connections below are the only ones the current version makes. Sections 3.1 to 3.3 are connections you start from your device to a party you choose; they never pass through a Setliner server. Sections 3.4 and 3.5 are things you may send us yourself. Sections 3.6 to 3.9, and 3.13 in a version of the app that offers Audience requests, are the services Setliner, LLC operates, and say exactly what each one receives. Sections 3.10 to 3.12 describe what the app keeps and does on your device: what it stores, the files you open, and practice mode, which makes no connection of its own. Section 3.14, in a version of the app that offers Planning Center import, is a connection you start from your device to Planning Center; it never passes through a Setliner server.

Permissions: the Android app declares the INTERNET permission, the CAMERA permission for the features in Section 3.1, and the RECORD_AUDIO (microphone) permission for practice mode and Record chords in Section 3.12. It requests no location, Bluetooth or contacts permission. It also declares the POST_NOTIFICATIONS permission, and asks for it (on Android 13 and later) only when you turn on team notifications (Section 3.8). It also declares WAKE_LOCK and the permissions its background scheduler adds, so that it can check for team changes in the background; none of them gives access to your data. The iPhone and iPad app declares camera and local network access for linked devices (Section 3.1), and asks to show notifications only when you turn them on there. The iPhone and iPad app declares microphone access (NSMicrophoneUsageDescription) for practice mode and Record chords in Section 3.12. On Android, iPhone, iPad and Mac, the app asks for microphone access the first time practice mode or Record chords needs to listen, and you can refuse or withdraw it in your device's settings. Foot pedals and page-turners work as ordinary keyboards and need no permission of their own. MIDI devices (keyboards, effects units, mixers and MIDI pedals) connected by USB, or already set up on your device by the system or another app, need no permission either. Setliner keeps their names and your MIDI settings on your device and sends MIDI messages only to the devices you choose.

3.1 Linked devices (Follow)

Follow lets one device lead a set while other devices on the same local network follow its position. Everything it exchanges travels device to device over your local network, on an encrypted connection pinned to a certificate the leading device generates for that one session. There is no Setliner relay, and nothing about the session reaches us.

• To let followers find and join it, the leading device advertises a service name and its network address on the local network, together with the name you gave the device if you gave it one, and shows an invitation as a QR code, a short code, or text you can copy. The invitation contains the session's connection secret. Anyone holding the invitation can ask to join while it is valid, so share it only with the people you intend to join. Joining also requires the leader's approval or a matching short code. Anyone on the same local network can see an advertised device name while that device is leading.
• When a follower joins, the leading device sends it a list of the set's rows, each with its kind and, for a song, its library identifier, and then which song or set item is showing (such as a slide deck, PDF or picture) and the position in it (section, slide or page), with a fingerprint of each text chart, and, keyed to the session, of each PDF chart, deck, PDF or picture, so a follower can tell whether its own copy matches, and the playback settings for the set (key, section order with its name, and section shorthands). A deck's fingerprint is a one-way hash of its slides' internal numbers, titles, words and notes, and a PDF's or picture's is a one-way hash of the file's contents. In a version of the app that leads sets with them, the leading device also sends how many slides or pages each has, whether a file is a PDF or a picture, the internal numbers a deck gives the slides it shows, and, for a deck, PDF or picture, a code made from its place in your library folder and that session's key, which a follower compares with the places in its own library, so it can find its own copy; the file's name and path themselves are not sent. A follower holds the session's key, so it could test the code and the fingerprints against files or places it has or guesses; a text chart's fingerprint, a song's identifier and a deck's slide numbers are the same in every session. For a blank page, a web link or another kind of file in the set, it sends only which of these it is. If you press the cue button on the leading device, it also sends the cue's text, which you set in Settings ("CUE" unless you change it). It does not send your library location, your tags, your play history, your preferences, or any file other than the charts described next. Slides, PDFs, pictures, notes, file names, web links and files are never sent, nor a blank page's title or text (for a song kept as a PDF, the app names its file after the song's identifier): a follower shows its own copy from its library, or a placeholder.
• If a follower turns on temporary chart sharing, the leader also sends that follower the title, chart text, key, capo and tuning of charts the follower does not already have, so it can display them, and the marks the leader has made on them (pen, highlighter, emoji and text boxes). Those copies are temporary and are not added to the follower's library. Chart sharing is off until the follower turns it on, and songs that exist only as a PDF are not shared this way.
• A follower sends the leader a device name it chose, which starts as the name you gave the device and can be changed before joining, whether it wants charts shared with it, which of these features its version supports, and acknowledgements of what it received. Other participants can see the name you choose and the charts you share with them.
• Scanning an invitation uses your device's camera, only while the scanner is open. The camera image is used to read the code and is neither stored nor transmitted.
• A follower can remember the leader it last joined so it can rejoin without a new invitation. That memory, and the leader's list of approved followers, stays on the device that made it, and each has a Forget option.

3.2 Folders synced by a provider you choose

Setliner reads and writes your songs and setlists in a folder you pick. If that folder is one a cloud storage app keeps in sync (Google Drive, OneDrive, Dropbox or similar), that provider transfers its contents under its own privacy policy. On desktop and Android, Setliner does not sign in to the provider; it only reads and writes files in the folder, like any other program on your device. In a version of the app that offers it, that includes copies of the takes you keep, unless you choose another folder for them (Section 3.12, copies of kept takes), and your goals and the counts they measure (Section 3.10, goals and training).

3.3 The OneDrive sign-in diagnostic (iPhone and iPad)

Settings on iOS includes a diagnostic that proves a OneDrive sign-in works. Running it opens a Microsoft sign-in page and then asks Microsoft for the names of the top-level folders in that OneDrive. The application identifier you type, the sign-in code and the resulting access token go to Microsoft; the folder names come back to your screen. Setliner does not store the token or the folder names, and it is not a Setliner account. Nothing happens until you tap the button.

3.4 Links you open, and email to us

A video or web link you add to a song opens in your browser or the relevant app when you tap it, and that site sees your visit as it would any other. The Customer Support button opens your own email app addressed to support@setliner.com; whatever you send is then an ordinary email between you and us. A chart, setlist, debug log or other file you attach is used only to look into your problem. We keep the correspondence and its attachments for as long as we need them to help you and for our own records, for example to handle a follow-up or to show what we told you, and no longer than 10 years. If you ask us to delete them, by emailing support@setliner.com, we do, unless the law requires us to keep them or a specific claim or dispute about them is open (Section 9). We delete support mail by hand, and nothing deletes it automatically. A training-examples file or a take's sound you email us is support material in the same way: we use it only to look into what you reported, which can include playing it through Setliner on our own computers to reproduce the problem, and we never add it to a test set, use it to tune or train anything, or use it to identify anyone heard in it or to make a voiceprint (Section 3.12).

3.5 Diagnostics

The app keeps a short debug log in memory while it runs. It is never sent anywhere automatically. You can save it to a file from Settings and send it to us if you choose; if you do, we use it only to look into the problem you reported, and keep it as Section 3.4 says for support mail.

3.6 Your Setliner account, trials and licensing

Paid features are licensed through our website and activated in the app. Nothing in this section happens until you start a trial, buy something, or sign in on a device. In the iPhone and iPad app, a trial comes from the App Store, and you can buy or restore a purchase without signing in (Section 3.7); for those, nothing in this section happens until you sign in.

• Your Setliner account is your email address, verified by a code or link we send to it. We do not ask for a password: signing in on a new device means proving you can read that mailbox. We keep the address and the entitlements attached to it. When you ask for a sign-in code the app also asks which country you are in, and we keep the answer you give, so that we can apply the restriction in Section 8. That answer is only ever what you tell us: we do not look it up, and nothing works it out from your IP address or your device's language or region. In a version of the app that asks it, if you choose Canada, the app also asks whether you live in Québec. It sends that answer only with your request for a sign-in code, and only if it is Yes; we use it only to refuse the sign-in code, and with it any account, trial, purchase or team there (Section 8), and we do not store it. If you answer No, the app sends nothing about it.
• Starting a free trial of a paid feature, except in the iPhone and iPad app, sends us that email address and a random device identifier the app generates. Apart from the verification message, we email the address only for things the service needs: a receipt, a reminder 10 days and 2 days before a free trial you started ends (each one has a link to stop them), a security alert, a notice when a device is added to or released from your account, or a change to this policy that Section 14 says we email you about. We do not email you about teams, and we send marketing email only if you separately opt in to it.
• Activating a purchase or trial on a device sends our licensing service the device identifier, your email address, which feature you are activating, and the kind of device it is. We use that to record which devices hold an entitlement, to enforce the seat or device limits of what you bought, to apply the limits on repeat free trials (End User License Agreement, Section 5.9), which we check by account and by device identifier, and to let you deactivate a device you no longer use. The identifier is generated by the app, is not derived from your hardware, and stays on that device in the app's own storage. To limit how often one network can use our licensing service, including how often it can ask for sign-in codes, our licensing service keeps counters labelled only with a scrambled form of the network's internet (IP) address (a keyed one-way hash), and deletes each counter within two days.
• You can give a device a name, such as "Stage iPad", so you can tell your devices apart. The name is only ever what you type: the app never reads your device's own name, its computer name or your account name. It is kept in the app's private storage on that device and, when you are signed in and the device is activated, sent to our licensing service, which shows it on your other devices in Manage devices, uses it in the emails we send when a device is added to or released from your account, and shows it to us when we help you recover a lost device. You can change or remove it at any time, and logging out removes it from the device. So that a device you have not named can still be told apart, the app also tells the licensing service what kind of device it is: Windows, Mac, Linux, Android, or iPhone or iPad. That is the operating system only, never its version, the model, or anything else about your hardware.
• To keep you signed in, the app stores your verified email address and a sign-in token in its private storage on that device for up to 30 days. Logging out deletes both from the device and ends the sign-in on our service.
• Once activated, the app keeps working without a connection. It contacts the licensing service again only to renew its cached entitlement, or when you deactivate, and if it cannot reach us it keeps working on what it last knew for at least 30 days, as Section 5.8 of the End User License Agreement promises.
• Licensing tells us that a device holds an entitlement. It does not tell us what songs you have, what you play, or what you do with a licensed feature, and we keep no such record.
• We also count, in weekly totals that name no one, how many accounts start a free trial and how many accounts that started one buy that feature (Section 9, Statistics totals). To do that, our licensing service notes when each trial started, kept with the trial as part of your account information. A trial in the iPhone and iPad app never reaches us and is not counted.

3.7 Purchases

Purchases made through our website are sold by Polar Software, Inc. (Polar), our merchant of record, and processed by Polar's payment provider. Polar collects your name, email address, billing address and payment details under its own privacy policy at https://polar.sh/legal/privacy; we never receive or store your card number. Polar sends us a record that a purchase occurred, namely the transaction identifier, the item, the date, the amount and the email address it was bought under, so that we can attach the entitlement to your account. That record also includes other details you gave Polar, such as your name and billing address; our server uses only the billing country from them and, for an order billed to Canada, the billing province, to apply the restriction in Section 8, and keeps none of them in our records. The country, and for an order billed to Québec the province, appears only in the reason we give Polar for an automatic refund and in the alert we log and send ourselves if that refund fails.

Purchases made in the iPhone and iPad app are sold by Apple under its own terms and privacy policy; we never receive your Apple ID, name or payment details. When you buy or restore a purchase while signed in, the app sends us the receipt Apple signed for it, which records the transaction identifier, the item, the date, the price and currency, and the App Store country; we keep only the transaction identifier and the item, attached to the account you are signed in to. You do not have to sign in to buy or restore: if you are not signed in, the purchase unlocks its features in the iPhone and iPad app on your devices that use the same Apple Account, from what the App Store tells the app, and we receive nothing about it, except that if Apple refunds or revokes it, Apple tells our server its transaction identifier, which we keep, linked to no one, so that it can never be added to an account; if you sign in later, the app then sends us the receipts for those purchases, so that they are attached to your account and reach your other devices. A trial in the iPhone and iPad app is a free item from the App Store, named 90-day Trial: the app times it from the date Apple records for it, it unlocks its features only in the iPhone and iPad app (including that app on a Mac or Apple Vision Pro, where the App Store offers it), and the app never sends it to us. Apple also tells our server directly when it refunds or revokes a purchase, so that the entitlement can end.

We also count, in weekly totals that name no one, how many purchases are made on our website, how many purchases from the iPhone and iPad app are added to a Setliner account, and how many refunds or revocations reach us (Section 9, Statistics totals). To do that, our licensing service notes when each website order reached it, kept with the purchase record. The totals hold no amounts.

If you came to our website through a link with campaign tags (such as utm_source=meta in an ad's link), the Buy links on our pages pass that link's source, medium and campaign name to Polar, which records them with your checkout and order. A visit without tags whose link carried Facebook's click identifier (fbclid), or that came from a Facebook or Instagram website, passes source meta, medium paid-or-social and, as the campaign, fbclid or referrer, which says only which of the two it was, never the identifier itself. A visit from any other website or app passes only the source referral, without naming it, even when our own visit counts name it (Section 13). A visit where your browser does not say which site or app sent you passes no tags, even when our counts name the app from its built-in browser. We read these tags only to count purchases by campaign. Campaign names come from the link you followed: we name our own ads and links after the ad, never a person, and anything that is not a short plain word is passed and counted as other. Buy links carry no tags if you came to the site directly, if your browser sends the Global Privacy Control signal, or if your device is set to a European time zone or to none that names a place. We do not send purchases or campaign tags to Meta or any other advertiser.

3.8 Teams

If you create or join a team, our team service stores the team's name; each member's account email address and permission level, and up to two optional names: a display name that only you can set for yourself, and a label that the team's owner or an administrator can give you. Both are plain text of up to 40 characters, are shown to everyone in the team, including you, where your email address would otherwise appear, and your own display name is shown instead of the label. You can change or clear your display name at any time; the owner or an administrator can change or clear the label. Both are deleted when you leave the team or are removed from it; the roles the team defines; its events (title, date, time zone, the name of the setlist attached to it and, in a version of the app that offers it, an end time, a place and a checklist) and who is assigned to them; and, for each setlist a member has been granted, its identifier and name and who may receive it, never its songs or contents. It does not store or transmit your songs, charts or the contents of a setlist: a grant records that you may receive a setlist, and the setlist itself reaches you through the channels you already use, such as a shared folder, an export or a linked session. If we ever carry setlist files through our own service, we will describe that here first.

A team runs on one or more team bundles: purchases, described in Section 3.7, that each come with a fixed number of seats, and an owner's bundles are one pool that serves every team the owner runs, so a seat given to you covers you on any of that owner's teams. Creating a team requires holding one, except that an account holding a license in its own name (not a seat from someone else's bundle) or an active trial (not a trial from the App Store, which we never see) may run one free team of up to five people, the owner and any viewers included, without seats. To check that, the team service reads from our licensing records whether your account holds one and the country you declared. The team's record notes that it is a free team and, for a team started on a trial, the last day of that trial, which only the owner sees; both go when the team is closed. Members can see when a free team is paused. The owner keeps one seat and gives the others to members; while a seat is yours, the bundle's features are unlocked on your devices as if you had bought them, and the owner can see, in Manage seats, the email address each seat is assigned to. Giving a seat back ends that; so does being removed from the last of that owner's teams you are on. Neither affects anything you bought yourself. If a bundle is refunded or charged back, its seats stop working; when the owner has no team bundle left, every team they run that was created on a bundle is frozen: nobody can change them or use their seats, and nothing in them is deleted unless the owner deletes the team; a free team that a bundle upgraded goes back to being a free team. A free team whose owner holds neither a license nor the trial it was started on, whose owner has declared a country in the European Economic Area or the United Kingdom, or that has more than five people without a bundle, takes no new members and no new or changed events or assignments until that is no longer so; nothing in it is deleted.

You can be on more than one team, and an owner can run more than one. You join a team by entering its join code in the app. The owner or an administrator sees the code in the app and passes it on however they choose; Setliner does not send it, and we email nobody about a request, an approval or an assignment: everything a team tells you appears in the app. Entering a code creates a request that holds your account email address and when you asked, which the team's owner and administrators can see until one of them approves or declines it, or you withdraw it. Approving it puts you on the roster, with or without a seat. A member without a seat can be scheduled and can answer, and the bundle's features are not unlocked for them; the owner can give them a seat later, and can take a seat back without removing them from the team. A declined, withdrawn or unanswered request is deleted 30 days after it was made. Owners, administrators and planners see the whole team; ordinary members see the roster and roles, and only their own assignments, grants and the events those belong to. A member can ask the owner or an administrator to remove them, or delete their account, and the owner or an administrator can remove a member. Either ends that person's access to that team, takes them off its roster and cancels their grants at once, and returns their seat unless they are still on another of the owner's teams with a seat assigned. Assignments they had are marked cancelled and stay in the team's schedule history for as long as the team exists; only owners, administrators and planners can see that history. On request we replace the departed member's name and email address in that history and in any request record with a placeholder. The team's audit trail is not changed by that: it keeps, for each change made to the team, the acting account's internal identifier, what was changed, and a reference to the item changed, which for a request is a one-way hash of the requester's email address. Those records can still be linked to a person by someone who already knows the identifier or the address, so they remain personal information, stay visible to nobody but our staff under the access rule in Sections 7 and 9, and are deleted with the team under Section 9.

If you turn on calendar sync, the Teams server gives your calendar app a private link. Your calendar provider (for example Google or Apple) fetches your upcoming team events through it: titles, times, team name, your roles and the setlist name. It does not include an event's place at present. Anyone with the link can see those events until you turn sync off or make a new link.

Unavailable dates. You can mark days on which you are unavailable for a team. For each range, the team service stores its first and last day, an identifier the app picks, and that it is yours. In a version of the app that offers it, you can add a short note (up to 100 characters); please leave out health and other sensitive details. While a day is marked, nobody can assign you to an event that starts on that day (the day as it falls in the event's own time zone) and you cannot accept an assignment to one; a planner who tries is told only that you are unavailable that day. If you are already on an event that day, you decline it before you can mark the day. In a version of the app that offers it, you can turn on, on a device, the setting that marks you away in your other teams. Each time you open Teams on that device, the app then adds, where it can, a one-day unavailable date in each of your other teams for the day on which each upcoming event you have accepted starts (in the event's own time zone), and removes one for a day you are no longer accepted for, for example because you declined or the event was cancelled, moved or removed; until it next runs, and for days already past, the date stays. While the setting is on, a day it added comes back if you remove it by hand. The setting is kept on each device, so turn it off on each device where you turned it on to remove those dates. Such a date holds its day and, in a version of the app that offers it, the time the earliest of those events starts, and nothing else from the other team, unless you also turn on, on that device, the setting that shows the event's name, which puts that event's name in its note; a name can say which church, band or person the event is about, and turning that setting off takes the names off days still to come. The apps show these dates as set automatically, and their identifier is made from your account, the team and the day, so the team's owner, administrators and planners can tell that the app added it, which shows that you are on an event in another Setliner team that day, though not which team, or, unless you show its name, which event. The team's owner, administrators and planners see your unavailable dates, with their notes and times; other members see only their own, and viewers have none. They are not in calendar sync links, notifications, emails or anything outside the team in Setliner. A range is deleted when you remove it, within a day once 30 days have passed since its last day, when you leave the team or are removed from it, when you become a viewer, and when the team or your account is deleted; backup copies age out as Section 9 says. The team's audit trail records that you added, changed or removed a range, and when, by its identifier, never its dates, times or note; for a date the app adds, the identifier could be tested against guessed days, and we never do that. To stop the same change being applied twice, the team service also keeps, for as long as the team exists, a one-way check value of each change sent to it, including one that marks or changes a range; it does not hold the dates themselves, but could be tested against guessed dates, and we never do that; it leaves out a range's note and times. We use unavailable dates, their notes and times for nothing but keeping you off the schedule on those days and showing them to the people this section names, and never to infer anything about you.

Event places. In a version of the app that offers it, an event can have a place: one line of free text, such as a venue's name or address, which the owner, an administrator or a planner types when they create or change the event. Everyone in the team who can see the event sees its place. At present neither calendar sync nor the app's calendar export includes it, and changing only an event's place sends no notification. It is deleted when it is cleared, when the event is removed, and with the team (Section 9). Setliner never looks a place up on a map or anywhere else, never uses it to find or check where anyone is, and asks for no location permission. Your app may offer a place you can see as a venue in your own venues list (Section 3.10); a venue you save that way is yours and stays in your list after you leave the team, until you delete it. A place is seen by the whole team: give a venue's public name and address, not a private person's home address or phone number unless they agree.

Event checklists. In a version of the app that offers it, an event can have a checklist of up to 200 items. Each item is a line of text with an optional note and, if the owner, an administrator or a planner chooses, the teammate it is for, who must plan for the team or be on that event when chosen. Those people add, change and remove items, and can add the lines of a checklist template; the template's name is not sent. They can also save an event's checklist as a template in their own library; that copy holds only the items' text, is theirs, and stays after they leave the team, until they delete it. Everyone in the team who can see the event sees its checklist, and anyone among them except viewers can tick an item; the team service then stores who ticked it and when, which they all see, and unticking it clears both from the checklist. Because an item can name who it is for and who ticked it, everyone who sees the event can learn that those teammates are on it or plan for the team, even where they would otherwise see only their own assignments. At present, calendar sync, the app's calendar export and notifications do not include checklists, and changing one sends no notification. An item is deleted when it is removed, when the event is removed, and with the team (Section 9); backup copies age out as Section 9 says. When someone leaves the team, is removed, deletes their account or becomes a viewer, they are taken off every item as who it is for and who ticked it; anything an item's text says about them stays until someone changes it. The team's audit trail records each checklist change, including which account ticked or unticked an item and when, by the item's or the event's identifier, never its text. The one-way check value described under Unavailable dates is kept for these changes too; it does not hold an item's text, but could be tested against guessed text, and we never do that. A checklist is seen by everyone who can see the event: do not put a fee, contract terms, a private person's phone number or a child's details in one unless all of them may see it.

Notifications. So that the app can tell you about them, the team service keeps, for every assigned member, whether or not they turn notifications on, a short list of the changes that concern them: that they were added to an event or taken off one, that an event they are on was changed or cancelled, or that the set attached to it changed. Each entry holds only which team and event, what kind of change, and when, never the event's title, time or set, and is never made for the person who made the change. If you are on an event, or schedule for a team, you can also ask to be told when someone on it accepts or declines; the team service keeps that choice and then adds those answers to your list. The list is deleted after 30 days, when you leave the team or are removed, and when the team or your account is deleted; backup copies age out as Section 9 says. Notifications are off on each of your devices until you turn them on there, and you turn them off in the team screen. Turning them off in your device's settings stops them being shown, but on Android the app keeps checking your list, and on iPhone and iPad we keep the token, and keep asking Apple to deliver, until you turn them off in the team screen. Notifications made on your device can show the team's name, the event and, for answers, the teammate's name, and may appear on your lock screen. On Android and computers, the app reads your list from the team service itself: when it opens, and in the background where the system allows (on Android, about every 15 minutes at most, often less often while the device is asleep; on a computer, every few minutes while Setliner is running). The notification is made on your device, and no other company is involved. On iPhone and iPad, in a version of the app that offers it, the app also gets a push token from Apple for that installation of Setliner and sends it to the team service with whether it is for Apple's test or live service. We keep the token with your account (not with a team), when the app last confirmed it, and how far through your list it has been told about. When your list has new entries, at most once every two minutes, we send Apple's push service the token and a fixed message, whose words come from the app ("Your team schedule changed"), with no team, event, name or email address; your device then shows it and, when you open Setliner, gets the details from the team service over an encrypted connection. A token is deleted when you turn notifications off on that device, sign out on any of your devices (which stops pushes to all of them until each app next opens and registers again), leave or are removed from your last team, or delete your account, when Apple tells us it no longer works, and 90 days after the app last confirmed it; we keep at most 10 per account. Notifications are never needed to use Setliner, carry no advertising or marketing, and are not used for anything else.

A team's name and roles, and a label given to you, may say something about you, for example that you are on a church's worship team. The team's owner or administrator, not Setliner, chooses to enter that and, as the team's controller, is responsible for having whatever agreement from you the law requires; the join code you enter names the team before you ask to join, so you know what you are joining. We use it for nothing but running the team, and leaving the team takes you off its roster.

3.9 Update checks (desktop)

The Windows desktop app checks our update server for a newer version automatically, by default. You can turn that off, or check manually, under Settings, About. A check is one request to our update server, which necessarily reveals your IP address and, by what it downloads, the version you are running. Nothing else is sent; the request carries no account or device identifier, and we do not link it to you. An update is downloaded and installed only after you approve it. Android and iOS receive updates through their app stores, under the store's policy.

Our web server's log records each check, like any request (Section 13). From it we count, each day, how many times our update list was fetched and from how many different networks, and keep only those numbers (Section 9, Statistics totals). A network is told apart by its IP address, which the count reads but never writes anywhere; it remains only in our host's log. A network is not a person or an install: several devices can share one, and one laptop can use many. Turning automatic checks off stops your app's checks being counted; a check you start yourself under Settings, About is counted like any other.

3.10 Data the app stores on your own device

The Software writes files to your device so it can remember your library and preferences. Local files are not sent to Setliner, LLC. Files you place in a synced folder or choose to share, copies of kept takes the app puts in one (Section 3.12, copies of kept takes), and goals and the counts they measure (goals and training, below), can leave the device through those features. Uninstalling the app may leave user-selected folders, exports and provider copies intact. Local storage includes:

• your song and setlist files, wherever you chose to keep them;
• annotations, tags and per-song settings you have made;
• audience request history: for each request list you ran, its day, the set it came from and how many times each song was asked for (Section 3.13). It stays in your library folder, and syncs wherever you sync that folder, until you delete it; we never receive it;
• venues you add, with any address, contact details (a contact's name, email address and phone number), website and notes you write about them, and the earlier names you gave them; the app can suggest venues from the venue names in your sets and, in a version of the app that offers it, from the places of team events you can see. The app does not read your device's contacts or address book. Venues are kept on your device and in your library folder, so they sync wherever you sync that folder, until you delete them; the app never sends them to us. In a version of the app that offers it, a set's Venue box and a team event's Place box can list your recent places and your saved venues; the app works out that list on your device from your sets, your venues and the team events it already holds, and does not save the list. If you pick one for a team event, only the name shown in the list is copied into the event's place, which the team sees (Section 3.8); a venue's address, contact details and notes are not sent to the team or to us. In a version of the app that offers it, you can open a venue's email address, phone number or website in your own email app, phone app or browser, which handles it under its own terms, and export your venues, with all their details, to a spreadsheet (CSV) file or import them from one; an export is a plain file that goes where you save it (and to your sync service if that folder syncs), and the app never sends it to us. Contact details and notes about other people are information about them: keep only what you need, share an export only with people who may see it, and delete it when asked;
• your tip log (for each tip you record, its day, amount and currency, whether it came in cash, through a payment link or another way, an optional note, and the venue and set it was for) and the payment links you enter (PayPal.me, Venmo or Cash App), kept in your library folder in the same way; the app never sends them to us. Setliner never processes, holds or sees a payment: the tip QR code shows only your own link, and whoever scans it pays you through that provider under its own terms and privacy policy;
• checklists on your sets, in a version of the app that offers them: each item's text and optional note, whether it is ticked, and when it was added and changed, and the checklist templates you save. They are kept on your device and in your library folder, so they sync wherever you sync that folder, until you delete them; the app never sends them to us, except that adding a template's lines to a team event sends them to our team service as that event's checklist (Section 3.8). Deleting an item replaces it with a marker that holds no text, on each of your devices as it next opens the library; copies in library backups and your sync service's history stay until those are replaced. Deleting a set does not delete its checklist, which stays in the folder, hidden, so delete its items first if you want them gone;
• play history: the app records locally when you view a song or play through a set, so it can show you usage reports and export them as a spreadsheet. Play history stays in your library folder, so it syncs wherever you sync that folder; we never receive it;
• practice data: takes you keep, including recordings kept from Record chords, a score record of each run, the practice log, any chord change results from earlier versions and any training examples you save, in the app's own storage on the device where you practised (and, for copies of kept takes, the folder in Section 3.12), left out of phone and tablet backups unless you allow iCloud and computer backups of them on iPhone or iPad (training examples and the data of songs waiting to be deleted stay out even then; a backup of a computer's home folder includes them), and in a library backup only if you choose to include them (Section 3.12);
• goals and training: in a version of the app that offers goals that follow you, the goals you set, and the counts they measure, are saved in your library folder (Section 3.2; the app calls it your sync folder), in a folder for the Setliner account you are signed in with, so they follow your sign-in to your other devices wherever you sync that folder, including your own cloud storage account if you use one, such as iCloud Drive, Google Drive or OneDrive. Setliner never sends them to us or to any Setliner server. While you are signed out, they are kept the same way in a folder for the Settings profile the device uses, and the first time you sign in on that device while it uses that Settings profile, the goals and marks in that profile's folder (not the ones cleared) are added to your account's. A second account signed in on that device starts with only its own goals, and this device's counts are shared only with the first account. Signing out deletes nothing: your account's goals stay in its folder, and this device keeps its own copy, for the next time you sign in. Each device also keeps its own copy in the app's own storage, so nothing is lost while there is no library folder or it cannot be written. What is saved there: the goals (set in Practice: a goal tempo for a song or section, as a percent of its tempo, and minutes a week; set in Train: the percent of your recent answers you get right in Chord Quiz or Ear Training, and a number of scales marked practised in Scales), each with the song's identifier and section it is for, the day it was set, your progress that day and any optional date; the scales you mark practised; when each goal or mark last changed; and, from each device, how many minutes you practised and how long the metronome ran on each of the last 35 days, and its most recent Chord Quiz and Ear Training results (for each session, the exercise, when, how many answers and how many were right), as of the last time that device showed those goals, whether or not you set one, in the folder of the first account (and, signed out, the first profile) it used goals with. Each device's file is named with a random identifier the app makes for that device (not the one in Section 3.6), an account's folder with a code the app works out on your device from your email address, so the email itself is never written there (anyone who knows or guesses your email address could work out the same code and tell that the folder is yours), and a profile's folder with that profile's identifier (random, or default for the main profile). Clearing a goal or a mark leaves a small record of which one was cleared and when, so the change reaches your other devices; these records are kept for good. Anyone who can open your library folder, including people you share it with, can open these files, and your sync service, and any backup you make of that folder, hold them like the rest of it. The goals set in Practice and the practice minutes are practice data: a library backup holds them only if you include practice data, and Reset practice data deletes those goals (Section 3.12). Your Train results (Chord Quiz and Ear Training history, scores and points, the chords you mark tried or favourite in Explore New Chords and the key you last picked, the scales you mark practised in Scales, and how long the metronome ran on each day (runs of 10 seconds or more, counted even with the volume off; days more than about 400 days old are dropped the next time it runs; never its tempo or other settings)) also stay in the app's own storage with its other preferences on the device where you trained, and Setliner never sends them to us. Your device's own backup (Android's backup or phone-to-phone transfer, an iCloud or computer backup of an iPhone or iPad, or a backup of your home folder on a computer) may include the Train goals and results, and a library backup includes the copies in your library folder other than the practice ones. With Include practice data in library backups on, a library backup also holds this device's Chord Quiz and Ear Training history and Ear Training points.
• application preferences, window layout, language and theme choices, stored in the app's own storage on the device (~/.setliner on desktop, or the platform equivalent);
• feature-specific preference files, such as the Fretboard Builder's saved orientation, foot-pedal key mappings on Android, remembered linked-device leaders and approvals (Section 3.1), and the record of which version of the license agreement you accepted and when;
• the random device identifier and the cached entitlement described in Section 3.6, in the app's private storage.

You are in control of these files. You can copy, back up, move, or delete them like any other files on your computer, and we recommend you do keep backups — the Software is not a backup service.

3.11 Files you open

The Software reads files you point it at, and on Android and iOS may receive files other apps share with it. It reads them locally to display them. It does not upload them to Setliner, LLC or index them on a Setliner server. Selected charts can be sent to linked devices when a follower chooses temporary chart sharing (Section 3.1), and your selected cloud provider can sync files in its folder (Section 3.2).

3.12 Practice mode (microphone and audio input)

• Practice mode and Record chords are off until you start them. On Android, iPhone, iPad and Mac, the app asks for permission to use the microphone or audio input the first time it needs to listen, or again if you refused before, and you can refuse it, or withdraw it later in your device's settings. On Windows and Linux, Setliner shows no prompt of its own, though your system's own microphone settings may still apply.
• In practice mode, the app listens only while something you started is going: Play through, Play along or Check input level, which shows how loud the input is and the range to aim for, keeps nothing, and closes when you press Close or after 2 minutes. On a computer, Play along can also run as the speed trainer or on a section or loop, and you can loop a trouble spot. The app shows that it is listening. The microphone or audio input opens only after you start one of these, and closes when it ends, when you press Stop, or when you close practice mode. On a phone or tablet, practice mode and Record chords close when Setliner leaves the screen, so they never listen in the background; while Setliner is still on screen, for example beside another app in split screen, a run keeps listening. On a computer, a run keeps listening if you switch to another window, until it ends or you stop it. Nothing listens while practice mode and Record chords are closed.
• The sound is analysed as it arrives, on your device, to recognise the chords you play. Some modes also use a second note detector, which is built into the app and runs on your device, so nothing is downloaded for it. Setliner never sends it to us on its own; it leaves your device only if you send it to us, or when a sync service uploads the copy of a take you keep (below).
• A microphone hears the whole room, not only your instrument: other players, singers or people talking. Check input level keeps none of it, but a take or recording you keep saves everything it heard, so think about who else is on it before you keep one.
• Recording is always your choice. During a Play through of a song in your library (on a computer, a Play along too), the app holds that run's sound in memory so that you can keep it, and discards it when you start another run or close practice mode. Record chords holds its recording on the device while you record and until you save or discard the song, so that you can review it, for example with Hear this spot, and keep it if you choose: on a computer, and on a phone or tablet in a version of the app that offers Hear this spot or Keep the audio (earlier versions hold no sound on a phone or tablet). It holds at most the recording's first 20 minutes, in the app's memory and, in a version of the app that offers recovery, in a recovery copy on that device: the sound at a lower quality and the chords and timings found. On a phone or tablet the copy is in Setliner's private storage, which other apps cannot open; on a computer it is in Setliner's data folder in your user account, which other programs you run can read. In earlier versions, a computer held the recording in the app's memory only, never in a file (your operating system may, as for any app, move memory to its own swap or hibernation file), and a phone or tablet in the app's memory or in a temporary file in Setliner's private storage on that device. In a version of the app that offers recovery, Setliner leaving the screen, or a call or other interruption, stops the recording but does not delete it. Setliner deletes the recording and its recovery copy when you save the song (whether or not you keep the audio) or confirm that you want to discard it, start again, switch between playing and humming or close Record chords without saving. If Setliner closes unexpectedly, the next time it opens it offers to recover the recording or discard it. Setliner does not delete it without asking you, and there is no time limit: Reset practice data and Setliner's clean-ups do not delete it. Uninstalling Setliner or clearing its data removes it on a phone or tablet, but may leave it on a computer. The copy holds everything the microphone picked up, including other people's voices, so tell anyone you record. A recording can still be lost, for example if the device runs out of space or the recovery copy cannot be written or read (EULA Section 6.6a), and the last few seconds before Setliner closed unexpectedly may be missing. In earlier versions, unless you keep it (below), it is deleted when you save or discard the song, start again or close Record chords, and, on a phone or tablet, when Setliner leaves the screen, or when a call or other interruption stops the recording; if Setliner closed unexpectedly, the recording could no longer be used, and any temporary file left behind was deleted the next time Setliner started. Setliner never uploads a recording it holds before you keep it, or puts it in your library folder, a synced folder or a library backup; a backup or sync tool you use on a computer's home folder, including a cloud backup, may copy the recovery copy, and deleting it in Setliner does not remove it from that backup. The app saves sound only in two cases: when you press Keep this take after a run, or when you save a song from Record chords with its box for keeping the recording ticked (below). Only the first 20 minutes of a run or recording can be kept; if you go on recording after that, Record chords still listens for chords but holds no more sound.
• A kept take is saved as mono sound files: a WAV file at 16 kHz to play back and, where the app can make one, a lossless FLAC copy at the input's own sample rate. With them the app saves the take's timing, the chart as you played it, its marks, any corrections or verdicts you give, any name you give it, and how the take was recorded, including the input's name as your device shows it (which can include a name, such as your own), the kind of input, the sample rate and bit depth, how the device captured the sound, the app's version, and details of the device: its operating system and version, its processor type on a computer or an Android device, its maker and model on an Android device, and the kind of device on an iPhone or iPad. The app keeps up to 3 takes per song. You can play a take back or delete it, and on a computer you can also name it.
• Kept takes and the rest of your practice data are ordinary files, and Setliner adds no encryption of its own. On a computer, anyone or any program that can open the files in your user folder can open them, including playing a take. On a phone or tablet, they are in Setliner's own private storage, which other apps cannot open; copies of kept takes in a folder outside it (below) are not.
• Each Play through or Play along long enough to score keeps a small score record: when you played, the chords the song asked for, the time of each strum and the chord heard, the tempo, and your results. On a computer, runs of the speed trainer, a section or a loop are kept the same way, and so is each pass of a trouble-spot loop. The app keeps a song's last 50 runs and, separately, its last 50 trouble-spot loop passes. Earlier versions also had a one-minute chord changes drill, which kept each try you finished: its two chords, date, count and song, the last 50 for each pair of chords. Setliner no longer has the drill and saves no new tries; those already saved stay on the device and are not shown. On a computer, the practice log keeps how many minutes you practised each day, and on which songs. None of these contain sound. On a computer you can delete one run at a time from a song's score history; everything else is deleted with Reset practice data (below).
• Record chords (in the library) listens only while you are recording, shows that it is listening, and closes the microphone or audio input when you press Stop or close it. When you stop, you choose to save what it heard as a new song or discard it. A song you save holds the chords and their timing, never any sound, and goes into your library folder like any other song, so it syncs wherever you sync that folder (Section 3.10). When you save, a box decides whether the app also keeps the recording. In a version of the app that offers it, on a computer, phone or tablet, the box is Keep the audio, which is unticked unless you turn on its setting (Settings > General > Practice; off unless you turn it on, and it belongs to that device: restoring a library backup never changes it, although copying a computer's whole home folder to another computer, for example with a migration tool, copies it too; on a computer it starts off even where you used Record chords before). On a computer whose version does not offer Keep the audio, the box is Keep the recording instead, which is ticked by default; on a phone or tablet whose version does not offer it, Record chords never keeps the recording. You can change the box each time you save; that does not change the setting. If it is ticked, the app keeps the recording as a take of the new song, on the device where you recorded it, in the app's own storage, saved with the same details as your other takes, listed with them and treated like them everywhere in this section, including backups, copies of kept takes, Reset practice data and deleting the song. It is not sent to linked devices. Setliner never sends it to us on its own; it leaves your device only if you send it yourself, for example to us, in a backup you allow to include practice data or kept takes, or when a sync service uploads its copy (below). Leave the box unticked, or untick it, if other people can be heard on it. If the box is unticked, or you discard the song, cancel, or leave Record chords without saving, the recording is deleted and nothing is kept. If the song cannot be saved, the app deletes the recording it had just kept for it and still holds the sound, so that you can try again. Recordings kept with Keep the recording, including any kept because it was ticked by default, stay as takes of their songs, treated like your other takes.
• Hum or whistle: in a version of the app that offers it, Record chords can listen to you hum, whistle or sing a tune instead of playing an instrument. It listens only between Start and Stop, which you press. Your voice is analysed on your device into notes and pitch numbers. These stay in your device's memory, and in the recovery copy described below, only until the result opens in the Song Editor or you discard it, and are then deleted. The recording itself is held as a Record chords recording of an instrument is (above), except that its recovery copy holds the sound and the notes and pitch numbers found while you hummed; if you recover it, the chart is shown from those saved numbers and the sound is not analysed again, and a take that stopped within about its first 2 seconds may come back with its sound but no chart. It is held in your device's memory while you record and review it and, in a version of the app that offers recovery, in a recovery copy on that device, which leaving the screen or a call or other interruption does not delete. If Setliner closes unexpectedly, the next time it opens it offers to recover the recording, discard it or ask again later. Setliner deletes the recovery copy when the result opens in the Song Editor, and deletes the recording too unless Keep the audio is ticked; it deletes both when you confirm that you want to discard it, start again, switch between playing and humming (the app asks first and says the recording will be deleted) or close Record chords without saving. There is no time limit: Reset practice data does not delete it, and on a computer a backup or sync tool you use may copy the recovery copy. As above, a recording can still be lost, for example if the device runs out of space or the recovery copy cannot be written or read (EULA Section 6.6a). If you open the result with Keep the audio ticked, the recording is kept on this device as a take of the new song, like a recording of an instrument. In earlier versions, the recording was held in your device's memory only, with no recovery copy. Setliner never uploads it; a take you keep is copied like your other takes (below). Setliner does not try to recognise who is singing or which song it is. The chart you then save is an ordinary song in your library.
• Takes, score records, the practice log, chord change results from earlier versions and training examples stay on the device where you practised, in the app's own storage (~/.setliner/practice on a computer). They are not in your library folder, so they do not sync with it, and Setliner never uploads them; kept takes are also copied as the next item says, and, in a version of the app that offers goals that follow you, how many minutes you practised on each recent day is saved in your library folder too (Section 3.10, goals and training), where it is synced and backed up like the rest of that folder; the backup switches below cover only the app's own storage. Your device's own backups leave them out: Android's backup and phone-to-phone transfer always do, and iCloud and computer backups of an iPhone or iPad do unless you turn on Include practice data in iCloud and computer backups (Settings > General > Practice; off unless you turn it on), which then includes them, except training examples and the data of songs waiting to be deleted. On a computer, Setliner makes no backup of its own, but a backup you make of your home folder (such as Time Machine) includes them like your other files. A device backup made before this version may still hold them until it is replaced. They are not in library backups unless you turn on Include practice data in library backups (Settings > General > Practice, on every device with practice mode; off unless you turn it on), and kept takes only if you also turn on Also include kept takes; training examples and the data of songs waiting to be deleted never are. A library backup is a file you save yourself, and restoring it puts them back on the device you restore it to. These switches belong to the device they are set on: restoring a library backup does not change them.
• Copies of kept takes: in a version of the app that offers it, after a take you keep is saved in the app's own storage, the app also tries to copy its sound files and details (above, including the input's name and device details) to a folder for takes in your library folder (Section 3.2; the app calls it your sync folder), or to another folder you choose in Settings > Library & data. If you use no library folder and choose no other folder, nothing is copied. Copying does not remove the take from the app's own storage. Takes kept with an earlier version, score records, the practice log, training examples and recovery copies of recordings you have not saved are not copied. Files in that folder are not in Setliner's private storage: other apps, and people who can open the folder, including anyone you share it with, can open them. Setliner does not send them to us unless you send them yourself. If the folder is synced, your sync service uploads them to its servers and your other devices under its own terms. A take can hold other people's voices, so before you keep takes in a synced or shared folder, get the agreement of the people heard on them where the law requires it, or choose a folder that does not sync or that only you can open. That folder is backed up as you have set it up; the backup switches above cover only the app's own storage. When you delete a take in Setliner, it tries to delete its copy too, unless the copy has changed. Otherwise, and when you choose another folder, delete its song, reset practice data or uninstall Setliner, copies may stay in the folder until you delete them, and a sync service may keep a copy in its trash or version history, as may your other devices.
• Reset practice data, in Settings > General > Practice, deletes from this device whichever you choose of: the practice log, chord change results from earlier versions, score history for every song, kept takes with their sound, the goals set in Practice, and saved training examples, including those of songs waiting to be deleted. It does not touch your songs or the timings saved in them, and it cannot reach a copy already in a backup, and may not delete copies of kept takes (below). In a version of the app that offers goals that follow you, deleting the goals set in Practice also deletes them, for the account you are signed in with (and the Settings profile this device uses while signed out), on your other devices as each next reads the library folder, leaving the small record of which goal was cleared, and deleting the practice log also empties this device's practice minutes there, for the account or profile it uses now and for the first ones it used goals with. While you are signed out, only the profile's goals are deleted. Copies in your sync service's history stay until it replaces them.
• When you delete a song, its score history and kept takes are not deleted straight away. They move to a holding folder in the app's own storage (~/.setliner/practice/deleted on a computer), so that Undo, or Restore under Recently deleted in Settings, brings them back with the song. On a computer that works only until you close Setliner: when it closes, they are deleted for good, and if Setliner did not close normally, they are deleted the next time it starts. A phone or tablet may keep Setliner open in the background for days, so there they stay in the holding folder until Setliner next starts after the system has closed it, and are deleted for good then. A song deleted on another device, or outside Setliner, keeps its practice data on this device until you reset it. Copies of a deleted song's kept takes may stay in their folder until you delete them (below). The minutes you practised that song stay in the practice log, and any of its chord change results from earlier versions stay too, until you reset them.
• Save training examples, in a run's review, does something only when you press it. Each press writes a new file in the practice folder on this device with the runs and takes you corrected, in every song: the song's identifier, when you played, the tempo, the chords the song asked for, what the app heard, your corrections, the input and device details each take recorded (an input's name can include a name you gave it, such as your own), and where each take's sound files are on this device, but not the sound itself. Setliner never uploads the file or puts it in a library or phone and tablet backup (a backup of a computer's home folder includes it), and Reset practice data deletes it. On a phone or tablet the file stays inside the app. A training-examples file or a take's sound that you email us is support material like any other attachment (Section 3.4): we use it only to look into what you reported, and never add it to a test set or use it to tune or train anything. A take can include other people in the room, so do not email us one in which others can be heard unless they agree.
• On a computer, a timing you save, including one made from a kept take, and a chord shape you accept are saved in the song itself, like the rest of your library (Section 3.10): which beat each chord starts on, the tempo, when the timing was saved and the shape, never any sound.
• On a computer, the progress report (Share progress) is made only when you ask for it, as a PDF you save or text you copy. It holds your practice minutes and results, never any sound, and it goes to someone else only if you send it yourself.
• Practice mode and Record chords send nothing over the network on their own, although a sync service uploads copies of kept takes in a synced folder (above), and nothing they hear or keep on your device is used to train any AI model (Section 4).

3.13 Audience requests

In a version of the app that offers it, Audience requests lets you, while signed in to your Setliner account, open a request list for a performance: people in the audience scan a QR code or open a link to a page on setliner.com, see the songs you chose, and tap one to ask for it. Nothing in this section happens until you start a list.

• What the app sends us: the title and artist of each song you choose to offer, and nothing else from your library (never chart text, notes, keys or files); how many requests one browser may send; how long the list stays open, at most 12 hours; and your sign-in, so our request service knows which account the list belongs to. It sends no venue, place or location, though like any connection to us, our server log records the IP address the app connects from (Section 13). Our request service keeps the list, the account it belongs to and its end time, and for each request only which song was asked for and when.
• Changing songs: in a version of the app that offers it, you can change the songs on a list while it is open. The app sends us the whole new list in the same way, titles and artists only; the link, the end time and how many requests one browser may send stay the same, and the page shows the new list the next time it is opened or reloaded. A song you add can be asked for like the others. A song you take off can no longer be asked for: a page opened before the change does not send it if someone taps it, and that tap is not counted. If anyone had already asked for it, our request service keeps it, hidden from the page, with its requests, and treats it like the other songs when the list ends, so that its count still reaches you (Ending, below); otherwise it deletes it at once. Our request service keeps the order of the latest list you sent, for the page, and a running number so that a song's number on the list is never reused. It keeps no times and no copies of earlier lists, apart from songs kept as above and the account counters below; like every request to our website, each change is recorded in the server log (Section 13).
• What you see: while the list is open in the app, the app regularly (at present about every 15 seconds) asks our request service which songs have been asked for, how many times and when last. You see nothing about who asked. The list's link and end time, a copy of the songs you sent, and what you mark as played, dismissed or hidden stay in the app's own storage on your device (on iPhone and iPad, outside backups) and are cleared when the app finds the list has ended, apart from the request history below; your marks are never sent to us or shown to the audience. You can share the list's link and QR code through your device's share sheet; it goes only where you send it.
• Request history: so you can look back after the performance, the app keeps, for each list, the day it started, the set you started it from, if any, and how many times each song was asked for, from the final counts the app collects from our request service after the list ends (below). It keeps no times, no link code and nothing about who asked, and it stores no venue or place. The history is part of your library, kept in your library folder, so it syncs and is backed up wherever you keep your library (Section 3.10), including, on iPhone and iPad, in your device's backups. It is never sent to us unless you attach it to a support email (Section 3.4), and our request service still deletes the list as described under Ending. It stays until you delete it: you can delete one list's history, or all of it, in the app. Deleting it removes it from your library folder; copies already in a library backup, your device or computer backups, or your cloud provider's version history stay until those are replaced. Deleting your Setliner account does not delete it, because we do not have it.
• The request page: anyone with the link or the QR code can open it, without an account or the app, and it asks for nothing about the person using it: no name, no message, no sign-in and no payment. Its search box filters the list on the phone and sends nothing. Tapping a song sends us which song it was and a random code that the page makes and keeps in that browser's local storage, which works like a cookie (we set no cookie for it): the same code for every request page opened in that browser until its site data is cleared, so that we can apply the limit you set for each browser. The page is shown in a language the browser asks for, where we offer it, and loads nothing from any other site.
• What we do not keep: our request service never stores the IP address of anyone who opens the page or sends a request, or the random code. To limit how often one browser or one network can open the page or send, it keeps counters labelled only with a scrambled form of them (a keyed one-way hash), and deletes each counter within two days. To limit how often an account uses the request service, it also keeps counters labelled only with a scrambled form of the account in the same way, each deleted within two days of its last use, including after the account is deleted. Like every request to our website, opening the page and sending a request are recorded in the server log described in Section 13, with the IP address, the time, the page address (which holds the list's link code, never a song) and the browser type, kept by our host under its own retention policy. Our request service records which song was asked for and when, never who asked. Once the list ends we keep no request times, but while that log exists, a list with few senders could still be matched to who asked.
• Ending: when you end the list in the app, or its end time passes, the page says the list is closed and our request service, within an hour, deletes each request and its time and the list's link code, keeping under a new random identifier only its songs, the account it belongs to and how many times each song was asked for. When the app, on any device signed in to your account, has collected those final counts, they are deleted; if it has not, they are deleted at the latest 30 days after the list ended. A copy in our host's routine backups ages out as Section 9 describes. If you choose to delete the list's history instead, the app tells us to delete the counts.
• Weekly totals: our request service adds one to a weekly count of lists opened when a list starts, and one to a weekly count of requests sent when it accepts a request. These two numbers name no list, song, account or person, are kept for about 25 months, and are not deleted with a list or an account, because they hold no record of either (Section 9, Statistics totals).
• Starting a list needs a Setliner account, so it is offered only where accounts are (Section 8) and only to people 13 and older (Section 12). If a request page shows something it should not, email its address to support@setliner.com.

3.14 Planning Center import

In a version of the app that offers it, you can import a service plan from Planning Center, a church planning service run by another company, into a set. Nothing in this section happens until you choose Import from Planning Center, or Sign in to Planning Center in Settings; after that, the app connects to Planning Center only when you import, open a set you imported (below) or disconnect, never in the background.

• Signing in: the app opens Planning Center's own sign-in page, in your browser on a computer or an Android device and in the system's sign-in sheet on an iPhone or iPad, and you sign in there with your own Planning Center account; Setliner never sees your Planning Center password. Planning Center then gives the app a sign-in for that one church. On Android it is kept in the app's own storage, sealed by the Android Keystore, which device backups and transfers leave out; on an iPhone or iPad in the Keychain, for that device only, so it is never restored to another device; on a computer in a file in Setliner's own folder (~/.setliner), sealed by the operating system's key store (Windows data protection, the Keychain on a Mac, the Secret Service on Linux), which a backup of your home folder may include, still sealed. It is never in your library folder. On a device where the app cannot use a key store, the sign-in lasts only until you close Setliner, and the app says so. The sign-in lets the app read Planning Center's Services product only: it never asks for the church's People directory and never changes anything in Planning Center.
• What the app reads, directly from Planning Center to your device: the church's name and identifier; the plans you are scheduled for and, if you look further, the service types and upcoming plans you can see; and, for the plan you pick, its title, series title and date, its items with their titles, notes and descriptions, and those songs' titles, authors, copyright text, CCLI song numbers, arrangements, keys and chord charts. To list the plans you are scheduled for, it reads which Planning Center person you are and your own schedule, and keeps them only in memory. It never reads other people's profiles, team lists or contact details, but the plan's titles, notes and descriptions can mention people. Planning Center receives these requests from your device, with its IP address and the app's name and version.
• What it keeps: the set and the songs you choose to import, saved in your library folder like your other songs and sets, so they sync and are backed up wherever you keep your library (Section 3.10), and so a sync service may keep earlier versions of them; item notes and descriptions only from the categories you tick before importing (none unless you do); non-song items as pages with their titles only if you choose; and the plan title in the set's notes, not its name, unless you add it to the name yourself (a set's name reaches our team service if you attach the set to a Team event, Section 3.8). Each imported song records in its chart that it came from Planning Center, with the church's name and the date, and keeps the copyright and CCLI lines it came with. For each import, a small file in the library folder records which Planning Center church, plan and songs it used, by identifier, with the church's name, the dates, the songs' copyright text and CCLI song numbers, and a scrambled check value (a salted one-way hash) of each line of Planning Center text it put in the set, so that those lines can be found again; it holds none of that text and no one's personal details.
• Notes when you lose access: item notes can contain personal details about people at your church. While a set holds item notes, descriptions, page titles or the plan title from Planning Center, opening it on a device signed in to that church lets the app ask Planning Center, at most every few hours, whether you can still see that plan. The app removes those lines from the set when Planning Center answers that you can no longer see the plan or that it no longer exists, or refuses the device's sign-in for that church; when you disconnect from that church or use Remove all for it; and, on any device, when you open the set after 90 days in which no device confirmed that you can still see the plan, which covers a sign-in that has lapsed or a device that never signed in. It keeps the songs, keys and order, and any line you wrote or changed yourself. A connection problem or any other answer removes nothing by itself. Copies already in a backup, or earlier versions your sync service keeps, are not reached. If you restore a library backup made before item notes were removed, Setliner leaves them out when the library shows they were removed, and otherwise checks again the next time you open the set.
• Disconnect, in Settings, deletes the sign-in from the device and asks Planning Center to end it (if Planning Center does not confirm, it ends on its own within 90 days), and removes the notes as above. Songs you imported stay until you remove them; Remove all, under Imported from that church in the Library, removes the songs an import added and keeps songs you already had. Uninstalling the app does not end the sign-in at Planning Center, and on an iPhone or iPad the Keychain may keep it, so disconnect first.
• Charts in Planning Center may be copies made under your church's licences, such as CCLI's, which are for the church's services and activities; as for anything you import, having the rights to them is your responsibility, and if you leave the church or its licence ends, remove them as above.
• None of this is sent to us, except a set's name if you attach the set to a Team event (Section 3.8), the plan's date if you create a Team event from the imported plan, and the titles and artists you choose to put on an audience request list (Section 3.13), as for any set or song. Planning Center's own privacy policy and terms cover its side. Planning Center is a trademark of Ministry Centered Technologies, Inc.; Setliner is not affiliated with or endorsed by it.

4. What we do not do, and will not start doing quietly

Independent of any feature we add later, we commit to the following:

1. We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California and other US state privacy laws.
2. We do not serve ads in the Software and do not embed advertising or tracking SDKs.
3. We do not use your Content, your practice data or anything you send us to train AI models, and we never give your Content to anyone else to train theirs. See Section 6.2.
4. We will not read the substance of your songs, setlists, or annotations, other than material you deliberately send us for support (Section 3.4). Teams stores membership and scheduling information, never charts (Section 3.8); apart from that support exception, the only way we could read your songs would be through a Setliner-operated cloud sync service, which does not exist (Section 6.1), and even then only in the narrow circumstances listed there.
5. We will tell you about any new collection. If a future version introduces any data collection, we will update this policy, raise the version number and say at the top what changed, and, when an app update includes it, the app will show you that summary. The change takes effect when that version is published (see Section 14).

5. Legal basis for processing (EEA/UK users)

We rely on: contract, to provide the account, trial, entitlement, team, audience request list or update you have asked for; legitimate interests, to keep those services secure, to prevent fraud and to enforce the limits of what you bought, and, for any visitor in the EEA or the UK whom the exclusion in Section 13 misses, to count website visits in aggregate and to record the campaign label on a website purchase (Section 3.7), balanced against your rights, and you can object to both at any time by turning on Global Privacy Control in your browser, which stops them for that browser for future visits; legitimate interests, to look up the country of a website visitor's IP address at the moment of the visit, keeping only the country and never storing the address in our visit counts, so that we can count visits by country and leave out visitors our server places in the EEA or the UK (Section 13): you can object at any time by turning on Global Privacy Control in your browser, which stops the lookup and the count for that browser; because we keep nothing that tells one visitor's visits apart from another's, that signal is how an objection takes effect, and you can write to support@setliner.com to object or to ask for help turning it on; legitimate interests, for anyone who opens a request page, wherever they are, to pass the request they send to the performer and to limit how often one browser or network can open the page or send (Section 3.13): Global Privacy Control does not change this, and you can object by not using the page or by writing to support@setliner.com; legitimate interests, to keep the statistics totals in Section 9, which name no one, so that we can see how Setliner is used and plan our work: you can object by writing to support@setliner.com from your account's email address, and we will leave your account's trials, purchases and audience request lists out of the totals from then on; update checks are not tied to any account, so to keep yours out, turn automatic checks off (Section 3.9); consent, for anything optional, such as a debug log you choose to send us, marketing email you opt in to, or the push token of team notifications on an iPhone or iPad (withdrawn by turning notifications off in the team screen), which you can withdraw at any time; and legal obligation, to keep tax and transaction records. Where a team's name or your role in it reveals something about your religious or other beliefs, the team's owner, whether an organization or a person, is the controller of that fact and is responsible for meeting whatever condition the law requires before entering it; we process it only as the team's processor and only to run the team (Section 3.8).

The connections described in Sections 3.1 to 3.3 are made by you, from your device, to parties you choose, and involve no processing by us. What you send us under Sections 3.4 and 3.5, we process to answer you.

6. Services we do not offer [NOT YET ACTIVE]

The following are not offered in the current version and are not planned for the near future. They are described here so that the commitments in Section 4 are on record before any of them exists. Nothing in this section is active.

6.1 Setliner-operated cloud sync [NOT YET ACTIVE]

A future sync service operated by Setliner, LLC would store copies of the song files, setlists, and annotations you choose to sync. This is separate from existing local linked sessions and folders synced by a third-party provider you choose.

We would treat that content as yours and private. We would access its substance only where reasonably necessary to: provide support you have specifically asked for; investigate a suspected violation of our terms or a copyright complaint; maintain the security of the service; or comply with a legally binding order. Where the law permits and it is practical, we would tell you before disclosing your content in response to a legal request.

Synced content would be encrypted at rest and in transit using keys we control, not end-to-end encryption — which means we would be technically able to access it under the circumstances described in the paragraph above (support you have specifically asked for, investigating a suspected violation, maintaining security, or complying with a legally binding order), and nowhere else.

6.2 AI features [NOT YET ACTIVE]

If we add AI features, the text you submit to them would be sent to a third-party AI provider to generate a response.

We would not use the content you submit to AI features, your prompts, or the results to train, fine-tune, or develop any machine learning model, ours or anyone else's — and we would not engage an AI provider unless it contractually commits not to train on what we send it. More broadly, we train no model on your content, on your practice data or on anything you send us, and we never give your content to anyone else to train their models. This matches Section 9.5 of the End User License Agreement, and it is a commitment we are making because our users routinely handle licensed material they may not be permitted to feed into a training corpus.

AI features would be opt-in. Nothing is sent anywhere unless you invoke one.

6.3 Crash reports [NOT YET ACTIVE]

If we add crash reporting, it would be opt-in, and we would say plainly what a report contains — typically a stack trace, the app version, and the operating system version. We would configure it not to transmit file contents or file paths that might include song titles. Until then, the only diagnostic that reaches us is a debug log you save and send yourself (Section 3.5).

7. Who we share data with

We share personal information only with the providers that run the services in Section 3. We share it only with the providers below and in the ways the rest of this section describes, and we update this policy before adding to them:

• Polar Software, Inc., Dover, Delaware, United States: merchant of record and payment for website purchases (Section 3.7). Polar runs the checkout as an independent controller under its own policy, and uses Stripe, Inc. to process cards.
• Apple Inc., Cupertino, California, United States: seller and payment for purchases made in the iPhone and iPad app (Section 3.7). Apple sells them as an independent controller under its own terms and privacy policy. Apart from team notifications (below), what passes between Apple and us is limited to those purchases: the receipt Apple signed for each one, which the app sends us; Apple's notice to our server when it refunds or revokes one; and, when you restore purchases, our server may ask Apple for the other purchases made with the same Apple account, sending it only the transaction identifier from one of your receipts. We never send Apple your email address or anything else from your Setliner account. If you turn on team notifications on an iPhone or iPad, in a version of the app that offers it, we also send Apple Push Notification service that device's push token and a fixed message ("Your team schedule changed"), which Apple delivers to the device as our service provider for push delivery, bound by the Apple Developer Program terms (Section 3.8). Apple learns that a notification was sent to that device and when, which shows that something changed for that device's user, but no content from the team's records. No other company, Google included, is involved in team notifications.
• Hostinger: hosting for our website and for the licensing, team, audience-request and update services, and the mail service that delivers our verification and account messages and receives email sent to support@setliner.com. Hostinger acts on our instructions as a processor.

Email you send to support@setliner.com is received on Hostinger's mail service and forwarded to a personal email account of ours with a consumer email provider, where we read it. That provider stores and processes it to run its service, including spam and security filtering, under its own terms. We do not sell your message or pass it to anyone other than the mail providers described here, and we keep and delete it there as Section 3.4 says. On its way to us, email passes through systems that neither you nor we control, starting with your own email provider, under their own terms. What you send to linked devices, a cloud storage provider or Microsoft under Sections 3.1 to 3.3, including copies of kept takes in a synced folder (Section 3.12, copies of kept takes), goes from your device to them directly, and we are not a party to it. Within a team, the information in Section 3.8 is visible to that team's other members because you or the team's owner chose to share it with them, and an invitation you send shows the invitee your name and the team's name. The songs on an audience request list are visible to anyone with its link, and the performer sees how many times each was asked for, never who asked (Section 3.13).

We may also disclose information: to comply with a law, subpoena, or court order; to enforce our terms or protect the rights, safety, or property of any person; or to a successor entity in a merger, acquisition, or sale of assets, in which case we would give notice and this policy would continue to apply to information transferred until the successor provides its own.

8. International transfers

Our services are hosted in the United States, so if you are outside it your personal information is transferred there. We have not put transfer clauses in place, because we do not offer the services that would need them in the EEA or UK. Where a disclosure to us, or by us, would be a restricted transfer under the data-protection law that applies to it, we will establish the safeguards that law requires before it occurs (for the EEA the European Commission's Standard Contractual Clauses, for the UK those clauses with the UK International Data Transfer Addendum, each with any supplementary measures required) or we will not make that disclosure. Not every contact with us is such a transfer: a support email you send, a visit to our website or a desktop update check is handled under Sections 3 and 13, and whether the EU or UK GDPR applies to it depends on the processing, not only on where you live. Ask us at support@setliner.com and we will tell you what applies to your case.

Accounts, trials, purchases and Teams are currently offered only outside the European Economic Area, the United Kingdom and the Canadian province of Québec, and we do not market those services there. When you ask for a sign-in code, the app asks which country you are in and, in a version of the app that asks it, if you choose Canada, whether you live in Québec (Section 3.6); if your answer is a country in the EEA or the UK, or Québec, we send no code, even for an email address that already has an account. What is already activated on your devices keeps working; write to support@setliner.com about anything you bought. The answers are your own, and we do not check them. Our website checkout asks buyers of some items to confirm that they are not in the EEA, the UK or Québec, Canada, and our server checks the billing country of every website order Polar reports to us: an order billed to a country in the EEA or the UK grants no license, any it had already granted ends, and we refund it in full, and so does an order placed on or after the effective date of version 1.38 of this policy and billed to an address in Québec, which our server tells from the billing province Polar reports. An order with nothing to pay, such as one made with a full-discount code, usually carries no billing country, so for it the confirmation at checkout and the questions at sign-in are the only checks, and so are the questions at sign-in for an order billed to Canada that carries no province. Purchases and trials in the iPhone and iPad app are not offered in the App Store in the EEA or the UK. The App Store cannot leave out a single province, so in a version of the app that asks it, when the app can tell that your App Store country is Canada, it asks whether you live in Québec before a purchase or a free trial and does not offer them if you answer Yes. That answer stays on your device until the app is closed, is not saved, and the app does not send it to us; as at sign-in, it is your own and we do not check it. Restoring a purchase you already made is not affected. Starting an audience request list needs an account, so it is offered only outside them too; a request page can be opened from anywhere, and asks for nothing about the person using it (Section 3.13). For that reason we have not appointed an EU or UK representative under Article 27 of the GDPR. The free app can be used anywhere: on its own it involves none of those services, and the desktop update check (Section 3.9) can be turned off. If, despite those checks, we find an account, trial or team being used from the EEA or UK, for example because a US organization invites a member who lives there, we will tell the people affected and either establish the safeguards described in the previous paragraph before continuing or end that service for them and delete what the service holds about them. If we open those services to the EEA or UK, we will appoint a representative and name them in this section first.

9. Retention

Your library never reaches us, apart from material you deliberately send us for support (Section 3.4), so there is nothing else of it for us to retain. The periods below are for our active systems; copies in our routine backups age out within 60 days after that, and copies in our host's own backups on its schedule, except support mail, whose copies held by our email providers are removed on their schedules (see below). We keep something beyond these periods only where the law requires it, or where a specific claim, investigation or abuse case is already open when the deletion falls due, in which case we keep only what that case needs and delete it when the case ends.

• Account information (your email address, the country you declared, the entitlements attached to it and when each trial started) is kept while any entitlement or trial attached to it is active and for 12 months after the last one ends, so a lapsed purchase can be restored. It is also kept while you belong to a team or have a request to join one waiting. Once you are in no team, the 12 months are counted from when your last entitlement or trial ended, not from when you left. An account that never held a licence or trial is kept for 12 months after you last signed in to it, then deleted; signing in again starts the 12 months over. Either way, your team account is deleted with it. You can ask us to delete your account sooner and we will. Deleting the account erases its verification state and its device activations and ends its current team memberships, and it cannot be undone; records a team keeps about a former member stay with that team as the team bullet below describes, and restoring a licence later does not restore team access. Deleting the account does not revoke a licence you bought: we keep one licence-restoration record, made of the email address you verified, the entitlements attached to it and the purchase transaction identifier, for as long as any of those entitlements exists, and we use it for nothing except restoring the licence when that address is verified again. If you ask us to erase that record too, we will tell you that the licence can then never be restored, and erase it once you confirm.
• A device activation record is the random identifier the app generates for that device, when it was activated, and which licence it holds. Releasing a device marks the record released rather than erasing it, because that record is how the trial limits in Section 5.9 of the End User License Agreement are applied. Deleting your account erases those records, and keeps in their place only the fact that a trial of a feature has been used on a device: a device identifier and a feature name, with no email address and no account identifier attached to either. That last record has no end date, because outlasting the account is the whole of what it is for. A device's name and kind are kept only while that device holds an active licence or trial on your account: they are deleted when its last one is released, including by support, and when you delete your account.
• Team data, including its join requests, its audit trail of who changed what and when, and the history described in Section 3.8, is kept while the team exists and deleted within 30 days of the team being deleted. A declined, withdrawn or unanswered join request is deleted 30 days after it was made. A member who leaves or is removed is taken off the roster, their seat is returned and their grants are cancelled at once; their cancelled assignments stay in the team's history for the life of the team, visible only to its owners, administrators and planners, with the name replaced by a placeholder on request. Unavailable dates are deleted 30 days after their last day, or sooner as Section 3.8 says, an event's place goes when it is cleared or the event is removed, and a checklist item when it is removed or its event is. The list of changes kept for team notifications is deleted after 30 days, or sooner as Section 3.8 says. Push tokens are deleted as Section 3.8 says, and at the latest 90 days after the app last confirmed them.
• Verification codes expire within 24 hours and are stored only as hashes until then. A team's join code is stored only as a hash and lasts until the owner or an administrator replaces it.
• Audience requests (Section 3.13): a list ends when you end it or its end time passes, at most 12 hours after you start it; its requests are then deleted, and the list, its songs and how many times each was asked for are deleted when your app has collected those counts, and in any case 30 days after the list ended. Deleting your account deletes them, and closes any list still open, within an hour. The counters that limit sending, and those that limit how often an account uses the request service, are deleted within two days. The request history the app keeps in your library is yours and is not held by us; it stays until you delete it. The weekly totals of lists opened and requests sent hold no record of any one list, song or person, are kept for about 25 months and are not tied to any account (Statistics totals, below).
• Update-server and website request logs, including those of request pages, are kept by our host under its own retention policy, and we never use them to identify or contact anyone.
• Website visit totals (Section 13) are deleted after about 25 months; they hold no record of any one visit. Our visit counter does not keep the IP address it looks a visit's country up from: it uses it at the moment of the visit and then discards it. Like every request, the visit is still recorded, with its address, in our host's server log (Section 13), which we never use to look up a country; for a counted visit, the hourly scrambled form described in Section 13 is also kept until the next hour.
• Statistics totals are counts by day or by week, kept from the day version 1.33 of this policy was published: update checks and the networks they came from (Section 3.9); trials started, trials that led to a purchase, purchases and refunds (Sections 3.6 and 3.7); and audience request lists opened and requests sent (Section 3.13). Each count goes up when the thing happens, and only the number is kept. They hold no record of any one person, device, account, list or song, so erasing a record or deleting your account does not change a count already made. Our private reports show any total below 5 as fewer than 5. They are deleted after about 25 months.
• Transaction records (what was bought, when, for how much, under which email address) are kept for as long as tax and accounting law requires, typically seven years, and are not affected by deleting an account. For a purchase in the iPhone and iPad app, Apple keeps those records; the transaction identifier and item we keep from Apple's receipt are kept like a Polar purchase record, as part of your account and its licence-restoration record above.
• Support correspondence and anything attached to it, including a debug log, is kept for as long as we need it to help you and for our own records (to handle a follow-up, show what we told you, or meet a legal or tax duty), and no longer than 10 years; we delete it sooner if you ask us at support@setliner.com (Section 3.4). We delete it by hand, from both the Hostinger mailbox and the account it is forwarded to. After that, copies in our email providers' deleted-items folders and backups are removed on those providers' own schedules, which we do not control.
• The app keeps a local record of which version of these terms you accepted and when; the text of every version is at https://setliner.com/privacy/archive, so the two together show what you accepted.

10. Security

The security of your library depends on your devices, any cloud provider you choose, and the people with whom you share files or linked sessions. Linked sessions use encrypted connections and invitation-based approval. Share invitations only with intended participants. We encourage full-disk encryption and regular backups, as for other important files.

For the services we operate, we use industry-standard measures including encryption in transit (TLS), encryption at rest, and access controls limiting staff access to what is necessary. We do not store passwords, because we do not ask for one. Entitlements are signed so the app can verify them without contacting us. No system is perfectly secure, and we cannot guarantee absolute security. We will notify you and any relevant regulator of a personal data breach as required by applicable law, without undue delay.

11. Your rights

11.1 Everyone

Most of what Setliner handles never reaches us. Your library, setlists, annotations, play history, audience request history, venues, tip log, the checklists on your sets and copies of kept takes stay on your devices and in folders you control, so the way to access, export or delete them is to open, copy or delete the files; the app exports songs in the formats it supports at any time.

For the personal information we do hold (Sections 3.4 to 3.9 and 3.13), you can see and change your email address and activated devices from the app's Licensing screen or our website, leave a team from within the team, and exercise every right below by contacting support@setliner.com. We verify a request by asking you to confirm it from the email address on your account, or by other reasonable means if you have none. We will respond within the period required by law (generally 45 days under US state laws, one month under GDPR), and we will not discriminate against you for exercising them. If we refuse a request, we will say why, and you may appeal by replying to that answer; we will decide the appeal within the period the applicable law allows and tell you how to complain to your regulator if you are still unsatisfied.

11.2 EEA and UK (GDPR)

You have the right to access your personal data; to rectify inaccurate data; to erasure; to restrict or object to processing, including profiling; to data portability; and to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local supervisory authority.

11.3 California (CCPA/CPRA)

California residents have the right to know what personal information is collected, used, disclosed, or sold; to delete it; to correct it; to opt out of sale or sharing; to limit the use of sensitive personal information; and to non-discrimination.

We do not sell or share personal information, and we have not done so in the preceding twelve months. We do not ask for sensitive personal information; the days you mark unavailable, with any note and time, are used only to keep you off the schedule on those days and to show your team's owner, administrators and planners, never to infer anything about you; if a team's name or your role in it reveals something about you, such as membership of a church's worship team, that is information you or your team's owner chose to enter, and we use it only to run that team (Section 3.8). We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. The categories of personal information we collect, as defined by Cal. Civ. Code § 1798.140(v), are: identifiers (email address, the app's random device identifier, the push token of an iPhone or iPad on which you turned on team notifications, the IP address on licensing, team, request-service, update and website requests, and the random code a request page sends, which we do not store); commercial information (records of purchases and entitlements, including when a trial started or a website order reached us, and the campaign label a Buy link passed with a website purchase, Section 3.7); internet activity (the pages requested and the referring page, in the website server log in Section 13); geolocation data, at country level only (the country our server looks up from a website visit's IP address, kept only as a count in the visit totals, Section 13); the contents of support correspondence you send us, including any sound recording you attach (audio information); for team members, the display name, role and assignments entered by you or your team's owner, the days you marked unavailable, with their notes and times, the places of events, the 30-day list of changes concerning you and whether you asked to be told about answers; for a performer who uses Audience requests, the titles and artists of the songs on their request list (Section 3.13). We collect them for the purposes in Section 3, keep them for the periods in Section 9, and disclose them only to the providers in Section 7, to the other members of a team you join, to anyone with the link to a request page, for the songs on it, and where Section 7 says the law may require.

You may designate an authorized agent to make a request on your behalf.

11.4 Other US states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have broadly similar rights of access, correction, deletion, portability, and opt-out, and a right to appeal a refused request. Use the same contact address; tell us which state you are in.

12. Children's privacy

Setliner is a tool for musicians of any age, faith, or none.

Using the app without an account or an activated paid feature tells us nothing about who is using it, so a child can use Setliner that way on a device that a parent, guardian or organization manages. In that use the only thing the app sends on its own is the desktop update check (Section 3.9): a request that reveals the IP address it comes from and the version it downloads, carries no account or device identifier, is not linked by us to anyone, is logged by our host under its own retention policy, is counted in daily totals that keep no address (Section 3.9), and can be turned off. What a linked-device session shares (Section 3.1) goes only to the people in that session. A request page (Section 3.13) asks for nothing about the person using it, so anyone in an audience can use it; it keeps only a random code in that browser. That code and the network address a request comes from are used only to limit how many requests one browser or network can send and to keep the service secure; they are never stored as they are (only as a keyed one-way hash), never combined with anything else about the person, and never used to contact anyone, build a profile or show advertising. Each request is also in the server log described in Section 13.

Accounts, trials and purchases outside the App Store, teams, and starting an audience request list are different, because they send us an email address or need an account, so they have age rules, and they are the same rules the End User License Agreement sets:

• Under 13. We do not knowingly collect personal information from a child under 13. Accounts are for people 13 and older; signing in confirms you are. If we learn an account belongs to a child under 13, we delete it. When we delete an account for that reason, we also erase its licence-restoration record. A younger player uses the app without an account, on a device an adult manages; that adult's own account stays their own, because accounts may not be shared (End User License Agreement, Section 7.3), and the child needs none.
• 13 to 17. You must be at least 13 to have an account, start a trial other than one from the App Store, or join a team, and at least 18, or the age of majority where you live, to create or own a team. A younger person's purchase needs a parent's approval, such as Apple's Ask to Buy. Between 13 and the age of digital consent where you live (16 in several EU member states), you need a parent's or guardian's permission to hold an account, join a team or start a trial. A group leader is not a substitute for a parent or guardian.
• If we learn we have collected information from a child in a way that did not comply with these rules, we will delete it promptly. Parents and guardians can contact support@setliner.com to review, delete, or refuse further collection of their child's information.

The list in Section 3.8 is kept for every assigned member, including members 13 to 17, and so are the unavailable dates they mark, which only they and the people who schedule the team see (if they turn on automatic away dates, those people can see the days they are on an event in another team, as Section 3.8 says); an event's place is seen by members 13 to 17 who can see the event, so owners should never enter a member's home address as a place; notifications to a device are off until its user turns them on, and carry no advertising or marketing.

13. Our website and cookies

Our website at https://setliner.com is hosted by Hostinger and, apart from request pages (Section 3.13), which our request service builds, is a static site. Like any web server, it records the IP address, the address requested (including any query string), the referring page, the time and the browser type of each request in a server log, which our host keeps under its own retention policy. We use it for security, to count downloads and to count desktop update checks as daily totals (Section 3.9), and never to identify or contact visitors. We count how many times each installer is downloaded. We keep only the totals for each file, never who downloaded it; to stop one network inflating a count we keep a scrambled form of its address, which is replaced each hour and deleted at the next request after that. We set no cookie of our own: there is no website sign-in to keep you signed in to. A request page (Section 3.13) keeps one random code in your browser's local storage, which works like a cookie, used only to apply the limit on requests from one browser, until you clear the site's data. Checkout is provided by Polar, which sets the cookies its checkout and customer portal need under its own policy.

We also count visits, to learn which ads and links bring people to the site. We set the site not to count visitors in the European Economic Area or the United Kingdom: if your device is set to a European time zone (any Europe/ zone, which also covers countries outside the EEA, and the EEA's time zones elsewhere), or reports no time zone or one that names no place, such as UTC, the page does none of what this paragraph describes. To decide this the page reads your device's time zone, which it never sends or keeps. Our server then makes a second check. We look up the country from your IP address at the moment of your visit and keep only the country: our visit counter never stores the IP address. When the page's message arrives, our server looks up the country of the address it came from, in a free country database from DB-IP (IP Geolocation by DB-IP, https://db-ip.com) that we keep on our own server, so the address is not sent to anyone else for the lookup, and if that country is in the EEA or the UK, or a territory we count with them, it counts nothing from that message. As for every request, the message is still recorded, with its address, in the server log described above. Neither check is perfect: a visitor there whose device uses another time zone, and whose address the database places in another country or cannot place, may still be counted, with that other country or with the country recorded as unknown, and their Buy links are tagged as Section 3.7 describes, because the page adds those tags before our server sees the message. For other visitors, when a page loads, when you start a video and when you click a download or Buy button, the page tells our server which of these happened, on which page, and which download platform or product, together with one label saying where your visit came from, the name of the website that sent you (not the page; for an app, only if it is one of the named sources), your browser's language and a rough screen size. The label comes from the first of these that applies: the campaign tags in the link you arrived by; whether that link carried a click identifier added by an advertising platform such as Google or Meta, of which we note only which identifier it was, never its value (at present we read only Google's and Meta's); the website or app that sent you, sorted into a named source for the large sites and apps that commonly send visitors, such as YouTube, Facebook, Instagram, Google, Bing, Reddit, X or TikTok, while any other app is counted only as another app, without its name; or, when your browser does not say which site sent you, whether the page is open in an app's built-in browser, such as Facebook's, Instagram's or TikTok's, which is told from the description your browser sends of itself with every request (its user agent), keeping only the app's name. A visit with a click identifier is named after the site or app it came through when the referring site or the built-in browser shows it. The page works out the label in your browser; for some requests our server works it out from the website name and the user agent. A label says where a visit came from, not whether you clicked an ad: Facebook adds its click identifier to links in ordinary posts too, and a website or app can send you from a post, a search result or an ad alike, so our reports show these as what they are. Any other website is counted as another website, with its name only in a separate count. The server adds one to a daily total for that label or campaign and page, and, for that label or campaign and page, to separate daily totals for each of those details and for your country (as our server looks it up from your IP address, described above, or unknown when the database cannot place the address), the kind of device (phone, tablet or computer), and your operating system and browser, including whether it is an app's built-in browser, which it works out from what your browser reports and then discards. These counts keep no record of any one visit: each detail is counted on its own, never combined with another detail, and our reports hide any of these details counted fewer than 5 times in a day. We store no IP address or cookie for this. To stop one network inflating the totals, we keep a scrambled form of its address, replaced each hour, as for downloads. We keep the totals for about 25 months and then delete them. The page remembers the label or campaign tags, and the name of the website or named app that sent you, for the rest of your visit in your browser's session storage, which the browser normally clears when you close the tab. If your browser sends the Global Privacy Control signal, the page stores, sends and counts nothing, and adds no tags to Buy links, and our server does not look up its address. The server log described above still records every request, including the full address of the page requested, with any campaign tags and click identifier in it. Campaign names come from the link you followed: we name our own ads and links after the ad, never a person; any other name is kept only as a count, and anything that is not a short plain word is counted as other. We do not send these totals, or anything about your visit, to Meta, Google or any other advertiser, and we use no advertising pixel, conversion API or third-party analytics on the site. We do not try to work out who is behind any total, these or the statistics totals in Section 9, and we never use the server log, or anything else, to do so.

We don't use any of these to identify or follow individual visitors, and we don't run advertising pixels or marketing cookies on the site. Before we count anything more, or count visitors in the EEA or the UK, we will assess what consent the law that applies to you requires and update this section first. The Software itself does not use cookies.

14. Changes to this policy

We may update this policy. When we do, we post the new version on this page with its version number, its effective date and a summary of what changed at the top, and it takes effect when it is published here. When an app update includes a new version, the app shows you, once, what changed in each version since the one you last saw, with a link to the full policy. We email you about a change only if it lets us share your personal information with anyone new, keep it longer, or narrows one of your rights in Section 11, or to ask for the consent described below, and then only at the email address tied to your Setliner account, license or order. A change that would use information we already hold in a new way needs your consent: we will ask for it rather than assume it, and until you give it we will use that information only as the version in force when we collected it described. Previous versions are at https://setliner.com/privacy/archive.

Previous versions will remain available at https://setliner.com/privacy/archive so you can see what changed.

This policy is written in English. Where we show part of it in another language, that is a translation for convenience; if it differs from the English, the English text is this policy. The short version, including At a glance, summarizes the sections that follow; if they differ, those sections govern.

15. Contact

Questions, requests, or complaints:

support@setliner.com Setliner, LLC 12042 SE Sunnyside Rd, Unit #2160, Clackamas, OR 97015

If you are in the EEA or UK and are not satisfied with our response, you may complain to your local data protection authority. If you are in California, you may contact the California Privacy Protection Agency.

Setliner is a product of Setliner, LLC.