Privacy

Coro is a small project made by one person, Kevin Amado. It keeps only what it needs to sign you in, save your progress, and read your feedback. There are no ads, Coro sets no tracking cookies, and your data is never sold or shared with anyone for marketing.

Your progress (and a few settings) is saved in this browser only, in its local storage and IndexedDB. It never leaves your device, and Coro can't see it. Clearing this site's data in your browser erases it.

This browser also remembers which pages you rated (see Page ratings below), so it doesn't ask again. If you open one of my unlisted test pages for offline playback, the songs and videos it downloads from Coro are saved in this browser too, and only there.

Signing in goes through kamadorueda.com's sign-in service (auth.kamadorueda.com), which Coro shares with Picks (picks.utilarium.app). You sign in with Google, or with a code sent to your email address. From Google it asks only for your email address. Either way, it stores:

• your email address (plus a lowercased copy, to recognize you),
• if you use Google, Google's id for your Google account, so the same Google account always signs in to the same account here,
• which ways you've signed in (Google, an email code, or both) and when you first used each,
• a random id for your account, and when you signed up and last signed in.

It doesn't store your name, your profile photo, or anything else from Google. Each time you sign in, it also keeps a session (a random id tied to your account and email) for up to 30 days, and your browser keeps a matching session cookie on utilarium.app (and on kamadorueda.com when the sign-in goes through it) for the same time. While you sign in, a cookie on auth.kamadorueda.com remembers which page to bring you back to, for at most 10 minutes. With Google, another one guards against forged sign-ins for the same time.

To sign in by email, the service sends a 6-digit code to your address through Cloudflare's email service, and you type it in the same window. Until you use the code, and for at most 15 minutes, it keeps your address, the page to bring you back to, a scrambled (hashed) copy of the code and how many wrong codes were tried, and a cookie ties the code to your browser for the same time. It also counts, under a hashed copy of your address, how many codes were asked for it (for an hour) and how many wrong codes were tried for it (for two days), so nobody can flood an inbox or guess codes.

If you choose Google, you leave this site and sign in on Google's site, under Google's privacy policy.

Signed in, your progress is also saved on Coro's server, so it follows you to your other devices: how you rated each move, which demo videos you've watched, your rhythm and ear-training scores, the Knowledge lessons you've read and your quiz answers, the Song stories you've marked as read, the Notable songs you've marked as listened, and your settings (such as whether songs play on YouTube or Spotify). Some of these carry the time you did them, so two devices can agree on the latest. It's one record, stored under your random account id (not your email), along with when it last changed.

Messages sent from the Feedback page are emailed to me (through Cloudflare's email service, to a Gmail inbox) so I can read them. Coro's server doesn't keep a copy. As a guest, your email address is included only if you type it in. Signed in, your account's email address is attached to the message so I can reply. The email stays in my inbox until I delete it; ask, and I will.

Most pages end with a quick “Was this page helpful?” prompt. Tapping 👍 or 👎, and any note you add, is saved right away: the page, your choice, your note if you left one, when, and whether it came from the live site or my test copy. As a guest, that's anonymous: no IP address, account, or browser information is attached, just what you tapped. Signed in, it's linked to your account (by its random id, not your email) instead, and deleting your account (below) deletes it too.

An instructor can share a link or QR code to join a class. Opening it stores a random class pass in a cookie on this device, only to give access to that class. The cookie lasts one year. Coro stores only a scrambled (hashed) copy of the pass, and you don't need an account. If you are signed in, the classes you join are kept with your account (by its random id), so they follow you to your other devices.

Leaving a class, or the instructor making a new code for it, ends that pass: it no longer gives access to the class. Deleting your account deletes your class memberships and the courses you teach.

An instructor can upload class videos. They are stored on Coro's storage (Cloudflare R2), and only the instructor and the people in that class can watch them. The instructor can delete a video at any time, and when an instructor's account is deleted, so are the videos of the courses they teach.

Instructors have a song menu for their classes. It keeps the song files instructors upload and their notes about each song (such as its tempo, style and saved moments), on Coro's server (Cloudflare), with no student data. Only instructors can open it or get the files; a class link never gives access to them. When an instructor plays a song, a copy is saved on their device so it plays with no network; they can delete it there at any time.

Only me. I have a private admin page, on its own site and open to my account alone, that lists who has signed in and left something in Coro: each person's email address, when they signed up and last signed in, how they sign in, when their progress last synced and how big it is, and how many pages they rated and when they last did. It never shows what's in anyone's progress. The page ratings and their notes show there too, without saying whose they are (only whether the person was signed in). It also shows the usage counts and plays back the screen recordings described under Analytics.

Coro counts how it is used, on its own server. When you open a page, press play, finish a lesson or come back from signing in, it records that this happened, the type of page (not the address), a random number that exists only while the page is open, whether your device is a phone or a computer, and the name of your browser. That holds no account, IP address or cookie, and nothing is saved in your browser. Cloudflare keeps these counts for 90 days.

About one visit in ten is also recorded as a screen recording that I can play back: the layout of the page, where the pointer goes, and your clicks and scrolls. All text, everything you type, and all pictures and videos are hidden in it, so it does not show what you read or write. Recordings are deleted after 30 days. The privacy page is never recorded.

None of this is done when your browser sends Do Not Track or Global Privacy Control.

The sign-in service also counts sign-ins by method (Google or email code), with no email or account in the count.

To find and fix errors, Coro's server and the sign-in service keep short technical records of the requests they answer, in Cloudflare's Workers logs and traces: the address asked for (without anything after a “?”), when, the answer, how long it took, and any error. For about one in ten requests, to Coro's server and to the sign-in service alike, Cloudflare also records the browser and operating system, the preferred language, the network and an approximate location (country, region and city), which it works out from your connection. These records hold no IP address, email address, cookie or account, and Cloudflare deletes them after 7 days. Pages themselves are served without them.

When Coro breaks in your browser, it sends an error report (the error message, the type of page, your browser and the app version) with no account, IP address or personal data, kept with these error logs for 7 days.

Videos play in YouTube's standard embedded player, loaded from www.youtube.com (not YouTube's privacy-enhanced youtube-nocookie.com mode). Until you press play (or a video's Demo or Slower button), a page only shows the video's thumbnail, loaded from YouTube's image server (i.ytimg.com); the player itself loads from YouTube only once you press one of them. From then on YouTube (Google) may set its own cookies and collect data under Google's privacy policy, not this one.

If you turn on the Spotify player in Settings and choose to play songs on Spotify, a song's page shows a placeholder drawn by Coro instead, and nothing loads from Spotify until you press play. Only then does Spotify's embedded player load from Spotify (open.spotify.com). From then on Spotify may set its own cookies and collect data under Spotify's privacy policy, not this one, including whether you're logged in to Spotify in this browser (which is what lets it play the full song).

Coro, the sign-in service, and their databases run on Cloudflare (Workers, D1, KV, R2 and Analytics Engine). Like any web host, Cloudflare handles your IP address and your browser's requests to serve the site, under its own privacy policy; neither Coro nor the sign-in service saves your IP address. Feedback emails live in Gmail. The only exceptions are Google sign-in, YouTube and Spotify, described above. Nothing else is sent anywhere.

Export: there's no download button yet. Ask through the Feedback page and I'll send you a copy of everything stored for your account.

Delete: in Settings, “Reset all progress” erases your progress on this device and, signed in, on the server. Signed in, “Delete my account” also deletes your account: your synced progress, any page ratings linked to it, your class memberships and the classes you teach, your email and Google id (if any), and your sessions on every device, which signs you out everywhere. What's left afterwards is an emptied progress entry under your old random account id, which no longer belongs to anyone. You can reach it from the account menu (your initial, at the top of every page) under “Settings”.

It doesn't delete feedback you've emailed (ask me to). What my other apps keep for the same account is covered below.

Your sign-in is shared with my other apps that use Google sign-in (Picks, Drive, Sign and Media), so deleting your account here signs you out of them too. Each of them keeps its own data about you under the same random account id (Picks, for example, your marks and private notes), and deleting your account here doesn't erase that by itself. Instead, deleting it sends me a request automatically, and I erase what those apps keep for that account by hand, soon after. Until I do, it stays on their servers under your old account id, no longer linked to your email or to any account.

Every one of those apps has its own “Delete my account” button, which works the same way, so you can start from any of them (Picks' privacy policy explains it). Picks also has “Delete my data”, which erases only what Picks saved and keeps your account.

My admin page shows Picks too, still to me alone. For each person who saved something in Picks, it shows their email address and how they sign in, with how many companies they starred, own or passed on and how many notes they wrote, but never what their notes say or which companies they marked.

Use the Feedback button at the top of every page, or reach me through kamadorueda.com. If this policy changes, this page changes with it, and so does the date at the top.