YOUR SOUND STAYS WITH YOU

Privacy policy.

Just BPM: Live Tempo · CybrCoast LLC · Effective October 14, 2026

Your audio and practice history stay on your device. Free monitoring uses online device verification and a retained usage record. No Just BPM signup is required, but that does not mean no data is collected.

Who is responsible

CybrCoast LLC operates Just BPM and justbpm.com. For privacy questions, access or deletion requests, contact info@cybrcoast.com. This policy covers the app, website, trial service, and support communications.

Microphone audio and local practice data

With your microphone permission, Just BPM analyzes live audio on your device to estimate tempo and related musical information. Monitoring is foreground-only and stops when interrupted or backgrounded. We do not save audio recordings or upload microphone audio.

Settings, tempo history, session summaries, and searches of your local session library stay on your device; they are not sent to the trial service. You can delete sessions and export summary statistics as CSV. There is no Just BPM cloud backup or cross-device session sync. Your operating system may back up local app data. Copies you export are controlled by their destination.

Data used for the free allowance

Before free monitoring starts, the app asks you to allow the following verification for that app launch. Declining does not send a trial-verification request and leaves saved sessions, settings, and practice tools available.

• Installation and verification identifiers: a randomly generated installation identifier, platform, verification key identifiers or public keys, cryptographic attestations or assertions, security challenges, and verification counters. These authenticate requests and help detect modified apps and repeat claims.
• Free-monitoring usage: claimed eligibility, remaining allowance, and the start and expiry of short authorization windows. These enforce ten minutes total per eligible device across sessions, not a monthly or per-session allowance.
• Network and technical information: hosting providers receive IP addresses and request metadata when handling requests. Our application rate-limit records use a keyed cryptographic representation of network information rather than storing a raw IP address in the usage ledger.

The ledger is pseudonymous: it is associated with an installation or device-verification identity, not a Just BPM email address or login. It is not fully anonymous. Audio, musical tempo readings, saved practice history, advertising identifiers, contacts, precise location, IMEI, and phone numbers are not included in trial requests.

On iPhone and iPad, Apple DeviceCheck and App Attest verify the app and help record whether the device has claimed the offer. On supported Android releases, Google Play Integrity and device recall perform the corresponding checks. Apple or Google processes app and device information through these services. Provider eligibility markers may survive reinstalling; losing the installation identity may make unused time inaccessible.

Your choices and withdrawal

Free-verification permission lasts for the current app launch, not indefinitely. You can decline the disclosure, or select Setup → Pause free verification after allowing it. Pausing stops and saves active free monitoring and prevents new trial-verification requests until you explicitly allow them again. A request already sent may finish processing. This choice does not erase existing records, restore used time, or reset eligibility.

A verified paid unlock does not require consent to the free-verification service. Apple or Google still processes purchase verification and restoration. Microphone permission is separate and remains necessary for live audio analysis; revoke it in your device’s system settings. Android billing is not yet available to the public; the Android purchase checks described below are prepared for its store release.

Android purchase verification

For the planned Google Play release, Google processes payment. To recognize, acknowledge, restore, and check the optional one-time unlock, the Android app sends its Google Play purchase token and product identifier to our Vercel service. The service checks current purchase status with the Google Play Developer API. This is separate from free-verification consent; pausing the free allowance checks does not disable paid-entitlement verification.

Our private storage retains a SHA-256 hash of the purchase token, the product identifier, first and latest verification times, and acknowledgement status. The raw token is processed for verification but is not intentionally logged or retained in the purchase ledger. A token or its hash identifies a purchase and is not fully anonymous. We do not receive your payment-card details or Google account password. The app exposes the hash as a purchase support reference, not a bearer token.

Android paid access requires an online check at launch and periodic rechecks. A verified authorization can be cached only in the running app for at most five minutes; restarting or reinstalling does not create a paid entitlement. Pending, refunded, revoked, or unverifiable purchases do not create a new authorization. Local practice sessions are not part of these requests.

Providers, sharing, and security

Vercel hosts the website and API. Private trial and Android purchase-verification records use DigitalOcean Spaces, or private Vercel Blob if that storage alternative is configured. Apple and Google provide the platform checks described above. We use these providers to deliver the service, verify purchases, enforce the allowance, and prevent fraud—not for advertising or profiling your practice.

We require providers handling data on our behalf to protect it to the same or an equivalent standard described in this policy, use it only for authorized service purposes, and comply with applicable privacy obligations. Platform services also operate under their own policies: Apple, Google, Vercel, and DigitalOcean.

App-to-service traffic uses HTTPS. Trial storage is private, credentials are server-side, and access is restricted to service operations and authorized support or security work. We do not intentionally log request bodies, raw verification tokens, or microphone content. No system can guarantee absolute security. Information may be disclosed when necessary to meet a lawful obligation; we do not sell it or authorize advertising use.

Retention

• Local sessions and settings: kept until you delete them, clear app data, or uninstall, subject to operating-system backup, storage eviction, and copies you export.
• Trial ledgers and verification records: kept while the one-time allowance is offered and the records are needed to preserve eligibility, remaining time, and fraud protection. They have no automatic uninstall-based or monthly expiry. Necessary eligibility markers can be retained after a deletion request, where permitted by law; we explain any retained information when responding.
• Android purchase-verification records: retained while needed to operate and support the permanent unlock, resolve purchase disputes, or prevent fraud. They do not expire when the app is uninstalled. You may request access or deletion; we explain any necessary, lawful retention. A stored hash is never used by itself to grant access.
• Rate-limit records: used in five-minute security windows. Old records are not used to grant or deny a new trial. Removal depends on storage cleanup; hosting logs and provider backups follow the applicable provider retention settings.
• Support correspondence: kept while necessary to resolve and follow up on your request, meet legal obligations, or address a dispute. You can request deletion of correspondence no longer needed for those purposes.

Access and deletion requests

Email info@cybrcoast.com to request access, correction, or deletion. Include “Just BPM data request”, your platform, and the trial or purchase support reference shown in Setup → Privacy and support, if available. These locate different records; include both if your request concerns both. We may ask only for information reasonably needed to locate a record and verify the request. Do not send raw purchase tokens, payment-card details, passwords, or audio recordings.

A support reference lets us locate a pseudonymous ledger; an email address alone may not. If the reference is unavailable, contact us for assistance. We explain any verification limitation or lawful retention exception. Withdrawal applies to future consent-based collection and does not undo earlier lawful processing. Your applicable privacy rights, including any right to complain to a data-protection authority, remain unaffected.

We do not create Just BPM accounts, so there is no account to delete. Deleting local sessions and requesting deletion of server-held data are separate actions. A deletion request does not create entitlement to another promotional trial. Support explains the available controls.

Purchases, website, and changes

Apple processes the optional one-time iPhone and iPad purchase. StoreKit verifies and restores the entitlement on-device; we do not receive your payment-card details or upload Apple purchase history to our server. Google Play will process the Android one-time purchase when that store release becomes available, with the server checks described above. Store purchases do not transfer between Apple and Android.

The website does not request microphone access or include advertising, ad tracking, or a product analytics SDK. It uses Google Fonts, so a browser may contact Google to load fonts. If you email support, we receive the address and information you choose to send. Just BPM is a general-audience music-practice tool; a parent or guardian may contact us about information a child provided.

We update this policy when practices change and show the effective date above. If a change expands consent-based collection, the app must explain it before that collection starts. Questions: info@cybrcoast.com.