Privacy Policy

MyStro.Live ("MyStro," "we," "our," or "us") is a Canadian software-as-a-service platform developed by the MyStro development team. MyStro is a voice-controlled music education tool that helps band directors navigate rehearsals more efficiently — allowing teachers to say "MyStro, measure 47" and have synchronized audio and sheet music jump to that location on a classroom Smartboard.

MyStro is operated as a small Canadian educational technology business. Our contact information appears at the end of this policy.

We collect the minimum information necessary to operate the platform. The following table summarizes what we collect, why, and from whom.

We do not collect social insurance numbers, health information, home addresses, financial information, biometric data, precise geolocation, behavioral advertising profiles, or any other sensitive personal information.

The following commitments apply specifically to student data:

• Student data is used exclusively for educational purposes within the platform — specifically, displaying instrument-specific parts and tracking assigned music.
• We never use student data for advertising, marketing, analytics profiling, or sale to any third party.
• Student names and roster information obtained via Google Classroom are stored only as long as needed to support the teacher's active class. When a teacher removes a student or disconnects their Google Classroom, that student's data is deleted.
• Students under 13 (or under 16 in jurisdictions with stricter rules) do not create accounts directly. Teachers manage all student access through their own account.
• Student records are not cross-referenced with other systems, databases, or external services beyond what is explicitly described in this policy.
• In the event of a data breach affecting student information, we will notify affected schools and, where required, relevant privacy authorities within 72 hours of becoming aware of the breach.

Google Classroom Integration

When a teacher connects their Google Classroom account, MyStro requests access to read class rosters (student names and email addresses) and distribute music assignments. This access is:

• Explicitly authorized by the teacher via Google OAuth — we never access Google accounts without the teacher's active permission.
• Scoped to the minimum necessary data (roster reading and assignment posting only).
• Revocable at any time from the teacher's Google Account settings.
• Used only to synchronize student instrument assignments within MyStro — not for any external purpose.

We use the information we collect only for the following purposes:

We do not use personal information to train AI or machine learning models, build advertising profiles, or conduct any activity unrelated to providing music education software.

Our business model is a straightforward annual subscription fee ($299 CAD/year per teacher). Your data is not our product. We have no advertising partnerships, data brokers, or revenue-sharing arrangements that involve personal information.

We share data with a small number of carefully selected service providers who help us operate the platform. These providers act as data processors — they may handle data on our behalf but are contractually prohibited from using it for their own purposes.

We do not share data with analytics companies, advertising networks, or any entity not listed above. We will share information with law enforcement or government bodies only if required to do so by law, and will notify affected users where legally permitted to do so.

If we ever sell or transfer our business, user data would be disclosed to the acquiring party subject to the same privacy commitments in this policy, and we would notify all account holders in advance.

We retain data only as long as reasonably necessary to provide the service:

• Active accounts: Data is retained for the duration of the subscription plus 30 days after cancellation (grace period for account recovery).
• Closed accounts: Upon written request, we will delete all personal data within 30 days. Anonymized technical logs may be retained for up to 12 months.
• Student roster data: Deleted when the teacher removes the student from their class in MyStro, disconnects Google Classroom, or closes their account — whichever comes first.
• Uploaded score and audio files: Retained while the piece exists in the teacher's library. Deleted when the teacher deletes the piece or closes their account.
• Server access logs: Retained for up to 90 days for security and diagnostic purposes, then purged.

We implement industry-standard security practices appropriate for an educational software platform:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS). HTTP access is automatically redirected to HTTPS.
• Passwords: Passwords are stored using PHP's password_hash() with bcrypt — never in plain text or with reversible encryption.
• Database access: All database queries use parameterized prepared statements to prevent SQL injection. Database credentials are stored outside the web root.
• API keys: Third-party API credentials (Google, Resend) are stored in a secure file outside the publicly accessible web directory.
• Access control: All user-facing pages require authenticated sessions. Users can only access their own data.
• Automatic backups: The platform maintains automatic file-level backups before any overwrite operation.

While we take these precautions seriously, no internet-based system can guarantee absolute security. We encourage teachers to use strong, unique passwords and to report any suspected security issues to us immediately.

Account holders (teachers) have the following rights with respect to their personal data:

We will respond to all privacy rights requests within 30 days. We do not charge fees for reasonable requests. If we are unable to fulfill a request, we will explain why.

Parents or guardians of minor students may contact us to inquire about, correct, or request deletion of their child's data. Schools acting as the data controller for student information may do the same on behalf of their students.

MyStro.Live operates under Canadian law. Our privacy practices are designed to comply with:

• PIPEDA (Personal Information Protection and Electronic Documents Act) — Canada's federal private-sector privacy law
• Alberta PIPA (Personal Information Protection Act) — Alberta's provincial privacy legislation, which applies to our operations as an Alberta-based business
• CASL (Canada's Anti-Spam Legislation) — all commercial electronic messages include unsubscribe options, physical address, and require explicit opt-in consent before sending

Alberta's PIPA requires that we collect only the information we need, use it only for the stated purpose, keep it secure, and give individuals reasonable access to their own information — all of which this policy reflects.

For school districts in other provinces or countries: we are happy to discuss provincial or jurisdictional requirements and provide written assurances where we are able to do so. Please contact us directly.

Users in the European Union: while MyStro is primarily a Canadian platform, we recognize GDPR principles and apply them in spirit. For formal GDPR compliance documentation, please contact us.

We may update this Privacy Policy from time to time as the platform evolves. When we make material changes — particularly any that affect how student data is handled — we will:

• Post the updated policy on this page with a new "Last Updated" date
• Send an email notification to all active account holders
• Provide at least 30 days notice before any significant change takes effect

Continued use of MyStro.Live after the effective date of a revised policy constitutes acceptance of the new terms. If you disagree with a change, you may close your account and request deletion of your data at any time.

For any privacy questions, concerns, data requests, or to discuss a Data Processing Agreement for your school district, please reach out. We will respond promptly — typically within 2–3 business days.

If you believe your privacy rights have been violated and we have not resolved your concern satisfactorily, you may also contact the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca.