ToBePlay Privacy Policy
Effective date: 16 October 2026
Last updated: 2 November 2026
1. Who is responsible for your data
ToBePlay (the website tobeplay.net and the web app installed from the browser) is operated by Công ty TNHH QPS House (QPS House Company Limited).
- Legal entity name (English): QPS House Co., Ltd.
- Address: Zone 1, Room 4.01, 4th Floor, The Prince Residence Building, 17-19-21 Nguyen Van Troi Street, Phu Nhuan Ward, Ho Chi Minh City, Vietnam
- Privacy contact email: info.qpshouse@gmail.com
2. Summary
- You do not need an account to use ToBePlay. Guest mode works fully, as it always has.
- Songs, practice lists and settings you create while using ToBePlay stay on your device. They are not sent to ToBePlay's servers.
- ToBePlay's Tuner uses your microphone only after you tap Start and allow it in your browser. The sound is analyzed on your device, in memory, to find its pitch, and is never recorded, stored or sent to ToBePlay or anyone else (section 3.3).
- If you choose to create an account, the data ToBePlay needs is what lets you sign in (your email, or your Google account if you sign in with Google), plus a minimal record on ToBePlay's server made of an account ID, a sign-in identifier and the membership rights granted to you (section 3.2).
- You can view your account data and delete your account inside the app.
- ToBePlay does not use advertising and does not sell data.
- ToBePlay uses Google Analytics for anonymous usage statistics only if you allow it. It is off until you choose Accept in the banner, and you can turn it off at any time in Settings (section 3.5).
3. Data we process
3.1. When you use Guest mode (no account)
ToBePlay does not collect personal data from Guests. What you create or choose is stored in the browser on your device (see section 6):
- songs you write, drafts, practice lists (playlists), favorites;
- practice settings (tempo, Key, Style, display), Tuner options (reference pitch, sharps or flats, chosen mode and string) and interface options (light/dark);
- copies of music data and audio stored so the app can run without a network connection.
This data does not leave your device. If you clear browser data or remove the app, it is lost; ToBePlay has no copy to restore it from.
3.2. When you create an account and sign in (optional)
| Data | When | Purpose |
|---|---|---|
| When you register with Email and Password, or when Google returns the email of the Google account you choose | Identify your account; send the registration confirmation email | |
| Password | When you register with Email and Password | Sign-in. ToBePlay does not read or store your password on its own servers; it is handled by the authentication service (section 5) |
| Basic information you agree to share when signing in with Google | When you choose "Continue with Google" | Sign-in. The app requests the email and profile scopes from Google |
| Account identifier issued by the authentication service | When you sign in | Tell your account apart from others |
| Minimal record on ToBePlay's server: a ToBePlay account ID, the sign-in provider (for example Google or Email) with your identifier at that provider, and the creation time | The first time you sign in | Link your account to membership rights. Does not include your email, password or name |
| Membership rights granted: type of right, source, grant time, expiry, revocation status | When you receive a right (for example the Founding program) | Determine which features you can use |
| Session token | When you sign in | Keep you signed in. Stored in your browser (section 6) and removed when you sign out |
| Technical logs (for example IP address, browser type, access time) | When you visit the website or sign in | Operation, security, abuse prevention. Recorded by the hosting provider and the authentication service under their own policies (section 5) |
Record on ToBePlay's server: since the account and membership features were switched on (17 October 2026), ToBePlay stores the minimal record described in the table above on its own server, in a database hosted at Supabase (section 5). The email used to sign in is held by the authentication service; ToBePlay keeps no copy. When you select "View details", the app shows the membership rights granted to you. This record is deleted when you delete your account (section 7).
3.3. Microphone (Tuner)
ToBePlay has one feature that uses your microphone: the Tuner.
- When: only after you tap Start in the Tuner and allow microphone access in your browser (or in your device's system settings for the Android app). Your browser or device asks you first, and you can refuse or withdraw permission at any time in its settings. Without permission the Tuner does not work; the rest of ToBePlay is not affected.
- What happens to the sound: it is processed in your device's memory, in real time, only to measure its pitch and loudness for the on-screen display. It is not recorded, not saved, not uploaded and not shared, and it does not leave your device, with or without an account.
- When it stops: ToBePlay releases the microphone when you tap Stop, leave the Tuner page, close the app, or the app moves to the background or its tab is hidden.
- What is saved: only your Tuner options (for example the reference pitch) in your browser's Local Storage on your device (section 6). No audio and no measurements are saved.
- Analyzing the sound does not need an internet connection.
3.4. Data we do NOT collect
- No advertising or tracking tools. Usage statistics are collected only through Google Analytics and only if you allow them (section 3.5); there are no other analytics tools.
- No payment or card data (ToBePlay does not currently sell anything in the app).
- No recording of audio. No access to your camera, location, contacts or photos, and no access to your microphone except for the Tuner as described in section 3.3.
- No personal data from Guests.
- Your songs, playlists and practice settings are not sent to a server.
- We do not sell or rent your personal data.
3.5. Usage statistics (Google Analytics, only with your permission)
ToBePlay asks you once, in a banner, whether you allow anonymous usage statistics. Nothing is collected until you choose Accept. If you choose Decline, or your browser sends a "Global Privacy Control" or "Do Not Track" signal, statistics stay off and the Google Analytics code is not even loaded.
- What the statistics contain: which pages and features are used (for example "Tuner opened", "Practice started"), the interface language, the part of the app visited, basic device and browser information, and an approximate region derived by Google from the connection. Google Analytics does not log or store IP addresses. A random identifier is kept in your browser cookies (
_gaand_ga_followed by a code) to tell visits apart. It is not linked to your account. - What the statistics never contain: your email or account ID, anything you type (song titles, lyrics, searches), your songs, playlists or settings, and any audio or measurement from the microphone.
- How: through Google Analytics 4, provided by Google LLC. ToBePlay turns off Google signals and ad personalization, and does not use the data for advertising. Event data is kept for 2 months.
- Your control: change your mind at any time in Settings > Privacy > Usage statistics. Turning it off stops sending immediately and removes the Google Analytics cookies from your browser. You can also block them in your browser settings.
4. How we use data
We use usage statistics (only if you allow them) solely to understand which parts of ToBePlay are used and to improve it. We use account data only to: let you register, sign in and stay signed in; send confirmation emails needed for registration; let you view and delete your data; and keep the service secure and running reliably. We do not use account data for advertising or to profile you.
5. Third parties and where data is stored
| Party | Role | Related data | Data location |
|---|---|---|---|
| Supabase (Supabase Auth) | Authentication service: stores sign-in information, issues and refreshes sessions, sends confirmation emails | Email, sign-in information, account identifier, authentication logs | Sydney, Australia (AWS ap-southeast-2) |
| Google (Google Sign-In) | Only if you choose to sign in with Google: Google authenticates you and lets ToBePlay receive your email and basic profile information | Your Google account, under Google's policy | As per Google |
| Google (Google Analytics 4) | Only if you allow usage statistics: measures anonymous usage of the app (section 3.5) | Usage events, language, device and browser information, approximate region, random cookie identifier | Google data centers, including outside your country (for example the United States), under Google's policy |
| Vercel | Hosts and delivers the tobeplay.net website | Standard technical access logs (such as IP address) | The website is hosted on Vercel infrastructure. |
Each party has its own privacy policy; we do not control how they handle data beyond what is described here. Data may be processed in a country other than where you live.
If ToBePlay changes providers later, this policy will be updated.
6. Storage on your device (Local Storage, Cache, Cookies)
- Browser Local Storage: holds songs you write, drafts, playlists, favorites, practice settings, Tuner options, the light/dark interface option (keys starting with
tobeplay:and the theme key), and, if you sign in, the sign-in session stored by the authentication library to keep you signed in. Signing out removes this session. - Service Worker cache: holds copies of pages, music data and (if you enable the download pack) audio so the app can run offline. Account data (
/api/*) is not stored in this cache. - Cookies: ToBePlay does not use cookies for advertising. Only if you allow usage statistics, Google Analytics sets the cookies
_gaand_ga_<code>to tell visits apart (up to 2 years unless you turn statistics off or clear them). Your choice (accepted or declined) is saved in Local Storage under a key starting withtobeplay:analytics. Some authentication services may use cookies or equivalent mechanisms to keep you signed in.
You can clear these at any time in your browser settings. Doing so does not delete your account at the authentication service.
7. How you view, export and delete your data
- View: sign in, open the Account page (
tobeplay.net/account) and choose "View details". The app shows on screen the data ToBePlay holds about you. Downloading it as a file is not available yet. - Delete your account: on the same Account page, choose "Delete account" and confirm. This removes your sign-in identity at the authentication service and any record ToBePlay holds about you. It cannot be undone. For security you may be asked to sign in again immediately before deleting. Songs and settings stored on your device are not deleted.
- Data on your device: you manage and delete it yourself in the browser (section 6).
- Other way: you can also send a request to view or delete your data to the contact email in section 1.
8. Retention
Account data is kept until you delete your account. Technical logs are kept by providers under their own policies.
9. Security
- Connections to
tobeplay.netuse HTTPS. - The server's secret keys exist only on the server side and are not included in the app running on your device.
- ToBePlay's server verifies the signature of your session token before allowing you to view or delete data; deleting an account requires a recent sign-in.
- We ask only for the minimum data needed for you to sign in.
No system is perfectly secure. If we discover an incident affecting your data, we will handle it and notify as required by applicable rules.
10. Children
Users under the age set by applicable law should use ToBePlay only with the consent of a parent or guardian.
11. Your rights
You have the right to: know what data is processed; view your data; request deletion; withdraw consent (where consent is requested, such as usage statistics: Settings > Privacy > Usage statistics); and lodge a complaint with the competent authority under the law where you live. You can do most of this inside the app (section 7); other requests go to the contact email in section 1.
12. Changes to this policy
When the policy changes, we update this page and the update date at the top.
ToBePlay may update this Privacy Policy when adding features such as Cloud Sync, Membership or Payments. Important changes will be announced before they take effect.
13. Contact
Công ty TNHH QPS House
Email: info.qpshouse@gmail.com
Address: Zone 1, Room 4.01, 4th Floor, The Prince Residence Building, 17-19-21 Nguyen Van Troi Street, Phu Nhuan Ward, Ho Chi Minh City, Vietnam