Privacy Policy

We keep only what we need to run free lessons and keep people safe:

• Your account: your name, email address and role. Your password is stored scrambled, so nobody at Note by Note can read it.
• Applications: your answers, such as your school, age group, instrument, level, the days and times you’re free, languages and goals. For a student under 18, the name and email of a parent or guardian.
• Mentor pages: what mentors write about themselves, their instruments, their weekly free times, and a photo if they add one.
• Lessons: requests, agreed lesson times, “can’t make it” notices, lesson notes, practice checklists and video call links.
• Messages and files shared between a mentor and their student.
• Volunteer hours that mentors and volunteers log.
• Agreements: when you accepted the Code of Conduct and Terms of Use, and the name you typed. For a student under 18, their parent or guardian’s consent: their name, email, relationship and the date.
• Messages sent through our contact form.
• Visits: which pages are viewed, without the parts of a web address that could identify you.

To match students with mentors, arrange and run lessons, keep everyone safe, contact you about the program, and understand which pages are useful.

We don’t sell your information, and we don’t use it for advertising.

• Your mentor or student. Before a mentor accepts a student, they see the student’s first name, age group, level, instrument and preferred times. Once they accept, they also see the name and email of the account that asked.
• The public. Published mentor pages, including approved photos, are shown on Find a Mentor. Team members on the About page are shown there. Nothing else is public.
• The Note by Note team. Volunteers see only what their role needs. Admins can read messages between mentors and students to keep people safe, such as when one is reported. Some volunteers see only totals, never names.
• Services that run the site for us (listed below), only to do that job.
• Others, only if we must: if the law requires it, or to protect someone from harm.

• Vercel hosts the website and counts page visits.
• Render runs our server.
• MongoDB Atlas stores our database.
• Google Analytics counts visits. We’ve turned off Google signals and ad personalization, and we remove anything that could identify you from the addresses it sees.
• Formspree delivers messages from our contact form.
• An email delivery service sends the site’s emails, such as lesson notices and consent requests.
• Video call services you choose for lessons, such as Zoom or Google Meet, have their own privacy policies.

To keep you signed in, the site saves a sign-in key in your browser’s storage. It also remembers small preferences, like which dashboard tab you used last. Signing out removes the sign-in key.

Google Analytics uses cookies to count visits. Vercel’s visit counting doesn’t use cookies. You can block or clear cookies in your browser settings; the site still works.

Connections to the site are encrypted. Passwords are stored scrambled. Location and camera details are removed from uploaded photos. Volunteers’ access is limited to their role, and only test accounts can be entered by staff, never a real person’s account.

We keep your information while your account is open. When you ask us to close it, we delete or anonymize your information, except anything we need to keep for safety reasons or because the law requires it.

• Ask to see, correct or delete your information through the contact page.
• Choose which emails you get in your account settings.
• A parent or guardian can withdraw consent for their child at any time by contacting us.

Many of our students are under 18. A parent or guardian gives consent before lessons start, and can ask to see or delete their child’s information. If you’re under 13, please ask a parent or guardian to set up your account with you.

If we change how we handle information, we’ll update this page and the date at the top.

Questions about privacy? Write to us through the contact page.