Privacy Policy

1. Information We May Collect

We process information only to the extent reasonably necessary to provide, maintain, protect, and improve MAPS. The information we process depends on which features you use.

1.1 Information You Provide

You may provide information to MAPS when you use certain features, including:

• the email address you use to register for or sign in to MAPS;
• your name, email address, message content, and attachments when you contact us through email or another official channel;
• information submitted through Submit an Activity or a similar contribution feature, such as your name, email address, activity title (if provided), activity description, source type, source details, teaching notes or variations, external links, supporting materials, and other information you choose to provide;
• supporting images uploaded with a submission. MAPS currently allows up to three JPG, PNG, or WEBP images per submission, with a maximum size of 10MB per image;
• a record of your agreement to the Submission Terms, including the version you accepted and the time of acceptance; and
• feedback, copyright questions, correction requests, or other communications you send to us.

A name is required when you submit an activity. If your submission is accepted and officially included in MAPS, that name may be used on a MAPS Certificate of Inclusion. You may submit an activity whether or not you are signed in, and eligibility for a Certificate of Inclusion does not depend on having a MAPS account.

Please avoid submitting sensitive personal information or personal information unrelated to the teaching activity unless it is genuinely necessary.

1.2 Information You Provide During the Welcome Experience

When you first visit MAPS, we may invite you to choose the role or teaching context that best describes you, such as elementary music teacher, secondary music teacher, college or university music teacher, independent studio teacher, music student or student teacher, or other.

We use this information to better understand the overall MAPS audience and to improve how content and features are organized. The response may be stored together with a randomly generated visitor identifier, language information, and a timestamp. It is not displayed publicly and is not automatically matched to your name.

2. Accounts and Authentication

MAPS currently uses email one-time passcodes (Email OTP) as its primary sign-in method. You do not need to create a MAPS-specific password. Account authentication and sign-in sessions are currently provided through Supabase.

When you create or sign in to an account, we may use your email address and other necessary account information to:

• verify your identity;
• establish and maintain your sign-in session;
• provide account-based features;
• save and synchronize data associated with your account; and
• protect account security and help prevent unauthorized access.

Authentication may rely on necessary cookies or similar session technologies managed by Supabase. Authentication-related service emails may currently be sent through Resend.

3. Saved Activities, Collections, and My Contributions

3.1 When You Are Not Signed In

If you are not signed in, certain information may be stored locally in your browser or on your device. For example, MAPS may use localStorage to save Saved Activities on the device you are currently using.

Local data may no longer be available if you clear your browser data, change devices or browsers, or use private/incognito browsing.

3.2 When You Are Signed In

If you are signed in, MAPS may store the following information in its database services:

• Saved Activities;
• Collections;
• associations between Activities and Collections; and
• other data reasonably necessary to synchronize account features.

In some cases, Saved Activities stored locally before you sign in may be copied to your account so they can be accessed across devices.

3.3 My Contributions

If you submit an activity while signed in, that submission may be linked to your MAPS account through your account user identifier and may appear in My Contributions. Once signed in, you can view submissions linked to your account, their submission dates and review status, and selected information that you previously submitted.

If you submit while signed out, the submission is still a valid, identified submission because both name and email are required. However, its account user identifier is left empty, so it is not automatically linked to an account you later create or use, and it will not automatically appear in My Contributions. MAPS currently does not merge earlier submissions into an account solely because the email address or name matches.

My Contributions is currently read-only. Users cannot use it to change review status, delete a submission, or view another user's submissions.

4. Website Usage Information and Analytics

To understand how MAPS is used and to improve teaching resources, search, taxonomy, navigation, and the overall user experience, we may collect limited usage information.

Current analytics may include events or information such as:

• viewing or opening an Activity (activity_view);
• search queries and result counts (search);
• searches that return no results (zero_result_search);
• filter dimensions and selected filter values (filter_used);
• saving or unsaving an Activity (save_activity / unsave_activity);
• sharing an Activity;
• creating a Collection (create_collection);
• adding an Activity to a Collection (add_to_collection);
• a session_start event when a browser-tab session begins; and
• a visitor identifier, session identifier, event time, and limited context associated with these events.

The visitor identifier is a random identifier stored in browser localStorage and is used to distinguish visitors within the same browser. The session identifier is a random identifier stored in sessionStorage and is currently tab-based: it generally survives a refresh in the same tab, while a new tab normally creates a new session identifier.

The session_start event helps MAPS estimate unique visitors, sessions, returning visitors, return rate, and visit frequency more reliably. Because these identifiers depend on local browser storage, they cannot reliably recognize the same person across different devices or browsers, or after local browser data has been cleared.

MAPS does not currently use this behavioral data for targeted advertising, and MAPS does not sell personal information.

5. Cookies, Local Storage, and Similar Technologies

MAPS and its technology providers may use cookies, local storage, session storage, and similar browser technologies to support the operation of the site.

These technologies may currently be used to:

• maintain authentication and sign-in sessions;
• store Saved Activities for users who are not signed in;
• remember language preferences;
• remember whether the welcome experience has been completed, the selected user role, and whether that role has been synchronized;
• store a visitor identifier;
• store a session identifier within the current browser tab;
• remember, for the current tab, whether a role prompt has been temporarily dismissed; and
• support security, troubleshooting, and basic usage analytics.

Clearing browser data may remove this local information and may affect signed-out Saved Activities, welcome-state preferences, and visitor/session recognition.

6. Technical Information and Server Logs

MAPS does not use its own analytics system to create device fingerprints or to identify users by precise location.

Our hosting, database, authentication, email, security, and infrastructure providers may automatically process limited technical information when operating and protecting their services. This may include IP addresses, browser or device information, request timestamps, access logs, error logs, and security or anomaly records. This information is generally used for service operation, security, abuse prevention, troubleshooting, and infrastructure maintenance.

7. Submissions and User-Contributed Content

MAPS provides a Submit an Activity feature. Submissions may currently be made while signed in or signed out. In either case, the contributor must provide a name and email address.

A submission record may currently include:

• an internal UUID and a database-generated sequential submission number;
• the contributor's name and email address;
• the activity description and an optional activity title;
• source type and source details;
• teaching notes or variations;
• a supporting link;
• language information;
• an account user identifier if the contributor was signed in at the time of submission;
• the Submission Terms version and database-recorded acceptance time;
• a review status, such as submitted, under_review, needs_revision, accepted, declined, or published; and
• submission creation time and later update time.

A human-readable reference in the form MAPS-SUB-000001 is used primarily for internal MAPS workflow and notification purposes. The internal UUID continues to be used for database relationships, attachment folders, and server-side processing.

Submission information may be used to review the activity, contact the contributor, verify sources and attribution, edit and organize the activity, decide whether to include or publish it, maintain submission status, and create or send a Certificate of Inclusion if the activity is accepted and officially included.

7.1 Supporting Images

Supporting images submitted with an activity are stored in a private Supabase Storage bucket. They are not publicly browsable by ordinary site visitors. MAPS may use server-side functions to create time-limited signed URLs for review. Links included in internal submission-notification emails are currently generally valid for seven days.

For submissions linked to a signed-in account, the My Contributions detail page may, after verifying the current account, generate shorter-lived signed URLs for that user's own images. These contributor-facing links currently last about 30 minutes. The underlying storage path is not displayed to ordinary users.

7.2 Submission Notifications

After a successful submission, a MAPS server-side Edge Function may retrieve the canonical submission record and use Resend to send an internal notification to the MAPS team inbox at musicactivityps@gmail.com.

The notification may include the contributor's name and email address, activity content, source information, teaching notes, supporting link, image count and time-limited review links, and an internal submission reference. Reply-To may be set to the contributor's email address so the MAPS team can respond directly.

The notification email is an internal workflow alert and is not the system of record. The Supabase database remains the primary record of the submission.

8. Information You Provide When You Contact Us

If you contact us through musicactivityps@gmail.com or another official channel, we may receive and retain your name, email address, message content, attachments, and other information relevant to your request.

We may use this information to respond to questions, handle feedback, copyright matters, source or attribution corrections, disputes, security issues, or other reasonable requests. We do not automatically use an email address from an ordinary support inquiry for unrelated commercial marketing.

9. How We Use Information

MAPS may use information to:

• provide, maintain, and protect the website;
• provide search, browsing, saving, sharing, and educational-resource features;
• authenticate users and maintain account sessions;
• save and synchronize Saved Activities and Collections;
• provide My Contributions;
• process, review, and manage submissions;
• send necessary functional or service-related emails;
• respond to user inquiries, feedback, and copyright requests;
• improve search results, taxonomy, navigation, and user experience;
• analyze overall usage patterns, returning visits, and visit frequency;
• identify and resolve technical issues;
• prevent spam, abuse, fraud, or security threats;
• enforce MAPS policies and terms; and
• meet reasonable legal, regulatory, or compliance obligations.

MAPS does not sell personal information, including to advertisers.

10. Third-Party Service Providers

MAPS relies on third-party technology providers to operate and maintain the site. Current providers include:

Supabase

• Email OTP authentication and sign-in sessions;
• database services for account-linked data, Saved Activities, Collections, analytics, visitor profiles, submissions, and My Contributions;
• Supabase Storage, including activity resources and private supporting images submitted by contributors; and
• Edge Functions for submission notifications, private-image signed URLs, and other server-side processing.

Vercel

• website hosting;
• deployment;
• web infrastructure and related technical services.

Resend

• authentication and other necessary functional emails; and
• internal Submit an Activity notification emails.

These providers may process technical information or personal information to the extent necessary to provide their services. Their processing is also governed by their own privacy policies, terms, and applicable law.

11. Sharing of Information

MAPS does not sell, rent, or trade personal information. We may share information only in limited circumstances, including:

• with service providers that help us operate MAPS;
• to provide a feature or service you have requested;
• with your consent;
• to protect platform security and prevent fraud or abuse;
• to enforce applicable terms or protect the rights and interests of MAPS, our users, or others;
• in response to courts, law enforcement, regulators, or other lawful legal process; or
• as otherwise required or permitted by law.

12. Data Retention

MAPS retains information for as long as reasonably necessary for the purposes described in this Privacy Policy. In deciding how long to retain information, we may consider whether an account remains active, how long the information is needed to provide the service, whether the information remains useful for product improvement, copyright or dispute records, security needs, submission and authorization records, and applicable legal or compliance obligations.

MAPS does not currently apply one uniform automated deletion period to every category of data. When information is no longer reasonably needed, we may delete it, anonymize it, de-identify it, or otherwise handle it appropriately.

Even if you request account deletion, certain information may need to be retained for legitimate purposes such as legal compliance, security, fraud prevention, dispute resolution, copyright, submission, or authorization records.

13. Data Security

MAPS uses reasonable technical, administrative, and organizational safeguards to protect information under our control. Current safeguards include or may include:

• Supabase Row Level Security (RLS) and table-level permission controls;
• private Storage buckets for supporting images submitted with activities;
• time-limited signed URLs for controlled access;
• keeping privileged database credentials and the Resend API key in server-side secrets rather than exposing them to the browser;
• restricting ordinary browser roles from reading, updating, or deleting protected submission data; and
• authentication, logging, and security features provided by our infrastructure providers.

No internet transmission, online service, database, or electronic storage system can be guaranteed to be completely secure.

14. Your Choices and Rights

Depending on where you live and the law that applies to you, you may have certain rights regarding your personal information. You may contact us to ask what information we may hold about you, request correction of inaccurate information, request deletion of certain personal information, request closure or deletion of a MAPS account, or raise questions or complaints about our data practices.

To make a request, contact us at musicactivityps@gmail.com. When reasonably necessary, we may ask for enough information to verify that the request relates to the relevant account or data.

15. Children and Student Information

MAPS is designed primarily for music educators and adult users and is not intended to collect personal information directly from children. We discourage teachers, contributors, and other users from submitting unnecessary student personal information.

Unless you have appropriate authorization and there is a genuine need, please do not submit a student's full name, email address, phone number, home address, identifiable photo or video, or other information that could directly identify a minor.

16. Aggregated, De-Identified Data, and Research

MAPS may use aggregated, anonymized, or de-identified information to understand overall platform use, improve the database, optimize search and taxonomy, evaluate site features, improve user experience, and support internal analysis and product development.

Where permitted by law, aggregated or de-identified information may also be used in educational, academic, or professional contexts. If MAPS later conducts a formal research project involving identifiable personal information or human-subject data, and applicable law, institutional policy, or research-ethics requirements call for additional authorization, informed consent, or ethics review, MAPS will provide project-specific information rather than relying on this Privacy Policy as a substitute for required research consent.

17. External Links

MAPS may link to third-party websites or services, including Google Drive, YouTube or other video platforms, publishers, online resources, educational materials, and other external services. MAPS does not control the privacy practices of those third parties. When you access a third-party service, that provider's privacy policy and terms govern its own processing of information.

18. Future Features and AI-Assisted Features

MAPS may add new interactive features, intelligent search, AI-assisted functionality, or other technology services in the future. If a new feature materially changes the types of information we collect, how we use information, how information is shared, or another significant data practice, we may provide additional notice and update this Privacy Policy.

19. Changes to the Service or Organization

If MAPS undergoes an organizational change, project transfer, asset transfer, merger, restructuring, or similar event, information related to MAPS may be transferred together with the relevant project, service, or assets to the extent permitted by applicable law. Where appropriate, we will provide reasonable notice of significant changes.

20. Updates to This Privacy Policy

We may update this Privacy Policy from time to time as MAPS features, data practices, technology providers, legal requirements, or operations change. The updated version will be posted on the MAPS website with a revised “Last Updated” date. If a change could materially affect users' privacy rights, we may provide additional notice where appropriate.

21. Contact Us

If you have questions about this Privacy Policy, MAPS data practices, your personal information, account data, correction or deletion requests, or another privacy matter, please contact us:

Email: musicactivityps@gmail.com

This Privacy Policy is intended to describe MAPS's current practices in clear, practical language. It may be updated as the platform evolves.