Privacy Policy

1. Introduction

This Privacy Policy explains how Chord ("we," "us," "our," or the "Company") collects, uses, stores, shares, and protects your personal information when you use the Chord mobile application (the "App"), the Chord web app at app.chordapp.in, the Chord website at chordapp.in (the "Website"), and any related services (collectively, the "Services").

Chord is operated by Anantaswar Technologies Private Limited, a company incorporated in India with its registered office in Mumbai, Maharashtra, India.

Chord is the app for live music: it helps you capture the moment and the song at gigs, festivals and club nights. We designed it to be private by default. We do not sell your data. We do not serve ads. We do not track you across other companies' apps or websites. What you capture is visible only to you until you choose to share it, and your private notes are encrypted before they are stored.

By using the Services, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Services.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

What we do NOT collect automatically: We do not collect your location in the background. We do not collect your call logs, browsing history, app usage outside of Chord, advertising identifiers (IDFA/GAID), or any device fingerprinting data. If you use the contacts-based invite screen, the App reads your contacts on your device only so you can pick who to invite; your contacts are not uploaded to Chord.

A photo can carry its own location, and that is a different thing. The line above is exact: Chord never asks your device where you are while you are not using it, and nothing about your location is collected between uploads or while the App is closed. Separately from that, most cameras write the coordinates of where a picture was taken inside the picture file itself. When you upload such a photo, Chord reads those coordinates out of the file you sent us and stores them with that memory. It happens only for photos you choose to upload, only from that file's own metadata, and it does not involve a location permission — your device is never asked where it is. Section 2.7 explains it in full, including how to prevent it.

2.3 Health and Fitness Data (Optional Connections)

Apple Health and Android Health Connect. Chord does not currently read any data from Apple Health (HealthKit) or Android Health Connect. The App does not ask for health permissions, and the "Apple Health" item in the App's connections list is marked "coming soon". No health data is read on your phone and none is sent to us from those sources.

Fitbit and WHOOP (optional). You can connect a Fitbit or WHOOP account from the App's connections list. The connection runs between Chord's servers and Fitbit or WHOOP — not through your phone. If you connect one:

The stored summaries are protected by our infrastructure's at-rest encryption but are not separately field-encrypted. They are never used for advertising and never shared with anyone else. Disconnecting Fitbit or WHOOP (currently available in the web app's wearable settings) deletes the stored tokens and summary from your account; you can also revoke Chord's access in your Fitbit or WHOOP account, or email privacy@chordapp.in and we will delete them. We do not currently offer Oura, Garmin or Samsung Health connections.

Strava (optional). If you connect Strava, we ask Strava for read access to your activities, and we store your encrypted access tokens and your Strava athlete name. Chord's servers can also import an activity as a memory; when that happens, we store the activity's name, type, distance, moving and elapsed time, elevation gain, start time, city, and its route line (the map outline of the activity) with that memory, and we may add the song you were playing at the time from your Last.fm scrobbles. We do not read heart-rate data from Strava. The App does not yet have a Strava "disconnect" button: you can revoke Chord's access in your Strava settings, or email privacy@chordapp.in and we will delete the stored tokens. Memories created from activities stay until you delete them or your account.

Wellbeing check-ins. Chord's servers include a feature that can store heart-rate-type readings sent from a device and use them to suggest taking a pause. No current version of the App or web app sends such readings, so this feature does not collect health data today.

2.4 Audio Data (Song Detection — Optional)

If you use song detection ("Detect song playing nearby" or "Detect later"):

• On iPhone, Chord first uses Apple's ShazamKit. ShazamKit creates an audio signature of what your microphone hears and matches it using Apple's Shazam service.
• When ShazamKit is not available (for example on Android, or when a detection was queued while you were offline), the App records a short audio clip (typically 8–12 seconds) and sends it to Chord's servers for identification.
• Videos you save to Chord are also analysed on our servers. When you save a video memory, Chord extracts audio from it (usually from the first 60 seconds, and in some cases from a longer part of the clip) to identify the song.

For server-side identification, short windows of that audio (roughly 8–60 seconds each) are sent to one or more music-recognition services: Shazam (via RapidAPI), ACRCloud, AcoustID (with a MusicBrainz lookup), and AudD. The audio sample is used solely for the purpose of identifying the song. The temporary audio file on our servers is deleted as soon as identification finishes, whether or not a song was found, and the sample is not stored by Chord after identification is complete — with the one exception described in the next paragraph. What we keep is the result: the identified song and a log of the attempt (see Section 4.4).

Clips we keep so we can try again. When the App records a short clip while you are listening live (for example with "Detect later") and the song cannot be named straight away, Chord may keep that clip — a few seconds of audio — on our servers so it can try to name the song again later. We keep it for no more than 30 days. It is deleted sooner if the song is named, if you delete that detection, or if you delete your account. After the audio is deleted, the unnamed entry (with no audio) stays in your detection list until you delete it. A kept clip is used only to identify the song, is sent only to the music-recognition services listed above, and is included when you download your data (Section 7). If the law requires us to preserve your data (for example under a court order), we keep it for as long as that requirement applies.

If you connect Spotify or Last.fm, Chord can also periodically ask that service what you are currently playing, so it can suggest the song for a moment you capture. The App shows this before you connect.

2.5 Voice Data (Voice Search and Siri Shortcuts — Optional)

If you use voice search within the App or invoke Chord through Siri Shortcuts (iOS), your voice input is processed by your device's native speech recognition engine (Apple Speech Recognition, or your device's native speech recognition service for in-app voice search on Android). Chord does not record, store, or transmit your voice audio for voice search or Siri. The only data Chord receives is the transcribed text of your voice command, which is used to search your memories or open the right screen. Chord does not currently integrate with Google Assistant; an Android voice-assistant integration is planned but not yet available.

Voice notes you record and attach to memories are different: they are uploaded and stored as audio files (Section 2.1).

2.6 Smart Glasses Data (Ray-Ban Meta Integration — Optional)

Ray-Ban Meta smart glasses support is in early testing and is not yet generally available. If you connect Ray-Ban Meta smart glasses, photos and videos captured through the glasses are transferred to Chord through Meta's Wearables SDK on your phone. These captures are stored with the same protections as any other memory content, and Chord does not send your captures to Meta. The Meta Wearables SDK built into the App collects its own usage analytics, which Meta receives under Meta's own terms. If you use "Smart glasses live", the point-of-view video from your glasses is streamed through Chord's servers to the people you share the live view with.

2.7 Location Data (Optional)

Chord does not access your GPS location in the background. The App only asks for location permission "while using the app". If you tag a memory with a place, that place text is stored as part of the memory. If you grant location permission, the App uses it only while it is open, in these ways:

• Geotagging a capture. When you capture or add a memory, the App may read your current position once and store the coordinates (and a place name) with that memory.
• Suggestions. To suggest nearby shows, venues and memories (for example on Discover).
• Co-Capture (opt-in, off by default). When you open a new capture, the App posts a short-lived "beacon" (your approximate position and the song you caught) so that a connection who was nearby, playing the same song, can link memories with you. A beacon expires after 10 minutes.
• Safety Mode (opt-in). If you turn on location sharing in Safety Mode, the App periodically sends your latest position so your crew can find you. If you send an SOS, your last-known location is shared with your crew. Only the latest position is kept, on that Safety Mode session.
• Trip route lines. Where trip or journey containers are available, while you have a trip's screen open the App records coarse waypoints (roughly every 250 metres) to draw the route between your photos. Recording stops when you leave the screen or put the App in the background. Up to 2,000 points are stored on that trip, are visible to the people who can see the trip, and are deleted with it.

We do not use your location for advertising, and we do not keep a location history of your movements. The only trail of positions we store is the trip route line described above.

To turn a place into a place name (or a name into a map position), Chord sends coordinates or place names to Google Maps and OpenStreetMap's Nominatim service. If weather is added to a memory, the time and approximate place are sent to Apple WeatherKit.

Location saved inside your photos (EXIF). This is separate from the permission described above, and it is the one way Chord learns a coordinate without asking your device for one. Cameras — including your phone's — routinely record where a photo was taken and save it inside the photo file as standard "EXIF" metadata. Chord did not put it there, and cannot see it until you upload the photo. When you do upload a photo that contains it, Chord reads those coordinates from the file and stores them with that memory, and uses them the same way it uses a location tag: to place that single memory.

What that does and does not mean:

• It happens only when you upload a photo, and only from the file's own contents. Nothing is read while the App is in the background, and no location permission is requested or required for it — which is exactly why we are spelling it out here rather than relying on a permission prompt to tell you.
• It applies to photos only. Video files can carry a location tag too; Chord does not store it.
• Each coordinate belongs to one memory. We do not assemble them into a movement history, and we do not use them for advertising or share them with anyone (see Sections 3 and 5).
• Coordinates that are plainly not a real reading — out-of-range values, or the "0, 0" placeholder some cameras write before they get a satellite fix — are discarded rather than stored.
• To prevent it: remove the location from the photo before you upload it (on iOS, in the share sheet: Options → turn off Location; on Android in Google Photos: ⋮ → Remove location), or delete the memory afterwards. The coordinates are stored on the memory itself and nowhere else, so they are covered by that memory's own retention and deletion (Section 4.4) and by your export and erasure rights (Section 7).

2.8 Assistants You Connect (Claude, ChatGPT and Others — Optional)

You can connect an AI assistant, such as Claude, ChatGPT or Claude Code, to your Chord account. This is optional and starts only when you approve the connection in the Chord app. When you ask the assistant a question, it can read the following from your own account: your Nights (name, acts, venue, city and dates), the songs caught at each Night, your moments (song, act, date, venue, city and the notes you wrote), the names of your collections and how many moments each holds, and yearly counts. It cannot read your photos or videos, your precise location, or other people's moments, chat, names or handles; a crew appears only as a count. If you turn on the optional "Let it organise my moments" switch in the app, the assistant can also create collections and add your own moments to them, and you can undo each change in Chord. You can see what each assistant did, and disconnect it at any time, in Settings → Agents & apps. Resetting your password, changing your email or using "Sign out everywhere" disconnects every assistant. Assistant connections are only for people aged 18 and over.

3. How We Use Your Information

We use your information solely for the following purposes:

We NEVER use your information for:

• Advertising, ad targeting, or ad personalisation
• Selling, renting, licensing, or sharing your personal data with third parties for their commercial purposes
• Profiling you for purposes unrelated to the Services
• Training general-purpose AI or machine learning models outside the App
• Cross-app tracking or device fingerprinting
• Creating user profiles for marketing purposes

4. How We Store and Protect Your Information

4.1 Encryption

This is server-side encryption, not end-to-end encryption: Chord's servers hold the encryption keys, so Chord can decrypt this data when it needs to (for example, to show your notes back to you, or as described in Section 4.2).

4.2 Access Controls

• Every database query in our backend is scoped to the authenticated user's own account (owner-scoped access, enforced in application code — every user-facing route requires a valid session token before it will read or write that user's data). Other people can see your content only through the sharing features described in Section 6.
• Every endpoint that reads or changes your account data requires a valid authentication token. A few pages are public by design (for example public setlist pages, a Night page you choose to make public, and these legal pages).
• A small number of authorised Chord administrators can access account data — including decrypted memory notes — only as needed to operate and support the Services, to review reported content and safety issues, and to comply with legal obligations.
• Administrative access requires a dedicated administrator role and a recent sign-in.

4.3 Data Residency

Your data is stored in a MongoDB Atlas database, which runs on top of AWS infrastructure. Your data may be stored in data centres located in the United States, the European Union, or Singapore, depending on the Atlas project configuration. Chord's backend servers are hosted on Railway. We select hosting regions that comply with applicable data protection laws.

Media files (photos, videos, voice notes) are stored on Amazon S3 and served via Amazon CloudFront, which operates globally. Files are encrypted at rest and in transit.

4.4 Data Retention

5. Third-Party Services

We use a limited number of third-party services to operate Chord. We select partners that meet our privacy standards.

Services we do NOT use: Google Analytics on the Website, Facebook SDK, Mixpanel, Amplitude, Segment, any advertising SDK, any cross-app tracking framework, any data broker or data marketplace.

6. Data Sharing

We do not sell, rent, lease, or trade your personal data. We share data only in these limited circumstances:

We will notify you before any business transfer that would change the controller of your data, and you will have the opportunity to delete your data before the transfer.

7. Your Rights

7.1 Rights Under GDPR (UK/EU Users)

If you are located in the United Kingdom or European Economic Area, you have the following rights under the UK GDPR and EU GDPR:

What "Download my data" contains. It is a single JSON file with your profile, your memories (including decrypted notes, and links to your photos, videos and voice notes rather than the media files themselves), collections, detected songs and detection history, comments, crew-chat messages, letters, tributes, connected-service data and consent records. It does not yet include your Support settings (Notes to Self, My Person and comfort memories) or tag notes; email privacy@chordapp.in for a copy of those, or of anything else we hold.

Deleting your account. When you delete your account, we immediately clear your profile details and sign you out everywhere. All remaining data — memories, media files and every other record — is permanently erased 30 days later. If you change your mind within those 30 days, contact support@chordapp.in from your original email address and we will restore the account; you cannot sign back in during that time.

We will respond to all rights requests within 30 days.

7.2 Rights Under India's Digital Personal Data Protection Act, 2023 (DPDP Act)

If you are located in India, you have the following rights under the DPDP Act:

"Child" under the DPDP Act and our consent mechanism. The DPDP Act defines a "child" as anyone under 18 — a broader threshold than the 16+ floor our Terms set for using the Services at all. This means a 16- or 17-year-old user is an adult under our Terms but still a "child" for DPDP purposes, and processing their personal data requires verifiable parental or lawful-guardian consent under Section 9 of the Act. At registration, we collect a date of birth (rejecting anyone under 16 outright) and a required checkbox attesting "I am 16 or older... If under 18, I have my parent's or guardian's consent," timestamped and versioned against the Terms in force at signup. This is a self-attestation recorded at the point of registration, not an independently verified parental consent — we do not currently collect a parent's identity or a separate parental confirmation. If we become aware that a 16- or 17-year-old's parental consent was not genuinely obtained, we will treat it the same as an under-16 discovery under Section 8 below.

7.3 Rights Under California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have the right to know what personal data we collect, request deletion, and opt out of the sale of personal data. We do not sell personal data. We do not share personal data for cross-context behavioural advertising.

8. Children's Privacy

Chord is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16, and registration is blocked at the point of signup for anyone whose date of birth indicates they are under 16 (see Section 2 of our Terms).

Connecting an AI assistant (Section 2.8) is only for people aged 18 and over; accounts under 18, or with no date of birth, cannot connect one.

If we nonetheless become aware that a user is under 16 — including through a report submitted by another user, flagged with a dedicated "underage" reason so our team can prioritise it — we will suspend the account immediately, permanently delete all associated data (memories, media, comments, and account information), and confirm the deletion internally. We do not notify the reported user that a report was filed against them. If you believe a child under 16 has provided us with personal data, please contact us at privacy@chordapp.in or report the account directly in the App.

9. Cookies and Tracking Technologies

9.1 Website (chordapp.in)

The Website does not use advertising cookies or third-party tracking cookies, and it does not use Google Analytics.

• Your cookie choice. When you first visit, the Website asks whether you accept analytics. Your choice is stored in your browser's local storage (under "chord-consent-v1"), and a record of the choice (accepted or declined, the categories, your region and your browser's user agent) is sent to our form provider, Netlify.
• Analytics (only if you accept). PostHog (EU region) is the only analytics tool on the Website, and it is loaded only after you accept analytics. It keeps a random identifier in your browser's local storage (not in a cookie). It records page events and session recordings in which all text and all form inputs are masked, so what you type — such as your email address in the waitlist form — is not captured.
• If you decline, no analytics run on the Website.

9.2 Web app (app.chordapp.in)

The web app uses your browser's storage to keep you signed in. It shows a cookie banner; only if you accept analytics does it load PostHog (EU region) — which keeps an identifier in your browser's local storage and a first-party cookie, links usage events to your Chord account ID, and may record sessions with all text and form inputs masked — and Google Firebase Analytics. Error reports sent to Sentry can include a short, masked replay of the page.

9.3 App

The Chord App does not use cookies, tracking pixels, advertising identifiers, or device fingerprinting. It does send product-analytics events to PostHog (EU region), linked to your Chord account ID; there is not yet an in-App switch to turn this off — email privacy@chordapp.in if you want us to stop analytics for your account.

10. International Data Transfers

If you are located outside of India, your data may be transferred to and processed in India (where our company is registered) and in the countries where our service providers in Section 5 operate (including the United States, the European Union, and Singapore).

For transfers from the UK/EU, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, and the UK International Data Transfer Agreement (IDTA), as applicable. Our infrastructure providers (MongoDB Atlas, Amazon Web Services) maintain appropriate data transfer mechanisms.

11. Security Incident Response

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours (as required by GDPR)
• Notify affected users without undue delay via email
• Provide clear information about what data was affected, what we are doing to address it, and what you can do to protect yourself

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:

• Displaying a notice within the App
• Sending an email to the address associated with your account
• Updating the "Last updated" date at the top of this Policy

Your continued use of the Services after notification constitutes acceptance of the updated Policy. If you do not agree with any changes, you may delete your account and data at any time.

13. Contact Us

For any privacy-related questions, requests, or complaints:

Email: privacy@chordapp.in

Company: Anantaswar Technologies Private Limited, registered office in Mumbai, Maharashtra, India

Grievance Officer (India DPDP Act): Name: Ameya Bhanushali Email: grievance@chordapp.in Address: Anantaswar Technologies Private Limited, Mumbai, Maharashtra, India

Data Protection Representative (UK/EU): None is appointed yet. Chord has no establishment in the UK or EU and has not yet appointed a representative there. Until one is appointed, UK and EU users can contact us directly at privacy@chordapp.in.

We aim to respond to all enquiries within 48 hours and resolve all formal requests within 30 days.

14. Regulatory Compliance Summary

15. Medical and Therapeutic Disclaimer

Chord is NOT a medical device, therapeutic tool, diagnostic system, or healthcare service. Chord does not provide medical advice, mental health treatment, counselling, or therapy. Where Chord shows health or fitness information from a service you connect (such as Fitbit or WHOOP), it is for your information only — it does not diagnose, treat, cure, or prevent any disease or medical condition.

The Support ("Take a pause") screen and Safety Mode are not a substitute for professional mental health care or emergency services. If you are experiencing a mental health crisis, please contact emergency services or a qualified mental health professional. In India, you may contact iCall at 9152987821 for free, confidential counselling.

We do not make claims of clinical efficacy.

Chord | Privacy Policy v1.0 | © 2026 Anantaswar Technologies Private Limited

Exercise your rights

Use these forms for anything we hold from this website (your waitlist signup or messages). For your Chord account, the fastest route is in the app — see Section 7 above — or write to privacy@chordapp.in. We confirm every request by email before acting.