Privacy policy

1. Who we are

Play Darbuka is operated by Calanur Limited, a company registered in England and Wales under number 17148576, with its registered office at 124 City Road, London, England, EC1V 2NX. Calanur Limited is the controller responsible for the personal data described in this policy. Use the support page for questions about privacy, your data or this policy.

Contact support

Business email: info@playdarbuka.com

2. Personal data we collect

• Account and identity data. Email address, password hash, verification status, language preference, account identifiers, sign-in/session records and any previously recorded declarations that you are 18 or older.
• Music and preferences. Saved arrangements, custom rhythms and scores, favourites, musical settings and the information you include in those items when you sync them to your account.
• Community data. Published rhythm snapshots, chosen display names, likes, reports, report descriptions and moderation records.
• Billing data. Stripe customer, subscription, checkout and payment references, payment status, paid periods and information about refunds or disputes. Incoming Stripe notifications are reduced to the references needed to reconcile billing; our event records do not retain customer names, email addresses, billing addresses or full notification contents. Stripe collects payment and billing details; we do not store full card numbers or security codes.
• Support data. Your optional name, email address, subject, message and verification/delivery information when you contact us.
• Content feedback. When you choose to send feedback, we save your message with your account, the selected content, language and practice settings, including a snapshot of an exercise where relevant. Authorised staff use it to review and improve the content. This is separate from optional analytics. Feedback remains in our private admin inbox until removed by staff or your account is deleted.
• Technical and security data. IP addresses, browser/device information, session identifiers, authentication activity, timestamps and request, error and abuse-prevention records. Optional analytics is described below.
• Browser storage and external content. Local music, reference files and preferences on your device, and information sent to external providers when their resources load.

Please avoid including unnecessary sensitive information in support messages, music titles, descriptions or community reports. An email address and password are required for an account, and payment information is required for a paid subscription. Without required information, we cannot provide the relevant feature; public practice tools remain available without an account.

3. How we collect personal data

We receive information directly from you, automatically from your browser or device, and from providers that help us operate the service. For example, Stripe sends payment and subscription updates, email providers handle delivery information, and other members may submit reports about shared rhythms.

4. How we use personal data

• Provide the service. Create and secure accounts, verify email addresses, manage Pro access, process subscription changes and sync the music and preferences you choose to save.
• Support the community. Publish rhythms at your request, record likes, review reports and address misuse or copyright concerns.
• Communicate with you. Send account, security and billing messages and respond to enquiries and privacy requests.
• Optional practice emails. Use your practice history, goals, language and time zone to send daily reminders and weekly progress updates. Both are on by default for new accounts and existing accounts without saved email preferences; saved choices are preserved. You can turn either email off in Account or unsubscribe from the email without signing in. We retain your email preferences and delivery-attempt records until account deletion; these records help prevent duplicate emails. We do not track opens or clicks in these practice emails.
• Keep the service reliable. Prevent abuse, investigate errors and incidents, and understand practice-tool usage where you have accepted optional analytics. We also use aggregate server performance counts without visitor identifiers or music content.
• Meet legal responsibilities. Maintain necessary records, resolve disputes, comply with lawful requests and protect our users and legal rights.

Practice exercises are generated from musical rules and settings. We do not use the service to make solely automated decisions about people that have legal or similarly significant effects.

5. Your music and community sharing

Free accounts save favourites and one last-practice link, including the rhythm or exercise, tempo and time, for use across devices. My Practice also saves session titles and links, dates, active durations, tempo, quiz and tapping results, goals, time zone and self-rated rhythm confidence to your account. This private history powers your dashboard, XP and achievements and is separate from optional analytics. Unfinished and unsynced sessions are temporarily kept in this browser for recovery. Account history is retained until your account is deleted or you ask us to remove it. Free accounts also save up to three custom rhythms and three arrangements across devices. Pro increases this to 500 rhythms, arrangements and scores in total and syncs musical preferences. Other device settings remain in your browser. Imported reference PDFs and images stay on your device; they are not uploaded to your account or analytics.

Rhythms are private by default. Publishing shares a saved version and your chosen display name with other Pro subscribers, who can play and like it. Your account email is not shared. You can unpublish a rhythm. Account deletion removes your publications and likes.

Aggregate admin reports also count how many accounts currently save each published content item as a favourite. These counts use synced favourites independently of optional usage analytics, without showing account details or private music. Removing a favourite or deleting your account removes it from these current counts.

Authorised staff can review community reports and moderation records to protect the community. A report can retain the reported title, display name, description and report details after the rhythm is unpublished or deleted. Avoid identifying yourself or anyone else unnecessarily in shared music.

6. Our legal bases

Where UK GDPR, EU GDPR or similar laws apply, our purposes and legal bases are:

• Contract. Providing the account, subscription, cloud music and sharing features requested by the adult account holder under our agreement with them, including essential service communications and support needed to deliver them.
• Legitimate interests. Securing and administering the service, preventing fraud and abuse, moderating the community, responding to other enquiries, investigating incidents and protecting our business and users. We consider these interests against your rights and expectations. This also covers providing supervised practice to young people who are not themselves the account holder; we give particular weight to their rights and interests.
• Legal obligation. Keeping records required by law and responding to applicable legal duties, court orders and lawful requests.
• Consent. Loading optional analytics and recording optional practice activity after you accept it. You can withdraw consent at any time without affecting earlier lawful processing.

7. Cookies and similar technologies

We use cookies, local storage and IndexedDB to operate requested features and remember choices. Essential storage works whether you accept or reject optional analytics. Browser controls let you clear or block storage, although this can sign you out or remove saved music.

• Sign-in cookies. Keep your account session secure. A remembered session can last up to 14 days; other sessions may end when you close the browser or sign out.
• Pricing currency. We estimate your country from your IP address on our servers to suggest a currency. We do not send your IP address to the geolocation database provider. You can change the currency; your explicit choice is remembered in a cookie for up to one year.
• Form-security cookies. Protect against forged requests. The CSRF cookie can last up to one year and may be refreshed when used.
• Music, reference files and preferences. Remain in browser storage until removed by you, the app or your browser. Signing out or deleting an account does not clear every device copy.
• Privacy choice. Stored in this browser until changed or cleared; it has no fixed automatic expiry.
• Optional practice-return day. Stores only the UTC day of your latest qualifying practice visit. It is replaced by a later visit and removed when you withdraw analytics consent or clear storage.

Privacy settings

Optional analytics is off by default. Umami loads and practice analytics starts only after you choose Accept optional. Reject optional leaves it off. You can withdraw permission at any time using Privacy settings on this page; this stops future analytics and removes the stored practice-return day. We remember your choice in this browser using local storage. Essential sign-in, security and saved-music storage continues to work with either choice.

Optional analytics is for adults’ own use only. If anyone under 18 uses this browser for Play Darbuka, choose Reject optional in Privacy settings before they use it, even when an adult is supervising. This setting applies to everyone using that browser.

Change privacy settings

Optional practice analytics

With the same optional analytics permission, Play Darbuka also records views of public content, playback attempts and active playback time for aggregate admin reports that guide content development. Video player opens are counted separately, without video watch time. Each view or attempt has a temporary random reference to prevent duplicate counts; it is not a visitor identifier and is not linked to your account. These individual records cover up to 90 UTC calendar days and older records are removed during collection or scheduled maintenance. Daily totals by public content or tool category and language, without interaction references, exact timestamps or visitor identifiers, are retained for long-term content trends. Private and community music is reported only as a tool category, without titles, music or document IDs. Paused and hidden-tab time is excluded. No activity from before your acceptance is replayed. The same permission covers visits to Book Omar and clicks on its private-lesson and event enquiry links. These clicks do not establish that a WhatsApp message was sent or a booking confirmed. Daily totals by language, without interaction references or visitor identifiers, are retained for long-term booking trends after individual records expire.

Umami measures public page visits and use of practice tools, including playback duration and exercise completion. It does not receive your account identity or saved music. To recognise return practice, this browser keeps only the UTC day of your last two-minute practice visit; analytics receives a broad gap category, not that date. Clearing browser storage resets this signal. Tracking respects Do Not Track, Global Privacy Control and the Umami opt-out. No microphone recording or session replay is used.

Reports also include technical context such as browser language, screen size, the public page path and the referring website’s domain. The analytics provider receives network information when your browser contacts it. We do not add your email address, account ID, payment details, music titles or reference files to these reports.

8. Who we share personal data with

Authorised staff and service providers receive information needed for their role. Our services and external resources include:

• Render and infrastructure providers. Website hosting, databases, service operation and associated logs/backups.
• Sentry. Server error and performance diagnostics in production, including error types, stack traces, operation timings and application versions, to help investigate faults. We limit request and account data in these reports.
• Stripe. Payment processing, subscription management, billing and fraud prevention. Stripe also processes some information for its own legal and regulatory purposes.
• Twilio SendGrid and our mailbox provider. Delivery and handling of account emails, verification messages and support correspondence.
• Umami Cloud. Optional public-page and practice analytics after you accept it.
• Cloudflare Turnstile. Browser checks to help prevent automated abuse of support forms when this protection is enabled.
• Google/YouTube and Meta/Instagram. Video thumbnails and embedded players. YouTube thumbnails can load as you browse video listings, before you press play. Selecting a video loads its provider’s player; YouTube uses privacy-enhanced mode. These requests reveal network/browser information, and providers may use their own cookies or similar technologies. Your analytics choice does not control these external resources.
• Bandcamp. Embedded album players on Omar’s profile connect to Bandcamp when they load, before you press play. These requests reveal network/browser information. Bandcamp applies its own privacy notice; your analytics choice does not control these players.
• GitHub and other linked publishers. Some original sound samples load from GitHub when requested. Following an external lesson or source link contacts that publisher. External services apply their own privacy notices.

Other Pro members receive the music and display name you explicitly publish. We may also disclose necessary information to professional advisers, authorities or parties involved in a business transfer where lawful and appropriate. We do not sell personal data or share it for cross-context behavioural advertising.

9. International data transfers

We and our providers may process information outside your country, including outside the UK or EEA. Where a restricted transfer requires safeguards, we use applicable adequacy arrangements or approved contractual safeguards, including UK transfer terms where necessary. Contact us for information about a particular provider’s processing locations or a copy of the relevant safeguards.

10. Data retention

We retain personal data for the purpose it was collected, taking account of the service you use, legal record-keeping duties, security needs and applicable dispute or claim periods. The following periods or criteria apply:

• Accounts and cloud music. Kept while your account exists or until you delete individual items. Music remains available to view and export after Pro expires. Deleting music clears its cloud content; a minimal deletion record may remain so your devices can stay in sync.
• Community records. Published music stays available until unpublished or removed. Reports and moderation records may outlast a publication while needed to address the report, prevent repeat abuse or resolve a dispute; account deletion also removes associated records where applicable.
• Billing records. Necessary transaction references remain after account deletion for accounting, tax, dispute and legal record-keeping requirements. Their retention depends on the applicable statutory and claim periods. Stripe retains records under its own legal duties and privacy notice.
• Support. Verification drafts expire after 15 minutes and are removed during routine cleanup. After delivery, their message content is cleared from the temporary draft; a short-lived delivery receipt is eligible for cleanup after one day. Anonymous daily counts of support messages accepted by our email provider are retained for operational reports; these counts contain no message content, subject, contact details or submission identifier. Mailbox correspondence is retained to resolve the enquiry, handle related follow-up or complaints, and meet applicable legal obligations.
• Security, analytics and backups. Security records are kept for incident investigation and prevention needs. Analytics retention depends on the configured provider retention and the period needed to compare usage trends. Backup copies may persist until the applicable backup rotation expires. Contact us for the current retention applicable to a specific record or provider.
• Device storage. Local music, files, exports and preferences remain under your control and your browser’s storage rules. Withdrawing analytics consent removes the local practice-return day and stops new analytics, but does not automatically erase earlier reports.

11. Your rights

Depending on the applicable law and legal basis, you may request access to your data, correction, deletion, restriction of processing or a portable copy of certain information. You can withdraw consent through Privacy settings. Contact us to exercise a right; we may need proportionate information to verify your identity.

We respond without undue delay and within applicable legal time limits, normally one month for UK or EU GDPR requests. If a permitted extension is needed, we will explain it within the initial response period. We will explain any information we must retain and the reason or criteria for retaining it.

Contact support

Your right to object

You can object to processing based on our legitimate interests for reasons relating to your situation. We will consider your request and stop that processing unless an applicable legal ground allows us to continue.

Account and data deletion

You can delete your account from Account settings, or email us or use the support form to request deletion of your account or particular information. Use your account email address where possible and explain what you want removed. If you cannot access that address, tell us. Do not send passwords, verification codes or unnecessary identity documents.

Account deletion cancels active subscriptions and removes your account, cloud music, practice history, favourites, preferences, publications and likes. Account access ends immediately; deletion does not automatically issue a refund. Necessary billing and moderation records may be retained as explained below. Device copies and downloaded exports are not erased remotely: remove them using the app’s controls, your browser’s site-data settings or your device’s file manager. Unpublishing removes a rhythm from the community, but cannot recall copies another person has already made.

Delete account

12. Security

We use technical and organisational measures designed to protect your information, including password hashing, access controls, secure production connections, session and form protections, input validation and abuse limits. Access is limited according to staff responsibilities. No system is completely secure, and we cannot guarantee absolute security.

13. Young people and supervised use (13+)

Play Darbuka is for people aged 13 and over. If you are aged 13–17, you may use it only with the permission and supervision of a parent or legal guardian. Children under 13 must not use the service.

Accounts and Pro subscriptions must be created and managed by an adult aged 18 or over. If you are aged 13–17 and want to use account or Pro features, your parent or legal guardian must hold and manage the account and any subscription for your supervised use.

We do not collect dates of birth or independently verify ages or parental permission.

Optional analytics is for adults’ own use only. If anyone under 18 uses this browser for Play Darbuka, choose Reject optional in Privacy settings before they use it, even when an adult is supervising. This setting applies to everyone using that browser.

If you use an account managed by your parent or legal guardian, they can see the music, practice history and preferences saved to that account. Avoid putting your real name, school, contact details or other identifying information in shared music. You can use the support page to ask about your own information or request its removal, with help from a parent or guardian if you wish.

If you believe a child under 13 is using the service, or a young person is using it without the required supervision or holding their own account, tell us through the support page. We will investigate, restrict access where appropriate and delete information where required, subject to applicable legal retention duties.

Contact support

Read the age and supervision terms

14. Changes to this policy

We may update this policy as the service or our practices change. The date at the top identifies the current version. We will explain material changes on this page and, where appropriate, through the service or by email before new uses of personal data begin.

15. Contact us and privacy complaints

For questions, rights requests or concerns about how Calanur Limited handles your Play Darbuka information, use the email address or support link below.

Contact support

Business email: info@playdarbuka.com

Privacy complaints

Email us or use the support form to raise a privacy complaint. We will acknowledge it within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. You can also complain to the Information Commissioner’s Office (ICO) in the UK or to your local data protection authority. You do not have to complete our complaints process before contacting a regulator.

Contact the ICO or make a complaint