Legal 📜

Privacy Policy

Last updated: April 5, 2026

Shema is built to be privacy-first. This policy explains — in plain language — exactly what the app does and doesn't do with your data. If something here is unclear, email dev+shema@by-shai.net and we'll clarify.

The short version

  • Your songs, lyrics, chords, audio recordings, and videos are stored only on your device.
  • There are no accounts, no sign-in, and no cloud sync.
  • We do not collect your name, email, IP address, location, contacts, or device identifiers.
  • We use a very limited amount of anonymous product analytics to understand which features are used. You can see exactly what below.
  • Some features (microphone, camera, transcription) require permissions or external services — and they only run when you choose to use them.

What is stored on your device

Shema stores the following locally on your device, inside the app's sandbox:

  • Songs & metadata (title, lyrics, chords, notes, key, BPM, tags, timestamps) in a local SQLite database.
  • Audio recordings and videos you capture, in the app's private file storage.
  • App settings (theme, language, haptic preferences, auto-save interval, export preferences).

None of this content is uploaded to us or to any third party. If you delete the app, this data is deleted with it. You can also delete individual songs, recordings, or reset the app from within the app itself.

What we do not collect

To be explicit, Shema does not collect or transmit:

  • Your name, email address, phone number, or any account information (there are no accounts).
  • Your IP address, precise location, or GPS data.
  • Your contacts, calendar, SMS, or call history.
  • Device identifiers such as IDFA, advertising IDs, or unique device IDs.
  • The contents of your songs, lyrics, recordings, or videos.
  • Browsing history or behavior outside of Shema.

Anonymous product analytics

Shema uses Mixpanel to track a small, fixed set of anonymous product events — specifically, when a usage limit or paywall gate is shown. This helps us understand whether limits are set correctly and which features people run into.

What is sent:

  • The name of the event (for example, gate_blocked_capture_new_song).
  • A randomly generated UUID (your "Support ID") created on your device at first launch, stored locally, and used as Mixpanel's distinct_id.

What is not sent:

  • Any personal information, name, email, or account identifier (there are no accounts).
  • The contents of any song, lyric, recording, or video.
  • City, region, or country derived from your IP address — IP-based geolocation is explicitly disabled in our Mixpanel configuration, so $city, $region, and $country_code are not set.

Analytics data is sent to Mixpanel's EU servers (api-eu.mixpanel.com). You can read Mixpanel's own privacy policy at mixpanel.com/legal/privacy-policy.

Your Support ID

Shema generates a random UUID the first time you open the app and stores it on your device. It contains no personal information — it's a random identifier tied only to that install. You can view and copy it from Settings → About → Support ID.

If you contact support about an issue, sharing your Support ID lets us look up your anonymous event trail in Mixpanel so we can diagnose the problem without collecting any personal data from you. Sharing it is optional. If you reinstall the app, a new Support ID is generated.

Permissions the app requests

Shema only asks for a permission when you use a feature that needs it. Each is optional — if you decline, the related feature simply won't work, but the rest of the app will.

  • Microphone — to record audio sketches and voice memos. Recordings stay on your device.
  • Camera — to capture performance videos. Videos stay on your device.
  • Photo Library (read) — to import existing media into a song.
  • Photo Library (write) — to save exported songs or videos back to your library when you choose to export.
  • Speech Recognition — to transcribe your recordings into lyrics. On iOS, transcription runs on-device via Apple's speech recognizer; no audio is sent to us.

Optional transcription via external services

Shema has an optional transcription feature that can use OpenAI or Google Cloud. This is off by default. To use it, you must enter your own API key in the app's settings. When enabled:

  • Audio you choose to transcribe is sent directly from your device to the provider you configured (OpenAI or Google).
  • Shema does not relay, store, or see that audio — it goes straight to the third party under your own API key.
  • The provider's own privacy policy applies to that data. Review it before enabling.

Exporting and sharing

You can export songs, recordings, and archives from the app. Exports use your device's standard share sheet — you choose where the file goes (Files, Messages, email, AirDrop, etc.). Shema does not upload exports anywhere automatically.

No accounts, no sign-in

Shema has no login, no registration, no user profiles, and no social or collaboration features. Everyone's library is private to their own device.

No push notifications, no marketing messages

Shema does not send push notifications, emails, SMS, or any other marketing communications. The app has no mechanism to contact you.

No ads, no advertising SDKs

Shema does not contain advertising, ad networks, or advertising SDKs. We do not sell or rent any data — there is no personal data to sell.

Children's privacy

Shema is a general-audience app. It does not knowingly collect personal information from children under 13 (or the equivalent age in your jurisdiction). Because Shema doesn't collect accounts or personal information from anyone, there is no children's data in our systems. If you are a parent or guardian and have questions, contact us at dev+shema@by-shai.net.

Your rights

Because Shema doesn't hold personal data about you, most traditional data-subject requests (access, deletion, correction) are satisfied directly on your device:

  • Access: All your content is visible inside the app.
  • Delete: Delete songs or recordings inside the app, or uninstall the app to remove everything.
  • Correct: Edit your content directly inside the app.
  • Opt out of analytics: Send us your Support ID (from Settings → About) and we will request deletion of the associated events from Mixpanel.

Security

Your content is stored in the app's private sandbox provided by iOS/Android. No method of electronic storage is 100% secure, but because Shema doesn't transmit your content off-device, the main risks are those that apply to your device itself (device passcode, device encryption, backups). We recommend enabling device encryption and a passcode.

Changes to this policy

If we change how Shema handles data, we'll update this page and update the "Last updated" date above. Material changes will also be reflected in the app.

Contact

Questions, concerns, or deletion requests: dev+shema@by-shai.net