Privacy Policy (effective 2026-10-06)

Previous version. This is the privacy policy that took effect on 2026-10-06. It applies until the day before 2026-10-30; from 2026-10-30 the revised privacy policy applies, which opens with the reasons for the change and what changed.

This is an English translation of the Korean privacy policy (개인정보처리방침). If the two versions differ, the Korean version prevails.

Your MIDI files and chord progressions are processed on your device and never uploaded. An account is created when you sign in; payment records exist only if you buy Remove Ads.

Culture & Tech (the "Operator") establishes and publishes this privacy policy under Article 30 of the Personal Information Protection Act ("PIPA") to protect the personal information of data subjects and to handle related complaints promptly and smoothly. It applies to Chord to MIDI (https://chord-to-midi.app, the "Service"), provided by the Operator.

1. Purposes of processing

The Operator processes personal information for the purposes below. It isn't used for any other purpose, and if a purpose changes, the Operator will take the steps required by Article 18 of PIPA, such as obtaining separate consent.

1. Member management: identifying members who sign in with a Google, Kakao or Naver account or an email link, linking several ways to sign in to one account, recovering an account with its confirmed email, linking a Remove Ads purchase to the account and restoring it, moving Remove Ads to another account after checking the proof of a member who lost both their sign-in and their mailbox, and handling withdrawal (account deletion).
2. Selling and providing Remove Ads: confirming the email that receives receipts, creating orders, approving, cancelling and refunding payments, providing receipts, applying Remove Ads, and notifying buyers of important matters about it, such as the end of the Service.
3. Legal obligations and customer support: keeping transaction records under the Act on the Consumer Protection in Electronic Commerce, handling inquiries and complaints, and responding to disputes.
4. Security: preventing misuse such as automated requests and payment fraud, and keeping the Service running reliably.
5. Advertising: showing Google AdSense ads to keep the Service free. The information used for ads is collected directly by Google and by the third-party ad technology providers that take part in delivering an ad, not by the Operator, as described in Section 9.

2. Personal information processed

What we don't collect

We don't collect the MIDI files you open, the progressions you type, the MIDI you generate, the audio you play or your tool settings (octave, unit, velocity, tempo and so on). All of it is processed only inside your browser and is never sent to the Operator's servers or to third parties. Your settings and the progression you're working on are stored only in your browser (localStorage), so you can pick up where you left off. Favorites you save (a progression and its tempo) are also stored only in your browser (localStorage), and never on the Operator's servers, even when you're signed in. They don't appear in other browsers or on other devices, and clearing this site's data in your browser deletes them. A progression in a share link sits after the # in the address, which browsers don't send to servers. If you use the DAW drag extension, the clips the tool makes also go to its companion app on your computer, and they don't leave your computer either (see 3 below).

If you use the tool without signing in, the Operator doesn't collect your personal information. However, the information in 2 below may be generated and collected automatically while you use the Service.

1. When you sign in or buy Remove Ads

Signing in is needed only to buy Remove Ads or to restore a purchase. Your first sign-in creates an account, and the account information below and that of the sign-in method you chose are kept until you withdraw, whether or not you buy.

Email addresses provided by Kakao and Naver are used only for display and to suggest the address to confirm, never to find or merge accounts. The receipt and recovery email is used only once you have opened the link sent to it. The emails with sign-in, confirmation and change links are sent by Firebase Authentication (Google). The Operator uses Kakao's and Naver's access tokens once, to receive your member information, and doesn't store them.

Card numbers, expiry dates, passwords and other payment details are entered in Toss Payments' payment window and processed by Toss Payments. Of the information Toss Payments reports about a payment, the Operator doesn't store the card number, the buyer's name, contact details or similar data.

2. Information generated and collected automatically

Security check information and access logs are processed for the Operator's legitimate interest in running the Service securely and reliably (PIPA Article 15(1)6). The account and payment pages and the legal pages, such as the terms and this privacy policy, carry no ads. If you're signed in, your sign-in state and whether Remove Ads applies are also kept in your browser so they take effect immediately on your next visit.

3. When you use the DAW drag extension

The Chrome extension Chord to MIDI DAW Bridge and its companion app, Chord to MIDI Bridge, let you drag a clip from the tool straight into a music application such as Cubase. Both run only on your computer, and nothing they handle reaches the Operator or any third party.

To stop, turn off or remove the extension in Chrome and uninstall the companion app. Deleting the folder above deletes the saved clips at once.

The extension's use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. The extension receives no personal information from Google; the only user data it handles is the clips above, used only for dragging them into a music application, never transferred to anyone, never read by a person, and never used for ads, sold or used for any other purpose.

3. Processing and retention periods

(1) The Operator processes and keeps personal information only within the retention period required by law or set when it was collected.

(2) The retention periods by item are:

• Account information, sign-in information, the receipt and recovery email, and buyer information: until you withdraw (delete your account). When you remove a sign-in method on the account page, its information is deleted without delay; when you disconnect the service at Naver, only a note that it was disconnected is kept. Remove Ads stops applying earlier if the payment is refunded (cancelled).
• Temporary records: email confirmation and change requests lapse after 30 minutes, and payment details kept while you sign in after 10 minutes; they are then deleted automatically (usually within a day), and immediately when you withdraw.
• Order and payment records, and administration records: until the end of the legal retention period in (3) (5 years).
• Inquiry records: 3 years from the day the inquiry is resolved.
• Advertising information, security check information and access logs: kept for the period set by Google and then deleted. The Operator uses server records only to investigate errors in the Service.

(3) Information kept under law:

(4) When you withdraw (delete your account), your account information, sign-in information, receipt and recovery email, buyer information and temporary records are destroyed without delay. Because the records in (3) must be kept for the legal period, they are kept separately from other personal information, with your account identifier and the receipt email address of your orders replaced by values from which the originals can't be recovered (hashes; pseudonymization), and are destroyed when the period ends. These values are not anonymous data; they are used only to match a refund or move request to its order. The receipt email address of your orders is replaced this way also when an order's Remove Ads was moved to another account.

4. Provision to third parties

The Operator processes personal information only within the purposes in Section 1 and provides it to third parties only in the cases allowed by Articles 17 and 18 of PIPA, such as with the data subject's consent or under a specific provision of law. The Operator currently provides no personal information to third parties.

5. Outsourcing of processing

(1) To provide the Service smoothly, the Operator outsources processing as follows.

(2) When concluding outsourcing contracts, the Operator sets out in writing, under Article 26 of PIPA, that personal information may not be processed beyond the outsourced work, the technical and managerial safeguards, restrictions on re-outsourcing, management and supervision of the processor, and liability for damages, and it supervises whether the processors handle personal information safely.

(3) If the outsourced work or the processors change, the Operator will publish the change in this privacy policy without delay.

6. Transfers abroad

(1) To conclude and perform contracts with data subjects, the Operator has personal information processed and stored abroad, and discloses the following under Article 28-8(1)3 of PIPA.

(2) Cloud Firestore and Cloud Functions are in Google's Seoul region (asia-northeast3), so the buyer information, Kakao and Naver member identifiers and profile information, and order and payment records stored there are processed in Korea. Firebase Authentication, however, handles every member's account whatever the sign-in method, and is transferred abroad as follows.

(3) The recipient in every case is Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), except for the third-party ad technology providers under "Advertising" below. Privacy questions can be sent to Google as described in Google's privacy policy.

Sign-in (Firebase Authentication)

• Countries: the United States and other countries where Google operates data centers
• When and how: when you sign in (and at each later sign-in), and when you ask for an email link or confirm or change an email, sent over the network
• Items: account identifier (Firebase UID), account creation and sign-in times, display name (your name with Google; your nickname with Kakao or Naver), for Google sign-in your Google account ID, email address and profile photo URL, and for email sign-in and the receipt and recovery email that email address
• Purpose: signing you in, managing your account and sending sign-in, confirmation and change emails
• Retention: until you withdraw (delete your account)
• How to refuse, and the effect: if you don't sign in, nothing is transferred. Without signing in you can still use every feature of the tool, including typing progressions, playback, and MIDI download and import, but you can't buy or restore Remove Ads. If you've already signed in, you can delete your account on the account page to have this information deleted.

Site delivery and security (Firebase Hosting, Firebase App Check)

• Countries: the United States and other countries where Google operates servers
• When and how: when you open the site (access logs) and when you use the sign-in and purchase features (security check information), sent over the network
• Items: access logs (IP address, browser information, requested address, access time) and security check information (browser and device information, information about the environment you use, verification tokens)
• Purpose: delivering the site, preventing misuse and keeping it secure
• Retention: for the period set by Google
• How to refuse, and the effect: this information is needed to deliver and protect the site, so the only way to avoid the transfer is not to use the site. Security check information isn't transferred unless you use the sign-in and purchase features.

Advertising (Google AdSense)

• Recipients: Google LLC and, when they take part in delivering or measuring the ad shown, Google's third-party ad technology providers (their names, websites and privacy policies are in Google's list referred to in Section 9)
• Countries: the United States and other countries where Google and those providers operate servers
• When and how: collected directly by Google through its scripts and cookies when you open a page that shows ads; a participating provider collects it while the ad is delivered
• Items: cookies, advertising identifiers, IP address, browser and device information, pages visited, ad views and clicks
• Purpose: showing ads (including personalized ads), measuring ad performance and preventing invalid clicks
• Retention: according to Google's and those providers' policies
• How to refuse, and the effect: you can refuse personalized ads and cookies as described in Section 9 and still use every feature of the tool. When you're signed in with an account that has Remove Ads, the ad code isn't loaded at all.

7. Destruction procedure and method

(1) When personal information is no longer needed, for example because its retention period has ended or its purpose has been achieved, the Operator destroys it without delay.

(2) Where a law requires information to be kept, it is stored separately from other personal information (Section 3(4)) and destroyed when the retention period ends.

(3) Electronic files are deleted so that they can't be recovered. When a member withdraws, their Firebase Authentication account, their buyer information and sign-in method links in Cloud Firestore, and their temporary records are deleted; copies left in Google's backups are deleted after a period under Google's policies. Personal information on paper is shredded or incinerated.

8. Your rights and how to exercise them

(1) You can ask the Operator at any time to let you access, correct or delete your personal information, or to suspend its processing.

(2) On the account page you can check your Remove Ads status and purchases, change your receipt and recovery email, link and remove sign-in methods, and delete your account yourself. Other requests can be emailed to the privacy officer in Section 12, and the Operator will act without delay (within 10 days) and tell you the result.

(3) You can also exercise these rights through a representative, such as a legal guardian or someone you have authorized. In that case, a power of attorney must be submitted.

(4) Requests for access and for suspension of processing may be limited under Article 35(4) and Article 37(2) of PIPA.

(5) Personal information that another law specifically requires to be collected can't be deleted on request, and the transaction records in Section 3(3) are not deleted during their retention period.

(6) The Operator checks that the person making a request is you or your rightful representative.

9. Cookies and other automatic collection, and behavioral information

Cookies and browser storage

• The tool's settings, the progression you're working on, your favorites and your language choice are kept in your browser's local storage (localStorage), not in cookies, and are never sent to a server. If you're signed in, your sign-in state and whether Remove Ads applies are kept in browser storage too.
• On pages that show ads, Google uses cookies and advertising identifiers.

Behavioral information and personalized ads

The Service shows Google AdSense ads to stay free. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.

The Operator doesn't receive or store the behavioral information Google or its providers collect. You can read how Google uses information from sites that use its services in Google's explanation.

Third-party ad technology providers

Google AdSense delivers ads not only through Google but also through Google's ad technology providers: ad networks, ad exchanges, measurement companies and the like. When one of them takes part in delivering or measuring an ad on this site, it may process the advertising information above under its own privacy policy. Which providers take part depends on the ad shown at the time, on Google's settings and, for visitors from the European Economic Area, the United Kingdom and Switzerland, on your consent choices. So not every provider Google makes available receives information on every visit, and a provider that is enabled doesn't necessarily process your information.

The names of the providers that may be used, each with a link to its website and privacy policy, are in Google's maintained list of ad technology providers. The Operator chooses the providers used for this site's ads within that list through Google's settings, and follows the list as it changes. Visitors from the European Economic Area, the United Kingdom and Switzerland can also see the list of providers in Google's consent message and manage their consent for each. The information processed for advertising is limited to the advertising information above: your MIDI files and progressions are processed only on your device, as Section 2 explains, and are never passed to Google or its providers.

How to opt out

• Turn off personalized ads in Google's Ads Settings.
• Opt out of third-party vendors' use of cookies for personalized advertising at www.aboutads.info, or on an individual provider's own website, linked from the list above, where it offers that.
• Block or delete cookies in your browser settings. Every feature of the tool still works, and ads may be shown without personalization.
• Sign in with an account that has Remove Ads, and the ad code isn't loaded at all.

Visitors from the European Economic Area (EEA), the United Kingdom and Switzerland see Google's consent message, and their choice decides whether ads are personalized and which providers may process their information. Every feature of the tool works without consent.

10. Children under 14

The Operator doesn't accept sign-ups (sign-ins) or Remove Ads purchases from children under 14, and checks at purchase that the buyer is 14 or older. If the Operator learns that it has collected personal information of a child under 14, it destroys that information without delay. Anyone can use the tool without signing in.

11. Measures to keep personal information secure

Under Article 29 of PIPA, the Operator takes the following measures.

1. Data minimization: the Service is designed so that MIDI files and progressions are never sent to a server, and card numbers and other payment details are not stored.
2. Encryption in transit: all communication between the site and the servers is encrypted with HTTPS.
3. Access control: database security rules let members read only their own records, and only server functions can write records. Administrative functions can be used only by accounts with administrator rights.
4. Secrets management: payment secret keys, Kakao's and Naver's client secrets and other credentials are kept in Google Cloud Secret Manager and never in source code or logs. Kakao's and Naver's access tokens are not stored.
5. Account protection: email confirmation and change links apply only to the account that asked for them and lapse after a while; linking or removing a sign-in method and changing the email need a recent sign-in. Accounts are never merged because their email addresses are the same.
6. Misuse prevention: Firebase App Check blocks requests that don't come from the genuine app.
7. Minimal access: the number of people who handle personal information is kept to a minimum, and the records of administrative actions keep pseudonymous identifiers only.
8. Physical security: personal information is stored in Google's data centers under Google's physical security controls.

12. Privacy officer

(1) The Operator has designated the following privacy officer, who is responsible for all personal information processing and for handling data subjects' complaints and remedies related to it.

• Name: Chan Baek
• Email: contact@cultureand.tech
• Phone: +82-10-2265-8170

(2) You can bring any privacy question, complaint, request for remedy or request for access arising from your use of the Service to the privacy officer, and the Operator will answer and act without delay.

13. Remedies for infringement

To seek remedies for an infringement of your personal information, you can apply for dispute resolution or counseling to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA), and similar bodies. For other reports and counseling about infringements, you can contact the agencies below.

• Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (no area code) (www.spo.go.kr)
• Korean National Police Agency: 182 (no area code) (ecrm.police.go.kr)

14. Changes to this privacy policy

(1) This privacy policy takes effect on 2026-10-06.

(2) If anything is added, removed or changed, the Operator will announce it on the site from 7 days before the change takes effect. Important changes to your rights, such as changes to the items collected or the purposes of use, will be announced from 30 days before they take effect.