Privacy policy
Last updated: 18 September 2026.
NodaLab stores what it needs to give you an account and keep what you build in it, and nothing else. Here is the whole list.
What is stored
- Your account: the name and e-mail address you gave, your password as a hash that cannot be turned back into it, your language and theme, and a profile picture if you added one.
- What you build: your saved graphs and collections, the MIDI files you upload, the groups you own or belong to, the messages you post in a shared graph's discussion, and who you share with.
- Your workspace: which sections are open and the graph you were editing, so the app reopens as you left it.
- If you asked for an account and it has not been answered yet: the request itself, with the same name, address, password hash and the note you left.
- If someone generated an invitation link for you: the link itself, until it is used, revoked or lapses after two weeks. It holds the role it grants, who issued it and which group you will join, and nothing about you.
- The reports you send about the app from your account page: what you wrote, and the answer an admin writes back. An admin sees them with your name and address; you can delete any of yours.
- For every page of the site, how many different people opened it each day. To count you once rather than at every reload, the server keeps for the day a mark standing for your visit: your address and browser hashed under a secret it draws at random each day and never writes down. That mark cannot be turned back into your address, cannot be matched with the one you leave the next day, and is deleted as soon as the day is over. What is left, and kept, is the count: no address, no browser, no account.
Why
To run the account you asked for and the features you use: signing in, saving, sharing with the people you chose. Nothing is used for advertising, profiling or resale, and nothing is handed to anyone else.
Cookies
One cookie, set when you sign in, keeps you signed in for fifteen days. It is technical and carries no tracking. The demo and the public pages set none; they remember your language and theme in your own browser only.
Third parties
When a graph plays, your browser fetches instrument sounds from the MIDI.js soundfont site (gleitz.github.io, hosted by GitHub), which therefore sees your address as any website you open does. The application itself sends nothing anywhere else.
How long
As long as your account exists. An account request that is turned down is deleted at once. The mark that tells one visit from a reload is deleted the day after it was left; the page counts themselves are kept for four hundred days.
Your rights
You can read and change your name, e-mail address and picture from your account page at any time, and delete your account there: it removes everything listed above, at once and without a copy being kept, except for backups of the whole database, which are overwritten within a few weeks. For anything else — access, correction, a complaint — write to {contact}. You may also lodge a complaint with the CNIL, the French data protection authority.