Security & Privacy

Last updated: August 27, 2026

Music Practice Coach is built to be local-first and private on every platform — the iPhone and iPad app, the Mac app, and the web app. There are no servers, no accounts, and no tracking. Your practice content lives on your device, and this page explains how it is protected on each platform.

Your content stays with you

Safe imports, on every platform

Practice packages are ZIP files that can contain plans and media. Whichever platform you use, the app applies the same checks when importing one:

• File paths are validated — packages containing absolute paths, parent-directory (“..”) escapes, or other unsafe path tricks are rejected.
• Contents are unpacked only into the app's known folders (plans, audio, PDFs, video), and only for supported file types. Anything else is skipped.
• Per-file and total size limits, plus a compression-ratio limit, guard against oversized or “zip bomb” archives.
• A plan's references to media are checked; any that point outside the package are ignored rather than followed.
• Video links are accepted only as HTTPS youtube.com / youtu.be URLs — other schemes and hosts are rejected.

iPhone & iPad

• The app runs inside Apple's app sandbox: it can reach only its own storage and files you explicitly pick or import — not the rest of your device.
• The microphone and camera are used only when you actively tap a Record control, and recordings are saved on your device inside the package you're editing.

Mac

• The Mac app runs in the macOS App Sandbox. It can read and write only the folders you explicitly choose; that access is remembered with security-scoped bookmarks so it doesn't need broad access to your disk.
• Exports go through a standard Save panel (defaulting to Downloads) rather than writing silently, so the app never holds standing access to your Downloads or other folders.

Web (in your browser)

The web app offers two ways to store your library, and never touches files outside them:

• Browser storage: your library is kept in private storage that belongs to this website only. The app has no access to your normal files or folders. Because browsers can clear this storage (clearing site data, private windows, or space pressure), the app encourages keeping a backup or moving to a folder.
• Local folder: you choose one folder, and the app reads and writes only inside it. We recommend creating a dedicated “PracticeCoach Library” folder rather than Documents, Desktop, or a whole cloud drive — and the app warns you if a folder you pick doesn't look like a library. Write access is requested only after you confirm the folder.

If you point the web app and the Mac app at the same local folder, they share one library — a plan you add or edit in one shows up in the other. There is no live sync or conflict detection: whichever app saves last wins, so avoid editing the same plan in both apps at the same time. The web app re-reads the folder when you return to its tab, so changes made in the Mac app appear without a manual reload.

The web app also includes no third-party analytics or advertising trackers.

Protecting a package with a code

A teacher sharing a practice package can lock its media — recordings, scores, video — with a code. The student installs the package as usual, and the first time they play a locked step the app asks for the code once, then remembers it on that device.

The purpose is narrow and worth stating plainly: it exists so that copyrighted material a teacher hands to their own students is not casually forwarded onward. That is the only thing it is for.

• Only the shared copy is locked. Your own files stay ordinary, unlocked files on your disk. The app never encrypts your library; the lock is applied when a package is exported, to the copy inside that package.
• Codes travel separately. The code is never inside the package. A teacher gives it to students by message, email, or in person.
• Nothing goes to us. Locking and unlocking happen entirely on your device. We never see a code, a key, or a file.

Under the hood this uses standard, well-established cryptography — AES-256-GCM for the content, with keys derived from your code using PBKDF2-SHA256. The format is documented and identical on Mac, iPad, iPhone and the web, so a package locked on one opens on any of the others.

We would rather be honest about the limits than oversell this. It is friction, not a vault. It raises the effort of passing material on, and it is not designed to stop a determined expert with the right tools — the same recording can often be found elsewhere anyway. Treat it as a courtesy to whoever owns the music, not as a guarantee. If a file must never be seen by the wrong person, do not distribute it at all.

Playback and third parties

Some steps play a YouTube video; the app uses YouTube's official player and passes only a video identifier, never an arbitrary link. The metronome and MIDI playback may load instrument sounds from their hosts. These features involve those services' own privacy practices and never send them your files. If you prefer no third-party contact at all, avoid YouTube steps — everything else works offline.

Questions

Security or privacy questions can be sent to support@music-practice-coach.com.