Privacy.

Who we are

Otra, Otra Rescue and otramusic.com are made by SikaHaus LLC, a United States company ("SikaHaus", "we", "us"), which decides how the personal data described here is used. This policy covers otramusic.com, rescue.otramusic.com, app.otramusic.com and the Otra app for Mac.

Questions about privacy go to support@otramusic.com.

Your files

Rescue reads and converts Encore files inside your browser, on your computer. Your scores aren't uploaded to us or to anyone else, and when you close the tab we have nothing of them. The one exception is a fix request, and only when you tick the box to include the file.

In the Otra editor, scores you save to the cloud are stored with your account so you can open them on your other computers and share them. Scores you keep on your computer stay there.

What we collect and why

• The waitlist. When you join the waitlist or register pre-order interest: your email, which of the two you chose, the page you signed up on, and when you agreed to hear from us. We use it only to email you about Otra's launch and pre-orders. You can withdraw that agreement at any time.
• Rescue's mailing list. Rescue's sign-up form passes your email to Brevo, which sends a confirmation email and adds you only once you confirm. Every email has an unsubscribe link.
• The free conversion. To give each visitor one free conversion, Rescue's server keeps a scrambled fingerprint of your IP address (a salted SHA-256 hash, never the address itself), the name of the file you converted free, and when. This keeps the free offer fair.
• Buying a licence. Paddle takes your payment; we never see your card details. From Paddle we receive and keep your email, the order number, what you bought, and when your licence starts, renews or ends, or was refunded. We use them to issue and check your licence key, to find a lost key and to handle refunds and cancellations.
• Fix requests. When you send a conversion report to be fixed: the report, the file's name and Rescue's version; the Encore file only if you tick the box; your email only if you give it. They go to our private issue tracker on GitHub, which only our team can read. We use them to fix the converter, and a file joins our test set only if you agreed.
• Otra accounts. When you sign in to the Otra editor: your email, and your name and country if you give them. If you sign in with Google or Apple, the account ID they send us, never your password. We also keep your cloud scores and their versions, the share and edit links you make, your plan and its renewal dates as Paddle reports them, any education, founding or referral discount, and a fingerprint (hash) of each Encore file you convert, so the same file never counts twice. We use all of this to run your account.
• Visit counts. We count events such as a preview being opened, with PostHog in its cookieless mode on its EU servers. Nothing is stored on your device, and PostHog tells visits apart only by a hash that changes every day. We use the counts to learn what works.
• Server logs. Like any website, our servers record each request: the IP address, the address asked for, the time and the browser. We use them only to keep Otra running and secure.
• Emails to us. When you write to support, we keep the conversation so we can help you.

Cookies and your device

otramusic.com and Rescue set no cookies. Rescue keeps a few things in your browser's storage: your licence key, which file you converted free, the files you've previewed, the price you were shown and the language you picked. The Otra editor sets one cookie when you sign in, holding a random session number, so you stay signed in.

Paddle's checkout window may set its own cookies when you open it, under Paddle's policy. Clearing your browser's site data removes everything above, including a licence key, so keep a copy of yours.

Who helps us

We don't sell your data or share it for advertising. These companies handle it for us, each only for its own job:

• Paddle (Paddle.com Market Limited) runs checkout, payment, tax and receipts as the seller of our licences. It handles your payment details under its own privacy notice.
• Cloudflare runs our servers, databases and cloud score storage.
• Our web host rents us the server that delivers otramusic.com and its subdomains.
• PostHog counts visits, cookie-free, on its EU servers.
• Resend sends sign-in links and renewal reminders.
• Brevo runs Rescue's mailing list.
• GitHub holds fix requests, in a private repository.
• Google and Apple sign you in, only if you choose them.

Where it's processed

Some of these companies process data outside your country, including in the United States. Where the law requires it, those transfers rely on the safeguards the companies offer, such as the European Commission's standard contractual clauses.

How long we keep it

• Waitlist and mailing list: until you unsubscribe or ask us to remove you.
• Licence records: for the life of the licence, then only as long as we need them to answer questions about it and as the law requires.
• Free-conversion fingerprints: while the free conversion is offered.
• Fix requests: until the fix is done. A file you let us add to the test set stays there until you ask us to take it out.
• Accounts and cloud scores: until you delete them or ask us to close your account.
• Server logs: a short time, for running and securing the servers.

Your rights

Wherever you live, you can ask us to show you the data we hold about you and give you a copy, correct it, delete it, stop using it for something you object to, or stop emailing you. Where you agreed to something, you can withdraw that agreement at any time.

Write to support@otramusic.com from the address the data is about. We answer within one month. If you live in the EU, the UK or anywhere else with a data protection authority, you can also complain to it. We don't sell or share personal information as California law defines those words.

Children

Otra accounts and purchases aren't meant for children under 13 on their own. If you think a child under 13 has given us personal data, write to us and we'll delete it.

Security

Every connection to Otra is encrypted. We store sign-in sessions and sign-in links only as hashes, sign-in links work once and expire after 15 minutes, and card details never reach us.

Changes

When this policy changes, the date at the top changes too. For a change that matters, we'll also email the people it affects before it applies.