Privacy

The score viewer on CPDL work pages is built to need as little about you as possible. This page says what it stores, why, and for how long.

When you view a page or open a score

The viewer counts how it is used, so we can see whether it helps: page views, opened scores, playback, searches and similar actions. Each counter holds only the day, the kind of action and the CPDL page name or edition number. We don’t store your IP address, your browser details or any identifier, and we can’t tell two visitors apart.

Scores, the viewer itself and its fonts come from our own servers, or from CPDL for files we don’t keep a copy of. Viewing a score sends no request to anyone else. The viewer reads CPDL’s discussion page only when you ask (see “Reports from CPDL”).

Our servers are viewer.abtakt.app (the viewer and its fonts) and data.abtakt.app (scores, counters, corrections, comments and sign-ins); the demo pages use demo-data.abtakt.app instead. They run on Cloudflare. Like any web server, Cloudflare sees your IP address while it delivers a request; we don’t keep it, and the viewer’s server logs are switched off.

The fixes link on CPDL pages

Where a CPDL page shows a link such as “3 fixes” next to an edition’s download icons, the page asked our server once which of its editions have fixes from readers. That is one request per CPDL page, carrying only the edition numbers listed on that page. It is sent without cookies, the viewer stores nothing for it, and our server writes nothing down. The answer is only the number of fixes per edition, for the editions that have any.

In your browser

The viewer sets no cookies. It keeps a few things in your browser’s storage, for you only. They stay on your device, except the token and the sign-in key, which are sent to us with what you send:

• your practice settings for an edition, for example tempo and which voices are muted (abt-cv:practice:<edition>);
• a correction you started but haven’t sent yet (abt-cv-draft:<edition>);
• a comment you started but haven’t posted yet (abt-cv:cdraft:<edition>);
• the suggestions you sent and your votes on others’ suggestions for an edition, so you keep seeing your own version and can withdraw it; entries are dropped after 30 days (abt-cv:mine:<edition>);
• a random token, created only when you send your first suggestion, vote or comment (abt-cv:tok, see below);
• if you sign in with a checked CPDL name or with ab|takt: your sign-in key for the viewer and the name it shows for you (abt-cv:sess, see “Signing in”);
• while an ab|takt sign-in is under way: a random one-time value that lets this tab pick up the sign-in. It is kept for this tab only and removed when the sign-in finishes, or after 10 minutes (abt-cv:abt-nonce, in session storage);
• that you have read the explanation of corrections (abt-cv:cx-intro);
• which version of an edition’s corrections you last saw, so the viewer can tell you about new ones; kept for your 200 most recent editions (abt-cv:cx-seen:<edition>);
• which version of a corrected score you downloaded, so the viewer can tell you when it has changed since (abt-cv:dl:<edition>);
• the CPDL discussion page you last asked the viewer to read, for 10 minutes, so it isn’t read again each time you open a score (abt-cv:cpdl:<page>, in session storage);
• that the viewer has already offered you a note to the CPDL discussion for an edition, so it offers one at most once per edition while the tab is open (abt-cv:cpdl-note:<edition>, in session storage);
• an offer of a note to the CPDL discussion that the viewer will show you on your next visit to that edition (abt-cv:cpdl-offer:<edition>).

If your browser blocks storage, the viewer still works and forgets these things when you close the page. You can remove them at any time by clearing this site’s data in your browser.

When you send a correction suggestion or vote

If the viewer offers “Suggest a correction” and you send one, or agree with, disagree with or keep a suggestion, we store the change or vote itself, the edition number and the time. To tell independent readers apart and to stop abuse, we also store two values with it:

• A network code. We take the network part of your IP address (the first three of its four parts for IPv4, the first 48 bits for IPv6), never the full address, and turn it into a short code with a keyed hash (HMAC-SHA256, 8 bytes). The month goes into the hash, so the same network gets a different code each month. Your IP address itself is never stored.
• A random token. It is created in your browser when you first send and sent along with your suggestions and votes, so you can withdraw a suggestion and see which ones are yours. We store only a scrambled copy of it. It says nothing about who you are.

We use these values only to count agreement between different readers, to apply daily limits and to hold back abuse. Without signing in, they are not linked to a name, an account or anything outside the viewer.

To keep the service working, we count how many changes and notes come from readers without a checked name each day, in total and per edition. These are counts only, with nothing about who made them, and are deleted after 35 days. Once a day’s count is used up, readers without a checked name are asked to sign in, or to try again the next day.

How long: a job runs every day and deletes the network code and the token 90 days after they were stored, whether the suggestion is still open or not. The suggestion or vote itself stays, without them. If a network code is used for abuse, sends from it can be blocked for at most 90 days; the block is then deleted.

Without a name, you appear in the list of changes as “Reader A”, “Reader B” and so on. The letter is given per edition, so it can’t link you across editions.

Because the network code is a keyed hash of part of your IP address, data protection law treats it as pseudonymous personal data while the key exists. We rely on our legitimate interest in keeping the corrections free of abuse, and keep it no longer than said above.

Signing in

Signing in is optional. Readers with a checked CPDL name or an ab|takt account count more when they agree with a correction, and only signed-in readers can write comments. Every sign-in prompt offers two ways: your CPDL account, or an ab|takt account.

With your CPDL account

The viewer runs inside the CPDL page, so it can see whether you are logged in on CPDL. It asks CPDL’s own site, with your CPDL login, for your user name, user id, groups and number of edits. It does this only when you first send, vote, report or open the comment box, never when you just view a page. This question goes to cpdl.org, not to us.

A CPDL name we can’t check yet. Our server can’t confirm on its own that this name is really yours. So when you send something, we store the CPDL name and user id with it for our admins only, to spot abuse. It is never shown in public: others see you as “Reader A”, and your comments as “Reader A (signed in on CPDL)”. We delete this name 90 days after it was stored, together with the network code and the token.

A checked CPDL name. Your name counts as checked when CPDL confirms it to us: through a signed line that CPDL adds to its pages for logged-in users, or through the code below. We then store your CPDL user id, user name, number of edits and whether you are in CPDL’s autoconfirmed, administrator or bureaucrat groups. Your CPDL name appears in the public list of changes with what you suggest, confirm or comment, linked to your user page on CPDL. Before your first named action the viewer tells you so, and you can send a correction without your name instead (“Send without my name”); it then counts like a reader who isn’t signed in.

Checking your CPDL name with a code (only if switched on). If CPDL doesn’t add the signed line, the viewer can give you a short code to save on a page under your CPDL user page. Our server then reads that page once from cpdl.org: who saved it last and whether it holds the code, and your groups and number of edits. This is the only time our server contacts cpdl.org about you. The code expires after 30 minutes and you can delete the page afterwards.

With an ab|takt account

ab|takt, who make this viewer, also make an app that puts what your conductor says in rehearsal at the right bar of your score. If you choose it, a window opens at abtakt.app where you log in or sign up; there, [OWNER: link to ab|takt’s privacy page] applies. After you agree, ab|takt passes the viewer a short-lived signed note with:

• a random id for you, made only for this viewer and not your ab|takt account number;
• how old your account is in days, counted only up to 30 (new accounts count less for their first 7 days).

The viewer never gets your e-mail address, how you signed in, your choirs or anything else from your ab|takt account. Until the score page picks the note up (at most 10 minutes), we keep it together with a scrambled code of your network (the same monthly code as for corrections, never the address), so that only a page on the same network can pick it up; both go as soon as it is picked up. You then choose the name shown with your changes and comments, as “ab|takt user <your name>”. Until you do, you are shown as “ab|takt user” with four letters from your random id.

Remove my name. When you are signed in with ab|takt, “Remove my name” replaces your name with “former ab|takt user” on all your changes and comments at once. Deleting your account at ab|takt does not reach the viewer automatically, so please press “Remove my name” first, or ask us (below).

Your sign-in key and how long it lasts

With a checked CPDL name or an ab|takt account, you get a random sign-in key for the viewer, kept in your browser. We store only a scrambled copy of it, together with the account it belongs to. It expires 180 days after you last used it. “Sign out of corrections” ends it at once.

Your name in the history. Your contributions and the name shown with them are kept for good, as the record of how the score came to read as it does. On request we replace a CPDL name with “former CPDL user” on every entry; the changes and comments stay. If you rename your CPDL account, earlier entries keep the name you had then.

Comments

Everyone can read comments. Writing them needs a sign-in, as above. A comment is public, shown with your checked CPDL name, as “ab|takt user <your name>”, or as “Reader A (signed in on CPDL)” when your CPDL name isn’t checked yet. We store the text, the place in the score it belongs to, the time, the name it is shown with and, like for corrections, a network code and a token for 90 days.

• Please leave contact details out: comments with an e-mail address, phone number or street address are not accepted.
• You can delete your own comment at any time. Its text is removed at once, and a line “Comment removed by its author” stays so that replies still make sense.
• A comment hidden after a review or after reports keeps its text for 90 days, so that it can be looked at again; then the text is deleted.
• Visible comments are kept with the history.

Automatic review (only when switched on)

To keep corrections and comments in good shape, our server can ask an AI model to check them, and to look again at them later. The model is Claude Fable 5.1 by Anthropic. It gets:

• score content: the edition’s public details, the notes of the bars around the change before and after it, the reading of another edition, and the reason the viewer flagged that place;
• comment text, after e-mail addresses, phone numbers and street addresses are removed, labelled only with the kind of sign-in (for example “checked CPDL user”).

When you choose an ab|takt name, that name alone is checked the same way, so that it isn’t advertising or abuse; nothing else is sent with it. Apart from that, the review never gets names, user ids, the network code, the token, times or anything about your browser. The model judges the music and the text, not the person. Its verdict and a short public reason are kept with the history, so you can see why something was undone or held back, and ask for another look.

Anthropic keeps the requests for [OWNER: confirm Anthropic’s retention period for API data of this model] under its commercial terms. [OWNER: confirm where Anthropic processes the data and the transfer basis].

Reports from CPDL

Singers and editors sometimes describe a place to check in a score on the CPDL discussion page of a work, or in an edition’s notes. The viewer shows these reports next to the score, so you can see them at the right bar.

Reports and the names of their authors

We took the reports from a public copy of CPDL made in 2020. Each one is shown with the reporter’s name as they signed it on CPDL, the date, a short quote of their words and a link to the full post on CPDL. We show the name because it is part of what they published on CPDL, and so you can read the whole post in its place. [OWNER: confirm the legal basis for showing reporters’ names]

If you wrote one of these reports and want your name taken out of the viewer, write to [OWNER: contact address] with your CPDL name. We then show the report without your name; the link to CPDL stays. Your post on CPDL itself is CPDL’s to change, not ours.

Reading the CPDL discussion page now

The 2020 copy can be out of date. When you ask the viewer to look for newer posts, your browser reads that one discussion page from CPDL’s own site (cpdl.org), without your CPDL login. This goes from your browser to CPDL, not to us, and we don’t see what it returns, unless you use the next item. The viewer never does this when you just view a page, and never for any other page. It keeps the answer in your browser for 10 minutes (see “In your browser”).

Reading a post for bars and voices (only when switched on)

A new post on CPDL often says in its own words which bars and voices it means. After a read you asked for, when you press “Read this post for bars and voices”, the viewer asks our server to work this out for that one post. It sends us the public text of the post’s thread, with user names and signatures replaced by placeholders, the edition number, the discussion page and its revision, and the notes of the bars the post names as the score shows them. Our server sends only the text and those notes to an AI model by Anthropic (Claude Fable 5.1, the model of “Automatic review”) and gets back the bars, the voices and the suggested reading. Nothing else goes with it: no name, no user id, no network code and nothing about your browser.

We keep the answer together with the discussion page’s revision, so that the same post is never sent twice, and we log what each request cost. Anthropic’s retention and where it processes the data are as said under “Automatic review”. Until this is switched on, such a post is shown with its link only.

Notes to the CPDL discussion

When one of your fixes is accepted, or when you check a place a CPDL report describes, the viewer can offer to add a short note about it to the CPDL discussion page, so that CPDL’s editors hear of it. This is always your choice:

• You see the note first, and you can change its text freely before sending it.
• It is posted only when you press the button, by your browser, under your own CPDL account, and signed with your CPDL name like any post you write there. If CPDL asks a question to check that a person is posting, the viewer shows it, and your answer goes to CPDL. If posting doesn’t work, the viewer copies the note for you and opens CPDL’s own editor instead.
• Once posted, the note is part of CPDL: it is public on the discussion page and in its history, and CPDL’s terms apply to the text you posted. [OWNER: link to CPDL’s terms of use]

Before posting, the viewer asks our server whether the daily limits allow another note; after posting, it tells our server which note it was. We keep the note’s revision number on CPDL and the fixes it lists, with the history, so the viewer can link to it. For the limits and to spot abuse, we also keep the CPDL name and user id you were logged in with (for our admins only, never shown by us) and a scrambled code for your network, the same as for corrections. Both are deleted 90 days after they were stored. In the viewer the note is linked, but not shown with your name; CPDL shows your name with it.

How long we keep what

The check before sending (Cloudflare Turnstile)

When you press send (or vote), and only then, the viewer loads Cloudflare Turnstile from challenges.cloudflare.com to check that a person is sending. For this check Cloudflare receives your IP address and details about your browser, under Cloudflare’s Turnstile privacy notice. We don’t store what Turnstile returns.

In our own check, Turnstile set no cookies. It saved one item (cf.turnstile.u) in the browser storage of its own frame, separate from CPDL’s and ours. Reading a score never loads Turnstile.

Corrections and comments are released under CC0

By sending a correction or posting a comment you release it under CC0 1.0 (public domain dedication), so the edition’s editor, CPDL and anyone else can use it without any licence questions. Showing your name with it is a courtesy, not a licence condition, which is why we can replace it on request. If you don’t want that, please don’t send it.

Where the data is stored

The counters, the corrections, the comments and the sign-ins are kept in Cloudflare’s storage in the European Union. Cloudflare processes the data on our behalf. The automatic review and reading a CPDL post for bars and voices are the only parts that send anything to another company (Anthropic, see above), and what they send contains no names or identifiers of yours. The live discussion read and notes to the CPDL discussion go from your browser straight to CPDL.

Your rights and how to reach us

Responsible for this viewer: [OWNER: controller name and address].

You can ask what we hold, ask for deletion or for your name to be replaced, or object, at [OWNER: contact address]. If you were signed in, tell us your CPDL name or your ab|takt name. If you weren’t, please include the edition number and roughly when you sent it; the random token in your browser lets us find yours. If you want your name removed from a CPDL report shown in the viewer, tell us your CPDL name. You can also complain to a data protection authority.