Applies to: the Cuesheet app for iPhone (ai.shelterwood.cuesheet) and the cuesheet.ca website
Cuesheet is made by Shelterwood AI Inc. in Canada. It has no accounts and no server of ours. What you make stays on your phone. This page says exactly what leaves it, and why.
What Cuesheet is
Cuesheet helps cycle and spin instructors build a class — segments, cues and timings set to Apple Music — and teach it from the phone. This version has no AI features switched on. The code for drafting cues with Apple's on-device model is in the app but disabled; if we switch it on, it will run on your phone with no cloud path, and we will update this page first.
What stays on your phone
Everything you create: cuesheets, cues, your song library, class history and ratings, settings, and the run-mode log the app keeps while you teach. It all lives in the app's private area on the device; it never reaches us.
- Device backups. An iOS backup (iCloud Backup or a computer backup) may include Cuesheet's data, as for any app. Apple's terms govern those backups. Cuesheet does not use iCloud Drive or any cloud sync.
- Export and share. Settings lets you export a backup file (your cuesheets, class history, and the titles and artists of bound tracks) and share the run-mode log (Apple Music track IDs and cue timings from your last class — no Apple ID, token or audio). Each leaves the phone only when you choose where to send it in the iOS share sheet.
Delete the app and this data goes with it. "Reset all data" in Settings wipes it and keeps the app.
Apple Music
The first time you search for a song, iOS asks your permission ("Cuesheet plays the music you choose during your spin classes"). With it, the app searches Apple's catalogue, looks up the tracks in your cuesheets, fetches a track's 30-second preview clip to measure its tempo on your phone, and plays tracks through the system music player. Those requests go to Apple, not us; Apple's terms and privacy policy govern them. Cuesheet never holds your Apple ID, password or Apple Music token; iOS keeps the authorisation, and you can withdraw it in Settings → Privacy & Security → Media & Apple Music.
Diagnostics: one switch
Cuesheet sends crash reports to Sentry and usage signals to TelemetryDeck. One switch governs both: Settings → About → Share diagnostics. It stays off until you answer the question Cuesheet asks on first launch. Turn it off and Cuesheet stops handing anything new to either service at once; the choice is kept until you change it, and "Reset all data" clears your answer, so Cuesheet asks again on the next launch.
What "off" does with what was already captured: Sentry's software may finish an upload already in progress, for up to two seconds, after which Cuesheet deletes everything it had cached, so turning the switch back on later cannot send it. TelemetryDeck's software has no stop call, so signals it had queued before you tapped may still go out within about ten seconds. Nothing captured after the tap is sent.
From version 0.17.0 Cuesheet asks you once, on first launch ("Help improve Cuesheet?"), whether to share, rather than assume yes. Until you answer, nothing is sent and nothing is saved to send later; if you already use Cuesheet and never set the switch, you are asked once when you update. Builds before 0.17.0 share by default until they are updated.
Crash reports
If Cuesheet crashes or hangs, it sends a report to Sentry so we can fix the bug. A report holds the stack trace and the error; the app version and build, and whether it came from the App Store or TestFlight; the iPhone model, iOS version, memory figures, battery state, orientation, locale and time zone; and a trail of recent events — screens shown and controls tapped, named as they are in the code, and the addresses of requests to Apple with any search terms removed. Before a report leaves the phone, Cuesheet strips the one field in that trail that could carry a title you wrote. The report has no field for your cuesheets, cue text, song titles, name or email; the only error the app reports deliberately, rather than through a crash, is a failure to start.
Sentry also records that a session started and ended, so we can see what share of sessions crash. Every report carries an installation identifier that Sentry's software makes at random on first launch. It is not your Apple ID or device name, and we hold nothing that links it to you: the data is pseudonymous rather than anonymous, telling one install from another and nothing more. Sentry does not store your IP address: its "Prevent Storing of IP Addresses" setting is on for this project, so the address its servers see when a report arrives — as any server does — is discarded rather than kept, and no location is derived from it.
Sentry processes reports in the United States and keeps them for 30 days. That is the retention on the Developer plan, which is the plan in force.
Usage analytics
Cuesheet sends a small set of usage signals to TelemetryDeck, so we know which parts of the app get used. This is the whole list:
| Signal | When it fires | What comes with it |
|---|---|---|
App.launched | the app opens | nothing extra |
ClassRun.started | you start teaching a class | nothing extra |
ClassRun.completed | a class ends | duration, cues delivered, segments completed |
Cuesheet.created | you save a new cuesheet | number of segments |
Restore.performed | you import a backup | number of cuesheets in it |
FeedbackForm.opened | you tap Report a problem or Send feedback | nothing extra |
TelemetryDeck's software adds two signals of its own (session started; new install detected) and attaches the same context to every signal: app version and build, iPhone model and iOS version, screen size, language, region and time zone, App Store or TestFlight, and session statistics such as days used. Nothing you type or name is included: the app refuses to send any value that looks like free text or an email address.
TelemetryDeck tells one install from another by hashing an identifier Apple issues to each developer for each device, then hashing it again with its own secret on arrival. Neither we nor TelemetryDeck can turn that back into the original, and we hold nothing that links it to you: it is pseudonymous, a label for an install tied to no person. TelemetryDeck does not use the advertising identifier, does not follow you across apps, and says it never stores IP addresses. Its servers are in the European Union (the Netherlands and Germany); it has no fixed deletion schedule and expects to delete signals after seven to ten years.
TestFlight
If you use a beta build through TestFlight, Apple collects crash logs, usage information and any feedback you send, and shares them with us; that may include your name and email address. Apple's TestFlight privacy notice governs this, and you cannot opt out of it while testing.
Feedback and support
"Report a problem" and "Send feedback" in Settings open your own Mail app with a message to hello@cuesheet.ca, pre-filled with the subject, the app version and build, your iOS version and the number of cuesheets on the phone. Nothing is sent until you press Send. We receive what you send — your email address, your message and any attachment — and use it to reply and to fix the problem. It arrives in a Shelterwood AI Inc. Google Workspace mailbox that only Peter Cresswell reads. We keep feedback for as long as we need it to act on it, and delete it when you ask.
The website
cuesheet.ca is a static site. It sets no cookies, runs no analytics and loads nothing from third parties. GitHub hosts it and, like any web host, receives your IP address and browser details when you visit; GitHub's privacy statement governs that, and GitHub does not pass those logs to us.
What we do not do
- No accounts, sign-in or passwords, and no server of our own that holds your data.
- No advertising, no advertising identifier, no tracking across apps or websites, no sale of data.
- No access to location, contacts, photos, microphone, health or calendar.
- No third-party AI, and no AI features switched on in this version.
Children
Cuesheet is designed for cycle and spin instructors 14 years or older. We do not knowingly collect personal information from anyone under 14, and if we learn that we have, we delete it. A parent or guardian who believes we hold information about a child under 14 can write to privacy@cuesheet.ca and we will delete it.
Your choices and your rights
- Turn off Share diagnostics in Settings → About to stop crash reports and usage signals.
- Delete the app to delete everything it holds on the phone, including the local files Sentry and TelemetryDeck keep. Reports and signals already sent stay with Sentry and TelemetryDeck until their retention runs out, as set out above; we cannot pick out one person's records to delete them sooner, because we hold nothing that ties a record to a person.
- Use Settings → Export first if you want a copy of your data.
- Withdraw Apple Music access in iOS Settings at any time.
Canadian law gives you the right to ask what personal information we hold about you, to have it corrected, and to withdraw consent. Write to privacy@cuesheet.ca and we will answer within 30 days. Know what an answer can contain: the only things we hold that could relate to you are the pseudonymous identifiers above, and we cannot tie one to a person, so we could not find one person's records to show, correct or delete. Two things are exceptions. Feedback mail is one, and we delete it on request. TestFlight is the other: while you are testing a beta build, Apple passes us your crash logs, your usage information and any feedback you send, and that may include your name and email address, so for as long as you test we may hold something that does identify you. Ask us and we will remove you as a tester and delete the feedback and anything else we have copied out of TestFlight. Apple keeps its own records of your testing; its TestFlight privacy page explains how to ask Apple about them.
Who we are and the law that applies
Cuesheet is made by Shelterwood AI Inc., a Canadian corporation based in Toronto, Ontario. Our designated Privacy Officer under PIPEDA's accountability principle is Peter Cresswell, Founder, Shelterwood AI Inc., at privacy@cuesheet.ca — a Shelterwood AI Inc. mailbox. Write to him at 126 – 500 Richmond Street West, Toronto, Ontario M5V 3N4, Canada. We handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, provincial law. Sentry processes crash reports in the United States and TelemetryDeck processes usage signals in the European Union. You may complain to the Office of the Privacy Commissioner of Canada.
Changes to this policy
We update this page before shipping any version of the app that sends more than this page describes, and we change the effective date at the top when we do. A check in our build process refuses a change to the code that decides what is sent unless this page changes with it.
Contact
Privacy: privacy@cuesheet.ca. Feedback and support: hello@cuesheet.ca. Both are Shelterwood AI Inc. mailboxes.