Privacy notice

Last updated: 8 November 2026

Who operates the app

Csanád Nemeshegyi develops and operates GBGYDB as a private person, for the Gödöllő Baptist Church. He is the data controller.

Questions about your data: nemeshegyi.csanad@gmail.com.

Who uses the app

The app is for the members of the church. There is no sign-up: a superadmin of the app creates your account with your email address, and the app sends you an email with a link to set your password.

This notice applies to that email, to the app and to the data that the app keeps about you.

What the app stores about you

The app stores:

Your email address, your password (as a hash, never in clear text) and the date of your last sign-in.
Your two-step verification: the secret of your authenticator app, or the codes that the app emails you (stored as hashes, valid for 10 minutes).
Your display name and your profile picture, if you add them. The app stores the picture as a small square image without metadata.
Your language, your roles (song admin, event admin, music leader, course admin or superadmin; without a role you are a member), which a superadmin gives you, and whether a superadmin blocked your account. A superadmin can also give a role to a group: then you have it while you are in the group or in a group below it. Only a superadmin can put you in a group that gives a role, or move a group that you are in under it. An event admin or a leader of the group can remove you from the group: then you lose its roles.
Your notification settings (the emails, the kinds of notifications) and the time zone of your device for the times in the notifications, if you change them in Settings, and which reminders the app has sent you.
If you turn on push on a device: the address that the push service of your browser gives for that device, the keys that encrypt the messages to it, and the time of your consent to the transfer (see below).
If you are a superadmin: the email texts, the settings of the AI research of the song rights and the exclude words of the announcements that you changed last, with the time of the change.
If you are a music leader, an event admin or a superadmin: the mixer setup (the mixing desk, its address on the local network, its delay effects and its tap tempo keys) if you changed it last, with the time of the change.
The events you volunteer for, your reply to each of them (yes, maybe or no) with its time, and the items of the events that you are assigned to. When the start time of an event changes, the app deletes the replies to it. Event admins and superadmins add you to events and assign you to items. Event admins, superadmins and the leaders of groups can add you to groups (for example Music → Band) and make you a leader of a group: then the app stores the groups that you are in and the groups that you lead. Every user is a member of the group at the top. The volunteer templates hold groups, not people. Event admins, superadmins and the leaders of a group can also put you in the team of the group at an event (for example Music or Broadcast): then the app stores the teams that you are in, and you become a volunteer of the event. In place of the people of a team, they can write a text (for example “Sign up at Gábor”). This text can contain your name, and everyone who sees the event sees it. They can also write a note on the teams of an event, which can contain your name too: everyone who sees the event sees it. In the team planner, event admins, superadmins and the leaders of groups can print the teams of the events, or download them as an Excel file, with the names of the volunteers, the texts and the notes: the file then stays on their device. For a volunteer without a display name, the file of a superadmin contains the email address in place of the name. If you are an event admin: the events that you add, with your account as the user who added them, and whether an event is private.
If you turn on the calendar feed in Settings: its secret link and the time of your consent to the transfer (see below).
Your personal notes on songs, your capo and key choices, the marks you draw on chord sheets, and the layout that you set for a song on the chord sheet, separately for phones, tablets and computers: the text size, the pages side by side, whether the chords and the syllable marks show, the section order, how repeated sections show, and whether the sheet shows the chords, a score, a PDF file or an image of the song. Also the zoom that you set for a PDF file or an image on the chord sheet, and the part of its pages that shows.
If you are a song admin: the score files (MusicXML), the PDF files, the images (photos or scans of sheet music) and the sound files (recordings) that you upload for songs, the file names of the score files, the PDF files and the sound files, and the links to other websites that you add to songs. It also stores the rights data of the songs that you enter: the names of the authors and of the translator, the original title, the songbook, the copyright text, the state of the permission and a note on it. The note can hold, for example, the death years of the authors and who gave the permission. These names come from the song itself, its publisher or public sources, not from the people themselves. An AI research can also propose the rights data (see the processors below). The app stores each proposal with the names, the death years and the rights holders that the research found on public websites, with their contact data if a website shows it, and with the sources and the searches of the research. It also stores which song admin reviewed a proposal, and when. The app stores each score file, PDF file and sound file as it is, so it can contain the names that the file holds, for example of the composer, the arranger or the person who made the file. A recording can also contain the voices of the people who sing or play on it: upload it only if they agree. Before the app stores an image, it makes the image smaller and removes its metadata, for example the place and the time of a photo. While a PDF file or a sound file uploads, the app stores who started the upload, so that one account cannot start too many uploads at once. It deletes this record when the file is added to the song, or within a few hours when the upload does not finish. After that, the app does not store who uploaded a file. The text recognition, which reads a chord sheet from a photo, runs only on your device: the photo does not go to a server for it.
If you are an event admin: the background images that you upload for projection themes. Before the app stores a background image, it makes the image smaller and removes its metadata, for example the place and the time of a photo. A photo can show people: upload it only if they agree. The app does not store who uploaded a background image. The same applies to the images that you upload as items of an event to show on the projection screens, for example announcements or photos: the app also stores their names and how the projection shows them (the size, the zoom, the position, the rotation and the background). A PDF file becomes an image for each of its pages, and a PowerPoint file an image for each of its slides, in your browser: the app stores these images, not the file. The app also stores the announcements items of the events: the entries that it reads from the calendars of the church (their titles, times, places and descriptions, which can contain the names of people), the entries that event admins write, and the settings, the QR codes and the attachments (images) of the entries. Superadmins add the calendars by their names and secret addresses. Write in an entry only what the people in it agree to show on the screens. The app also stores the text slides of the events: their titles, their descriptions and their highlighted texts, which the projection shows. These texts can contain the names of people, for example in prayer topics: write in them only what the people named agree to show on the screens and on the video stream.
If you are a course admin, or a leader of groups who makes the courses of their groups: the training courses that you make: their titles, descriptions, covers (an icon or an image that you upload), groups and drafts, and their lessons with their titles, texts, YouTube videos and links. These texts and images can contain the names or the pictures of people: add them only if the people agree. Before the app stores a cover image, it makes the image smaller and removes its metadata, for example the place and the time of a photo. The app does not store who made or changed a course, or who uploaded an image.
The live sessions you lead, and, while you take part in one, your name, whether you follow the leader and the accuracy of the clock of your device.
While you control the projection of an event: that your controller is open, with your user ID, the event and the time, again every 30 seconds. While a controller is open, nobody can delete the event. A change that would take the projection from you, for example your removal as a volunteer, fails, unless an event admin chooses to close your projection with the change. The app deletes this record when you close the controller, or at the latest one day after the last time.

Why

The app uses this data to run the songs, events, rehearsals and training courses of the church: to sign you in safely, to show who volunteers for which event and who can come, to put your events in your calendar app if you turn on the calendar feed, to notify you by email, and by push on the devices where you turn it on, when you are added to an event, before your events, with their setlists and when a live session of your event starts, to keep your personal notes and settings, to let the musicians follow a leader in a live session, to show the lyrics, the scripture readings, the images, the text slides and the announcements of the events on screens (projection), to show the lyrics, the scripture readings, the song titles, the titles of the text items and the texts of the text slides on a video stream (stream overlay), to show the training courses of the team to the members of their groups, or to all members, to record the authors, the translator and the permission state of the songs, also with the help of an AI research that a song admin reviews, and to limit the number of uploads that one account can start at once.

The legal basis is the legitimate interest of the church in organising its music and its events, in training its team and in announcing its events at its services (GDPR Article 6(1)(f)). The app does not use your data for anything else, and it does not profile you.

Who sees your data

Inside the app and in its emails:

Every signed-in member sees your display name, your profile picture, the public events you volunteer for, your replies to them, your name at the items of these events that you are assigned to (on the page of the event, on its chord sheet and in the setlist of its projection controller), the teams of these events that you are in, the texts and the notes of the teams of these events, and your name in a live session. Only event admins, superadmins and the leaders of your groups see the groups with their members: your display name and profile picture in the groups that you are in, and whether you lead them. Superadmins also see your email address there, and on your user page the roles that you have from groups.
Event admins and superadmins can make an event private. Only the volunteers of a private event, the user who added it and the superadmins see it, with its items, its volunteers, its teams with their texts and notes, their replies, its images and its announcements items, also on the songs page, which shows the last and the next events of each song. A member who opened the event before it became private, or before an event admin removed them as a volunteer, keeps the copy of it in the storage of their browser until the app deletes it (see Cookies and browser storage).
Every signed-in member can open and download the score files, the PDF files and the sound files of the songs, with their file names and the names in them, can play the sound files, and can open the images and the links of the songs. They can also see the rights data of the songs, with the names of the authors and of the translator. The title slide of a song in the projection and in the download of the slides shows its copyright text, so everyone in the room can see it. The projection shows the descriptions and the highlighted texts of the text slides on the screens, so everyone in the room can see them. A user who can use the projection of an event can also show the lyrics, the scripture readings, the title slides with their copyright text, the titles of the text items and the texts of the text slides as an overlay of a video stream, so everyone who watches the stream can see them. The overlay does not show the images and the announcements. Song admins and superadmins also see the proposals of the AI research.
Every signed-in member can open the background images of the projection themes and the images of the events that they can see, and sees the announcements items of these events with their entries. Every signed-in member also sees the training courses that they can see, with their lessons and cover pictures: the courses of the group at the top, and the courses of the groups that they are in and of the groups above them. Course admins and superadmins see all courses with their cover pictures, also the drafts and the removed courses. A leader of groups also sees the drafts and the removed courses of the courses of the groups that they lead. A cover picture can show people: the course admin who uploads it chooses it. The page of an event gets all the entries that the app read for its announcements items from the chosen calendars (up to the end of the next month), also the entries that an event admin or an exclude word excluded, with their full descriptions and places, which the screens do not always show. The projection shows the entries on the screens, so everyone in the room can see them. Every signed-in member sees the names of the calendars. Only superadmins see their addresses, and not even they see a saved secret address again.
The volunteers of an event get its setlist by email, with your display name at the items that you are assigned to. Their calendar feeds do not contain your name.
When you change an event, the other users who see it get a message at once that it changed, with your user ID. Supabase keeps these messages in the database for a few days, then deletes them. Their page of the event, its projection and its live sheet then load the event again, and the page of the event and the projection show your display name in a short notice of the change. Every member who can see an event also sees which item its projection shows now.
When you start the live session of an event, its volunteers get your display name in a push notification, on the devices where they turned on push.
Superadmins also see your email address, your roles, the state of your account and the date of your last sign-in. If you have no display name, they see your email address in place of your name, also in the team planner and in its print and Excel file.
Only you see your personal notes, your marks on the sheets, your capo and key choices, the layouts of your songs and the zoom of your files.
Anyone with the link of your calendar feed sees the events you volunteer for that have not ended or ended in the last 90 days, but only the events you replied yes to or did not reply to yet, with their items and your display name at your items, but not the names of the other volunteers. Your calendar app (for example Google Calendar, Apple Calendar or Outlook) gets these events through the link and keeps them under its own privacy terms. Its company can store them outside the EU, for example in the USA, where your data can have less protection than in the EU: for example, US authorities can get it. The app does not know which calendar app you use, so this transfer relies on your explicit consent (GDPR Article 49(1)(a)). Settings asks for it before you turn on the feed, and you take it back when you turn off the feed. A feed that you turned on before Settings asked for the consent gives no events until you agree.

Cookies and browser storage

The app uses only the cookies it needs to work. They need no consent:

Session cookies (their names start with sb-): keep you signed in. They stay until you sign out.
locale: your language. It stays for one year.
login-link: binds the link of the login email to your browser for one hour, while you set your password.

The app also keeps some settings in the storage of your browser: the theme, the color scheme, the note names, the general settings of the chord sheet, with whether the device sends the tempo to the mixing desk and the MIDI device that it sends it to (the layout that you set for a song stays on the server, see above), whether the event list shows only your events, a draft rehearsal setlist, whether you closed the cookie notice, the day on which you collapsed the psalm of the day, the screen shape that you chose for the projection, whether the stream overlay of a new projection shows the lyrics a few lines at a time, whether a new projection shows the Bible verses as a roll and the text size of the roll, the size of the Bible panel of the projection, whether it is open, and the Bible passage that it shows, and the width of the setlist of the projection (another one in its edit mode) and the details of the songs that it shows under their titles. They stay on your device until you clear them. The songs, scripture readings and text slides that you quickly add to a projection stay in the storage of your browser until you close its tab. The texts of the text slides can contain the names of people. An event admin adds them to the event: then the browser keeps only their IDs, until the tab closes. The chord sheet keeps the song and the page that you see in the storage of your browser, so that a reload of the tab opens the sheet at the same place. In a live session, it also keeps the latest state of the leader there: the user ID of the leader, the song and the section that the leader shows, the keys of the songs and the metronome. The app deletes them when you leave the sheet or close the tab, and deletes the state of the leader also when the live session ends. The search keeps the titles of the last 8 songs and events that you opened from it. The app deletes them when you sign out. After you control the projection of an event, the app keeps the event (its ID and title), the time and whether a screen was open in the storage of your browser, so the menu can take you back to the projection while it runs. After 12 hours the app does not use it and deletes it, or, if the app is not open then, the next time you open it. The app also deletes it when you sign out. It also keeps a copy of the songs, events, setlists and chord sheets that you opened, so these pages show at once. The copy holds the names of the volunteers, their replies to the events, their teams, the texts and the notes of the teams and the links to their profile pictures, the entries of the announcements items and the texts of the text slides, which can contain the names of people, and your marks, your capo and key choices, the layouts of your songs and the zoom of the files on the sheets. The app deletes this copy when you sign out. It never shows a copy older than 30 days, and deletes it when you next open the app. So that the app can open without a network, it also keeps the last 80 pages that you opened, except the settings, the Users, the groups, the volunteer templates and the team planner pages, and the last 300 profile pictures, score files, PDF files, song images, projection backgrounds, event images and course cover pictures that you saw in the storage of your browser (Cache Storage). They hold the data that these pages and files show, for example the names, the replies and the profile pictures of the volunteers. For an event admin or a leader of groups, the pages of the events also hold the groups, with the names and the profile pictures of their members. For a superadmin, the pages of the events also hold the email addresses of the volunteers and of the other members. They have no time limit: the app deletes them when you sign out. Your browser also keeps the profile pictures, the score files, the PDF files, the song images, the projection backgrounds, the event images and the course cover pictures that you saw, and the parts of the sound files that you played, in its cache for up to one year. After you first use the text recognition, the app keeps its files in the storage of your browser (IndexedDB), with no time limit. These files hold no personal data. When you sign out, the app tells your browser to delete the profile pictures, the score files, the song images, the projection backgrounds, the event images and the course cover pictures in its cache. Some browsers do not do this. Signing out does not delete the PDF files and the sound files in the cache or the files of the text recognition: to delete them, clear the data of your browser. The desktop app keeps all of this data in its own folder on your computer, not in a browser: to delete it, choose Clear data in the menu of the app (on Windows and Linux, press Alt to show the menu). This also signs you out. On Windows, the uninstall of the app deletes the folder. On macOS and Linux, the folder stays after you delete the app: delete it yourself (the folder Music Sheet DB in ~/Library/Application Support on macOS, in ~/.config on Linux).

The app has no analytics, no advertising and no tracking. The fonts come from the app's own server. The links of the songs and of the events, for example to YouTube, go to other websites, and so do the links to the sources of the AI research and to Google searches on the review page of its proposals, the links to the API key pages of Anthropic, OpenAI and Google in the settings of the AI research, and the links to szentiras.eu, abibliamindenkie.hu and bible.com in the dialog where you paste the text of a scripture reading, and the links of the lessons of the training courses, the links in their texts and the links to their videos on YouTube. The app loads nothing from these websites, also no preview of a video: your browser goes to such a website only when you open the link, in a new tab (in the desktop app, in your default browser). That website then gets your IP address and can set its own cookies, under its own privacy terms. One exception: a lesson of a training course can show a YouTube video in the page. Before you click the video, the page shows only a dark box and loads nothing from YouTube. When you click it, your browser loads the video player of YouTube (Google) from youtube-nocookie.com, the privacy-enhanced mode of YouTube. YouTube then gets your IP address, the address of the lesson page (without its path) and the video that you watch, and can keep data in the storage of your browser, under its own privacy terms. Google can process this data outside the EU, for example in the USA. Google takes part in the EU-US Data Privacy Framework: the adequacy decision of the European Commission (GDPR Article 45) covers the transfer.

Who processes the data for the app

These providers store or transmit data on behalf of the controller:

Supabase: database, sign-in, file storage, live sessions and projection. The data is in Ireland (AWS eu-west-1). Supabase keeps sign-in logs with the IP address and browser of each sign-in. Your browser also connects to Supabase directly: it plays the sound files from there, opens and downloads the PDF files from there, uploads the PDF files and the sound files to it, and gets the changes of events, live sessions and projections from it. So Supabase gets your IP address with these requests.
Resend: sends the login email, the two-step codes and the notification emails about your events to your email address. The notification emails contain your display name (or your email address if you have none) and the title, time and link of the event, and the setlist email also contains the items of the event with the display names of their volunteers. You can turn the notification emails off in Settings. When you reply no to an event, you get no reminder and no setlist for it.
The push services of the browsers (Google for Chrome, Android and most other browsers, Microsoft for Edge on Windows, Mozilla for Firefox, Apple for Safari, iPhone and iPad): if you turn on push on a device, they transmit the push notifications to it. The notifications contain the title and time of the event, the link to its page in the app and the number of your events without a reply, and for a live session the display name of the volunteer who started it. They are encrypted for your device, so the push services cannot read them, but they see the address of the device, when a notification goes to it and how large it is. The company of your browser runs its push service under its own privacy terms. These companies are in the USA, so this data goes outside the EU. Google and Microsoft take part in the EU-US Data Privacy Framework: for them, the adequacy decision of the European Commission (GDPR Article 45) covers the transfer. Mozilla and Apple do not take part in it, and the app has no contract with them: for them, the transfer relies on your explicit consent (GDPR Article 49(1)(a)). Before you turn on push, Settings tells you that in the USA your data can have less protection than in the EU, for example that US authorities can get it. You give the consent when you turn on push on a device. You take it back when you turn off push on that device, or in Settings on all your devices at once, also on a lost device.
The calendar services of the church, for example Google Calendar: the server of the app reads the calendars of the announcements from them by their secret addresses, at most once an hour for each item of an event that has not ended, and also at once when an event admin adds or copies an item, changes its calendars or asks for a new read. The requests contain no data about the members. The calendars belong to the church, which keeps them under the privacy terms of their services.
SongPraise (songpraise.com), a free database of worship songs: when a song admin looks for the lyrics of a song on SongPraise while they add or edit a song, the server of the app reads from it the titles of the songs of a language, for a search by a songbook number also the songbooks of all languages, and the lyrics and the songbooks of the chosen song. The search itself runs on the server of the app, so SongPraise gets only the language and the chosen song, not the search text. The requests contain no data about the members.
Vercel: hosts the app. Its server logs can hold your IP address and the addresses of the pages and requests of the app for a short time. The search of the app and the song search of SongPraise in the song form send the text that you search for in such an address, so the logs can also hold it, for example an email address that a superadmin types to add a new member. Vercel Inc. is in the USA, so this data can go outside the EU. The controller uses Vercel under its data processing addendum, which contains the standard contractual clauses of the European Commission (GDPR Article 46(2)(c)).
The AI provider of the song rights research (Anthropic, OpenAI or Google; a superadmin chooses one): while a superadmin keeps the research on, the app sends it each night the title, the artist, the copyright text, the songbook and the lyrics of a few songs that have no rights data yet. A superadmin can also start the research of songs at once, and research any song again, also a song that already has rights data. The provider searches the web with its own search tool and gives back the names, the death years and the rights holders that it found, with the sources. The requests contain no data about the members. A song admin reviews each proposal: the research changes no song by itself. A superadmin can also download these songs, or all songs that have lyrics, research them on their own computer, for example with an AI assistant, and upload the findings for the same review: then the provider of that assistant gets the same data. For this, a superadmin uses only an assistant under the data processing terms of its provider for API or business customers (for example with an API key or a business plan), not a personal plan. These providers are in the USA, so this data goes outside the EU. The controller uses them only under their data processing terms for API or business customers, which contain the standard contractual clauses of the European Commission (GDPR Article 46(2)(c)).

How long the data stays

Your data stays while you have an account. When a superadmin deletes your account, the app deletes your profile, your picture, your notes, your marks, your settings, the layouts of your songs, the zoom of your files, your volunteer assignments and replies, your places in the groups, the link of your calendar feed and the push addresses of your devices with it. When an event admin or a leader removes you from a group, or deletes the group, the app deletes your place in it. When an event admin or a leader of the group removes you from a team of an event, or deletes its group, the app deletes your place in the team, also in the events that ended. The text of a team goes when an event admin or a leader of the group puts people in the team or removes the text, when an event admin deletes its event, or when its group is deleted. The note on the teams of an event goes when an event admin removes it or deletes the event. When an event admin or a leader of a group removes you from your last team of an event, you stop being a volunteer of the event: the app deletes your reply to it and your assignments to its items. Songs and events stay. The events that you added stay without your account as the user who added them: a private event then stays only for its volunteers and the superadmins. When you turn off the calendar feed or make a new link, the app deletes the old link. When a song admin deletes a song, the app deletes your notes, marks, capo and key choices and layouts on that song with it. When a song admin removes a PDF file or an image, or deletes its song, the app deletes your zoom of that file with it. The app deletes a score file when a song admin removes or replaces the score, or deletes its song. It deletes a PDF file or a sound file when a song admin removes it or deletes its song, and an image or one of its pages when a song admin removes it or deletes its song. A link of a song goes when a song admin removes it or deletes its song. The rights data of a song changes when a song admin changes it, and goes when a song admin deletes the song. A proposal of the AI research stays after its review, also when a song admin rejects it, until a song admin deletes the song. When a superadmin deletes your account, the proposals that you reviewed and the settings that you changed stay, without your name. The app deletes a background image when an event admin replaces or removes it, or deletes its theme. It deletes an image of an event when an event admin removes it or deletes the event, and within a few hours after an event admin removes its item. The entries of an announcements item change with each read of its calendars while its event has not ended, and then stay as they were. The app deletes an entry that an event admin wrote, with its attachments, when an event admin removes it. An entry of a calendar goes from the item only at a read when it is no longer in the calendar: an event admin can only exclude it, so that the screens do not show it. The app deletes all the entries, with their attachments, when an event admin deletes the event, and within a few hours after an event admin removes the item. When a superadmin removes a calendar, the app deletes its entries and their settings at once, also in the events that ended. When an event admin copies an event or an announcements item, the copy gets copies of its images and of its entries that have not ended, with their attachments. These copies stay with the copy also when the source changes or goes. When the upload of a file does not finish, or when the app cannot delete a file at once, the app deletes the file within a few hours. A course admin, or a leader of the groups of a course, can remove a training course or a lesson: it stays for 90 days, so that they can restore it, and then the app deletes it, with its cover image. The app deletes a cover image that no draft and no published course uses, for example after a course admin replaced it, in the night at least one day after its upload.

Two-step codes expire after 10 minutes, and the app removes them after one day. A live session ends after 12 hours at most.

The app deletes the push address of a device when you turn off push on it or on all your devices, when you sign out on it, when another user signs in on it, when a superadmin blocks your account, and when the push service says that the address no longer works. A device where you turned on push before Settings asked for the consent gets no push, and the app deletes its push address when you open Settings on that device.

Your rights

You can see and change your display name, your picture, your language, your notifications, push on each of your devices and your calendar feed in Settings. You can delete your notes, your marks, the layouts of your songs and the zoom of your files in the app. What the sheet shows of a song (the chords, a score, a PDF file or an image) you can only change: this choice stays until your account or the song is deleted.

You can ask the controller for a copy of your data, for a correction, for the deletion of your account or for a restriction of the processing, and you can object to the processing. Write to nemeshegyi.csanad@gmail.com.

You can also complain to the Hungarian data protection authority (NAIH, naih.hu).

Changes to this notice

When the app starts to use your data in a new way, this page changes and shows the new date at the top.