Privacy policy

Edition of November 3, 2026. This is a translation; the Russian version prevails.

1. General

This policy describes what personal data Sole proprietor Andrey Viktorovich Gorobets, tax id (INN) 602718120826 (the "Controller") processes when you use the site https://handpan-soul.ru and the Handpan Soul app in a browser and on Android (the "App"), why, and for how long. It follows Russian Federal Law No. 152-FZ "On Personal Data" of 27.07.2006.

2. What stays on your device

Without an Account or a payment the App works on your device. Pan profiles, settings, lesson progress, added melodies and the practice log are kept only on your device and are not sent to the Controller.

The microphone is used to recognise the notes of your pan and to hear you play. Sound is analysed on the device, never recorded and never sent anywhere. Only the detected note frequencies are saved in the pan profile.

The diagnostics file in Settings is created only when you ask for it and stays with you; you may send it to the Controller yourself when asking for help.

To show prices and sign-in options, the App asks the Controller's server for general settings. Like any website, the server sees your IP address while answering but does not store it.

3. Data the Controller processes

The Controller gets data only when you sign in to an Account or pay for access:

• installation: a random device token (the Controller keeps only its hash), the store the App came from, the App version, the purchase region (Russia or another country; on Android it is taken from the SIM card's country);
• email address: for sign-in codes, receipts, renewal reminders and replies to your requests;
• with VK ID, Yandex ID or Google sign-in: your user id at that service and its email address if the service shares it. The Controller never receives passwords to these services;
• purchase records: order number, plan, amount, payment status and dates, the email for the receipt, and with auto-renewal also the masked card number (first and last digits), the bank's id for repeat charges and the record of your consent to them;
• Google Play and RuStore purchases: the purchase id the store gives the App, to verify it with the store.

The Controller does not receive card details: the bank processes them on its payment page. The Controller processes no special categories of personal data and no biometric data.

4. Purposes and legal grounds

• providing the Account and the paid access on your devices, taking payment, auto-renewal with your consent, service letters (sign-in code, receipt, charge reminder) and replies to requests: to conclude and perform the contract under the offer (Art. 6(1)(5) of 152-FZ);
• issuing receipts and keeping payment records: to meet tax law (Art. 6(1)(2) of 152-FZ);
• protection against code guessing and abuse: the IP address is used in the server's memory to limit request rates and is not stored (Art. 6(1)(7) of 152-FZ).

The Controller sends no marketing emails, sells no data and makes no decisions with legal effect for you based solely on automated processing.

5. How and where data is processed

Processing is automated and covers collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), blocking, deletion and destruction. The databases are on servers in the Russian Federation (Art. 18(5) of 152-FZ). Personal data is never disclosed to the public.

6. Who receives data

• the hosting provider running the service and the object storage provider holding encrypted backups, both with servers in the Russian Federation;
• JSC "TBank" to process a payment: order number, amount, plan name and the Account id (no email);
• the Russian Federal Tax Service through "Moy Nalog": a receipt holds the service name and the amount, nothing about you;
• the email service that delivers letters: your email address and the letter;
• VK, Yandex or Google when you sign in with their account: sign-in happens on their side under their rules;
• Google or RuStore to verify a purchase in their store: the purchase id;
• public authorities where the law expressly requires it.

Cross-border transfer. Google LLC is in the USA. The Controller sends Google only the Google Play purchase id to verify it. With Google sign-in you give your data to Google yourself; the Controller only checks the signature of the answer against Google's public keys and sends nothing. If you neither buy in Google Play nor sign in with Google, none of your data leaves Russia.

Lesson videos play in the embedded YouTube player (youtube-nocookie.com) only after you open one. Google then receives your IP address and browser details under its own rules.

7. Cookies and browser storage

The site and the App use no cookies and no web analytics or advertising trackers. The App keeps its settings and installation token in browser or device storage; clearing the site's or App's data removes them. On Android the token and the paid lessons are excluded from Google backup; the rest of the App's data goes into it if backup is on for your device.

8. Retention

• Account and installation data: while the Account exists;
• a sign-in code is valid for 10 minutes;
• purchase records: 5 years after the end of the year of payment, as tax law requires, unlinked from the Account once it is deleted;
• backups: no longer than 60 days, deleted automatically.

9. Security

Connections to the site and the server use TLS (HTTPS). Device tokens and sign-in codes are stored only as hashes, backups are encrypted, and only the Controller can access the server, by key.

10. Deleting the Account

Delete the Account in the App's Settings ("Subscription", "Delete account") or by writing to support@handpan-soul.ru; see how to delete an account. Deletion erases the email and sign-in methods and the access rights, and switches off installations. Purchases, including Lifetime, are lost.

11. Minors

Signing in and paying are for persons aged 18 or over, or minors with the consent of a parent or other legal guardian. Anyone may use the App without an Account: the data then stays on the device.

12. Your rights

You may ask what personal data of yours is processed, have it corrected, blocked or destroyed, withdraw consent where processing relies on it, and complain to Roskomnadzor or a court. Send requests to support@handpan-soul.ru from the Account's email; the Controller answers within 10 working days.

13. Changes

A new edition is published on this page with its date. Material changes are also sent by email to Account holders.

14. Controller

Sole proprietor Andrey Viktorovich Gorobets, tax id (INN) 602718120826, OGRNIP 320602700015631. Personal data questions: support@handpan-soul.ru.