Privacy Policy

Harmony is a multi-tenant scheduling application for studios and schools, operated by Harmony. When you create a studio, join one as a teacher or student, or browse our public marketing pages, this policy describes how we handle your information.

Questions about privacy? Email support@harmonyscheduling.com or support@harmonyscheduling.com.

We collect information you provide and information generated when you use the service:

• Account details — name, email address, and password (stored hashed, never in plain text) when you use email sign-in. If you use Google sign-in, Google shares your name and email with us for authentication.
• Studio data — studio name, branding settings, lesson schedules, availability, reschedule/cancellation policy, and member roles (admin, teacher, student).
• Lesson and notification data — recurring lesson patterns, per-occurrence changes, email notification preferences, and a delivery log of messages we send on your behalf.
• Billing information — when Stripe billing is enabled, payment method and subscription status are processed by Stripe. We store Stripe customer and subscription identifiers, not full card numbers.
• Security data — optional two-factor authentication settings, trusted-device choices, rate-limit counters, and support-access audit entries when platform support is granted.
• Assistant chat — if your studio enables the optional student assistant, chat messages and tool-call metadata are stored to provide the feature and enforce rate limits.
• Technical data — session cookies, an active-studio selection cookie for users in multiple studios, standard server logs (IP address, user agent, request timing) needed to operate and secure the service, and when enabled, analytics and advertising-measurement data collected by Google across our marketing website (page views, navigation paths, interaction events such as sign-up attempts, and conversion events used to measure paid advertising).

We use personal information to:

• Provide scheduling, rescheduling, cancellation, and calendar-invite features.
• Authenticate users, enforce role-based access, and protect accounts (including optional 2FA).
• Send transactional emails such as lesson updates, password resets, invites, and two-factor codes.
• Operate optional billing through Stripe when configured.
• Provide optional AI-assisted scheduling help to students when enabled.
• Grant time-boxed, consent-gated platform support and record those visits in your audit log.
• Detect abuse, enforce rate limits, and maintain the security and reliability of the service.
• Understand how visitors and signed-in users navigate the website and improve the product (via Google Analytics when enabled).
• Measure the effectiveness of our own marketing (via Google Ads conversion tags when advertising is enabled).

We do not sell your personal information. We do not use your lesson data for advertising.

We do not sell your personal information and do not use your lesson data for cross-context behavioral advertising. When Google Ads is enabled on our marketing site, conversion tags may measure whether a visitor later signs up so we can optimize our own campaigns — that is limited to marketing-site measurement, not lesson content. Depending on your state of residence, you may have rights under laws such as the California Consumer Privacy Act (CCPA/CPRA), Colorado Privacy Act, Connecticut Data Privacy Act, Virginia Consumer Data Protection Act, and similar state statutes.

Subject to applicable law, those rights may include:

• Know / access — request details about the categories and specific pieces of personal information we have collected about you.
• Delete — request deletion of personal information we hold, subject to legal exceptions.
• Correct — request correction of inaccurate personal information.
• Opt out— opt out of the sale or sharing of personal information. We do not sell personal information. When Google Ads conversion measurement is enabled on our marketing site, you can limit advertising cookies via your browser settings or Google's ad settings.
• Non-discrimination — we will not discriminate against you for exercising privacy rights.

To exercise these rights, email support@harmonyscheduling.com. We may need to verify your identity. You may designate an authorized agent where your state law allows. California residents may also use the contact information in our Terms of Service state notices.

Each studio is a separate tenant. Studio admins control membership, policy, and (where enabled) billing. Teachers can manage their own lessons and see their students; students can act only on their own lessons. Data is scoped to your studio on every server request.

If you join a studio via an invite, your studio admin is the primary controller of lesson and membership data for that studio. Harmonyprocesses that data on the studio's behalf to run the application.

We use trusted providers to host and deliver the service. They process data only to perform work for us and are bound by contractual confidentiality and security obligations:

• Cloud hosting (Microsoft Azure Container Apps) for the application.
• Managed PostgreSQL (Neon) for application data.
• Google — Sign in with Google (OAuth) when enabled; optional Google Calendar sync (including bidirectional updates when you opt in), free/busy, Meet links, and Contacts autocomplete when you connect them from settings; optional website Analytics and Google Ads conversion measurement when enabled.
• Stripe — optional payment processing and subscription management.
• Azure Communication Services Email — optional transactional email delivery when configured.
• Anthropic — optional AI assistant responses when configured.

A current list of subprocessors and related security practices is on our Security page.

Harmony uses cookies and similar storage to operate the service and, when analytics or advertising measurement is enabled, to understand how visitors use our marketing website and whether paid campaigns lead to sign-ups. We do not use lesson data for advertising.

• Session cookie — keeps you signed in (expires after seven days of inactivity, refreshed while you use the app).
• Active studio cookie — remembers which studio you are working in when you belong to more than one.
• Trusted device cookie— if you choose “trust this device” during two-factor sign-in, skips the prompt for up to 90 days on that browser.
• Google Analytics cookies — when enabled, Google may set first-party analytics cookies across our website to measure page views, navigation, and events (such as sign-up form interactions). See Google's Privacy Policy.
• Google Ads cookies — when advertising is enabled, Google may set cookies used for conversion measurement (and related ad features) so we can tell whether a marketing visit led to a studio sign-up. See Google's advertising technologies.

Authentication cookies are strictly necessary for the signed-in app. You can clear cookies in your browser settings, which will sign you out. To opt out of Google Analytics across websites, use the Google Analytics Opt-out Browser Add-on. To manage Google ad personalization, visit Google Ads Settings.

We retain account and studio data while your account or studio is active. Notification and support-audit records are kept to provide history to studio admins. If you request that we delete your account or close a studio (email support@harmonyscheduling.com), we delete or anonymize associated personal data within a reasonable period, except where we must retain information for legal, security, or billing purposes (for example, Stripe records or abuse-prevention logs).

We use industry-standard measures including hashed passwords, server-side access checks on every request, per-studio data isolation, rate limiting on authentication endpoints, and audited, consent-gated support access. No online service is perfectly secure; report concerns to support@harmonyscheduling.com.

In addition to state privacy rights described above, you can:

• Access and update account information in your profile and studio settings.
• Request an export of data you provided by emailing us.
• Control lesson notification emails in your account notification preferences.
• Withdraw consent for optional features such as trusting a device for two-factor sign-in.

Email support@harmonyscheduling.com for requests we cannot fulfill in-product. Studio members should also contact their studio admin for lesson-specific requests. Transactional messages required for security (password reset, two-factor codes) cannot be opted out while you use those features.

Harmonyis intended for use by studios and schools. Student accounts are created by studio admins or via invite. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe we have collected information from a child under 13 in violation of the Children's Online Privacy Protection Act (COPPA), contact support@harmonyscheduling.com and we will take appropriate steps.

We process and store information in the United States. Our service providers may also process data in the U.S. By using the service, you understand that your information will be handled in the United States, which may have different data-protection rules than your home state's laws provide for data held locally.

We may update this policy from time to time. We will post the revised version on this page and update the effective date. Material changes that affect how we use personal information will be communicated through the service or by email where appropriate.

Harmony
Privacy: support@harmonyscheduling.com
General: support@harmonyscheduling.com
Security: support@harmonyscheduling.com

See also our Terms of Service and billing summary on Pricing ($10/teacher/month, 30-day trial).