Policies

Effective 17 June 2026 · Version 1.10

This page covers the three documents you should know about when using Stairway2Fast: the Terms of Service, the Acceptable Use Policy, and the Privacy Policy. Plain English, no legalese.

1. Terms of Service

What this service does

Stairway2Fast (the "Service") lets you loop and slow-play YouTube videos and your own uploaded videos for music practice, and tracks your practice time. The Service is operated by Feya Labs Ltd, a company registered in England and Wales (company number 17267727).

Your account

• Account registration is for adults only (18+). To create an account you must confirm you are an adult — at least 18, or the age of majority in your jurisdiction — by ticking the confirmation at sign-up. We do not open account registration to anyone under 18. The Service is not directed to or intended for children, and we do not knowingly collect personal information from anyone under 13. We do not ask for a date of birth.
• If you choose to let someone under 18 use the Service, you do so through your own adult account, as their parent or legal guardian; you supervise that use and you are responsible for it — the same way you would be for any other website or app you allow them to use. The account remains yours and you are legally responsible for all activity under it. A minor must not create their own account.
• You are responsible for keeping your password safe and for everything that happens under your account.
• One account per person. Don't impersonate someone else.
• We may suspend or terminate your account if you violate these Terms or the Acceptable Use Policy.

Your content

• You own your videos. Uploading or syncing a video to the Service does NOT transfer ownership to us.
• You grant us a limited, non-exclusive licence to host, process, and deliver your videos solely for the purpose of providing the Service to you.
• You represent that you have the right to upload and use any content you upload (including any third-party music or video in it).
• You can delete your videos at any time. Deletion removes the video from our cloud storage; cached copies on Cloudflare's edge network may persist for up to 24 hours before they expire.

Third-party content (YouTube and others)

• When you add a YouTube link, the Service uses YouTube's official embedded player to play it in your browser. We do not host, mirror, download, or modify YouTube content. The relationship between you and YouTube is governed by YouTube's Terms of Service.
• Whether ads are shown during YouTube playback depends on YouTube and on your browser settings. We do not provide, bundle, recommend, or encourage tools that block YouTube ads, and we make no promise that YouTube playback through the Service is ad-free.
• The Service applies playback controls (loop, slow-down, pause-seek) only via YouTube's own publicly documented embedded-player API. We do not bypass YouTube's content protection, modify the video stream, or remove watermarks / end-screens / branding shown by YouTube.
• If a video is removed from YouTube, becomes private, or loses embedding permission, we cannot play it. Your saved loops and practice history for that video remain intact — you just can't watch it any more.

Service availability

We aim for the Service to be available 24/7 but provide no guarantee. We may perform maintenance, change features, or suspend the Service without notice. We are not liable for any loss caused by the Service being unavailable.

Payments & Pro subscription

Most of the Service is free, including cross-device sync of your YouTube library and all the practice tools. Pro is an optional paid subscription (currently $6/month or $58/year in USD, or your local-currency equivalent shown at checkout — e.g. £4.99/month in the UK) that unlocks cloud-mirroring of your own uploaded video files, cross-device playback of them, and the deeper practice insights. Prices are shown before you pay. There is no free trial — the free tier lets you try the product for as long as you like before upgrading.

Who you pay. Pro payments are processed by Stripe, which acts as the merchant of record (the seller for the transaction) via Stripe's Onelink (Managed Payments) service. Stripe handles the payment, any applicable sales tax / VAT, and billing support. Your card statement shows an Onelink / Stripe descriptor and your receipts are issued by Stripe.

By subscribing you agree that:

• Auto-renewal. Subscriptions auto-renew at the end of each billing period (monthly or annual) until cancelled, charged to the payment method on file.
• Cancellation. Cancel any time in Settings → Cancel subscription (in-app, one tap). Cancellation takes effect at the END of the current paid period — you keep Pro until then and are not billed again.
• 14-day cancellation right. If you are a consumer, you may cancel within 14 days of subscribing for a full refund. By starting to use Pro features immediately you ask us to begin the service within that period; we still honour a full refund within 14 days of the first charge.
• Refunds. Because Stripe is the merchant of record, refunds are handled through Stripe / Onelink. You can request one from your Onelink account or by emailing [email protected], which we will forward; refunds are subject to Stripe's processing (typically within 60 days of the charge). Our guideline: monthly — full refund within 14 days of the most recent charge; annual — full within 14 days, then pro-rated for whole unused months.
• Failed payments. If a renewal fails, Pro stays active for about three weeks while the payment is retried (you will see an in-app prompt to update your card). If retries fail, the account reverts to Free.
• What happens on downgrade. Your practice history and YouTube library are unaffected. Videos you uploaded to cloud storage (a Pro feature) may be removed from our cloud storage after you downgrade, so please download or back up anything you want to keep before cancelling. You can also delete your uploads yourself at any time; copies stored locally on your own device are not affected. Your practice sessions and history are kept and retained the same way as on the free tier — see the Privacy Policy's Retention section.
• Pricing changes. We will give at least 30 days' notice before any price increase affects your subscription; you can cancel before it applies.
• Taxes. Listed prices are inclusive of any applicable VAT / sales tax where it applies. Stripe, as merchant of record, calculates and remits that tax and itemises it on your receipt — so the price you see is the price you pay.

Disclaimers and liability

The Service is provided "as is" without warranty of any kind. To the maximum extent permitted by law, our total liability for any claim arising from the Service is limited to the amount you paid us in the 12 months before the claim. Nothing in these Terms limits liability that cannot lawfully be excluded (including death or personal injury caused by negligence, fraud, or breach of statutory consumer rights).

Changes

We may update these Terms. If a change materially reduces your rights, we'll give reasonable notice (for example an in-app notice or an email) before it takes effect, and the change will apply going forward only. Minor changes (clarifications, or terms for new features) take effect when posted. If you don't agree with a change, you can stop using the Service and close your account; the previous terms continue to apply to your use before the change.

Governing law

These Terms are governed by the laws of England and Wales. Disputes are subject to the exclusive jurisdiction of the English courts.

2. Acceptable Use Policy

Stairway2Fast is for music practice. The following content and behaviour is prohibited:

Prohibited content

• Child sexual abuse material (CSAM), including AI-generated. Where we become aware of CSAM, we remove it and report it to the relevant authorities (UK Internet Watch Foundation / US NCMEC) and cooperate with law enforcement.
• Non-consensual intimate imagery ("revenge porn", upskirting, deepfake pornography of identifiable people).
• Pornography of any kind. The Service is not for adult content.
• Gore, real violence, or content glorifying violence, terrorism, or self-harm.
• Hate speech targeting protected groups (race, religion, sexuality, gender, disability, etc.).
• Harassment of identifiable individuals, including doxxing.
• Content that infringes someone else's rights. You must own, or have the necessary rights, permission, or licence for, anything you upload. We are not responsible for verifying this. If we receive a valid complaint that uploaded content infringes a third party's rights, we remove it (see the DMCA / Copyright takedown page and "Reporting abuse or illegal content" below).
• Malware, phishing payloads, or any content designed to compromise other users.
• Personal data of others (private addresses, ID documents, etc.) without consent.

Prohibited behaviour

• Using automated tools to scrape, mass-upload, or artificially inflate practice time.
• Circumventing our rate limits or content checks.
• Reverse-engineering the Service to build a competing product.
• Sharing your account credentials with others.

Enforcement

• We may remove content or suspend accounts at our discretion if we believe this Policy has been violated. We aim to give notice where reasonable, but for severe violations (CSAM, violence, malware) we act first and notify later.
• For CSAM specifically, we are legally required to report and we will. There is no warning, no "delete and we'll ignore it".
• Appeals: email [email protected] with the content URL and your explanation. We respond within 7 days.

3. Privacy Policy

What we collect

• Account info: email address, display name, an avatar (an emoji or a profile photo you choose to upload), and an optional @handle (username). Provided when you sign up or edit your profile. If you sign up using Google Sign-In, we receive your email and basic Google profile (name, profile picture) from Google. We never request access to your Gmail, Drive, Calendar, Contacts, Photos, or any other Google data — only the basic identity needed to sign you in.
• Practice data: what videos you added, how long you practiced each, at what speed, with what loop range. Tracked automatically while you use the Service.
• Uploaded content: if you sync local videos to our cloud, we store the video file and a thumbnail on Cloudflare R2 storage. If you upload a profile photo, the cropped image is stored there too.
• Social & settings: friends you connect with, anything you explicitly choose to share (a practice loop or a recap you send), and your settings such as your daily practice goal and theme.
• Technical logs: request timestamps, IP address (truncated before we store it), browser type. Used for security, abuse prevention, and basic usage analytics.

What we do with it

• Provide and improve the Service.
• Bill you for paid features (when applicable).
• Investigate abuse or security incidents.
• Comply with legal obligations (e.g., respond to court orders, report CSAM).

Personalisation & aggregated insights

Current status: of the activities described below, the personalised dashboard features (Today's Step, streak, weekly recap) are live today. The cross-user aggregated insights and the YouTube-metadata instrument inference are not yet active — they are planned for a future release, and we will not begin them without a clear update here first. The opt-outs in Settings → Privacy already apply, so any choice you record now is honoured the moment those features turn on.

We process your practice data (speed history, loop ranges, session durations, video metadata derived from YouTube public information) under legitimate interest (GDPR Art 6(1)(f)) to:

• Personalise your dashboard — show you Today's Step, streak grace, weekly recap, and (in future) practice recommendations tailored to your history. In a future release we may infer the primary instrument of each video from its public YouTube title, channel, and tags (no audio analysis) so we can route recommendations correctly; this inference is not running yet. When active it is internal only and is never surfaced as a label in the UI.
• Compute anonymised group insights (planned) — for example "the median user reaches 0.9× on this song in 14 days". These statistics are computed only when at least 20 users have practised a given video, and only when each speed bucket / loop region has enough users to prevent any individual being identified (k-anonymity + l-diversity applied). Identifying fields (email, display name, @handle) are stripped before aggregation.
• (Future) train a personalised recommendation model — Phase 3, year 2+. This would be done under your consent, not legitimate interest: we will write a dedicated update to this policy and ask for opt-in before any model training begins. Until then, no model uses your data.

Your right to object (GDPR Art 21): You can opt out anytime in Settings → Privacy:

• Personalized recommendations off → no Why button, no future recommendation surfaces.
• Contribute to aggregated insights off → your sessions are excluded from the cross-user statistics computation. Your own dashboard works exactly the same.

Deleting your account removes your contribution from all future aggregations. Aggregations already computed before deletion are not re-run, but your individual data has already been stripped by the k-anonymity step.

Children

Stairway2Fast is a general-audience tool intended for adults. It is not directed to or intended for children, and we do not knowingly collect personal information from anyone under 13. We do not ask for a date of birth and we do not market the Service to children.

If you are a parent or guardian and you choose to let a child use the Service under your supervision, you do so through your own adult account and you are responsible for that use — the same as for any other website or app you allow them to use (see Terms → Your account).

If you believe a child under 13 has provided us personal information, or that a child is using the Service without a parent's involvement, please email [email protected] and we will delete the information and take appropriate action. We action such requests within 30 days.

What we do NOT do

• We do not sell your data to third parties.
• We do not run third-party ads or advertising trackers.
• We do not look at the content of your uploaded videos except as needed for automated safety scanning (image/frame checks for nudity and abusive content) and incident response. Where we become aware of child sexual abuse material we report it — see the Acceptable Use Policy.

Where your data lives

• Account and practice metadata: Google Firebase (Firestore + Auth), hosted in the EU.
• Uploaded videos and profile photos: Cloudflare R2, Western Europe region.
• Static site assets: Cloudflare Pages global CDN.
• Transactional emails (account verification and password reset): delivered via Resend (resend.com), processed in the EU (Ireland). Only your email address and the email body are sent — no practice data, no uploaded content.
• Bot / abuse protection: Google reCAPTCHA via Firebase App Check (Google LLC, United States). Receives technical request signals only (device / interaction data) to score bots — no practice data, no uploaded content, no advertising use.
• Payments (Pro only): processed by Stripe as merchant of record (Stripe Payments Europe, Ltd., Dublin, Ireland, and its affiliates) — see "Payment processing" below. We never receive your card number; no practice data or uploaded content is shared with Stripe.

International transfers. Our data is processed in the EU — Firebase Firestore (Europe), Cloudflare R2 (Western Europe), and email delivery via Resend (Ireland). The one processor that handles data in the United States is Google, which receives technical security signals for reCAPTCHA / App Check (no practice data or uploaded content). For Pro subscribers, Stripe additionally processes payment data as merchant of record (the contracting entity is Stripe Payments Europe, Ltd., Dublin; Stripe is a US-parented group). Note that some providers are US-incorporated companies even where they process your data in the EU. Where personal data is transferred to, or accessible from, outside the UK/EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) / Addendum or the EU Standard Contractual Clauses, as provided in each processor's data processing agreement.

Payment processing (Stripe)

When you upgrade to a paid Pro subscription, payment is handled entirely by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland, and its affiliates), which acts as the merchant of record via Stripe's Onelink service. Stripe is PCI-DSS Level 1 certified. We do not see or store your card number, CVC, expiry, or any card details. From Stripe we receive only a customer ID, your subscription status, plan, renewal date, and receipt links — never the card itself, which stays in the Stripe / Onelink portal we don't have access to. Stripe processes this data under its own privacy policy at stripe.com/privacy.

Security & data breaches

We protect your data with per-account access rules, isolated service credentials, App Check attestation, and truncated IP logging. No system is perfectly secure, but if a personal-data breach occurs that is likely to pose a risk to your rights, we will notify the UK Information Commissioner's Office without undue delay (within 72 hours where required), and we will inform affected users directly without undue delay where the breach is likely to result in a high risk to you.

Your rights (UK / EU GDPR)

• Access: request a copy of your data (email us, or use the self-serve export below).
• Deletion: delete your account and all associated data yourself, in-app, from Settings → Advanced → Delete account — it removes your login and data straight away. Anything that can't be removed instantly is purged within 30 days. This is permanent and cannot be undone.
• Portability: download your data as a JSON file from Settings → Advanced → Download my data. Includes your videos, categories, named loops, daily practice totals, preferences, and friend connections — the data you provided to us. Stairway2Fast's analytical derivations (per-speed breakdowns, IoU cluster bands, tier achievements, monthly reports, speed-progress timelines, recap images, Stairway visualisation data) are not included; these are our analysis of your data, not your data itself. This follows the GDPR Article 20 scope of "data the data subject has provided."
• Rectification: correct inaccurate data we hold about you.
• Object / restrict: object to or restrict processing based on legitimate interest (see legal bases below).
• Complain to a regulator: if you believe we have mishandled your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk), or your local EU/EEA supervisory authority. We'd appreciate the chance to resolve it first — email us below.

Deletion and Portability are self-serve in the app (Settings → Advanced). For Access, Rectification, or objection requests, email [email protected].

Our legal bases (UK / EU GDPR Art 6)

• Contract (Art 6(1)(b)) — to provide the Service you signed up for: your account, your video library, practice tracking, cross-device sync, and (for Pro) uploaded-video storage.
• Legitimate interest (Art 6(1)(f)) — security and abuse prevention (including reCAPTCHA / App Check and truncated-IP logs), and the dashboard personalisation described above. You can object to legitimate-interest processing at any time.
• Legal obligation (Art 6(1)(c)) — to comply with the law, e.g. responding to valid legal requests and our adult-affirmation record.
• Consent (Art 6(1)(a)) — for anything we mark as opt-in, such as any future model training. You can withdraw consent at any time.

Account deletion is permanent. Deleting your account removes your login and data and cannot be undone — we cannot recover a deleted account, and a previously-downloaded data export cannot be re-imported (the export is one-directional by design, which keeps streaks and totals honest). If you may want a copy of your data, use Settings → Advanced → Download my data before you delete.

Revoking Google Sign-In access

If you signed in with Google, you can revoke our app's access to your Google account at any time at myaccount.google.com/permissions. Revoking access prevents future Google sign-ins but does not delete your existing Stairway2Fast account or your practice history — for that, use the "Deletion" request above.

Cookies & local storage

We use Firebase Authentication's storage (so you stay signed in) and your browser's local storage / IndexedDB to keep the app working — for example your interface preferences and, on the guest tier, your practice data before you create an account. These are strictly necessary for the Service to function.

For security and abuse prevention we use Google reCAPTCHA (via Firebase App Check). reCAPTCHA loads a script from Google and sets a cookie that is necessary for that protection, and sends technical signals about the request (such as device and interaction data) to Google in order to tell real users apart from bots. It does not receive your practice data or uploaded content, and we do not use it for advertising. Your use of the Service is subject to Google's Privacy Policy and Terms.

We do not set advertising or marketing cookies, and we do not run third-party advertising trackers. The only third-party script we load is the Google reCAPTCHA security component described above.

Retention

We keep the minimum we need to run the tool and show you your progress. Retention by data class:

• Practice sessions (the precise per-session record of video, speed, loop, and duration): kept while your account is active, so your long-run progress and Stairway hold up. We may aggregate older precise rows into daily totals over time to keep the app fast; either way they are deleted when you delete the video or the account.
• Daily totals: kept for the life of the account so long-run streaks and lifetime totals survive; deleted on account deletion.
• Library & profile (your videos, categories, notes, profile name, @handle, goal): kept while in your library / while the account is active; deleted on removal or account deletion.
• Uploaded videos (Pro): kept while referenced by a library item; deleted on video removal, account deletion, or subscription end.
• Diagnostic / security logs (truncated-IP request logs, error / diagnostic events): kept for as long as needed for debugging, security, and abuse investigation, and no longer than necessary for those purposes; deleted at the latest when you delete your account.

Deleting your account removes your sessions, daily totals, videos (including any uploaded files), your profile, and social connections.

4. Contact & takedown

General contact

Questions, bug reports, feature ideas: [email protected].

Reporting abuse or illegal content

If you encounter content that violates our Acceptable Use Policy — especially CSAM, threats, NCII, or harassment — please report it immediately:

• Email [email protected] with the URL or video title and a brief description.
• For CSAM specifically, you can also report directly to the UK Internet Watch Foundation or US NCMEC CyberTipline.

Copyright / DMCA

Full details and counter-notice procedure are on the DMCA / Copyright takedown page.

If you believe your copyrighted work has been used on the Service without permission, send a DMCA notice to [email protected] including:

• Identification of the copyrighted work
• URL or location of the alleged infringement on our Service
• Your contact information
• A statement that you have a good-faith belief that the use is not authorised
• A statement, under penalty of perjury, that the information is accurate and you are authorised to act on behalf of the copyright holder
• Your physical or electronic signature

We action valid notices within 48 hours.