Privacy Policy

Last updated: 3 October 2026

1. Introduction

This Privacy Policy explains how Sticky Keys handles your personal information. Sticky Keys is a native desktop application for Windows and macOS that gives pianists real-time harmonic feedback, along with a Teaching Mode for tracking multiple students and a Learning Library of guided lessons.

We are committed to protecting your privacy and to handling your personal information in accordance with South Africa's Protection of Personal Information Act 4 of 2013 (POPIA). This policy describes what we collect, why we collect it, who we share it with, and the rights you have. Please read it carefully.

By using our website, downloading the free trial, purchasing a licence, or using the software, you agree to the practices described in this policy.

2. Who we are and our Information Officer

Kafka's Kaleidoscope is a trading name operated by Joubert Bekker, an individual founder and sole proprietor based in South Africa. For the purposes of POPIA, Joubert Bekker is the responsible party who determines the purpose and means of processing your personal information.

The product is now called Sticky Keys. "Kafka's Kaleidoscope" remains the registered trading name. Both names refer to the same responsible party and the same software.

The Information Officer responsible for our compliance with POPIA can be contacted at the email address below.

• Responsible party: Joubert Bekker, trading as Kafka's Kaleidoscope
• Information Officer email: [email protected]
• Business and postal address: 13 Pioneer Rd, Irene Security Estate, Centurion, Gauteng, South Africa
• Website: https://stickykeys.music

3. The personal information we collect

We aim to collect only the personal information we genuinely need to provide and protect the service. The information we collect is:

• Email address — to deliver licences, send receipts, and provide support.
• Device identifier — to activate your licence and to enforce device and seat limits. An individual licence may be activated on up to 2 devices.
• Purchase and transaction identifiers from PayPal — to verify your entitlement to the software.
• Limited technical data — such as your IP address, which we use for security, rate-limiting and abuse prevention, along with app version, operating system, and update-check data.
• Institution licences only: student name, device identifier, class membership, attendance dates and a daily practice summary. Where a school or studio buys a seat licence and enrols students in a class, we store the student's name as entered by the school, the device the student activates on, which class they belong to, and the dates the student was marked present. Each device activated on an institution seat, other than one activated with the teacher code, also sends us a daily practice summary, whether or not it has joined a class: minutes practised in lessons, how many lessons were set, attempted, passed and completed, how many different pieces were tried, average accuracy and timing scores, and the practice streak. The summary is counts and scores only, stored against the device. It holds no recording and nothing about which pieces or notes were played. This is stored so a teacher can see their own class roster, attendance and practice across devices. It applies only to institution licences: an individual customer's practice data never leaves their own machine.

We never store or process card numbers. All card data is handled solely by PayPal, as explained in section 6.

4. Why we collect it and our justification under POPIA

We only process your personal information where a justification ground under section 11 of POPIA applies. Depending on the information, our justification is one or more of the following:

• Performance of a contract — processing that is necessary to conclude or perform our agreement with you, so that we can provide the software, deliver and activate your licence, verify your entitlement, and provide support.
• Our legitimate interests — processing that protects the legitimate interests of Sticky Keys, such as keeping the service secure and preventing fraud and abuse, including rate-limiting and enforcing device and seat limits.
• Consent — where processing is based on your consent, such as for optional communications, in which case you may withdraw your consent at any time.

5. Local-first design

Sticky Keys is largely local-first. Your practice data, student profiles, and settings are stored locally on your own device and are not uploaded to us. For an individual licence, the only information that leaves your device is what is needed for licence and entitlement checks, together with the limited technical data described in section 3.

Institution licences are the one exception. Where a school or studio enrols students in a class, the class roster (each student's name as entered by the school, and the device they activate on) and their attendance dates are stored on our servers, so that a teacher can see their own class across devices. Each device activated on an institution seat also sends a daily practice summary for the teacher to see, whether or not it has joined a class: minutes practised, how many lessons were set, attempted, passed and completed, how many different pieces were tried, accuracy and timing scores, and practice streak. Recordings and what was played are still never uploaded. A device activated with the teacher code sends no practice summary, and nothing of this kind is sent for an individual licence. See sections 3, 9 and 11.

The software requires a MIDI keyboard connected by USB or MIDI cable. We do not supply hardware, and we do not receive your practice content.

6. Who we share your information with

We do not sell your personal information. We share it only with the operators and third parties who process data on our behalf so that we can provide the service. These are:

• PayPal — processes all payments, including debit and credit cards via PayPal guest checkout. Sticky Keys never stores or processes card numbers; PayPal handles all card data.
• Cloudflare — provides website hosting, serverless Workers, R2 file storage, and security services.
• Email provider (Google / Gmail) — used for correspondence with you.

These operators process your personal information on our behalf and are required to protect it in a manner consistent with POPIA.

7. Cookies and local storage

Our marketing website does not use third-party advertising or cross-site tracking cookies.

The organisation admin console stores an admin token in your browser's sessionStorage only. This is cleared when the browser tab is closed and is used to keep you signed in during your session. It is not a tracking cookie and is not used to profile you.

8. Cross-border processing

Some of our operators process personal information outside South Africa. In particular, website hosting (Cloudflare) and payments (PayPal) may involve processing in other countries.

Where personal information is transferred across borders, we ensure it is handled with the safeguards required by POPIA, including the conditions for trans-border information flows set out in section 72 of POPIA. This means such transfers are made only where the recipient is subject to laws, binding rules, or agreements that provide an adequate level of protection, or where another lawful ground for the transfer applies.

9. How long we keep your information

We keep your personal information only for as long as it is needed to provide the service to you and to meet our legal and accounting obligations. Once it is no longer required for these purposes, we delete it.

For institution licences, a device's daily practice summaries are kept for 120 days and then deleted. They are deleted sooner when the teacher removes or blocks a student's device, when the school asks us to remove a device from its licence or to erase its data, or when the school's licence has ended and its grace period has passed.

10. How we keep your information secure

We take reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, and misuse. This includes measures such as rate-limiting and abuse prevention, restricting the information we collect, and relying on established operators, such as PayPal for all card data and Cloudflare for hosting and security. Because your practice data and student profiles remain on your own device, you should also take care to keep your device secure.

11. Children's and students' information

The service is intended for a general audience, which includes music students. Where the software is used by minors, for example in a school setting, the institution or the parent is responsible for obtaining any consent required by law before the minor uses the service. Under an institution licence, that includes consent to the attendance dates and the daily practice summary that each device on a seat sends for the teacher to see.

We do not knowingly collect the personal information of children beyond what a school provides to us to manage its seats and classes, and the attendance dates and daily practice summaries described in sections 3 and 5. If you believe a minor's information has been provided to us without appropriate consent, please contact us and we will address it.

12. Your rights under POPIA

Under POPIA, you have the following rights in relation to your personal information:

• Access — to ask what personal information we hold about you.
• Correction — to ask us to correct information that is inaccurate or out of date.
• Deletion — to ask us to delete your personal information where we are no longer entitled to keep it.
• Objection — to object to the processing of your personal information in certain circumstances.
• Complaint — to lodge a complaint with the Information Regulator of South Africa if you believe we have not handled your information lawfully.

13. How to exercise your rights and complain

To exercise any of your rights, please email us at [email protected]. We will respond to your request in accordance with POPIA.

You also have the right to lodge a complaint with the Information Regulator of South Africa, which oversees compliance with POPIA. We would, however, appreciate the chance to address your concerns directly first, so we encourage you to contact us before doing so.

14. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes in our practices or in the law. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of the website and the software after an update means you accept the revised policy.

15. Contact

If you have any questions about this Privacy Policy or about how we handle your personal information, please contact our Information Officer:

• Email: [email protected]
• Postal address: 13 Pioneer Rd, Irene Security Estate, Centurion, Gauteng, South Africa

This Privacy Policy is governed by the laws of the Republic of South Africa. Nothing in this policy limits or excludes any statutory right you have under POPIA, the Consumer Protection Act 68 of 2008, or the Electronic Communications and Transactions Act 25 of 2002 that cannot lawfully be excluded.