Privacy Policy for Harmony Engine Plus

Harmony Engine Plus is an Android MIDI utility application developed and published by Valla Productions.

This Privacy Policy explains what information is processed when using Harmony Engine Plus, why it is processed, how long it may be retained, and how users may contact the developer regarding privacy matters.

1. Information Processed by the App

Harmony Engine Plus does not require users to create an account and does not collect names, postal addresses, contacts, precise location, financial information, MIDI performances, musical projects, or the contents of files stored on the device.

The app does, however, use an Internet connection to verify the authenticity, licensing status, and integrity of the installed application, and to protect the verification service against abuse, excessive requests, replay attempts, or flooding.

For these purposes, the app may generate and store locally two random, stable technical identifiers:

• a random device or installation identifier;
• a random app instance identifier.

These identifiers are generated by the app and stored locally on the user's device using Android SharedPreferences. They are used to distinguish repeated verification requests from the same installation or app instance.

These identifiers are not derived from the device IMEI, serial number, MAC address, Android Advertising ID, user name, email address, contacts, or other personal content.

These identifiers may remain stable across normal app launches, but may change if the user clears the app data, resets the app storage, or uninstalls and reinstalls the app.

2. Google Play Integrity and Licence Verification

Harmony Engine Plus uses the Google Play Integrity API to help verify that:

• the app is genuine and has not been improperly modified;
• the app was installed or acquired through an authorised Google Play distribution channel;
• the user has a valid Google Play licence for the app;
• the app is running on an environment that satisfies the required security checks;
• requests sent to the licence-verification service are genuine and have not been replayed or altered.

When an integrity verification is performed, Google Play Integrity may process technical information including:

• the application package name and version number;
• the application signing certificate;
• the Google Play licensing status associated with accounts present on the device;
• a request hash, nonce, token, or similar anti-replay value;
• application-integrity and device-integrity verdicts;
• device-attestation information generated by Google Play services;
• Play Protect or application-access-risk information, when those optional checks are enabled.

Google processes this information according to the applicable Google Play terms, Google Privacy Policy, and Play Integrity API terms. According to Google's Play Integrity documentation, information processed by the API is encrypted, is used for integrity and anti-abuse verification, and is deleted by Google after a fixed retention period.

Harmony Engine Plus does not use Play Integrity information to fingerprint users, track users across applications, create advertising profiles, or monitor individual user behaviour.

3. Developer Verification Server

To complete the licence and integrity check, Harmony Engine Plus sends an integrity token and related verification data to a server operated on behalf of Valla Productions. The server validates the request and, where necessary, communicates with Google Play Integrity services.

The app may send the following technical data to the verification server:

• the integrity token or verification request;
• request identifiers, challenge identifiers, hashes, nonces, or timestamps;
• a random device or installation identifier;
• a random app instance identifier;
• application version and package information.

The server may automatically process limited technical information, including:

• the integrity token or verification request;
• request identifiers, challenge identifiers, hashes, nonces, or timestamps;
• application version and package information;
• integrity and licensing verdicts returned by Google;
• the random device or installation identifier sent by the app;
• the random app instance identifier sent by the app;
• the IP address from which the request originated;
• the date and time of the request;
• HTTP status codes, security events, rate-limit events, and technical error information.

This information is processed only to provide licence verification, prevent piracy and unauthorised access, detect abuse, enforce request limits, prevent flooding, maintain service security, investigate technical failures, and protect the app and its users.

The random device or installation identifier and the random app instance identifier are used only for technical security purposes, including associating challenge and verification requests, detecting repeated or excessive requests, applying rate limits, and reducing replay or abuse attempts.

Harmony Engine Plus does not currently send a user account identifier, email address, user profile, or personal account data to the Valla Productions verification server.

4. Legal Basis

Where applicable under the European Union General Data Protection Regulation, technical information used for licence verification is processed because it is necessary to provide the licensed application and its security functions.

Security logs, random technical identifiers, request identifiers, integrity tokens, and anti-abuse information are processed on the basis of the legitimate interests of Valla Productions in protecting the app, preventing fraud, maintaining server security, enforcing valid software licences, preventing flooding, and protecting the verification infrastructure from misuse.

5. Data Retention

Integrity tokens and verification requests are processed only for the time necessary to complete the verification.

Harmony Engine Plus may store a successful licence-verification result locally on the user's device for up to seven days. This allows the app to continue operating temporarily without repeating the verification for every launch. This locally stored result is removed when it expires, when the app data is cleared, or when the app is uninstalled.

The random device or installation identifier and the random app instance identifier are stored locally on the user's device and may remain available until the app data is cleared or the app is uninstalled.

Technical server and security logs, including IP addresses, request timestamps, rate-limit events, challenge identifiers, random device or installation identifiers, and random app instance identifiers, may be retained for up to 30 days, after which they are automatically deleted or anonymised, unless a longer period is reasonably necessary to investigate an identified security incident, fraud attempt, legal claim, or abuse of the service.

Information retained for an active security investigation is deleted when it is no longer required for that investigation or for compliance with applicable legal obligations.

6. Service Providers and Data Recipients

Technical information may be processed by the following service providers solely to provide the functions described in this Privacy Policy:

• Google LLC, through Google Play, Google Play services, and the Google Play Integrity API, for application, licence, environment, and device-integrity verification;
• the infrastructure or hosting provider used to operate the Valla Productions verification server, which may process network traffic and server logs as a service provider.

Valla Productions does not sell, rent, or use this information for advertising, marketing, commercial profiling, or cross-app tracking.

7. Internet Access

An Internet connection is required periodically to perform licence and integrity verification. MIDI generation and MIDI transmission remain local to the user's device and selected MIDI destinations.

If the verification service is temporarily unavailable, the app may retry the request later or rely on a valid, non-expired local licence result.

8. MIDI Functionality

Harmony Engine Plus uses Android MIDI functionality to send MIDI notes, chords, scales, arpeggios, timing information, and related MIDI messages to compatible MIDI devices, digital audio workstations, applications, or external hardware selected by the user.

MIDI notes, chords, performances, and user-created musical content are not sent to the Valla Productions verification server or to Google Play Integrity.

9. Analytics, Advertising and Tracking

Harmony Engine Plus does not use advertising SDKs, behavioural analytics services, advertising identifiers, cookies, or tracking technologies for marketing purposes.

Technical server logs and random technical identifiers used for security, licence verification, error diagnosis, rate limiting, and abuse prevention are not used to analyse users for advertising or commercial profiling.

10. Permissions

Harmony Engine Plus uses only the Android permissions and system features required for its MIDI, connectivity, and licence-verification functionality.

The app does not use these permissions to collect contacts, messages, photographs, microphone recordings, precise location, or other unrelated personal content.

11. Security

Communications between Harmony Engine Plus and the verification server use encrypted HTTPS connections. Communications between the verification server and Google services are also transmitted using encrypted connections.

Reasonable technical and organisational measures are used to restrict access to verification data, protect server credentials, limit abusive requests, prevent flooding, and reduce unauthorised access. No method of electronic transmission or storage can, however, be guaranteed to be completely secure.

12. User Rights and Data Deletion Requests

Harmony Engine Plus does not provide user accounts and does not maintain a user profile database.

Depending on applicable law, users may request information about personal data associated with them, request correction or deletion, object to or restrict certain processing, or submit a complaint to a competent data-protection authority.

Because server logs are not intended to identify users by name, fulfilling a request may require the user to provide sufficient information to identify the relevant technical record, such as the approximate date and time of a verification request, the IP address used at that time, or the random technical identifier stored by the app if available to the user.

Privacy and deletion requests may be submitted to: vallaproductionsoriginal@gmail.com

13. Children's Privacy

Harmony Engine Plus is not specifically directed to children and does not knowingly collect personal information from children.

If Valla Productions becomes aware that personal information relating to a child has been collected unintentionally, reasonable steps will be taken to delete it.

14. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect changes to the app, licence-verification system, service providers, legal requirements, or data-handling practices.

The updated version will be published on this page with a revised effective date. Material changes will be communicated through the app or its Google Play listing where appropriate.

15. Contact