Privacy Policy
Effective Date: March 1, 2026 · Last Updated: April 6, 2026 (added state student privacy laws and parent deletion request path)
MusiCal ("MusiCal," "we," "us," or "our") respects your privacy. This Privacy Policy ("Policy") describes how we collect, use, disclose, retain, and protect personal information when you visit our website, create or use an account, download a calendar, or otherwise interact with the MusiCal website at musicalendars.com, the application at app.musicalendars.com, and any related products, features, content, or services (collectively, the "Service").
By accessing or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree with this Policy, you must not access or use the Service. This Policy is incorporated by reference into our Terms of Service.
1. Definitions
For purposes of this Policy:
- "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.
- "Student Data" means personally identifiable information from education records as defined under the Family Educational Rights and Privacy Act ("FERPA") and applicable state student privacy laws.
- "Administrator" means a user authorized by a school, theatre company, or other organization to manage productions in the Service on its behalf.
- "School" means any educational institution, theatre program, community theatre, or organization that uses the Service to manage productions.
- "Cast Member" means an individual whose information is added to the Service by an Administrator as a participant in a production.
2. Information We Collect
2.1 Information Provided by Administrators
Administrators voluntarily enter information into the Service to manage their productions. This may include:
- Cast and crew member names, display names, grade levels, and contact information (email and phone)
- Parent and guardian names and contact information
- Character assignments, casting decisions, audition results and notes
- Rehearsal schedules, scene breakdowns, and production timelines
- School or organization name, location, and related details
- Conflicts, attendance records, and any production-related notes
2.2 Information from Cast Members and Families
When Cast Members or families interact with the Service through the public download portal, audition forms, or other self-service features, we may collect:
- The name selected from a roster of Cast Members for a particular production
- The production access code or audition form link used
- Audition submissions, including the prospective performer's name, grade level, contact information, prior experience, role preferences, and any other fields the School chooses to include on its audition form
- Conflicts and availability information voluntarily entered through self-service features
- Calendar download activity (format requested, timestamp)
Submissions by parents and guardians on behalf of minor children. Parents and legal guardians may submit audition forms, conflict information, and other Cast Member information on behalf of their minor children. By submitting such information, the parent or guardian represents that they have the authority to do so and consents to the collection and use of that information by MusiCal and the relevant School in accordance with this Policy. Information submitted by a parent on behalf of a child is treated as Cast Member information for purposes of this Policy and, where applicable, as Student Data under FERPA and state student privacy laws once it is associated with a School's production.
2.3 Information from Administrators When They Sign In
Administrators authenticate through one or more third-party identity providers. When you sign in, we may receive:
- Your email address
- Your display name
- Your profile picture URL
- A unique account identifier issued by the identity provider
We do not receive your password from the identity provider.
2.4 Automatically Collected Information
When you interact with the Service, we and our service providers may automatically collect:
- Device and browser information (device type, browser name and version, operating system, screen resolution, and timezone)
- IP address and approximate location derived from it
- Pages visited, features used, actions taken, and timestamps
- Referring URL and exit URL
- Error reports and diagnostic information
2.5 Information We Do Not Collect
We do not knowingly collect:
- Government-issued identification numbers
- Financial account or payment card information through the Service (any future paid plans will be processed by a third-party payment processor with its own privacy notice)
- Precise geolocation data
- Biometric information
- Health information
3. How We Use Information
We use Personal Information for the following purposes and on the following lawful bases (where applicable under data protection laws):
- To provide the Service — generating personalized rehearsal calendars, managing productions, distributing schedules, processing role assignments, and tracking attendance (performance of contract; legitimate interests).
- To authenticate and secure accounts — verifying identity, preventing fraud, and protecting the integrity of the Service (legitimate interests; legal obligation).
- To communicate with users — responding to inquiries, sending operational notices, and providing support (performance of contract; legitimate interests).
- To monitor, troubleshoot, and improve the Service — diagnosing technical issues, analyzing usage patterns, and developing new features (legitimate interests).
- To comply with legal obligations — responding to lawful requests from public authorities and complying with applicable laws (legal obligation).
- To enforce our agreements — investigating violations of our Terms of Service and protecting our rights, property, and safety, and that of our users and the public (legitimate interests).
We do not use Personal Information for advertising, behavioral profiling, marketing to children, training generative AI models, or any purpose unrelated to providing the Service.
4. How We Share Information
We do not sell Personal Information, and we do not share it for cross-context behavioral advertising. We disclose Personal Information only as follows:
- With your School or Administrator — Cast Member and family information entered by an Administrator is accessible to other authorized Administrators within the same production or organization.
- With service providers — We use carefully selected third-party vendors to host, operate, secure, and support the Service (including cloud infrastructure providers, identity providers, email delivery services, error tracking services, and customer support tools). These vendors are bound by contractual confidentiality and data protection obligations and are permitted to use information only as necessary to provide their services to us.
- For legal reasons — When required by law, regulation, court order, subpoena, or government request; to enforce our Terms; to protect against fraud or abuse; or to protect the rights, property, safety, or security of MusiCal, our users, or the public.
- In a business transaction — In connection with a merger, acquisition, financing, sale of assets, reorganization, bankruptcy, or other change of control. In such an event, we will provide notice and any successor will be bound by the commitments in this Policy.
- With your consent — When you explicitly direct us to share information with a third party.
5. Data Storage, Security, and Location
We store Personal Information using commercial cloud infrastructure providers located in the United States. We employ a combination of administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, and destruction, including encryption in transit (HTTPS/TLS), encryption at rest, access controls based on the principle of least privilege, and routine security monitoring.
However, no security system is impenetrable, and no method of data transmission or storage is one hundred percent secure. We cannot guarantee the absolute security of Personal Information, and we are not responsible for circumstances beyond our reasonable control, including unauthorized acts by third parties. You acknowledge that you provide Personal Information at your own risk.
If we become aware of a security incident affecting your Personal Information, we will notify you and the relevant authorities as required by applicable law.
6. International Users
The Service is operated from and intended for users in the United States. If you access the Service from outside the United States, your information will be transferred to, processed in, and stored in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to the United States. We do not currently offer Service in jurisdictions where doing so would require us to comply with the General Data Protection Regulation ("GDPR") or similar comprehensive data protection regimes.
7. Data Retention
We retain Personal Information for only as long as necessary to fulfill the purposes for which it was collected, including providing the Service, complying with our legal obligations, resolving disputes, and enforcing our agreements. Our default retention practices are:
- Generated calendar files are automatically deleted approximately ninety (90) days after generation.
- Production and Cast Member data is retained for approximately two (2) years after the end of the production season, configurable by the Administrator.
- Activity and audit logs are retained for as long as necessary to provide ongoing analytics and to support security and integrity of the Service.
- Administrator account information is retained until the account is deleted or becomes inactive for an extended period.
Schools may request earlier deletion of their data by contacting us. Parents and legal guardians may also request deletion or correction of their child's information by contacting us at privacy@musicalendars.com; we will route such requests to the relevant School for verification and act on the School's instruction in accordance with FERPA and applicable state law. After deletion, residual copies may persist in backup systems for a limited time before being overwritten in the ordinary course.
8. Children's Privacy and COPPA
The Service is designed for use by schools and theatre organizations, and we recognize that some Cast Members may be under thirteen (13) years of age. The Children's Online Privacy Protection Act ("COPPA") regulates the online collection of personal information from children under 13.
- We do not direct the Service to children under 13 for general consumer use, nor do we knowingly allow children under 13 to register accounts or interact directly with the Service in ways that would require notice and verifiable parental consent under COPPA.
- Cast Member information about children under 13 is entered into the Service by Administrators acting on behalf of a school or organization that has obtained any required consents from parents or legal guardians.
- Schools using the Service represent that they have authority under applicable law to provide such information to MusiCal as a "school official" with a "legitimate educational interest" or as otherwise permitted under FERPA, COPPA, and applicable state student privacy laws.
- We act as an operator providing services to schools and rely on the school's authorization for the collection of student information.
If you believe we have inadvertently collected personal information from a child under 13 in a manner not authorized by a school or parent, please contact us immediately and we will take prompt steps to delete it.
9. FERPA and Student Privacy
When the Service is used by an educational institution, certain information may constitute "education records" under FERPA. In such cases:
- MusiCal acts as a "school official" with a "legitimate educational interest" performing institutional services that the school would otherwise use its own employees to perform.
- MusiCal is under the direct control of the school with respect to the use and maintenance of education records.
- MusiCal uses Student Data only for the purposes authorized by the school and as described in this Policy.
- MusiCal does not re-disclose Student Data to third parties except as necessary to provide the Service, as directed by the school, or as required by law.
- Schools retain ownership of and control over Student Data and may request access, correction, or deletion at any time.
We further commit, where applicable, to comply with the principles of state student privacy laws, including but not limited to:
- California — Student Online Personal Information Protection Act ("SOPIPA"), which prohibits the use of student data for targeted advertising, the creation of advertising profiles, and the sale of student information.
- Illinois — Student Online Personal Protection Act ("SOPPA") and Illinois School Student Records Act ("ISSRA"), which impose additional restrictions on the collection, use, and disclosure of student records by Illinois schools and their service providers.
- New York — Education Law § 2-d and Part 121 of the Commissioner's Regulations, which require service providers handling student data on behalf of New York schools to enter into a written Data Privacy Agreement and to publish a Parents' Bill of Rights.
- Other states — comparable student privacy statutes in Colorado, Connecticut, Texas, Virginia, Washington, and other jurisdictions.
Data Privacy Agreements. Schools and districts that require a written Data Privacy Agreement ("DPA") in connection with their use of the Service may request one by contacting privacy@musicalendars.com. We are willing to execute commonly used DPA templates, including the Student Data Privacy Consortium ("SDPC") National DPA, subject to reasonable negotiation.
Schools are solely responsible for ensuring that all required notices, parental consents, parental opt-outs, and other authorizations are in place before submitting Student Data to the Service.
10. State Privacy Rights
Depending on where you reside, you may have additional rights under state privacy laws, including the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA"), and similar laws in other states. These rights may include:
- Right to know what Personal Information we have collected, used, disclosed, or sold about you
- Right to access a copy of the Personal Information we hold about you
- Right to correct inaccurate Personal Information
- Right to delete Personal Information, subject to exceptions
- Right to opt out of sale or sharing of Personal Information for cross-context behavioral advertising — we do not sell or share Personal Information in this manner
- Right to limit use of sensitive Personal Information
- Right to non-discrimination for exercising your privacy rights
To exercise these rights, contact us using the information in Section 16. We will verify your request through reasonable means before responding. We may decline requests to the extent permitted by law, including where another individual's rights would be infringed or where retaining the information is necessary for our legitimate business purposes.
11. Cookies and Tracking Technologies
The Service uses essential session-based authentication tokens and similar technologies to maintain administrator sign-in sessions and to operate basic functionality. We do not use third-party advertising cookies, cross-site tracking pixels, or social media tracking tags. We do not respond to "Do Not Track" browser signals because there is no industry-standard interpretation of such signals at this time.
12. Third-Party Services and Links
The Service may contain links to or integrations with third-party websites, services, or applications that are not operated or controlled by MusiCal. This Policy does not apply to those third parties. We are not responsible for the privacy practices, content, or availability of any third-party sites or services. We encourage you to review the privacy policies of any third party before providing any Personal Information.
13. Changes to This Policy
We may modify this Policy from time to time in our sole discretion. If we make material changes, we will update the "Last Updated" date above and may provide additional notice through the Service or by email. Your continued access to or use of the Service after any such changes constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must stop using the Service.
14. Disclaimers
Nothing in this Policy is intended to or shall be construed as creating any contractual or other legal rights in favor of any third party. The descriptions of our practices in this Policy are general statements and may not address every specific use of Personal Information. We make no representation or warranty that the Service will be uninterrupted or error-free, that defects will be corrected, or that the Service or its hosting infrastructure are free of viruses or other harmful components. To the maximum extent permitted by law, we disclaim all liability arising from any inaccuracy in this Policy or from any failure to comply with the practices described herein.
15. Filing a Complaint
If you have concerns about our privacy practices, we encourage you to contact us first using the information in Section 16 so that we may attempt to address your concerns. You also have the right to lodge a complaint with the appropriate data protection authority or state attorney general's office in your jurisdiction.
16. Contact Us
For questions about this Policy, to exercise your privacy rights, or to report a concern, please contact us:
MusiCal
Email: privacy@musicalendars.com
Website: www.musicalendars.com
We will respond to verifiable requests within the timeframe required by applicable law.