Last updated 2026-09-27
Privacy Policy
The short version: there are no accounts, and your audio never leaves your device. The only data we collect is anonymous analytics about how the site is used.
1. Who is responsible
[FILL: legal name] is the data controller for this site. Contact: [FILL: contact email].
2. What we do not collect
Microphone input and any audio file you open are processed entirely inside your browser using the Web Audio API. Nothing is recorded, uploaded, transmitted or stored by us. Close the tab and it is gone. The same is true of anything you design in the Drum Lab, exports are generated on your device and saved straight to it.
We do not ask for or hold names, email addresses, passwords or payment details. There are no accounts to create.
3. What we do collect
Analytics
We use Google Analytics, via Firebase, to understand roughly how many people visit and which pages they read. It records things like page views, approximate location (country or city level, derived from IP), device and browser type, and in-page events such as which chapter you scrolled to or whether you turned sound on. This is used in aggregate; we do not use it to identify anyone.
Google acts as our processor for this and may set cookies or similar identifiers on your device. Google’s own practices are described in its privacy policy.
Server logs
The site is hosted on Google Firebase Hosting, which keeps standard request logs (IP address, timestamp, requested URL, user agent) for security and reliability. We do not use these for tracking.
Preferences stored on your device
We store one thing in your browser’s local storage: whether you chose the light or dark theme. It never leaves your device and is not used to identify you. Clearing your browser data removes it.
4. Permissions we ask for
- Microphone, only when you actively choose to drive the visuals with it. Your browser will ask first. Audio is analysed live and never recorded. Deny it and everything else still works.
- Files, only files you pick or drag in yourself, read locally and never uploaded.
- Serial / USB, the PO-32 Transfer page talks to hardware you connect, with your explicit per-device permission. No data from it reaches us.
5. Legal basis
Where the UK/EU GDPR applies: we rely on legitimate interests to run and secure the site, and on your consent for analytics cookies where consent is required.
6. How long we keep things
Analytics data is retained on Google’s default schedule (currently up to 14 months) and then deleted. Hosting logs are kept on Google’s standard retention. We hold no database of our own.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, and to complain to your data protection authority. Because we hold no accounts, we usually cannot link any data to you individually, but write to [FILL: contact email] and we will help where we can.
To opt out of analytics entirely, use your browser’s tracking protection, an ad blocker, or Google’s opt-out add-on.
8. Transfers
Our hosting and analytics provider, Google, processes data in the United States and elsewhere, under the safeguards described in its own documentation.
9. Children
This site is not directed at children under 13, and we do not knowingly collect their data.
10. Changes
We may update this policy. The date at the top shows when it last changed.