Privacy Policy — version 2026-09-15

Effective 2026-09-15. This is an archived version, reproduced exactly as it was published. The version in force today is at Privacy Policy.

If — and only if — you opt in, we share data with music-industry partners who pay us for it: your email address, the name and photo on your profile, the practice details you've entered, and what you favourite. This is not anonymous and partners may contact you directly. Nothing is shared unless you tick the box, wherever you live. Never your password, your uploaded audio or your IP address.

# Privacy Policy

**Version 2026-09-15 — effective 15 September 2026**

This policy explains what personal data Jamtrackers collects, why, who it
goes to, and what rights you have over it.

## Who is responsible for your data

The data controller is Parker Siddall, an independent sole proprietor based
in California, United States.

Contact for any privacy question or request: jamtrackers@gmail.com

## What we collect

**Account data** — your email address (which also serves as your username),
an encrypted form of your password, and your account verification status. We
never store your password in readable form.

**Profile data** — anything you choose to add: a profile photo, a cover
photo, a short bio, and, if you're a creator, a donations link.

**Practice profile** — the optional details you can give us during
onboarding: the instruments you play, the genres you like, your skill level,
how long you've been playing, how often you practise, what you're working
towards, how you learn, whether you play live, your gear, your country and
city, your timezone, and your age bracket. All of it is optional and
self-declared. We never infer your location from your IP address.

**Activity data** — the tracks, chords, scales and tools you favourite, the
learning paths you follow, and the users you follow.

**Content you upload** — any audio files you add to the Service.

**Technical data** — IP address, browser type, device information, and pages
visited, collected through our hosting providers' standard logs and through
analytics.

**Consent records** — when you agree to these terms or change a privacy
choice, we record what you agreed to, which version of this policy was in
force, the exact wording you were shown, the date and time, your IP address,
and your browser's user-agent string. We keep this because the law requires
us to be able to demonstrate that you consented, and a record without those
details wouldn't demonstrate anything. It is used for that purpose and no
other.

## Why we use it, and our lawful basis

| Purpose | Lawful basis |
| --- | --- |
| Creating and running your account, authenticating you | Performance of a contract |
| Sending account emails — verification, password resets | Performance of a contract |
| Keeping your favourites and follows | Performance of a contract |
| Personalising which play-alongs and learning paths you're shown | Performance of a contract |
| Protecting the Service against abuse and spam | Legitimate interests |
| Understanding how the Service is used, via analytics | Consent |
| Sharing your details with music-industry partners | Consent — never without your explicit opt-in, wherever you are |
| Keeping records of the consents you've given | Legal obligation |
| Complying with other legal obligations | Legal obligation |

## Sharing your practice data with partners

Jamtrackers is free to use, and part of how it stays free is that we share
data about you with companies in the music industry — instrument and gear
makers, music-education companies, and market researchers — who pay us for
it. Under United States law this counts as a "sale" of personal information,
so we describe it that way plainly rather than hiding it behind a softer
word.

This is not anonymous. What we share identifies you by name and email
address, and partners may use it to contact you directly.

**What is included**

- your contact and identity details: your email address, your username, and
  your first and last name if you've given them;
- your profile as it appears on the site: your profile photo, cover photo,
  bio, and your donations link if you're a creator;
- your practice profile: instruments, primary instrument, genres, skill
  level, years playing, practice frequency, practice goals, learning
  contexts, whether you perform live, gear, age bracket, country and city;
- your activity: which tracks, chords, scales and tools you favourite, and
  which learning paths you follow.

**What is never included**

- your password, in any form — we couldn't share it if we wanted to, since
  we only ever store a hash of it;
- any audio you have uploaded. You granted us a licence to host it in order
  to run the Service, and selling it would go beyond what you agreed to;
- your IP address and your exact location, which we collect to keep the
  Service secure and use for nothing else;
- your consent records, which exist solely as evidence of what you agreed
  to;
- anything at all belonging to a user who is under 18.

We require partners, by contract, to use what we send only for the purposes
we agreed, to honour any objection or request you make to them directly, and
not to pass it on again.

Because partners receive your email address, they may send you marketing.
That is their responsibility, not ours, and they are required to give you a
way to unsubscribe — but the honest summary is that saying yes here means
more email from people you haven't heard from before. Turning this off stops
us sending anything further; it doesn't retract what a partner already has,
so you may need to unsubscribe from them directly as well.

**None of this happens unless you opt in**

We apply one rule to everyone, wherever you live: **we share nothing unless
you have specifically said yes.** Some countries would let us share your data
by default and simply offer you a way to opt out afterwards. We don't do
that. If you have never ticked the box, nothing about you has ever been sent
to a partner.

Not opting in costs you nothing. Every feature of Jamtrackers works exactly
the same either way, at the same price — free. If you're not sure what you
chose, Settings tells you, and you can change it there in one click.

We also honour Global Privacy Control signals. If your browser or a privacy
extension sends one, we treat it as a standing instruction not to share, and
it overrides the switch.

**Changing your mind** is a single switch in Settings, and takes effect
immediately for everything we send from that point on. Withdrawing is as easy
as opting in was, and we won't treat you differently, charge you differently,
or degrade the Service because of what you choose.

Data already delivered to a partner before you opted out can't be recalled,
which is the honest reason to think about the switch before you flip it on
rather than after.

## Who we share it with

We use third-party providers to run the Service. Each processes data only as
needed to provide their service:

| Provider | Purpose |
| --- | --- |
| Heroku (Salesforce) | Application and database hosting |
| Netlify | Frontend hosting |
| Amazon Web Services (S3) | Storage of uploaded images and audio |
| Amazon Web Services (SES) | Sending account emails |
| Google reCAPTCHA | Preventing automated sign-up abuse |
| Google Analytics | Usage analytics (only with your consent) |
| YouTube (Google) | Embedded video playback |
| Music-industry partners | Practice data, as described above, and only where that section says it applies |

We may also disclose data where legally required.

## International transfers

Some of these providers and partners process data outside the European
Economic Area, including in the United States. Where that happens, transfers
rely on appropriate safeguards — typically the European Commission's Standard
Contractual Clauses, or an adequacy decision such as the EU–US Data Privacy
Framework.

## How long we keep it

Account and profile data is kept while your account is active. If you delete
your account, we delete or anonymise your personal data within 30 days,
except where we must retain something to meet a legal obligation.

Consent records are one of those exceptions. We keep them for as long as we
rely on the consent, and for three years afterwards, because they are the
evidence that we were entitled to do what we did. They are kept in isolation
and are never shared with anyone.

Deleting your account stops us sharing anything further, but does not reach
data a partner already holds. To have that deleted too, contact the partner,
or email us and we'll pass the request on to every partner we sent your data
to.

Server logs are retained for a short period by our hosting providers as part
of their standard operation. Analytics data is retained according to the
retention period configured in Google Analytics.

## Your rights

Under the GDPR you have the right to:

- **access** the personal data we hold about you;
- **rectify** anything inaccurate;
- **erase** your data ("right to be forgotten");
- **restrict** how we process it;
- **port** your data to another service in a machine-readable format;
- **object** to processing based on legitimate interests;
- **withdraw consent** at any time, where processing is based on consent —
  including analytics cookies and partner data sharing.

To exercise any of these, email jamtrackers@gmail.com. We'll respond within
one month.

If you think we've handled your data improperly, you have the right to lodge
a complaint with the data protection supervisory authority in your country of
residence within the EU or EEA.

## If you are in California or another US state with a privacy law

You have the right to know what personal information we've collected about
you and who we've disclosed it to; to delete it; to correct it; to opt out of
its sale or sharing; and not to be discriminated against for exercising any
of these rights. We do not offer financial incentives in exchange for
personal information.

The categories of personal information we sell or share, for those users who
have opted in, are identifiers (email address, username, name), commercial
and preference information (your practice profile), internet activity (what
you favourite and follow), and the visual content on your profile. We sell
and share no other category, and we do not sell or share sensitive personal
information as that term is defined in the CCPA.

California law would permit us to sell your information unless you opted
out. We have chosen not to operate that way: we treat every user as opted out
until they say otherwise, so if you have not ticked the box in Settings,
there is nothing to opt out of. The switch is there anyway, at
[/do-not-sell](/do-not-sell) or in Settings, and we honour Global Privacy
Control signals automatically. To make any other request, email
jamtrackers@gmail.com. An authorised agent may act for you if you give them
written permission and we can verify it.

## Security

Passwords are stored hashed, never in plain text. Authentication uses
short-lived tokens held in httpOnly cookies, which JavaScript on the page
cannot read. Traffic is encrypted in transit over HTTPS.

No system is perfectly secure, but we take reasonable technical and
organisational measures to protect your data.

## Children

You must be 18 or over to hold a Jamtrackers account, and we don't knowingly
collect data from anyone younger. If you believe someone under 18 has given
us personal data, contact us and we'll delete it and close the account. No
data belonging to an under-18 is ever shared with a partner, whatever else is
set.

## Changes

We may update this policy. Every version is archived and remains readable at
`/legal/versions/privacy/<version>`, so you can always see the exact text you
agreed to.

Where a change materially affects how we use your personal data — a new
purpose, or a new kind of recipient — we will ask you to agree to it before
it applies to you, rather than treating your continued use of the site as
agreement. Smaller changes are announced through the Service, and the version
and date above will always reflect the current text.

SHA-256 of this text: 411c410059fe9b2bc64c8ed1471425a2d6531cdc1dfaaad066123d22977878a9