Privacy Policy

Overview

simpleSoundbank is run by me, Aiden, an independent developer in the United Kingdom. I'm responsible for the personal data described here (the “data controller”). This policy covers this website and the simpleSoundbank plugins.

• The plugins don't send usage data. They only contact this website to check for updates, activate a licence or start a trial.
• The website uses analytics, including recordings of visits. Visitors in the UK, the EU and the EEA are asked first, and anyone can turn it off.
• Payments go through Lemon Squeezy. I never see your card details.
• I don't sell your data or use advertising trackers.

1. What I collect

1.1 Licences and trials

When you activate a licence, the plugin sends the following to my activation server:

• Licence key: the key you received after purchase
• Hardware identifier (HWID): a salted, one-way hash derived from your machine's hardware. I cannot reverse this to identify your specific hardware

This is used to check your licence and limit how many computers it's activated on. The activation token is cached on your computer so the plugin doesn't need to contact the server every time it starts.

When you start a free trial, the plugin sends the plugin's name and version and the same hardware identifier, so reinstalling doesn't restart the trial. I record when the trial started, and send a “trial started” event to PostHog (section 1.3) with the plugin's name and version and your IP address, so I can count trials and see roughly where they come from.

Some plugins also check the website for a newer version by downloading a small version file. That request is only seen in Cloudflare's standard web logs.

The MIDI player's unlock is activated from your browser. The page sends your licence key and a random ID it makes for that browser, which isn't worked out from your hardware, to the same activation server. This is used to check your licence and keep a key to 5 browsers or devices. The token that comes back and the random ID are kept in your browser's storage (section 1.7), so the player stays unlocked without checking in each time.

1.2 Purchases

Purchases are processed by Lemon Squeezy, which sells the plugins on my behalf as the merchant of record. Lemon Squeezy collects your name, email address, payment details and billing information. I receive your name, email address, order details and licence key, but never your payment card details.

I also record each order in PostHog: the product, price, currency, discount, order number and your operating system, but not your name or email address. If analytics is on (section 1.3), the order is linked to your visit, so I can see which pages lead to sales.

Tips for simpleTapeStop open Lemon Squeezy's checkout in a window over the page, or on phones, tablets and devices that can use Apple Pay, as its own page so Apple Pay and Google Pay can show. When you press a tip button, my server asks Lemon Squeezy for a checkout with the amount you picked, your country (worked out from your connection) and, if you gave it in the download pop-up, your email address, so you don't have to type them again. For the window over the page, the page also loads Lemon Squeezy's lemon.js script at that moment, and not before. Either way the checkout is Lemon Squeezy's own page, and their cookies and privacy policy apply to it.

Lemon Squeezy's Privacy Policy explains how they handle payment data.

1.3 Website analytics

The website is hosted on Cloudflare. Like any web host, Cloudflare processes your IP address, browser user agent and the pages you request, to deliver the site and protect it from abuse.

Two kinds of analytics run without cookies:

• Cloudflare Web Analytics counts page views and load times. It doesn't use cookies or identify individual visitors.
• My own counts of page views, download and checkout clicks, and installer downloads, made by my Cloudflare Worker. They record the page, the link, the site you came from, and your browser and operating system (and, for downloads, your network provider and country). Your IP address, or a shortened one-way hash of it, is only included while analytics is on. Installer downloads, and download clicks made before you've answered the bar, also go to PostHog as anonymous events, with no cookie or ID.

When analytics is on (see “Your choice” below), the site also uses PostHog to see how the site is used, so I can fix what's broken or confusing and learn what leads to downloads and sales. PostHog records:

• the pages you visit, the site you came from and any campaign tags in the link
• clicks, and actions like starting a download, signing up for emails or opening checkout
• your browser, operating system, device type and screen size
• your IP address, which PostHog keeps with these events and uses to estimate your town and country
• how fast pages load, and any errors on them
• recordings of your visit: what's on the screen, scrolling, mouse movement and clicks, and the page's console messages and network timings. Anything you type into a form is hidden from recordings

PostHog keeps a random ID in a cookie and your browser's storage, so it can tell visits apart. I don't try to find out who you are, but if you buy something or send feedback with your email address, that order or message is linked to your visit (sections 1.2 and 1.6).

Your choice. In the UK, the EU and the EEA, analytics is only on once you press Allow on the bar at the bottom of the page. Until you answer, only the cookie-free counts above are kept, without your IP address, and No thanks turns analytics off. Everywhere else, analytics is on unless you turn it off. Anyone can change their answer here at any time:

Turning analytics off stops PostHog and Cloudflare Web Analytics in this browser, stops my own counts except installer downloads, and deletes the ID PostHog stored. Your answer is kept in a cookie for a year.

I use PostHog with your consent where I ask for it. Everything else in this section, and PostHog outside the UK, the EU and the EEA, relies on my legitimate interest in running and improving the site, which you can object to with the switch above. PostHog stores its data in the United States. Events are kept for a year and recordings for 30 days, then deleted. See PostHog's Privacy Policy.

1.4 Email list

If you sign up for new plugin and sale emails or a plugin waitlist on the website (or joined the earlier simpleSPU waitlist), your browser sends your email address and a label (such as “simpleSoundbank news” or “simpleStutter waitlist”) straight to Lemon Squeezy, which adds you to the simpleSoundbank store mailing list. Like any website your browser connects to, Lemon Squeezy also sees your IP address. I use that list to email you about new plugins, updates and sales, a few times a year. Signing up is optional and nothing on the site requires it. I do not keep a separate copy of the address on my own servers. Use the unsubscribe link in those emails, or email support@simplesoundbank.com, if you want to be removed.

1.5 Affiliate links

Some creators who review my plugins earn a commission through Lemon Squeezy's affiliate program. Only if you arrive on the website through one of their affiliate links, I load Lemon Squeezy's affiliate script. It records the referral with Lemon Squeezy (including a browser identifier the script calculates, so repeat visits aren't counted twice) and sets an ls_aff_ref cookie so a later purchase is credited to that creator. Visitors who don't come from an affiliate link don't load the script.

1.6 Feedback form

If you send a message through the feedback form, I keep what you write, the topic you pick and, if you give it, your email address, so I can read it and reply. It is sent through my Cloudflare Worker to PostHog and stored there as a survey response, with the page you sent it from, your browser and your country. If analytics is on, it also carries your IP address and is linked to your visit. I use your email address only to reply to that message. The form is optional. Email support@simplesoundbank.com to have a message deleted.

1.7 Cookies and browser storage

Video thumbnails load from YouTube's image server, which sees your IP address like any image host. Some pages may also remember small display choices in your browser's storage, such as which sound chip you last looked at. These never leave your browser.

If you install the MIDI player as an app, it saves a copy of the player and its SoundFont in your browser's storage so it works offline. Uninstalling the app or clearing the site's data removes it. The installed app doesn't use analytics: PostHog, Cloudflare Web Analytics and my own counts don't run in it, whatever you chose on the website.

The MIDI player's practice mode can listen to a MIDI keyboard. Your browser asks you before the page can read it, and the notes you play stay in your browser. Videos it saves are made in your browser and aren't uploaded.

Until 27 October 2026 the site also used Google Analytics. It has been removed, and the site deletes the _ga cookies it left in your browser.

2. What I don't collect

• I do not collect telemetry or usage data from the plugins
• I do not track which SoundFont files or sounds you load
• I do not use advertising trackers
• I do not sell or rent your personal data. I only share it with the services in section 5

3. How long I keep your data

Licence records (your email address, name, licence key, order and activation status) are stored on my Cloudflare server for as long as your licence is active. Trial records (the plugin, its version, your hardware identifier and the start date) are kept so a trial can't restart. Activation tokens are cached locally in your system's standard application data folder.

PostHog keeps events, including orders, trial starts and feedback messages, for a year, and recordings for 30 days. My own click records are kept for 90 days, and my Worker's logs for up to 7 days. Daily totals, which hold no personal data, are kept.

Email list addresses are held by Lemon Squeezy as part of the store mailing list until you unsubscribe, not in my own database.

4. Your rights

Under UK and EU data protection law you have the right to:

• Access the personal data I hold about you
• Correct anything that's wrong
• Delete your data, by asking me to remove your records
• Object to how I use it, or ask me to restrict it
• Portability: get a copy of your data in a standard format
• Withdraw consent to analytics at any time, with the switch in section 1.3

To exercise any of these rights, email me at support@simplesoundbank.com. If you're unhappy with how I handle your data, you can complain to the UK's Information Commissioner's Office or your local data protection authority.

5. Third-party services

Lemon Squeezy, PostHog, Cloudflare and Google may process data in the United States. When data leaves the UK or the EU, they rely on the safeguards data protection law requires, such as standard contractual clauses.

6. Children's privacy

simpleSoundbank is not directed at children under 13. I do not knowingly collect personal information from children.

7. Changes to this policy

I may update this policy. Changes go on this page with a new "Last updated" date. I will not reduce your rights under this policy without your explicit consent.

8. Contact

If you have a question about this policy or your data, email me:

• Email: support@simplesoundbank.com