Heads up: this is a starting template. If you have EU/UK customers, have a lawyer review before relying on it.
1. What we collect
To run an account: email, username, hashed password (we never see your real password), and the timestamp of your account creation.
To deliver purchases: product IDs you've bought, payment timestamps, and download links. Payment is handled by our processor — we never see card numbers.
To deliver free downloads: the email you give us when claiming a free product.
For newsletter: your email and the page where you subscribed.
For server operation: standard request logs (IP, user-agent, path, timing) used for security and debugging. We don't run third-party trackers.
2. Why we collect it
To deliver the products you buy, run your account, send transactional emails (verification, receipts, password resets), and operate the service. Marketing emails only go to people who opt in to the newsletter.
3. Who else sees it
We use a small set of providers under data-processing agreements:
- Cloudflare — hosting, DNS, request routing, the database for your account, and the storage bucket where downloads live.
- Resend — transactional email delivery (verification, password reset, free downloads, contact form).
- Lemon Squeezy — payment processing and license-key issuance once payments are live.
We don't sell your data, ever.
4. Cookies
We use one strictly-necessary cookie (at_session) to keep you signed in. It's HttpOnly, Secure, and SameSite=Strict. We don't use tracking cookies.
5. Your rights
You can:
- Update your username from your account settings.
- Change your password from your account settings.
- Delete your account, which removes your profile, library entries, and any verification/reset tokens. Free-download logs (keyed by email, not user ID) are kept for fraud and abuse review for up to 12 months.
- Unsubscribe from the newsletter using the link in any newsletter email.
- Request a copy of your data by emailing hello@audiotoad.space.
6. Data retention
Account data: kept while your account is active. Free-download logs: 12 months. Server logs: typically 30 days.
7. Children
audiotoad isn't intended for users under 13. We don't knowingly collect data from children.
8. Changes
We may update this policy. Material changes will be communicated by email or a notice on the site.
9. Contact
Privacy questions or data requests: hello@audiotoad.space.