Privacy
Draft, pending legal review. Accurate to what the software does today, but not yet checked by a lawyer, and some of it describes parts of the service that are not switched on yet. Where that is true, it says so.
The short version
- Audio you open in 66loops is decoded in your browser. It is not uploaded to us.
- No advertising or tracking pixels. Ever. Not Meta, not Google Ads, not TikTok. None are installed and none will be.
- No cookie is set for analytics. There is a per-visit label and, if you arrived from a tagged link, five campaign tags — both kept only until you close the tab. Whether that needs a consent banner is a question for a lawyer rather than for us, and it is on the list of things being checked before launch.
- We do not sell anything to anyone.
What we collect, and why
If you have an account
Your email address, so you can sign in and we can send the handful of emails the service needs. What you have marked as learned or saved, so it is there next time. Whether you have paid, so you can hear the things you have paid for.
Lawful basis: performing the contract you entered into when you signed up. For the occasional non-essential email, consent, which you can withdraw with one click.
If you join a teacher with an invite code
Typing a teacher’s invite code into your account page shares exactly one thing: that teacher can see the email address you signed up with, so they know you joined. Nothing else — not what you practise, not your progress, not whether you have paid. Only the one teacher whose code you typed can see it, and you choose whether to type it at all. Lawful basis: consent, given by entering the code.
If you are just visiting
Not switched on yet — none of this is being collected today.
Which pages were viewed and which features were used. Each visit is labelled with a random value kept in your browser's per-tab storage. It survives a reload, so one visit reads as one visit, and it is deleted when you close the tab. It is never written to a cookie and never to long-term storage, so coming back tomorrow is a new visit with no connection to today's.
So that we are precise rather than flattering: that label, and the campaign tags below, aresmall pieces of information stored in your browser for the length of the visit. They are not cookies, and they are gone when the tab closes — but “nothing is stored on your device” would be the wrong way to describe it, so we do not say that.
If you arrived from a link with campaign tags on it (the utm_ parts of a web address), those five tags are remembered for the length of the visit so we can tell which places are worth posting in. They are labels we wrote ourselves, not information about you, and they are discarded when you close the tab.
Lawful basis: legitimate interest in knowing whether the product is being used.
What we never collect
- The name of any file you open, the title of any track, or any path on your computer. This is enforced in the software: anything that even looks like a filename is stripped before anything is sent anywhere, and error messages are cleaned the same way.
- Recordings of your screen. Many products record what visitors do so it can be replayed later. We do not, at all — there is no such recorder in the software.
- Your microphone. Nothing here listens unless you press a button that says so.
- Your location, beyond the country your internet connection suggests.
Who else sees it
These are our sub-processors. The list will grow as the service launches, and this page will grow with it.
- Supabase — accounts, saved progress, and the storage the guitar recordings are served from.
- Vercel — hosting. Sees the requests your browser makes, as any web host does.
- PostHog (EU) — the page and feature counts described above. Configured to discard the internet address a request came from. Not switched on yet.
- A payment processor — will handle payment details, which never reach us. Not chosen yet.
- An email provider — will send account emails. Not switched on yet.
Getting your data out, or deleting it
Both are buttons on your account page, and both are immediate. “Download my data” gives you one file with everything attached to your account. “Delete my account” removes the account and everything with it, at once — it is permanent, we cannot undo it, and a paid purchase does not survive it. Email works too, if you prefer a person.
How long we keep things
Account data for as long as the account exists, and thirty days afterwards in backups. Page-visit counts are kept in aggregate and are not attached to a person, so there is nothing there to delete.
Your rights
If you are in the UK or the EU you have the right to see what we hold, correct it, take it elsewhere, object to us using it, and complain to your data protection authority. We would rather you told us first, but you do not have to.