Privacy Policy

Version 2026-09-15 — effective 15 September 2026

This policy explains what personal data Jamtrackers collects, why, who it goes to, and what rights you have over it.

Who is responsible for your data

The data controller is Parker Siddall, an independent sole proprietor based in California, United States.

Contact for any privacy question or request: jamtrackers@gmail.com

What we collect

Account data — your email address (which also serves as your username), an encrypted form of your password, and your account verification status. We never store your password in readable form.

Profile data— anything you choose to add: a profile photo, a cover photo, a short bio, and, if you’re a creator, a donations link.

Practice profile— the optional details you can give us during onboarding: the instruments you play, the genres you like, your skill level, how long you’ve been playing, how often you practise, what you’re working towards, how you learn, whether you play live, your gear, your country and city, your timezone, and your age bracket. All of it is optional and self-declared. We never infer your location from your IP address.

Activity data — the tracks, chords, scales and tools you favourite, the learning paths you follow, and the users you follow.

Content you upload — any audio files you add to the Service.

Technical data— IP address, browser type, device information, and pages visited, collected through our hosting providers’ standard logs and through analytics.

Consent records— when you agree to these terms or change a privacy choice, we record what you agreed to, which version of this policy was in force, the exact wording you were shown, the date and time, your IP address, and your browser’s user-agent string. We keep this because the law requires us to be able to demonstrate that you consented, and a record without those details wouldn’t demonstrate anything. It is used for that purpose and no other.

Why we use it, and our lawful basis

Sharing your practice data with partners

Jamtrackers is free to use, and part of how it stays free is that we share data about you with companies in the music industry — instrument and gear makers, music-education companies, and market researchers — who pay us for it. Under United States law this counts as a “sale” of personal information, so we describe it that way plainly rather than hiding it behind a softer word.

This is not anonymous. What we share identifies you by name and email address, and partners may use it to contact you directly.

What is included

• your contact and identity details: your email address, your username, and your first and last name if you’ve given them;
• your profile as it appears on the site: your profile photo, cover photo, bio, and your donations link if you’re a creator;
• your practice profile: instruments, primary instrument, genres, skill level, years playing, practice frequency, practice goals, learning contexts, whether you perform live, gear, age bracket, country and city;
• your activity: which tracks, chords, scales and tools you favourite, and which learning paths you follow.

What is never included

• your password, in any form — we couldn’t share it if we wanted to, since we only ever store a hash of it;
• any audio you have uploaded. You granted us a licence to host it in order to run the Service, and selling it would go beyond what you agreed to;
• your IP address and your exact location, which we collect to keep the Service secure and use for nothing else;
• your consent records, which exist solely as evidence of what you agreed to;
• anything at all belonging to a user who is under 18.

We require partners, by contract, to use what we send only for the purposes we agreed, to honour any objection or request you make to them directly, and not to pass it on again.

Because partners receive your email address, they may send you marketing. That is their responsibility, not ours, and they are required to give you a way to unsubscribe — but the honest summary is that saying yes here means more email from people you haven’t heard from before. Turning this off stops us sending anything further; it doesn’t retract what a partner already has, so you may need to unsubscribe from them directly as well.

None of this happens unless you opt in

We apply one rule to everyone, wherever you live: we share nothing unless you have specifically said yes. Some countries would let us share your data by default and simply offer you a way to opt out afterwards. We don’t do that. If you have never ticked the box, nothing about you has ever been sent to a partner.

Not opting in costs you nothing. Every feature of Jamtrackers works exactly the same either way, at the same price — free. If you’re not sure what you chose, Settings tells you, and you can change it there in one click.

We also honour Global Privacy Control signals. If your browser or a privacy extension sends one, we treat it as a standing instruction not to share, and it overrides the switch.

Changing your mind is a single switch in Settings, and takes effect immediately for everything we send from that point on. Withdrawing is as easy as opting in was, and we won’t treat you differently, charge you differently, or degrade the Service because of what you choose.

Data already delivered to a partner before you opted out can’t be recalled, which is the honest reason to think about the switch before you flip it on rather than after.

Who we share it with

We use third-party providers to run the Service. Each processes data only as needed to provide their service:

We may also disclose data where legally required.

International transfers

Some of these providers and partners process data outside the European Economic Area, including in the United States. Where that happens, transfers rely on appropriate safeguards — typically the European Commission’s Standard Contractual Clauses, or an adequacy decision such as the EU–US Data Privacy Framework.

How long we keep it

Account and profile data is kept while your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where we must retain something to meet a legal obligation.

Consent records are one of those exceptions. We keep them for as long as we rely on the consent, and for three years afterwards, because they are the evidence that we were entitled to do what we did. They are kept in isolation and are never shared with anyone.

Deleting your account stops us sharing anything further, but does not reach data a partner already holds. To have that deleted too, contact the partner, or email us and we’ll pass the request on to every partner we sent your data to.

Server logs are retained for a short period by our hosting providers as part of their standard operation. Analytics data is retained according to the retention period configured in Google Analytics.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify anything inaccurate;
• eraseyour data (“right to be forgotten”);
• restrict how we process it;
• port your data to another service in a machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent at any time, where processing is based on consent — including analytics cookies and partner data sharing.

To exercise any of these, email jamtrackers@gmail.com. We’ll respond within one month.

If you think we’ve handled your data improperly, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence within the EU or EEA.

If you are in California or another US state with a privacy law

You have the right to know what personal information we’ve collected about you and who we’ve disclosed it to; to delete it; to correct it; to opt out of its sale or sharing; and not to be discriminated against for exercising any of these rights. We do not offer financial incentives in exchange for personal information.

The categories of personal information we sell or share, for those users who have opted in, are identifiers (email address, username, name), commercial and preference information (your practice profile), internet activity (what you favourite and follow), and the visual content on your profile. We sell and share no other category, and we do not sell or share sensitive personal information as that term is defined in the CCPA.

California law would permit us to sell your information unless you opted out. We have chosen not to operate that way: we treat every user as opted out until they say otherwise, so if you have not ticked the box in Settings, there is nothing to opt out of. The switch is there anyway, at Do Not Sell or Share or in Settings, and we honour Global Privacy Control signals automatically. To make any other request, email jamtrackers@gmail.com. An authorised agent may act for you if you give them written permission and we can verify it.

Security

Passwords are stored hashed, never in plain text. Authentication uses short-lived tokens held in httpOnly cookies, which JavaScript on the page cannot read. Traffic is encrypted in transit over HTTPS.

No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

Children

You must be 18 or over to hold a Jamtrackers account, and we don’t knowingly collect data from anyone younger. If you believe someone under 18 has given us personal data, contact us and we’ll delete it and close the account. No data belonging to an under-18 is ever shared with a partner, whatever else is set.

Changes

We may update this policy. Every version is archived and remains readable at /legal/versions/privacy/<version>, so you can always see the exact text you agreed to.

Where a change materially affects how we use your personal data — a new purpose, or a new kind of recipient — we will ask you to agree to it before it applies to you, rather than treating your continued use of the site as agreement. Smaller changes are announced through the Service, and the version and date above will always reflect the current text.