Privacy policy

Last updated: August 26, 2026

Controller

[OPERATOR NAME]
[STREET, POSTAL CODE, CITY, COUNTRY]
[CONTACT EMAIL]

The short version

soundwork runs in your browser. Your projects and audio are processed and stored on your own device and are not sent to us unless you create an account and save a project to it. We use no analytics, no tracking and no third-party cookies.

Data stored on your device

soundwork keeps your local projects, container templates, imported audio files, your recordings and the dismissal of the privacy notice in your browser’s site storage (localStorage and the browser’s private file system). This data never leaves your device and you can remove it at any time by clearing your browser’s site data. This storage is strictly necessary to provide the service you request and therefore requires no consent (Art. 5 (3) ePrivacy Directive, § 25 (2) TDDDG in Germany).

Google Drive sync (optional)

If you have an account, you can optionally connect your Google Drive in the Account dialog. When connected, your browser uploads your saved projects, imported audio files and recordings directly to a “soundwork” folder in your own Google Drive, and downloads them from there when they are missing on the device you are using. Our server stores only the token Google issues for this connection and never sees the file contents. Google processes this data as its own controller under the Google privacy policy. Legal basis is the performance of the contract with you (Art. 6 (1) (b) GDPR) for a feature you explicitly enabled; disconnect at any time in the Account dialog, which removes the token (your files remain in your Drive under your control).

Cookies

soundwork sets a single cookie, soundwork_session, and only when you log in to an account. It authenticates your session, is HttpOnly, expires after 30 days and is deleted when you log out. It is strictly necessary for the login feature and requires no consent. Without an account, no cookie is set at all.

Accounts

Creating an account is optional. If you register, we store your chosen username, a salted hash of your password (never the password itself) and the projects you explicitly save to the account. Legal basis is the performance of the contract with you (Art. 6 (1) (b) GDPR). This data is kept until you delete your account, upon which it is removed from our database. Sessions expire after 30 days.

Server logs

When you access this site, our server temporarily processes the data technically required to deliver it (such as your IP address and the requested URL). Legal basis is our legitimate interest in operating the site securely (Art. 6 (1) (f) GDPR). Log data is not merged with other data and is deleted automatically after a short period.

No tracking, no third parties

This site uses no analytics services, no advertising, no social media plugins and no third-party content delivery networks. Fonts and all other assets are served from our own server. The only third party involved is Google, and only if you explicitly connect your Google Drive (see above).

Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) regarding your personal data, as well as the right to lodge a complaint with a supervisory authority (Art. 77). To exercise these rights, contact us at the address above.