Privacy Policy

1. What you can do without an account

All musician tools (tabs generator, metronome, music theory visualizer, tanpura), the blog and the newsletter sign-up form work without an account. Presets you save in a tool without signing in stay in your own browser (local storage) and never reach our servers.

2. Data we collect when you sign in with Google

Sign-in uses Google. When you continue with Google, we receive and store:

• Your name, email address and profile picture URL, as shared by Google.
• Your Google account identifier, so we can recognise you next time.
• A session record: a random token, the time it was created, its expiry, and the IP address and browser (user agent) it was created from.

We request only the basic "openid, email, profile" scopes. We do not get access to your Gmail, Drive, contacts or any other Google data, and we do not post anything to your Google account. We never see your Google password.

3. Newsletter

When you create an account with Google, the email address Google verified is added to the Crazy Verse newsletter list, as stated next to the sign-in button. Every email we send carries a one-click unsubscribe link, and unsubscribing never affects your account. If you previously unsubscribed, creating an account does not re-subscribe you.

If you subscribe through the form instead, we store your address as pending until you confirm it from the email we send (double opt-in). We record the source of each subscription (form, footer or sign-up) and the dates you confirmed or unsubscribed.

4. Emailing us

If you email us we receive your email address and message. They are kept in our inbox as ordinary correspondence and are not stored in the site database.

5. Analytics, logs and error reports

• Google Analytics (via Google Tag Manager) records page views and basic device information so we can see which tools people use. Google may set cookies for this; see Google’s own privacy policy for how it handles that data.
• Sentry receives error reports when something breaks. Reports include the page, the browser and a technical stack trace. We strip query strings from URLs before sending and we do not send your email address.
• Cloudflare sits in front of the site for security and caching and keeps short-lived request logs (IP address, URL, time) as part of that service. Cloudflare Turnstile may be used on forms to block bots.
• The site itself keeps limited request logs for debugging and rate limiting, including IP addresses, for a short period.

6. Cookies and browser storage

• A session cookie after you sign in (HTTP-only, secure). It is essential to keeping you signed in and is not used for tracking.
• A short-lived signed cookie that caches your session details for up to five minutes so pages load without a database lookup.
• Local storage for your theme, sound settings and browser-only tool presets. This never leaves your device.
• Analytics cookies set by Google, as described above.

You can clear all of these from your browser at any time. Clearing the session cookie signs you out.

7. Why we process this data and on what basis

• To provide the account you asked for and keep it secure: this is necessary to deliver the service you requested.
• To send the newsletter: with your consent, given when you sign up or subscribe, which you can withdraw at any time by unsubscribing.
• To answer messages you send us: necessary to respond to your request.
• To understand how the site is used, fix errors and prevent abuse: our legitimate interest in running a reliable, safe site, kept proportionate by the limited data involved.

8. Who processes your data for us

We do not sell personal data and we do not share it with advertisers. The following providers process data on our behalf, under their own contractual and security commitments:

• Google LLC: sign-in (OAuth), Analytics and Tag Manager.
• Supabase, Inc.: the database that stores accounts, sessions and the newsletter list, hosted on Amazon Web Services in Singapore.
• DigitalOcean, LLC: the server that runs the site.
• Cloudflare, Inc.: DNS, CDN, security and bot protection.
• Resend, Inc.: sending newsletter and transactional email.
• Functional Software, Inc. (Sentry): error monitoring.
• YouTube (Google): embedded videos load from youtube-nocookie.com and only when you play them.

9. Where your data is stored and international transfers

Account, session and newsletter data is stored in Singapore. Other providers listed above may process data in the United States or the European Union. By using the site you understand that your data may be transferred to and processed in those countries, where it is protected by the providers’ safeguards and contractual commitments.

10. How long we keep it

• Account data: until you delete your account. Deleting it removes your user record, sessions and linked Google identity immediately and unsubscribes your email from the newsletter.
• Sessions: expire 30 days after your last activity, or immediately when you sign out.
• Newsletter: until you unsubscribe. An unsubscribed address is kept only as a suppression record so we do not email you again.
• Emails you send us: as long as the correspondence is relevant.
• Analytics and error reports: according to the retention settings of Google Analytics and Sentry, typically 14 months and 90 days respectively.

11. Your rights and how to use them

Under the Digital Personal Data Protection Act, 2023 (and similar laws elsewhere) you can access the personal data we hold about you, correct it, have it erased, withdraw consent, and nominate someone to exercise these rights on your behalf. Most of this is self-service:

• See and correct your name and picture: change them in your Google account; they refresh on your next sign-in.
• Delete your account: Settings, then Account, then Delete account. This is immediate and cannot be undone.
• Sign out everywhere: Settings, then Account, then Sign out everywhere.
• Stop the newsletter: the unsubscribe link in any issue.

For anything else, or to raise a grievance, email . Tanay Toshniwal is the grievance officer for this site and will respond within the time the law requires. If you are not satisfied with the response, you may approach the Data Protection Board of India.

12. Children

The tools and blog may be used by anyone, but accounts and the newsletter are for people aged 18 or over, because we cannot verify the parental consent Indian law requires for younger users. If you believe a child has created an account, email us and we will delete it.

13. Security

All traffic is encrypted in transit (HTTPS). Sessions are random tokens stored server-side and can be revoked at any time. Database access from the public internet is blocked. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authority as the law requires.

14. Changes to this policy

We will update this page when our practices change and update the date at the top. For material changes affecting account holders we will also tell you by email or a notice on the site.

15. Contact

Tanay Toshniwal, Jaipur, Rajasthan, India. Email: .