Privacy Policy

1. Who we are (Data Controller)

The controller for the personal data described in this policy is Deckmatics, which operates the website deckmatics.com and its audio analyzer.

You can write to us at privacy@deckmatics.com about this policy, about privacy generally, or to exercise your rights.

This policy covers the website and its audio analysis tools. It does not cover third-party sites you may reach through a link: those have their own terms.

2. Summary: what we do and don't do

• No accounts. There is no sign-up, no login and no user database, because there is no user backend to hold one.
• Your audio is not uploaded. The file is read with the browser's File API and decoded and analysed entirely inside the tab.
• We store analysis results in your browser (not the audio), so a reload can restore them without you dropping the files again. You can delete them whenever you like.
• We show Google AdSense advertising. Advertising storage and personalisation are denied by default until consent is given. This is explained in section 5.
• We run no analytics of our own. No analytics, metrics or telemetry product is installed by us. Advertising is described separately.
• The site is not directed at children. It is a technical tool for audio professionals and is not intended for, or aimed at, children.

3. What we do not collect

These statements are deliberately narrow and specific:

• No user accounts. We do not ask for your email address, your name or a password to use the analyzer, and we do not create accounts for you.
• No audio uploads. Your audio files are not sent to any server of ours. There is no ingestion server, no object storage and no audio database in our infrastructure. File decoding runs in the browser tab on the main thread, and the heavy signal analysis (STFT, loudness, tempo, key and structure) runs in a Web Worker inside that same tab so the interface does not freeze. The analyzer contains no code path that can send audio over the network.
• No analytics we run. We have installed no web analytics, heatmap, session-replay or error-telemetry product. We are precise about the limit of that claim, though: the Google AdSense script the site loads has its own effects, described in section 5. Saying "zero tracking" would be inaccurate.
• No selling or sharing of personal data for our own commercial purposes. We hold no user profiles that could be sold.

4. What is stored on your device

We store data only in your browser's local storage, on your own machine. None of it is transmitted to our servers or to third parties.

One point deserves to be spelled out, because it is one of two places where something identifying one of your tracks is kept: a stored record reproduces metadata that was already embedded in the file itself (title, artist, album, genre, year), plus the file name, the hash and the metrics. If you work with unreleased material, those names can be sensitive to you, so treat the cache the way you would treat the file name: it stays on your machine, but it stays.

The second is the Rekordbox store (deckmatics-rekordbox): if you link a library, a copy of the data you imported is kept on your device — including the absolute file paths it contains and any free-text notes you write. None of it is sent anywhere by us, but it can reveal the structure of your folders. Unlinking the library, or clearing site data, removes it.

To empty it, open the analyzer's "Local Memory" dialog and use its clear option: that wipes the whole analysis_cache store. If you prefer a clean sweep, clear site data in your browser settings, which also removes the localStorage preferences.

The site sets no tracking cookies of its own. Third-party cookies and technologies are covered in section 5 and, in more detail, in the Cookie Policy.

5. Advertising and consent (Google AdSense)

To keep the site running we display ads served by Google AdSense. The AdSense script is loaded from pagead2.googlesyndication.com on every page of the site. Plainly stated, that means part of the data processing associated with advertising is carried out by Google, not by us.

Consent denied by default. Before any Google script executes, the site declares the Google Consent Mode v2 defaults as denied for ad_storage, analytics_storage, ad_user_data and ad_personalization. The order matters: the declaration is emitted ahead of the AdSense tag, so advertising never starts with an undefined consent state. While consent remains denied, advertising storage and ad personalisation remain denied.

Where consent is given, the intended framework is a Google-certified consent management platform (CMP).

You can read more about how Google handles this data, and how to object to personalisation, at:

• Google's privacy policy: policies.google.com/privacy
• Google ads settings: adssettings.google.com

On Google's role: depending on the specific advertising product and configuration, Google may act as an independent controller or as a joint controller for the data associated with advertising. We do not claim to control that processing; we describe it and link to Google's own information so you can exercise your rights there as well.

6. Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, Article 6 of the GDPR requires a legal basis for each processing operation. These are the ones we rely on, and only for these three things:

• Advertising and non-essential cookies — consent (Art. 6(1)(a) GDPR). Personalised advertising and advertising storage depend on your consent, which is denied by default. You can withdraw it at any time as easily as you gave it.
• Security, delivery and operation of the site — legitimate interests (Art. 6(1)(f) GDPR). The hosting provider processes IP addresses and request data in order to serve the site and protect it from abuse and attacks. This is not processing from which we build user profiles: it is the minimum technical processing without which a website cannot be delivered at all.
• Analysis of your own files — not our processing. When you drop a track into the analyzer, decoding and computation run in your browser, under your control and by your decision. We do not receive the audio or the results. Caching the analysis in your own browser is a local feature of the tool, not a disclosure of data to us.

7. How long each item is kept

• Interface preferences (localStorage): until you clear site data. They do not expire on their own.
• Analysis cache (IndexedDB, analysis_cache): until you clear it from the "Local Memory" dialog, or until the store exceeds 2000 records, at which point the oldest records are dropped automatically so the cache cannot fill your disk quota.
• Audio samples and object URLs: for the lifetime of the tab session only. Object URLs are revoked and do not persist.
• Data held by Google (advertising): we neither control it nor set its retention period. See Google's privacy policy for its retention practices.
• Hosting provider logs: Cloudflare retains technical request logs for the periods in its own policy. We cannot state a specific figure here because we have not verified one; see Cloudflare's policy for the detail.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, objection, data portability, and to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

To exercise them, write to privacy@deckmatics.com. One practical limitation, stated honestly: because we have no user accounts and no database of people, in many cases we hold nothing about you that we could show, correct or delete. The data that does exist sits on your own device, and you can delete it yourself without asking us (section 4). For data processed by Google in the context of advertising, you should also contact Google, using the ads settings link in section 5.

If you believe we have not handled your request properly, you have the right to lodge a complaint with a supervisory authority, in particular in the country where you live, where you work, or where the alleged infringement took place. In Spain, the competent authority is the Spanish Data Protection Agency (aepd.es).

9. Third parties and international transfers

• Google AdSense (advertising): serves the ads and, as explained in section 5, may process advertising data as an independent or joint controller. Google is a US company, so this data may be processed outside the EEA; Google relies on the transfer mechanisms it describes in its own privacy policy.
• Cloudflare (hosting): the site is delivered as static content from Cloudflare's network, which processes IP addresses and request data as a hosting, security and content-delivery provider.

Beyond these two providers we disclose your data to no one. We do not sell personal data. We do not transfer data to any other categories of recipient.

10. Cookies

The site sets no tracking or advertising cookies of its own. The cookies and similar technologies that can appear come from the advertising service described in section 5 and from your own hosting provider.

The detailed list of cookies and storage technologies, with their purpose and duration, is in the Cookie Policy.