Privacy Policy

1. Who we are (Data Controller)

The controller for the personal data described in this policy is Santiago Pascual Cañas (Tax ID / NIF: 35579568V, located at C/ Oporto 7, 36201 Vigo, Spain), owner operating the website deckmatics.com and its audio analyzer.

You can write to us at contact@deckmatics.com about this policy, about privacy generally, or to exercise your rights.

If you email us, we process your email address, message and any information you choose to include to handle your enquiry or request. We do not use these messages to send you advertising. Avoid including sensitive information or audio files that are unnecessary for your enquiry.

This policy covers the website and its audio analysis tools. It does not cover third-party sites you may reach through a link: those have their own terms.

2. Summary: what we do and don't do

• No accounts. There is no sign-up, no login and no user database, because there is no user backend to hold one.
• Your audio is not uploaded. The file is read with the browser's File API and decoded and analysed entirely inside the tab.
• We store analysis results in your browser (not the audio), so a reload can restore them without you dropping the files again. You can delete them whenever you like.
• Commercial advertising is currently disabled. No third-party ads are displayed and no advertising scripts or cookies are loaded. In the event of future activation following domain verification, advertising storage and personalisation will remain denied by default under Google Consent Mode v2 and IAB TCF v2.4 until explicit consent is given. This is explained in section 5.
• We run no analytics of our own. No analytics, metrics or telemetry product is installed by us. Advertising is described separately.
• The site is not directed at children. It is a technical tool for audio professionals and is not intended for, or aimed at, children.

3. What we do not collect

These statements are deliberately narrow and specific:

• No user accounts. We do not ask for your email address, your name or a password to use the analyzer, and we do not create accounts for you.
• No audio uploads. Your audio files are not sent to any server of ours. There is no ingestion server, no object storage and no audio database in our infrastructure. File decoding runs in the browser tab on the main thread, and the heavy signal analysis (STFT, loudness, tempo, key and structure) runs in a Web Worker inside that same tab so the interface does not freeze. The analyzer contains no code path that can send audio over the network.
• No analytics or advertising trackers we run. We have installed no web analytics, heatmap, session-replay or error-telemetry product. With commercial advertising currently disabled, no third-party tracking or advertising scripts are executed.
• No selling or sharing of personal data for our own commercial purposes. We hold no user profiles that could be sold.

4. What is stored on your device

We store data only in your browser's local storage, on your own machine. None of it is transmitted to our servers or to third parties.

One point deserves to be spelled out, because it is one of two places where something identifying one of your tracks is kept: a stored record reproduces metadata that was already embedded in the file itself (title, artist, album, genre, year), plus the file name, the hash and the metrics. If you work with unreleased material, those names can be sensitive to you, so treat the cache the way you would treat the file name: it stays on your machine, but it stays.

The second is the Rekordbox store (deckmatics-rekordbox): if you link a library, a copy of the data you imported is kept on your device — including the absolute file paths it contains and any free-text notes you write. None of it is sent anywhere by us, but it can reveal the structure of your folders. Unlinking the library, or clearing site data, removes it.

To empty it, open the analyzer's "Local Memory" dialog and use its clear option: that wipes the whole analysis_cache store. If you prefer a clean sweep, clear site data in your browser settings, which also removes the localStorage preferences.

The site sets no tracking cookies of its own. Third-party cookies and technologies are covered in section 5 and, in more detail, in the Cookie Policy.

5. Commercial advertising and conditional consent (Google AdSense)

Currently, third-party commercial advertising monetization is disabled. This means that no third-party ads are served, no advertising scripts are downloaded, and no tracking cookies are placed in your browser.

The verification tag in the HTML header (<meta name="google-adsense-account">) is included exclusively to technically validate domain ownership and verification with Google AdSense, without executing ad scripts or tracking users.

Conditional framework and Consent Mode v2: In the event that commercial advertising monetization is activated in the future following domain verification, the IAB Europe TCF v2.4 standard and Google Consent Mode v2 will strictly apply. Prior to loading any ad scripts, all consent signals (ad_storage, analytics_storage, ad_user_data, and ad_personalization) will be initialized by default as denied. Activating advertising storage and personalisation will require the prior affirmative consent of the user via a Google-certified Consent Management Platform (CMP).

You can read more about Google's policies and settings at:

• Google's privacy policy: policies.google.com/privacy
• Google ads settings: adssettings.google.com

6. Voluntary Online Metadata and Artwork Enrichment

The library includes an optional, on-demand feature for online metadata and cover art lookup for selected tracks. This capability is completely disabled by default and strictly requires your affirmative, informed consent before any external network requests are initiated.

External query recipients: When this feature is invoked, your browser sends direct HTTP GET read requests to the public APIs of external music services:

• MusicBrainz (MetaBrainz Foundation): queries public release and recording databases by track title and artist.
• Cover Art Archive (Internet Archive & MetaBrainz): fetches voluntary front cover images linked to MusicBrainz release identifiers.
• Apple iTunes Search API (Apple Inc.): queries public catalog listings and retrieves high-resolution official release artwork.

What data is transmitted and what NEVER leaves your machine:

• Transmitted data: Only the plain-text title and artist of the selected tracks as HTTP GET search query parameters. Because requests are executed directly from your browser, your IP address and standard browser request headers are technically received by those third-party servers in order to fulfill the HTTP response.
• Absolute privacy guarantee over your audio: NO audio samples, audio files, acoustic fingerprints, local computer file paths, or private tags (such as custom comments or calculated BPM) are EVER sent over the network.

Local artwork storage: When you choose to download and apply cover art, the image is scaled and optimized locally (500×500 px) and saved directly into your browser's local client database (IndexedDB: deckmatics-artwork). It is never stored on our servers.

Consent revocation: You can revoke your online search authorization at any time by clicking "Revoke online consent" within the metadata lookup modal, or by clearing the technical preference cookie deckmatics_lookup_consent in your browser settings.

7. Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, Article 6 of the GDPR requires a legal basis for each processing operation:

• Advertising and non-essential cookies — conditional consent (Art. 6(1)(a) GDPR). Commercial advertising is currently disabled. In case of future activation following domain verification, advertising storage will strictly depend on your prior, affirmative consent in the CMP (under IAB TCF v2.4), remaining denied by default.
• Voluntary online metadata and artwork lookups — consent (Art. 6(1)(a) GDPR). External communication with MusicBrainz, Cover Art Archive, and Apple iTunes is only triggered after your affirmative consent in the dialog. You may revoke it at any time.
• Security, delivery and operation of the site — legitimate interests (Art. 6(1)(f) GDPR). The hosting provider processes IP addresses and request data in order to serve the site and protect it from abuse and attacks. This is not processing from which we build user profiles: it is the minimum technical processing without which a website cannot be delivered at all.
• Email enquiries — legitimate interests (Art. 6(1)(f) GDPR). We process the information you send us to respond and follow up on your enquiry. Requests to exercise your rights are handled to meet our legal obligations (Art. 6(1)(c) GDPR).
• Analysis of your own files — not our processing. When you drop a track into the analyzer, decoding and computation run in your browser, under your control and by your decision. We do not receive the audio or the results.

8. How long each item is kept

• Interface preferences (localStorage and technical cookies): until you clear site data, or up to 1 year for the online lookup consent cookie (deckmatics_lookup_consent).
• Artwork cache (IndexedDB, deckmatics-artwork): until you clear site data in your browser.
• Analysis cache (IndexedDB, analysis_cache): until you clear it from the "Local Memory" dialog, or until the store exceeds 2000 records (oldest records are dropped automatically).
• Audio samples and object URLs: for the lifetime of the tab session only. Object URLs are revoked and do not persist.
• Third-party advertising data: currently inactive with commercial advertising disabled.
• Hosting provider logs: Cloudflare retains technical request logs for the periods in its own policy.
• Email correspondence: while handling and following up on your enquiry, and afterwards as needed to meet legal obligations.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, objection, data portability, and to withdraw consent at any time.

To exercise them, write to contact@deckmatics.com. We have no user accounts or database of analyzer users. Local tool data sits on your own device and you can delete it yourself (section 4).

If you believe we have not handled your request properly, you have the right to lodge a complaint with a supervisory authority, in particular in the country where you live, where you work, or where the alleged infringement took place (in Spain, the AEPD: aepd.es).

10. Third parties and international transfers

• Google AdSense (currently inactive): inactive. Only if activated following domain verification would it process data according to its own privacy policy outside the EEA under user consent.
• Cloudflare (hosting): delivers the site as static content and provides security and CDN infrastructure.
• Zoho Mail (contact email): provides the email service used to receive and respond to enquiries.
• External music metadata services (MusicBrainz, Cover Art Archive, Apple Inc.): voluntary lookups connect directly to their servers under their respective privacy policies.

Beyond these technical providers and expressly consented lookup services, we disclose your data to no one. We do not sell personal data.

11. Cookies

The site sets no tracking or advertising cookies of its own. In the current state with commercial advertising disabled, no third-party advertising cookies are loaded or executed. Third-party cookies are limited to the hosting provider and, if voluntarily enabled, the technical metadata lookup preference.

The detailed list of cookies and storage technologies is in the Cookie Policy.