Privacy policy

1. Who is responsible

Box Of Rules (James H. Gordy, Brighton, United Kingdom) is the data controller for your Box Of account and the Box Of Rules sites it logs you into. Contact: [email protected], or the help page on this site.

2. What we collect

Account: your name, email, password (stored hashed, never readable), when you signed up and logged in, and whether your email is verified. Sign-in providers: if you use Google or Apple, the identifier they give us, the email and name they share, and a profile picture if you choose to use it. Profile: what you choose to show publicly: username, picture, bio, website, location, instruments. Private details: what you enter for invoices: legal name, company, VAT number, phone, addresses. Purchases: what you bought, when, for how much, and PayPal's transaction reference. PayPal handles the payment itself and shares no card details with us. Licences and activations: licence keys, and for each activated machine a name, platform and hashed machine identifier, so the activation limit can work. Tokens: a ledger of every credit and debit. Tools: what you ask the hosted tools to do (a sound design prompt, an analysis) and the result, so you can come back to it. Support: tickets and chat messages you send. Plugin telemetry: the plugins send anonymous usage events (which plugin, version, host, platform); no audio, no project names, and you can opt out in each plugin.

3. Why, and on what basis

To run the account and deliver what you bought (contract). To send receipts, security notices and replies to your tickets (contract). To keep the sites safe, stop abuse and enforce licences (legitimate interest). To count visits with our own cookieless statistics (legitimate interest and the statistical purposes exception in UK law, with an off switch below). To measure how the sites are used with Google Analytics and Microsoft Clarity, only if you allow analytics (consent). To show our own adverts to people who have visited, and to measure whether those adverts work, only if you choose Accept all (consent). To send the newsletter and product updates only when you have ticked the box (consent, withdraw any time on the Privacy page). To meet tax and accounting law: records of payments are kept for six years (legal obligation).

4. Who else sees it

Processors who help us run the sites, each under their own terms: PayPal (payments), Postmark (email delivery), Cloudflare (the network in front of the sites), DigitalOcean (hosting, in the EU), Google and Apple (only when you sign in with them), Anthropic (the model behind the help chat and the sound designer; your messages are sent to answer them and are not used to train models), Google Analytics and Microsoft Clarity (only if you allow analytics; Clarity records how pages are used, with whatever you type masked), Google Ads and Meta (only if you choose Accept all: they learn that your browser visited and what it did here, such as a download or a purchase, so that we can show you our own adverts on their platforms and measure them). We do not sell data. We never give an advertiser your name, your email address or anything from your account.

5. Where it lives and how long

The sites run on a server in the European Union, with Cloudflare in front. Your account data stays for as long as the account exists. When you delete the account it is closed at once and removed after 30 days, along with profile, details, licences, tokens and tickets. Payment records stay for six years because tax law requires it, kept to the minimum needed. Anonymous analytics and plugin telemetry keep no link to you.

6. Cookies

The account sites set the cookies needed to keep you logged in and to protect forms; those are strictly necessary and need no consent. The cookie notice gives three choices. Essential only keeps just the necessary ones. Analytics only adds Google Analytics and Microsoft Clarity. Accept all also adds the advertising cookies of Google Ads and Meta, which exist so that we can advertise our own products to people who have visited; we sell no advertising space and nobody else's adverts appear on our sites. The account pages never load an advertising or session recording script, whatever you chose. The tick "Show me Box Of Rules adverts on Google and Meta" at checkout or on your account is the same choice as Accept all, recorded against the account with the date and the wording you saw; untick it on the Privacy page to withdraw it. Change your choice at any time with the button below, on the Privacy page, or by clearing the site's cookies in your browser, which brings the notice back.

Change my cookie choice

We run our own copy of Matomo at stats.boxofrules.com to count visits, pages, referrers, downloads and purchases, so we can see what works and fix what does not. It sets no cookies and stores nothing on your device. It masks the last two parts of your IP address before anything is saved, honours your browser's Do Not Track setting, and the data never leaves our server: nothing goes to Google or anyone else. We only ever read it as totals. We rely on the statistical purposes exception in UK law and on our legitimate interest in running the sites. You can switch it off for this browser here.

7. Your rights

Under UK GDPR you can ask for a copy of your data (the Privacy page downloads one instantly), correct it (edit it under Profile and Account), delete it (the Account page), object to or restrict processing, and withdraw consent. Write to us for anything the pages do not cover; we answer within a month. If you are unhappy with how we handle it you can complain to the Information Commissioner's Office at ico.org.uk.

8. Children

The sites are not for anyone under 16 and we do not knowingly keep data about them. Tell us if you think we have some and we will remove it.

9. Changes

When this policy changes the date at the top changes with it, and for anything that matters we email account holders.