Privacy Policy
Last updated: 26 October 2026
The short version. BassRack keeps your music on your device. Your library, audio, stems and charts are stored locally in your browser or on your computer, and we do not store your songs or audio on our servers. The one exception is Premium Cloud: a file you upload for processing is processed and then deleted, within 24 hours at most. If you create an account, you sign in with Google or an email link (there are no passwords), and we keep only your account details, your plan and, once sync is available, practice metadata (profile, charts, corrections, progress, scores, achievements). If you join the waitlist, we keep your email address only to tell you when BassRack launches. Personalised ads only with your consent.
1. Who is responsible for your data
The controller of your personal data is Jeronimo Maria Repetto Cirio, who operates BassRack (full details in the Legal notice). Contact for any privacy question or request: privacy@bassrack.com.
Because we are established in the European Union (Spain), we are not required to appoint a representative under Article 27 GDPR. We have not appointed a UK representative; we will do so if required under UK GDPR Article 27.
This policy covers the website bassrack.com, the BassRack web app and the optional BassRack Tuner desktop helper (together, the "Service"). It applies to everyone who uses the Service, in particular to users in the European Economic Area (EEA) and the United Kingdom under the General Data Protection Regulation (GDPR) and the UK GDPR.
2. How BassRack is built: local first
BassRack is designed so that the data that matters most never leaves your device:
- Your library, audio files, separated stems and charts are stored locally in your browser (for example, in its local storage or file storage) or on your computer. We do not receive them. Songs are processed there too, by AI models running on your device; the only exception is Premium Cloud (section 3.4).
- Your microphone or instrument input is analysed in your browser in real time to detect the notes you play. It is not recorded or sent to us.
- The device check ("Can my computer run BassRack?") reads your browser's reported capabilities (graphics, memory, storage) on your device to give you an answer. The result is shown to you and is not sent to us.
- The BassRack Tuner fetches audio from links you provide on your own computer. The links and the audio stay on your computer; the Tuner may contact our servers or its update source to check for updates. It is free for everyone and does not depend on your plan.
3. What we collect
3.1 Account data
If you create an account, you sign in with Google or with a sign-in link sent to your email address. There are no passwords: BassRack never asks for one and never stores one. Accounts are run by Firebase Authentication, a service of Google LLC that acts as our processor. It holds your email address, your account identifier (uid), the sign-in method you used (Google or email link) and the dates and times your account was created and you last signed in. If you sign in with Google, Google also shares your name and profile picture, which Firebase Authentication may keep with your account; BassRack does not use or show them. We do not receive your Google password.
We use this data to run your account and your subscription, on the basis of our contract with you. We keep it while your account exists and delete it when you ask us to, at privacy@bassrack.com (see section 7).
3.2 Practice metadata (planned feature)
If you have an account, we sync metadata only: your profile and settings, charts, corrections you make, practice progress, best scores and achievements (including gold and holographic rewards). To label your charts and achievements we store song titles and artist names as you entered them. No audio is synced. Your achievement history is kept even if you delete a song from your library, until you delete it or your account.
3.3 Payment data
Payments are handled by Paddle, our Merchant of Record (see section 5). Paddle collects your payment details directly. We receive from Paddle the information we need to manage your subscription: your email address, country, plan, subscription status, transaction identifiers and amounts. We never receive your full card or bank details.
- What the app passes to Paddle: only your email address and your account identifier (uid). The uid travels in the checkout's custom data, so Paddle can tell us which account a subscription belongs to.
- Paddle.js, Paddle's checkout script, is loaded from Paddle only when you start a checkout. The free app never contacts Paddle otherwise.
- The customer portal, where you manage or cancel your subscription, is run by Paddle. When you choose "Manage subscription", our backend asks Paddle for a link to your portal and opens it.
- Plan data on our servers: we keep your account identifier, plan, subscription status, the end of the current billing period, and Paddle's customer and subscription identifiers, plus a log of Paddle's notifications (event type, time and the same identifiers). They are stored in Cloud Firestore and handled by Cloud Functions, both from Google, in the European Union (Google Cloud region europe-west1).
3.4 Premium Cloud uploads (planned feature)
If you use Premium Cloud, you upload an audio file so our servers can separate and transcribe it. The audio is processed and deleted immediately after processing, and in any case within 24 hours of the upload. The results (stems and chart) are returned to your device. We keep technical records of the job (time, file size and duration, processing time, errors) without the audio, to operate the service and limit abuse.
3.5 Technical and security data
When you visit the website or use the Service, our hosting and network providers process technical data such as your IP address, browser type, the pages requested and timestamps, to deliver the Service, keep it secure and prevent abuse. The free plan periodically checks that the Service is reachable; that request carries only the technical data any web request carries.
3.6 Advertising
The Free plan shows ads. Today the ads in the app are simulated samples and no ad network receives any data. When we enable a real ad network, it will process technical data needed to deliver ads (such as your IP address and device information). Personalised advertising, and any non-essential cookies or storage used for it, only happen with your consent. Without consent, only non-personalised ads may be shown.
3.7 Communications
If you write to us (support, privacy requests, copyright notices), we process your message and contact details to answer you.
3.8 Waitlist
BassRack is not open to the public yet. If you join the waitlist on the website, we store your email address, the language of the page you used (English or Spanish), the platform you play on if you choose to tell us (Windows, Mac or phone), and a record of your consent (its date and time and the version of the text you agreed to). To protect the form against spam bots and abuse, we also store a one-way, salted hash of your IP address and of your browser's user agent; we never store them in readable form. A separate counter of recent requests per hashed IP address, used to limit abuse to 5 requests per hour, is deleted after one hour.
The form uses Cloudflare Turnstile, a security check that tells people from bots. It is loaded only when you reach the form, and Cloudflare processes technical signals from your browser (such as your IP address and browser characteristics) to run it.
We use your email address only to tell you when BassRack launches. Every email we send includes a link to unsubscribe, and you can also write to us. We do not use the waitlist for anything else and we do not share it with anyone except the providers in section 5.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Provide the Service, your account, your subscription and sync | Account data, plan data, practice metadata | Performance of a contract (Art. 6(1)(b)) |
| Process Premium Cloud uploads | Uploaded audio (transient), job records | Performance of a contract (Art. 6(1)(b)) |
| Manage subscriptions with Paddle | Payment data received from Paddle | Performance of a contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) |
| Keep the Service secure and prevent abuse | Technical and security data | Legitimate interests (Art. 6(1)(f)) |
| Tell you when BassRack launches (waitlist) | Email address, language, platform (optional), consent record | Consent (Art. 6(1)(a)) |
| Protect the waitlist form against bots and abuse | Turnstile signals, hashed IP address and user agent, request counter | Legitimate interests (Art. 6(1)(f)) in keeping the list free of spam |
| Show non-personalised ads on the Free plan | Technical data needed to deliver ads | Legitimate interests (Art. 6(1)(f)) in funding the Free plan |
| Show personalised ads and use advertising storage | Data the ad network collects | Consent (Art. 6(1)(a)) |
| Audience measurement (not used today) | Usage statistics | Consent (Art. 6(1)(a)) |
| Answer you and handle copyright notices | Communications | Legitimate interests (Art. 6(1)(f)); legal obligations (Art. 6(1)(c)) |
| Comply with the law and defend legal claims | Relevant records | Legal obligations (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
You can object at any time to processing based on legitimate interests (see section 9). You can withdraw consent at any time from "Cookie settings" or, for the waitlist, with the unsubscribe link in any of our emails, without affecting the lawfulness of processing before the withdrawal.
5. Who processes your data
We use a small number of providers. Where they act as our processors, they process data only on our instructions under data processing terms.
- Google (Google LLC; Google Cloud and Firebase): sign-in (Firebase Authentication), the database for plan data and account metadata (Cloud Firestore) and our backend (Cloud Functions), both in the EU region europe-west1, website and app hosting, and server processing for Premium Cloud (Cloud Run). Processor.
- Cloudflare: domain name system, content delivery and security for bassrack.com, website hosting and the waitlist form (Cloudflare Pages), the waitlist database (Cloudflare D1), the bot check on the form (Cloudflare Turnstile), and email routing for our addresses. Processor. For Turnstile, Cloudflare also processes some technical signals under its Turnstile Privacy Addendum.
- Paddle (Paddle.com Market Limited and its affiliates): our Merchant of Record. Paddle sells subscriptions to you and processes payments, taxes and invoices as an independent controller under its own privacy notice.
- An advertising network, once enabled: the advertising network we use, which will be listed here before ads go live (planned: Google AdSense / Ad Manager). We will update this policy before enabling it. Depending on the network, it may act as an independent controller for personalised advertising, which only happens with your consent.
We may also disclose data to authorities when the law requires it, and to a rights holder or the user concerned when handling a copyright notice (see the Copyright & Takedown Policy). We do not sell your personal data.
6. International transfers
Some providers may process data outside the EEA and the UK, including in the United States. When that happens, transfers rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, for certified providers, and the UK extension to it) or on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), together with additional safeguards where needed. For Firebase Authentication, Google LLC may process sign-in data in the United States; Google is certified under the EU-U.S. Data Privacy Framework and also offers the Standard Contractual Clauses. You can ask us for information about these safeguards at privacy@bassrack.com.
7. How long we keep data
- Premium Cloud audio: deleted immediately after processing, and within 24 hours of the upload at most.
- Account data, plan data and practice metadata: while your account exists. You can ask us to delete your account at any time at privacy@bassrack.com. When your account is deleted, we delete them within 30 days, including from backups, except the subscription records the law requires us to keep (below).
- Subscription records: for as long as tax and accounting law requires. Paddle keeps its own records as Merchant of Record.
- Waitlist: until BassRack launches and then for up to 12 months, or until you unsubscribe, whichever comes first. When you unsubscribe, we stop using your address at once and delete your entry within 30 days. The hourly request counter is deleted after one hour.
- Technical and security logs: up to 90 days, unless needed longer to investigate a specific security incident.
- Communications and copyright notices: for as long as needed to handle the matter and, after that, for the applicable limitation period for legal claims.
Data stored on your device stays there until you delete it.
8. Data stored on your device
The website and the app store data in your browser so they can work: your settings, language, progress, best scores, consent choices and your local library. If you sign in, the app also keeps your sign-in session and a signed copy of your plan in your browser. This storage is described, key by key, in the Cookie Policy. Most of it is strictly necessary for the features you use; anything that is not (advertising, analytics) is only used with your consent.
Because your library is stored locally, clearing your browser's site data deletes it, and we cannot recover it for you.
9. Your rights
Under the GDPR and the UK GDPR you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict processing in certain cases;
- data portability: receive the data you gave us in a structured, machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, from "Cookie settings" on the website (footer) or in the app (Rig panel), and for the waitlist with the unsubscribe link in our emails.
To exercise your rights, write to privacy@bassrack.com. We will answer within one month, which can be extended by two further months for complex requests (we will tell you if so). We may ask you to confirm your identity. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work: Agencia Española de Protección de Datos (AEPD), www.aepd.es. In the UK, this is the Information Commissioner's Office (ICO).
10. Children
The Service is not directed at children under 14. If you are under 14 (or the age of digital consent in your country, if higher), you may not create an account without the consent of a parent or legal guardian. If you believe a child has given us personal data without the required consent, contact us at privacy@bassrack.com and we will delete it.
11. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls on our systems and providers with recognised security certifications. No system is completely secure; if a data breach is likely to put your rights at risk, we will inform you and the authorities as the law requires.
12. Automated decisions
BassRack scores your playing to help you practise. These scores have no legal or similarly significant effect on you, and we do not make decisions about you based solely on automated processing that would.
13. Changes to this policy
We will update this policy when the Service changes, in particular before enabling Premium Cloud or a real ad network. The date of the latest version is shown at the top. For material changes, we will inform you in advance in the Service or by email if you have an account.
14. Contact
Email: privacy@bassrack.com. Full controller details: see the Legal notice.