• Every tool works without an account. Signed out, your stuff stays in your browser.
• With an account, your stuff is saved to soniroll's servers so it follows you between devices.
• Only what you choose to make public (a public profile, a post, a shared link) is seen by anyone else.
• soniroll counts which pages and tools get used, anonymously. No ads, no third-party trackers, nothing sold.

Your settings, tunes, chord charts, practice history and any audio files you open stay in your browser's own storage. They aren't sent to soniroll. Clearing your browser's data for soniroll.com deletes them.

• Sign-in: your email address and password (stored hashed, so nobody can read it), or, with Google, your email and name.
• Your stuff: tool settings, tune lists, chord charts, setlists, your Shed Log, recordings and any files you upload (PDFs, images, audio, video and so on, on their own or attached to a tune). Each account can store up to 100 MB. When you sign in, soniroll uses what's saved to the account; it doesn't merge in what was saved in that browser.
• Profile: your username, and if you add them, a picture, banner and instruments.
• Emailed confirmation codes are stored hashed and expire after 15 minutes.

Slow Downer's audio files always stay in your browser, signed in or not.

• Public profile (off until you turn it on): your username, picture, instruments, all your Tunes I Know and Tunes to Learn (names, keys, tempos; never your notes), ear-training levels and stars, who you follow and who follows you, and unless you turn it off, a Shed Log summary (streaks, hours, days practiced, milestones; never your routines, tasks or notes). Anyone can view it, with or without an account. Make it private again at any time.
• Posts and shared links: anything you post to Community, and any setlist, routine, tune or file you share by link, can be seen by whoever has it. Recordings attached to a shared setlist can be played by them too. A shared tune shows its keys, tempos, chord chart, the files attached to it and its recordings (never its notes), and whoever has the link can download those files and save a copy. A shared file can be opened, downloaded and copied the same way; your username shows only if your profile is public. Stop sharing at any time and the link stops working.
• Lessons: once you join a teacher, they see a summary of your Shed Log, how you're doing on the routines they gave you (including notes and recordings on those), and anything you hand in. Not your other routines, notes or recordings. Lesson materials, hand-ins and booking details are shared only between the teacher and that student, and booking emails go to both. Leave a teacher at any time.

To see what's useful, soniroll counts, per day: visits, page views, which tools are started and how long they run, and whether a visit was signed in. Only daily totals are kept (for example, "the Metronome was started 40 times on Tuesday"). They aren't tied to you, your account or your device, and no IP address or advertising ID is stored. Nothing is counted if your browser sends Do Not Track or Global Privacy Control. Account activity soniroll already has (like when an account was created) is also summed into charts for the administrator.

When you send feedback or report a post or profile, soniroll keeps your message, the page you were on, your browser and device type, any screenshot you attach, and your account (or the email you typed if you're signed out), so it can be fixed and answered.

The administrators can see each account's email, username, sign-in method and sign-up date, read feedback, and remove posts or accounts that break the terms. They don't browse your private stuff (your library, Shed Log, recordings or notes).

Only what the site needs to work: keeping you signed in, your theme, tool settings and similar preferences. No ad or tracking cookies.

• Convex stores account data, synced data and uploaded files, and runs the server code.
• Resend sends soniroll's emails (sign-in codes, password resets, lesson emails).
• Google handles "Sign in with Google", if you use it.
• Vercel hosts the website and, like any web host, sees standard request details such as IP addresses.
• GitHub Pages serves some of the piano and Rhodes samples straight to your browser (see Credits).

These may process data outside your country, including in the United States. soniroll doesn't sell or share data for advertising.

Your data is kept while your account exists. Deleting your account (from the Account page) permanently removes it and everything tied to it: profile, posts, library, Shed Log, recordings, files, lessons and feedback. Daily usage totals aren't tied to anyone, so there's nothing of yours in them to delete.

Passwords are stored hashed and traffic is encrypted (HTTPS). Nothing online is perfectly secure, so soniroll keeps only what it needs.

soniroll isn't aimed at children under 13. If you think a child has made an account, get in touch and it will be removed.

If this policy changes, this page and its date will be updated. Questions or requests about your data: use the feedback page (or a GitHub issue).