Sonic Canvas · Gear Tracker

Privacy Policy

Effective 8 August 2026 · [email protected]

1. Who is responsible

The data controller is Ásgeir Þrastarson, Iceland — the individual who builds and runs Gear Tracker (soniccanvas.app) under the Sonic Canvas name. Contact for anything in this policy: [email protected].

2. Local-first: the default is that we hold nothing

Gear Tracker works fully without an account. In that mode your entire ledger — items, events, photos, rigs — is stored by your own browser (in IndexedDB, on your device) and is never transmitted to us. We cannot see it, and this policy's server-side sections simply don't apply to you until you create an account.

Even with an account, a complete copy of your data stays in your browser. The server's role is sync and backup, not custody.

3. What we store when you have an account

Account

• Email address, optional display name, a password hash (never the password), and whether the email is verified.
• A session record for each signed-in device. The session lives in a cookie that is httpOnly, Secure and SameSite=Lax — it exists to keep you signed in and does nothing else. Sessions last 30 days of inactivity and signing out genuinely invalidates them server-side. Authentication is Better Auth, self-hosted on our own database — no third-party identity provider sees your login.

Your collection

• Gear entries (items, events, rigs — the things you type) are stored in Cloudflare D1, a database running on Cloudflare's network, keyed to your account and readable only by it.
• Photos and receipt images are stored in Cloudflare R2, keyed under your account. Before any photo leaves your device, the app resizes it in your browser — a process that strips the EXIF metadata, including GPS location, the camera embedded in it. Where you took a photo of your guitar never reaches us.
• A running count of your photo-storage bytes, used to enforce the storage allowance.

Operational records

• A failure log: when a mail fails to send, an upload is rejected, or the API crashes, we record a timestamp, a reason code and where relevant the account — never the contents of anyone's collection. It exists so problems get noticed, is written only on failures, and is pruned after 30 days.
• If you buy the unlock: the Paddle transaction id, its status, the amount and currency, and your account email. No card numbers, no billing addresses — Paddle holds those (section 5).

4. What we deliberately don't do

• No analytics, no trackers, no advertising, no fingerprinting. The only cookie is the session cookie, which is strictly necessary — so there is no cookie banner, because there is nothing to consent to.
• No profiling and no automated decision-making.
• Your content is never sold, shared for marketing, or used to train anything.
• The operator cannot browse your collection. The admin view this service's operator uses shows aggregate counts and service-health data — user totals, storage bytes, failure codes — and is deliberately built without any way to open a user's items, photos, prices or notes. A collection is its owner's. If a support case ever required more, we would ask you first.

5. Who processes data for us

• Cloudflare — hosts the site and stores account data, gear entries (D1) and photos (R2) on our behalf, under Cloudflare's data processing addendum, which includes the EU-approved safeguards (standard contractual clauses) for any processing outside the EEA.
• Resend — sends transactional email only: email verification, password resets, and email-change confirmations. Resend processes the recipient address and message for delivery. We send no newsletters and no marketing mail.
• Paddle — the merchant of record for purchases. Paddle is the seller of record and acts as a controller in its own right for checkout, payment, billing and tax data, under Paddle's privacy policy. Card details are entered into Paddle's checkout and never touch our servers; what Paddle passes back to us is the transaction record described in section 3.

6. Why we may lawfully do this (GDPR Article 6)

• Performance of a contract — storing and syncing your collection, running your account, and processing your purchase are the service you asked for (Art. 6(1)(b)).
• Legitimate interests — the failure log and abuse prevention keep the service working and secure, use the minimum data that can do that job, and never touch collection contents (Art. 6(1)(f)).
• Legal obligation — purchase records are retained as bookkeeping and tax law requires; Paddle, as merchant of record, carries most of that burden (Art. 6(1)(c)).

7. How long we keep things

• Your account and collection: until you delete them. Deletion is real and immediate: your gear entries, your photos in R2, your storage records and then the account itself are all purged, in that order, so a half-failed deletion can never leave orphaned photos behind. Nothing is kept "in case you come back".
• Failure log: 30 days, then pruned automatically.
• Purchase records: the minimal transaction record (id, status, amount) is retained even after account deletion, because refunds and chargebacks can arrive later and accounting rules require it. It contains no collection data.
• The copy in your own browser is yours — it is on your device, under your control, and you can erase it from the app's Account page at any time.

8. Your rights

Under the GDPR (which applies to us as an Iceland-based, EEA-serving service) you have the right to:

• Access your data — largely self-serve: the app shows you everything it holds, because the app is everything it holds.
• Rectify it — edit anything, any time, in the app.
• Erase it — the Delete account page does this genuinely, photos included, no email required, no waiting period.
• Take it with you (portability) — the Account page exports your entire collection as a JSON file, at any time, on any tier.
• Restrict or object to processing based on legitimate interests.

For anything not self-serve, email [email protected] and it will be handled within a month, as the GDPR requires. You also have the right to complain to a supervisory authority — in Iceland that is Persónuvernd (personuvernd.is), or the data protection authority of your own country.

9. Security, honestly stated

Traffic is encrypted in transit (TLS). Passwords are stored only as hashes. Sessions are server-side and revocable. The service runs on Cloudflare's infrastructure, and the API refuses requests that don't belong to the signed-in account — every query is filtered by the session's user, never by anything the client claims. No system is breach-proof and we won't pretend this one is; what we can say is that the design keeps the blast radius small: no card data, no location data, no tracking profiles, and the most personal thing on the server is what your gear cost you.

10. Children

Gear Tracker is not directed at children under 13, and we do not knowingly hold accounts for them.

11. Changes

If this policy changes materially, the change will be announced in the app or by email to account holders before it takes effect, and the date above will move. The current version always lives at this address.