Sonic Canvas · Gear Tracker

Privacy Policy

Effective 8 August 2026 · Updated 9 August 2026 · [email protected]

Þessi síða er aðeins til á ensku — enski textinn er sá sem gildir.

1. Who is responsible

The data controller is Ásgeir Þrastarson, Iceland — the individual who builds and runs Gear Tracker (soniccanvas.app) under the Sonic Canvas name. Contact for anything in this policy: [email protected].

2. Where your data lives

Gear Tracker requires an account. Your ledger — items, events, photos, rigs, plus your currency choice and insurance-schedule selections — is stored on our servers (section 3) and synced to every device you sign in on. Losing or replacing a device does not lose your ledger.

Your browser also keeps a complete working copy (in IndexedDB, on your device) so the app opens instantly and works offline. That copy is a cache of your account: it stays on the device until you erase it from the Account page, and changes made offline sync up when the connection returns. Anything logged in this browser before accounts were required is adopted into your account the first time you sign in — never wiped.

3. What we store when you have an account

Account

• Email address, optional display name, a password hash (never the password), and whether the email is verified.
• A session record for each signed-in device. The session lives in a cookie that is httpOnly, Secure and SameSite=Lax — it exists to keep you signed in and does nothing else. Sessions last 30 days of inactivity and signing out genuinely invalidates them server-side. Authentication is Better Auth, self-hosted on our own database — no third-party identity provider sees your login.

Your collection

• Gear entries (items, events, rigs — the things you type) are stored in Cloudflare D1, a database running on Cloudflare's network, keyed to your account and readable only by it.
• Photos and receipt images are stored in Cloudflare R2, keyed under your account. Before any photo leaves your device, the app resizes it in your browser — a process that strips the EXIF metadata, including GPS location, the camera embedded in it. Where you took a photo of your guitar never reaches us.
• A running count of your photo-storage bytes, used to enforce the storage allowance.

Pages you choose to publish

• You can publish an individual item or rig to a public page anyone with the link can open. This never happens on its own — it is a deliberate, per-item action, and you choose at publish time whether prices and your notes appear. Serial numbers, receipts and lending details are never included, whatever you choose.
• A published page is a copy made at the moment you publish (including copies of the photos you had on that item); later edits stay private until you update the page. Taking a page down deletes the copy and its photos — but anyone who already opened the link may have seen or saved it, and we cannot undo that.
• Public pages ask search engines not to index them.

Operational records

• A failure log: when a mail fails to send, an upload is rejected, or the API crashes, we record a timestamp, a reason code and where relevant the account — never the contents of anyone's collection. It exists so problems get noticed, is written only on failures, and is pruned after 30 days.
• If you buy the unlock: the Paddle transaction id, its status, the amount and currency, and your account email. No card numbers, no billing addresses — Paddle holds those (section 5).

4. What we deliberately don't do

• No advertising, no fingerprinting, no cross-site tracking, and no cookies beyond the session cookie — which is strictly necessary, so there is no cookie banner, because there is nothing to consent to. What we do measure is anonymous and aggregate, twice over: Cloudflare Web Analytics counts page views without cookies or identifiers, and our own counters record daily totals — front-page visits, sign-ups, first items, upgrades — as a date, a name and a number. Neither records who you are, follows you anywhere, or is joined to your account.
• No profiling and no automated decision-making.
• Your content is never sold, shared for marketing, or used to train anything.
• The operator cannot browse your collection. The admin view this service's operator uses shows aggregate counts and service-health data — user totals, storage bytes, failure codes — and is deliberately built without any way to open a user's items, photos, prices or notes. A collection is its owner's. If a support case ever required more, we would ask you first.

5. Who processes data for us

• Cloudflare — hosts the site and stores account data, gear entries (D1) and photos (R2) on our behalf, under Cloudflare's data processing addendum, which includes the EU-approved safeguards (standard contractual clauses) for any processing outside the EEA.
• Resend — sends transactional email only: email verification, password resets, and email-change confirmations. Resend processes the recipient address and message for delivery. We send no newsletters and no marketing mail.
• Paddle — the merchant of record for purchases. Paddle is the seller of record and acts as a controller in its own right for checkout, payment, billing and tax data, under Paddle's privacy policy. Card details are entered into Paddle's checkout and never touch our servers; what Paddle passes back to us is the transaction record described in section 3.

6. Why we may lawfully do this (GDPR Article 6)

• Performance of a contract — storing and syncing your collection, running your account, and processing your purchase are the service you asked for (Art. 6(1)(b)).
• Legitimate interests — the failure log and abuse prevention keep the service working and secure, use the minimum data that can do that job, and never touch collection contents (Art. 6(1)(f)).
• Legal obligation — purchase records are retained as bookkeeping and tax law requires; Paddle, as merchant of record, carries most of that burden (Art. 6(1)(c)).

7. How long we keep things

• Your account and collection: until you delete them. Deletion is real and immediate: your gear entries, your photos in R2, your storage records and then the account itself are all purged, in that order, so a half-failed deletion can never leave orphaned photos behind. Nothing is kept "in case you come back".
• Failure log: 30 days, then pruned automatically.
• Purchase records: the minimal transaction record (id, status, amount) is retained even after account deletion, because refunds and chargebacks can arrive later and accounting rules require it. It contains no collection data.
• The copy in your own browser is yours — it is on your device, under your control, and you can erase it from the app's Account page at any time.

8. Your rights

Under the GDPR (which applies to us as an Iceland-based, EEA-serving service) you have the right to:

• Access your data — largely self-serve: the app shows you everything it holds, because the app is everything it holds.
• Rectify it — edit anything, any time, in the app.
• Erase it — the Delete account page does this genuinely, photos included, no email required, no waiting period.
• Take it with you (portability) — the Account page exports your entire collection as a JSON file, at any time, on any tier.
• Restrict or object to processing based on legitimate interests.

For anything not self-serve, email [email protected] and it will be handled within a month, as the GDPR requires. You also have the right to complain to a supervisory authority — in Iceland that is Persónuvernd (personuvernd.is), or the data protection authority of your own country.

9. Security, honestly stated

Traffic is encrypted in transit (TLS). Passwords are stored only as hashes. Sessions are server-side and revocable. The service runs on Cloudflare's infrastructure, and the API refuses requests that don't belong to the signed-in account — every query is filtered by the session's user, never by anything the client claims. No system is breach-proof and we won't pretend this one is; what we can say is that the design keeps the blast radius small: no card data, no location data, no tracking profiles, and the most personal thing on the server is what your gear cost you.

10. Children

Gear Tracker is not directed at children under 13, and we do not knowingly hold accounts for them.

11. Changes

If this policy changes materially, the change will be announced in the app or by email to account holders before it takes effect, and the date above will move. The current version always lives at this address.