Privacy Policy
Last updated: 20 September 2026
Who we are
ToneMatch (“we”, “us”) is a community platform where guitarists share amp settings and presets for specific songs. We are the data controller for the personal data described in this policy. You can reach us at privacy@tonematch.io.
What we collect
You can browse ToneMatch without an account, and without accepting analytics. We only collect what the site actually needs.
| Data | When | Why |
|---|---|---|
| Email address and password | When you create an account | To sign you in and send account emails. Passwords are hashed by our authentication provider — we never see or store them in readable form. |
| Username, display name, bio, avatar | When you create or edit your profile | Shown publicly next to the presets and comments you post. |
| Presets, comments, votes, tone requests, uploaded files | When you post them | This is the content of the site. Presets, comments and your username are public by design. |
| IP address and browser details | Every request, in server logs | Security, abuse prevention, and keeping the service running. Held only briefly by our hosting provider. |
| Pages viewed, clicks, session recordings, error reports | Only if you accept analytics | To understand which parts of the site work and which confuse people. Never collected if you decline. |
We do not collect payment details, we do not buy personal data from anyone, and we do not sell yours.
Our legal bases (UK/EU GDPR)
- Contract — creating and running your account, and publishing the content you post.
- Legitimate interests — keeping the site secure, preventing spam and abuse, and fixing faults. We balance this against your rights and keep it to what is necessary.
- Consent — analytics and session recording. We ask before any of it runs, and you can change your mind at any time.
Analytics and cookies
ToneMatch does not use advertising or tracking cookies. We use strictly necessary cookies to keep you signed in — these are required for the site to work and cannot be turned off.
If you accept analytics, we use PostHog (hosted in the EU) to record which pages are visited and to capture anonymised session recordings and error reports. Recordings are configured to mask everything you type — text you enter into any field, including search boxes and forms, is never recorded. Analytics identifies you only by a random account identifier; your email address is never sent to our analytics provider.
Declining costs you nothing — every feature works the same. You can withdraw consent at any time by clearing this site's data in your browser, which resets the choice and asks again.
Who we share data with
We use a small number of service providers who process data on our behalf under contract. They may not use it for their own purposes.
| Provider | What they handle |
|---|---|
| Supabase | Database, authentication, and file storage |
| Vercel | Website hosting and delivery |
| PostHog (EU) | Analytics, session recordings, and error reports — only with your consent |
| Resend | Sending account emails, such as confirmation links |
Preset pages may embed YouTube videos. We use YouTube's privacy-enhanced mode, so Google does not set tracking cookies unless you press play. If you do, YouTube's own privacy policy applies to that playback.
We will also disclose data where we are legally required to, or where it is necessary to protect our rights or someone's safety.
How long we keep it
- Account and profile data — until you delete your account.
- Presets, comments and votes — these stay published unless you delete them or your account.
- Server logs — a short period, set by our hosting provider.
- Analytics and session recordings — retained by PostHog according to their standard retention, and deleted when you withdraw consent or ask us to remove them.
Your rights
Under UK and EU data protection law you have the right to access a copy of your data, to have inaccurate data corrected, to have your data erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time.
You can delete your account and its data yourself at any time from your profile settings. For anything else, email privacy@tonematch.io and we will respond within one month.
If you are unhappy with how we have handled your data, you can complain to your local data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk).
Children
ToneMatch is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.
Changes to this policy
If we make a material change we will update the date at the top of this page and, where the change is significant, tell you in the app.
See also our Terms of Service.