Distortion Hall Download
Legal · local-first recording storage

Privacy Policy

Draft for review. This preview shows 42 unresolved placeholders (highlighted). They must be filled in and the document reviewed by an Ontario lawyer before launch. This banner and the highlighting never appear in production.

Last updated: [DATE] Effective date: [DATE]

[LEGAL ENTITY NAME] ("CHUG", "we", "us", "our"), based in Toronto, Ontario, Canada, respects your privacy. This Privacy Policy explains what personal information we collect, why, how we use, share and protect it, and the choices and rights you have. It applies to the CHUG website at [WEBSITE URL] (the "Website"), the CHUG recording and music-production software for macOS and companion tools including CHUG Link (the "Software"), and related services (together, the "Services"). It is part of our [Terms of Use]([TERMS URL]).

The Services are in BETA until December 2027. During the Beta Period we may collect additional diagnostic information to find and fix problems, and this Policy may change more often. See section 12.

We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, and we describe additional rights for some regions in section 10.

1. Summary

  • CHUG is local-first. Your recordings, sessions, projects and settings are stored on your own computer, not on our servers, unless you choose to send them to us or use a feature that says otherwise.
  • We do not sell your personal information, and we do not use your recordings, music or voice to train AI or machine-learning models without your separate, explicit consent.
  • We collect only what we need: contact and account details, purchase information, support messages, and limited technical data about the Website and Software. [CONFIRM AND EDIT: list any telemetry or crash reporting that the Software actually sends.]
  • You can access, correct or delete your information, and withdraw consent, by contacting [PRIVACY EMAIL].

2. Who is responsible

Organisation: [LEGAL ENTITY NAME] Privacy Officer: [NAME OR TITLE], [PRIVACY EMAIL] Address: [STREET ADDRESS], Toronto, Ontario [POSTAL CODE], Canada

We are responsible for personal information under our control, including information handled by service providers on our behalf.

3. Information we collect

3.1 Information you give us

  • Contact and account details: name, email address, username, password (stored hashed, if accounts exist), country or region. [EDIT]
  • Beta sign-up and community information: email, instruments, gear and how you use CHUG, if you join the beta list or surveys.
  • Purchase information: purchase history and billing details processed by [PAYMENT PROCESSOR]. We do not receive or store your full card number.
  • Support and feedback: messages, bug reports and attachments you send. If you attach session files, logs or audio, they may contain personal information, including voices; please send only what you are comfortable sharing.
  • Communications: your preferences and our correspondence with you.

3.2 Information collected automatically

  • Website: IP address, approximate location derived from IP, browser and device type, operating system, pages visited, referring page, time and date, and cookie or similar identifiers (see section 8). [EDIT TO MATCH ANALYTICS TOOLS]
  • Software (if enabled/enforced): app version, macOS version, hardware model class, audio-interface model names and sample-rate/buffer settings, feature-usage counts, performance measurements (such as audio dropouts or CPU load), licence status and crash or error reports. [CONFIRM: describe exactly what is sent, whether it is optional, and whether it can be turned off.] Diagnostic data does not include the content of your recordings, sessions or projects.

3.3 Information that stays on your device

The Software stores on your device: recordings and audio files, MIDI, imported media, sessions, takes, mixer and tool settings, saved musician and rig profiles (names and instrument details you enter), device and gear information, preferences, and local logs. This information is not sent to us unless you choose to share it (for example, by attaching it to a support request) or use a feature that explicitly transfers it.

3.4 CHUG Link and local network features

CHUG Link may let a phone or tablet on your local network connect to the Software, for example to pair by QR code and show status or controls. Pairing and traffic stay on your local network between your devices. We do not receive that traffic. You are responsible for who is on your network and for who you pair with.

3.5 Microphone and audio-device access

The Software requests macOS permission to access audio input devices so that you can record and monitor. Audio captured is processed and stored locally on your device. We do not receive it unless you send it to us. You can revoke access at any time in macOS System Settings.

3.6 Information from others

We may receive information from payment processors (confirmation of payment), analytics or advertising platforms (aggregate or limited data), and from other users (for example, a bandmate who invites you or names you in a shared session) if such features exist.

We use personal information to:

Purpose Examples
Provide and operate the Services Deliver downloads and updates, manage licences and accounts, process purchases
Support you Answer requests, investigate bugs, restore access
Improve and secure the Services Diagnose crashes, measure performance, prevent fraud and abuse, test new features during the Beta
Communicate Service notices, beta announcements, changes to our terms, and (with consent where required) marketing
Comply with the law Tax and accounting records, legal requests, enforcing our rights

Consent. Under PIPEDA we rely on your consent, which may be express or implied depending on the sensitivity of the information and the circumstances. You can withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice; withdrawal may limit what we can provide. Where permitted, we may also process information without consent (for example, to investigate breaches, comply with law, or for business transactions).

Marketing and CASL. We send commercial electronic messages only with consent as required by Canada's Anti-Spam Legislation (CASL). Every marketing email includes an unsubscribe link. Transactional and service messages (for example, receipts and security notices) are not marketing.

5. How we share information

We do not sell personal information. We share it only:

  • With service providers who process it for us under contract, such as website and download hosting ([HOSTING PROVIDER]), email delivery ([EMAIL PROVIDER]), payment processing ([PAYMENT PROCESSOR]), analytics ([ANALYTICS PROVIDER]), customer support ([SUPPORT TOOL]) and crash reporting ([CRASH REPORTING PROVIDER]). They may use the information only to provide services to us.
  • For legal reasons: to comply with law, court orders or lawful requests; to enforce our terms; to protect the rights, property or safety of CHUG, our users or others; or to detect and prevent fraud or security issues.
  • In a business transaction: if we are involved in a merger, financing, acquisition or sale of assets, information may be transferred subject to this Policy or equivalent protections.
  • With your direction or consent: for example, when you share a file with us or with another user.
  • Aggregated or de-identified information that cannot reasonably identify you, which we may use and share for any purpose.

6. International transfers

We are based in Canada. Our service providers may process information in other countries, including the United States [EDIT], where privacy laws may differ from Canada's and information may be accessible to courts and authorities under local law. We use contractual and other measures to require comparable protection. Contact [PRIVACY EMAIL] for more information about our service-provider practices outside Canada.

7. Retention

We keep personal information only as long as needed for the purposes in this Policy, including legal, tax, accounting and security requirements, and then delete or de-identify it. As a guide: account and licence records for the life of the account plus [7] years for tax/accounting; support correspondence for [2] years; website analytics for [14–26] months; marketing consent records for as long as required to prove consent. [EDIT] Files you send for support are deleted after the issue is resolved plus [90] days, unless needed for a continuing issue. Data stored only on your device is controlled by you; uninstalling the Software may not delete your sessions, which you can delete yourself.

8. Cookies and similar technologies

The Website uses:

  • Essential cookies for security, load balancing and basic functions.
  • Analytics cookies or similar to understand how the Website is used [only with your consent, where required]. [NAME TOOLS]
  • [Marketing/advertising cookies]: [NONE / DESCRIBE].

You can manage cookies through our cookie banner [IF USED] and your browser settings. Blocking some cookies may affect how the Website works. We [do / do not] respond to "Do Not Track" signals. [EDIT]

9. Security

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls and limiting access to personnel who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. The Software is beta software; you are responsible for securing your own device, backups and network. If a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and other regulators where required) as the law requires.

10. Your rights and choices

10.1 Canada (PIPEDA and provincial laws)

You may ask us to: tell you whether we hold your personal information and how it is used and shared; give you access to it; correct inaccuracies; withdraw consent; and challenge our compliance. We will respond within the time required by law (generally 30 days) and may need to verify your identity. Access may be refused in limited cases permitted by law, and we will explain why. If you are unsatisfied, you may complain to us and to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or your provincial regulator.

Quebec: If you live in Quebec, you may also have rights under Law 25, including to data portability in a structured, commonly used format, to have us stop disseminating or de-index information in some cases, and to be informed of and object to decisions made exclusively by automated processing. We do not currently make decisions about you solely by automated means that produce legal or similarly significant effects. [CONFIRM] Our Privacy Officer is named in section 2.

10.2 European Economic Area, United Kingdom and Switzerland

If GDPR/UK GDPR applies to you, our legal bases are contract (to provide the Services), legitimate interests (security, improvement, direct communication, defence of claims), consent (where requested, such as optional cookies or marketing) and legal obligation. You may have the rights of access, rectification, erasure, restriction, portability and objection, and to withdraw consent and lodge a complaint with your supervisory authority. [OPTIONAL: appoint an EU/UK representative if required.] International transfers rely on appropriate safeguards such as standard contractual clauses where required.

10.3 California and other US states

We do not sell or "share" personal information for cross-context behavioural advertising [CONFIRM], and we do not knowingly sell the personal information of anyone under 16. You may have the right to know, access, delete and correct your personal information and to not be discriminated against for exercising your rights. To exercise them, contact [PRIVACY EMAIL]. You may use an authorised agent, subject to verification.

10.4 How to exercise your rights

Email [PRIVACY EMAIL] with "Privacy Request" in the subject. We may ask for information to verify your identity. You can unsubscribe from marketing at any time using the link in any message.

11. Children

The Services are not directed to children under 16 (or the age of majority where required to consent), and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact [PRIVACY EMAIL] and we will delete it. If you are under the age of majority, use the Services only with the involvement and consent of a parent or guardian.

12. Beta Period

Until December 2027 the Services are in beta. During that time we may: collect additional diagnostic and usage information to find defects; ask for logs, session files or audio to investigate problems (always optional, and only with your action); contact beta participants about testing and feedback; and change data practices more frequently. Beta data may be reset or deleted. We will describe any material new collection in this Policy or in the Software before it begins, and will ask for consent where required.

13. Other people's information

If you record or share content that includes other people's voices, names or personal information, you are responsible for having any consents and notices required by law. Please do not send us other people's personal information unless necessary.

The Website may link to third-party sites and services, which have their own privacy policies. We are not responsible for their practices.

15. Changes to this Policy

We may update this Policy. We will post the new version with an updated date and, for material changes, notify you (for example, by email or in the Software) and obtain consent where required. Please review it periodically.

16. Contact and complaints

Privacy Officer: [NAME OR TITLE] Email: [PRIVACY EMAIL] Mail: [LEGAL ENTITY NAME], [STREET ADDRESS], Toronto, Ontario [POSTAL CODE], Canada

Office of the Privacy Commissioner of Canada: 30 Victoria Street, Gatineau, Quebec K1A 1H3 · 1-800-282-1376 · www.priv.gc.ca