PRIVACY POLICY / EFFECTIVE January 12, 2027
Your music stays yours.
Soundbox has no accounts, no advertising, no analytics and no tracking cookies. Your projects, recordings and presets stay on your computer. We collect only what we need to check license keys, offer updates, sell licenses and answer email, and we explain all of it here.
1. Who we are
The controller responsible for your personal data is SoundBoxQD, Pennsylvania 15425, United States. Privacy contact: Soundbox.support.qd@gmail.com. We have not appointed a data protection officer; we are not required to.
This policy covers the Soundbox website (soundboxqd.com), the Soundbox application for Windows (demo and full studio, including test builds), the activation service, purchases and the support mailbox.
2. Summary
| What | Where it goes | Kept for |
|---|---|---|
| Your projects, recordings, presets, imported samples, settings | Only your computer | Until you delete them |
| Website visits (IP address, page requested, time, browser) | Netlify, our host | less than 30 days (Netlify’s stated retention for access logs) |
| Update checks (IP address, time) | Netlify | As above |
| License activation and checks (key, hashed hardware identity, app version, network hash) | Our activation service on Netlify; the key alone is checked with our license-key provider | Activity records 180 days; the key’s registration while the key is active, then deleted 60 days after the key expires or is revoked |
| Purchases (name, email, country, order) | Paddle.com Market Limited, the reseller; order and key records with us | Our order and key records while the key is active, then deleted 60 days after the key expires or is revoked; the reseller keeps its own invoices |
| Support email | Our mailbox at Google (Gmail) | Deleted 60 days after the conversation ends |
3. On your computer
These stay on your computer and are never sent to us:
- Projects, recordings and exports: saved where you choose. The demo cannot save or export.
- Preset and sound libraries, crash-recovery copy, interface memory (open panels, scroll positions, filters, favorites and recently used sounds) and settings: kept in Soundbox’s data folder in your Windows user profile,
%APPDATA%\Soundbox. You can switch interface memory off or clear it in Preferences. - Window position, the last folder used for each kind of file, and up to ten recently opened project paths: in the same folder.
- Update log (
update-log.txt): the steps of update downloads, with your Windows user folder and tester code removed. It is only sent if you attach it to a support email. - Security notes (
hardening-events.json): the last 200 things Soundbox’s built-in protections blocked or noted, such as a refused link or a restarted window, kept for diagnostics. - Diagnostics file: Help → Save diagnostics… writes a zip where you choose, with versions, Windows and graphics details, your graphics settings, the license state, the update log, the security notes and recent errors, and no license key, name, email address, device identifier, project or folder path. It is only sent if you attach it to a support email.
- License files: your license key and this computer’s device key, encrypted with Windows’ own data protection for your user account.
- Project file association: the full edition registers
.soundboxfiles for your Windows account so they show the Soundbox icon and open in Soundbox. Turning this off in Settings removes it. - Microphone and audio input: used only when you choose live input or recording in the full studio and Windows lets Soundbox use it. Audio is processed on your computer.
Removing everything: deactivate your license first (License → Deactivate this computer), then remove Soundbox and its data folder. Removing Soundbox explains the steps for the installer and the portable build. Deleting the data folder also deletes your libraries, so export anything you want to keep first.
4. The website
Netlify, Inc. hosts the website, the product video and the downloads. Like any web server, it receives your IP address, the page or file requested, the time, your browser’s user-agent and the referring page, and keeps server logs to deliver and protect the service. Our pages send no referrer onwards. We may count requests in aggregate (for example how many pages or downloads were served in a day); those counts identify no one.
- The website sets no cookies and loads nothing from other websites: no analytics, advertising, social media widgets, embedded players or web fonts. Our content security policy blocks third-party scripts and connections. When you continue to checkout from the Buy page, you go to the reseller’s checkout, which has its own privacy policy.
- Your Customize choices (theme, dark mode, colors, particles, glass, background, motion) are stored in your browser’s local storage, only when you change them. They are not sent to us. Reset website look or clearing site data removes them. See Cookies and local data.
- The interactive sound sketch runs entirely in your browser, without microphone access.
- The unlisted tester page uses the tester code you type only to request the test build’s folder from our website and does not store it. Our host’s logs record the requested address, which contains the code.
5. Update checks
Shortly after Soundbox starts, and whenever you press Check for updates, Soundbox asks our website for the latest release information. You can turn the automatic check off under License → Updates. If you joined the test channel, it also asks for the test channel’s information, using the address that contains your tester code. Downloads happen only when you choose Download update.
These requests carry no license key, device identity or personal information beyond what any connection reveals: your IP address and the time, which our host’s logs record. To verify a downloaded update, Windows checks its digital signature, which can make Windows contact Microsoft’s certificate services.
6. License activation
The demo never contacts the activation service and does not read your hardware identity.
When you use a license key, Soundbox contacts our activation service (hosted on Netlify): when you activate a key; when the full studio starts and its saved authorization needs renewing, and about every 15 minutes while it is open; when you press Recheck, deactivate a computer, or install an update (Soundbox releases the computer before updating and activates it again afterwards).
| Item | What it is |
|---|---|
| Your license key | Sent over an encrypted connection so it can be checked. |
| Hardware identity | A one-way hash of your Windows installation’s machine identifier and your computer’s hardware (SMBIOS) identifier. The identifiers themselves are not sent. |
| Hardware fingerprint | A one-way hash of the hardware identifier alone, so that a reinstalled Windows is recognized as the same computer. Not sent when the computer reports a generic identifier. |
| Device public key | The public half of a key pair Soundbox creates for this computer. The private half never leaves your computer. |
App version, protocol version and the program name Soundbox/<version> | So the service answers in a way your version understands. |
| A one-time random number, the time and a digital signature | To stop requests being copied or replayed. |
Our host also sees your IP address, as for any connection.
What happens on the server. A key bought on this website is checked against our own order and key records. A key issued by hand before launch is checked with LicenseGate (operated by Leo Garbe, Karlsruhe, Germany), our license-key provider (LicenseGate). It receives the license key from our server, not your IP address or any hardware identity. The answer is cached for up to 15 minutes, and a confirmed answer may be relied on for up to 24 hours if the provider cannot be reached.
Activation records (telemetry). To keep one key to one computer at a time and to recognize copied keys, the service keeps the records below, in a database run for us by Neon, LLC (United States).
| Record | Contents | Kept for |
|---|---|---|
| Registration | One-way hash of the license key; hash of the device public key, the hardware identity and the hardware fingerprint of the registered computer (and of the computer that last released it for an update); authorization and transfer times | While the key is active; deleted 60 days after the key expires or is revoked (a refund revokes it) |
| Activity records | For each request with a valid key: keyed hashes of the license key and of your network (the first three parts of an IPv4 address or the first three groups of an IPv6 address; the address itself is not stored), the device key hash, hardware identity hash, fingerprint, app version, program name (at most 64 characters), the kind of request, the result and the time | 180 days |
| Copy-detection flags | Which device keys were asked to confirm again, and why | 180 days |
| License settings | A keyed hash of the license with any computer limit or temporary trust we set for it | Until we remove it, at the latest when the registration is deleted |
| License-check cache | A keyed hash of the license and whether the provider accepted it | Up to 24 hours |
| Replay and rate-limit entries | Random request numbers; keyed, minute-by-minute counters derived from your address or network | 10 minutes; 2 minutes |
Requests with unknown or invalid keys are not recorded beyond the short replay and rate-limit entries. An identical renewal within the same hour is not recorded again.
Hashes are not anonymous: a hashed hardware identity still identifies a computer, so we treat all of these as personal data. The keyed hashes can only be matched against a key or network by someone who holds our server secret. Only the publisher can query the database. Our operator report shows counts per license (computers, requests, refusals and flags) and does not display keys, device keys, hardware hashes, networks or program names.
Automatic decisions. The activation service decides automatically whether a key is valid and whether a computer may hold it, using the rules in section 5.3 of the License Agreement: a device key seen on different hardware, from 5 or more networks within an hour, or on more computers in 30 days than the license allows is asked to confirm its activation again, and a key used on far more computers than allowed is refused on additional computers. A current Soundbox repairs a genuine computer’s activation by itself. If you are refused, contact support: a person will review the decision, and you can explain your circumstances and contest it.
7. Purchases
Licenses are sold by Paddle.com Market Limited, which acts as merchant of record. When you buy, the reseller collects your name, email address, billing country, payment details, IP address and tax information, and processes them as an independent controller under its privacy policy. We never receive your full card or bank details.
The reseller gives us your name, email address, country, order number, product, price, tax and the order’s status (for example refunded). We use them to issue and deliver your license key, help you with your order and keep accounting records. We keep a private record linking your order to your license key so we can help you with transfers, resets and refunds, and so we can disable a refunded key. We do not use your email address for marketing unless you sign up for it separately. The email with your key is sent for us by Resend (Plus Five Five, Inc., United States), which receives your email address and the message for that purpose only.
The Buy page holds a random token for your checkout in your browser tab until it has shown your key; we keep only a hash of it with the order. When you use the key recovery page, the address you enter is compared with our records as a keyed hash and, if it bought Soundbox, its keys are emailed to it (the queued email keeps the address only in encrypted form). An address that did not buy is not kept.
8. Support email
When you email us, we receive your email address, name, message and attachments, such as screenshots, recordings or update logs. We use them to answer you, investigate problems and handle license requests. Our mailbox is hosted by Google (Gmail).
Please don’t send passwords, payment details or a complete license key in your first email. The last four characters of your key and your order number are enough to start.
9. Email list
We do not run an email list. If we start one, it will be opt-in only, run on a provider we name here before it opens, with one-click unsubscribe and no tracking pixels; we will update this policy first.
10. Why we use your data (legal bases)
If you are in the European Economic Area or the United Kingdom, these are our legal bases under the GDPR and UK GDPR:
| Purpose | Legal basis |
|---|---|
| Activating and checking your license, transfers and resets | Performing our contract with you (Article 6(1)(b)) |
| Detecting copied or shared keys, rate limits, replay protection, keeping activity records for 180 days | Our legitimate interest in preventing license abuse and protecting the service (Article 6(1)(f)) |
| Website hosting and server logs, update checks | Our legitimate interest in providing a secure website and keeping Soundbox up to date (Article 6(1)(f)) |
| Purchases, key delivery, order records | Performing our contract (Article 6(1)(b)); tax and accounting records: legal obligation (Article 6(1)(c)) |
| Support email | Performing our contract, or our legitimate interest in answering you (Article 6(1)(b) or (f)) |
| Email list (only if you join it) | Your consent (Article 6(1)(a)) |
| Responding to legal claims | Our legitimate interest in establishing or defending claims (Article 6(1)(f)) |
Activation data is needed to use the full studio: without it, Soundbox stays in demo mode. You can ask us for our assessment of the legitimate interests listed above.
11. Who processes your data for us
| Provider | Role |
|---|---|
| Netlify, Inc. (United States) | Website hosting, downloads, activation service (privacy policy) |
| Neon, LLC (United States) | The activation service’s database, operated for Netlify (United States, AWS US East) |
| LicenseGate (operated by Leo Garbe, Karlsruhe, Germany) | License-key verification |
| Google (Gmail) | Support email |
| Resend (Plus Five Five, Inc., United States) | Sends the license-key and key-recovery emails (your email address and the message; no tracking of opens or links) |
| Paddle.com Market Limited | Reseller and merchant of record (independent controller) |
We do not sell your personal information, share it for advertising, or use it to build profiles for marketing. We disclose it to others only where the law requires it, to protect our rights or users’ safety, or if Soundbox is transferred to a new owner who continues this policy.
12. International transfers
We are based in United States, and our providers store data in the United States and other countries. When personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on standard contractual clauses offered by the providers. Ask us for a copy of the relevant safeguards.
13. How long we keep data
The periods are in sections 2 and 6. In short: activity records and copy-detection flags 180 days. A key’s computer registrations are kept while the key is active and deleted 60 days after the key expires or is revoked; our order and key records and any unsent mail for it are deleted 60 days after the key expires or is revoked, keeping only an anonymous note that an order existed, when, and why it ended. A 3-month key expires at its end date; a refund, a chargeback or a deletion request revokes a key. The reseller keeps its own invoices and tax records under its privacy policy. Support email is deleted 60 days after the conversation ends, unless needed for a legal claim. Our host’s logs: less than 30 days (Netlify’s stated retention for access logs).
Deleting your data while your key is active. A lifetime key never expires, so you can ask us to delete its records at any time: in Soundbox, open License and updates and choose Request deletion of my data…, or email Soundbox.support.qd@gmail.com with your license key. Within one month we close the key: the full studio returns to the free demo on every computer and the key cannot be activated again. Its activation records, the order record and the encrypted copy of your email address are then deleted 60 days after the key expires or is revoked, as for any revoked key. We keep only an anonymous note that a key was deleted (no key, email address or order number), so a late payment message cannot bring it back. Paddle, our reseller and merchant of record, keeps its own invoice and payment records under its own privacy policy and tax law. Keys that end on their own (3-month keys, refunded or revoked keys) are deleted the same way, and copies in our encrypted backups age out within 12 months. Ask only when you no longer want to use the key.
14. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct it if it is wrong;
- delete it;
- restrict how we use it;
- object to our use of it based on legitimate interests, including the copy-detection records. We will stop unless we have compelling grounds or need it for legal claims;
- portability: receive data you gave us in a machine-readable format;
- not be subject to a decision based solely on automated processing that significantly affects you, and to have a person review it (section 6);
- withdraw consent where we rely on it (the email list);
- complain to a data protection authority, for example the authority where you live or work. In the UK this is the Information Commissioner’s Office (ico.org.uk).
To use these rights, email Soundbox.support.qd@gmail.com. We answer within one month (we may extend that by two months for complex requests and will tell you). We may ask for information to confirm the request is yours, for example the last four characters of your key and your order number, because we cannot otherwise link hashed activation data to you. Deleting your activation data deactivates your license on all computers; it does not delete anything on your computer.
US state privacy rights. Residents of California and other US states with consumer privacy laws may have the rights to know, access, correct and delete personal information, and to opt out of its sale, sharing for cross-context behavioral advertising, or profiling. We do not sell or share personal information and do not use it for profiling with legal or similarly significant effects other than the license checks described in section 6. We do not use or disclose sensitive personal information. You can use your rights by emailing Soundbox.support.qd@gmail.com; you may use an authorized agent, and we will not discriminate against you for using them. In the last 12 months we collected identifiers (license key, hashed device identifiers, IP address, email address), commercial information (orders), internet activity (server logs) and inferences limited to whether a license is being shared, from you and your device, for the purposes in section 10.
15. Children
Soundbox is a general-audience creative tool. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). Licenses must be bought by an adult, who may let a child use Soundbox under supervision. If you think a child has sent us personal information, contact us and we will delete it.
16. Security
Activation uses encrypted connections, signed requests and signed responses. Keys and device credentials on your computer are encrypted with Windows data protection. On the server, we store hashes rather than keys or addresses, and access to the database is restricted to the publisher. No system is perfectly secure. If we learn of a breach affecting your personal data, we will notify you and the authorities where the law requires. To report a vulnerability, see our Security page.
17. Changes
We will update this policy before we change what Soundbox collects, and the date at the top shows the current version. If a change materially affects how we use data we already hold, we will tell you in the app or by email before it applies.
18. Contact
SoundBoxQD, Pennsylvania 15425, United States
Privacy questions and requests: Soundbox.support.qd@gmail.com