Short version: we collect almost nothing.

This page says what data monoglyphaudio.com, our plugins and our licence server handle, why, who else touches it, how long we keep it, and what you can ask us to do with it. There are no trackers and no advertising anywhere in it.

Who we are

Monoglyph Audio is a trading name of Monoglyph Ltd, a company registered in England and Wales (company number 17364027), registered office 128 City Road, London EC1V 2NX. We are the data controller for the personal data described here. Questions, or to exercise any of your rights: hello@monoglyphaudio.com.

This website

No trackers, no analytics scripts, no advertising pixels, and no cookies outside the checkout and your account. The site keeps your basket, and the prices it looked up for you, in your own browser's storage; that never leaves your device. Signing in to your account sets one cookie that keeps you signed in, and nothing else. Fonts are served from our own domain. The site runs on Cloudflare, which processes technical request data such as your IP address to serve and protect the page; we don't read it, combine it with anything, or keep our own copy. To show prices in your currency, the site asks Paddle for the price in the country Cloudflare says you're in; only the two-letter country code is sent, never your address. None of this is non-essential, so there's no cookie banner to click.

The download host (download.monoglyphaudio.com) keeps a tally of downloads: the day, the file, the referring site and the country, added up per day. No address, no identifier, nothing about you; it tells us how many people installed a plugin, not who. The host also limits how many downloads one address can start in a minute, using the address only as a counter that expires; it is never stored.

The one exception is the checkout page. It loads Paddle's payment script and secure payment frame, because Paddle takes the payment. Paddle may set cookies inside its frame for fraud prevention and to remember the checkout; that page, and what Paddle sees on it, is covered by Paddle's privacy policy. Nothing loads from Paddle on any other page.

The signup forms store the email address you type, which form you used, which version of its promise you saw, and the time, in a database we control on Cloudflare. There are two kinds, and each is used for exactly what it says above the button. The list on the home page: an email when a plugin ships and when one goes on sale. A launch form on a plugin's page: one email the day that plugin ships, and nothing else; once that email has gone out, the signup is deleted. Every email has an unsubscribe link, and asking us also removes you.

The in-browser demo on the Strand page runs entirely in your browser. No audio or pattern leaves your machine.

The plugins

Our plugins run inside your DAW and process your audio there. They do not send audio, patterns, presets, usage data or crash reports anywhere. The only network calls a plugin makes are to our licence server, described below: when you activate or deactivate, at most once a day to confirm a licensed machine is still licensed, and, until a key is entered, at most once a day to record when the trial started.

The trial call sends the plugin's product code and a hash of your computer's hardware identifier. The hash cannot be turned back into the identifier, and we store it with nothing else, so it identifies no person; it only lets the trial keep its start date if the plugin is reinstalled. Trial records are deleted twelve months after the machine was last seen. Offline, the plugin keeps working and the trial counts from the first run on that machine.

When you buy

Purchases are sold and processed by Paddle as our merchant of record: Paddle.com Market Ltd, Paddle.com Inc. for buyers in the US, and Paddle.com (Canada) Ltd for buyers in Canada. Paddle is the seller you contract with and the controller for the data it collects at checkout: your name, email address, country, postcode where tax needs it, payment details and what you bought. We never see or store your payment details. Paddle's own privacy policy, linked above, covers that.

After a sale, Paddle passes us your email address, the order and its Paddle identifiers, so we can issue your licence key, record the sale, and answer questions about it. That record is the legal basis of "performing a contract with you"; keeping it afterwards is a legal obligation (tax records).

Your licence and account

Our licence server stores your email address, your licence key, the order it came from, and for each activated machine a short label the plugin generates (the operating system, the computer's name and a four-character hash) with the time of activation and the time it was last confirmed. That is what lets you see and free up your activations at account.monoglyphaudio.com. Signing in there works by a link sent to your email; we hold no passwords. The server stores no audio and no patterns. Beyond each machine's last-confirmed time, it keeps only daily counts of how many machines checked in, with nothing about who.

Emails from us about your licence (your key, a sign-in link, a refund notice) are sent through Resend. Resend records that a message was sent and whether it was delivered or bounced, so we can tell when a key didn't reach you.

Why we're allowed to

UK and EU data protection law asks us to say which legal basis covers each use. Issuing and checking your licence, running your account and answering your questions: performing our contract with you. Keeping sales and licence records for six years: a legal obligation. The trial anchor, rate limits and fraud checks on the licence server, and keeping the site up: our legitimate interest in running a small software company that doesn't get cheated, which we've judged doesn't override your interests because nothing in it identifies you. The mailing list: your consent, which you withdraw with the unsubscribe link.

Support

The contact form sends your name, email address and message to our support inbox through Resend, with your address as the reply-to, and stores nothing else; it is rate-limited per address, and the address is used only as an expiring counter. When you email us, or use the form, we keep the conversation for as long as it takes to resolve, and then for as long as the licence it concerns is live, so the next question doesn't start from zero. Ask and it's deleted.

Who else processes your data

Paddle is not on this list: as merchant of record it is a controller in its own right for the checkout, under its own privacy policy. These companies process data for us:

Each of them processes data only on our instructions, under its data processing terms. Beyond those, our accountants and legal advisers may see records when their work needs it, and we'll hand data to an authority only if the law makes us or to protect someone's safety or rights. We don't sell data and we don't share it with advertisers.

Data leaving the UK and EU

We keep data in the UK and EU wherever we can, and the table above says where each processor holds it. Cloudflare, Google and Resend are US companies, so some data (request metadata at Cloudflare, support email at Google, email delivery records at Resend) is processed under their US parent. Those transfers rest on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses in each provider's data processing agreement, and on the UK and EU adequacy decisions for the US Data Privacy Framework where the provider is certified. Paddle is a UK company; its own policy covers its processors.

How we keep it safe

Everything travels over TLS. The licence server accepts only what it needs, rate-limits by address, and sits behind Cloudflare. Databases are encrypted at rest, backups are encrypted before they leave the server, and the only people with access are the ones who run the company. Sign-in to your account is by a one-time emailed link that expires, so there is no password to lose. No system is perfect; if we ever learn of a breach affecting you, we'll tell you and the regulator as the law requires.

How long we keep it

• The home-page list: until you unsubscribe or ask.
• A launch signup: until that plugin's launch email has gone out, then deleted; sooner if you unsubscribe or ask.
• Licence records (email, key, activations): for as long as the licence is valid, and then six years from the sale, which is how long UK law requires us to keep sales records.
• Order records from Paddle: six years from the sale, same reason.
• Support email: see above.
• Backups of the licence server are taken every three hours, encrypted before they leave the server, kept in Cloudflare storage in the EU and deleted after 35 days, and may also be copied, still encrypted, to a server we own in the UK, where each copy is deleted after 31 days. Neither copy can be read without a key that never leaves our own machines.

Your rights

Under UK GDPR (and the EU GDPR if you're in the EU) you can ask what we hold about you, have it corrected or deleted, get a copy of it in a portable form, restrict or object to processing, and withdraw consent where consent is the basis. Email us and we'll answer within a month, usually within days; the law lets us extend that for a complex request, and we'll say so if we need to. Deleting your licence record means the key stops working, so we'll check that's what you want first. If you're unhappy with how we've handled something you can complain to the Information Commissioner's Office (ico.org.uk) or, in the EU, to your local data protection authority.

Changes

If this policy changes in a way that matters, the date at the top moves and the change is described in plain words here.

28 September 2026: the two kinds of signup form and how long each signup is kept; the browser storage and the account's sign-in cookie; Google, which holds our support inbox, and Cloudflare's email routing; Paddle listed as the controller it is rather than as our processor; the trial check continuing until a key is entered; the daily counts the licence server keeps; where backups are kept.

9 September 2026: the contact form, and what it sends.