Privacy | Odd Duck Audio

Last updated 16 October 2026.

The short version

The site sets no cookies of its own. It counts visits with Cloudflare Web Analytics, which uses no cookies and keeps no profile of you.
Google Ads’ and Meta’s (Facebook’s) cookies are the one exception, and only if you press Accept on the bar at the bottom of the page: they tell me whether an ad of mine led to a visit or a sale, and Google and Meta also use what they collect for their own purposes. Say no, or don’t answer, and nothing from Google or Meta loads. More below.
If you arrive by a link with a campaign tag on it (from one of my ads or posts), press Accept on the cookie bar, and then buy, the tag is recorded with your order, so I know which ad or post it came from. More below.
The plugins only go online when you start a trial or activate or release a licence. After that, they never contact anything again.
I keep your email address, and a code for each computer you activate, so your licence works. I never sell them or use them for ads.
Payments are handled by Stripe (as Link). I never see your card details.
The mailing list is one email when a plugin is released or there’s a sale, and one click to leave.
Downloading a free plugin never needs your email. If you leave it for a discount code, you get that one email, and nothing more unless you tick the box for the list. More below.

Who is responsible for your data

Odd Duck Audio is the trading name of Paul Bell, a sole trader based in Scotland, United Kingdom. You can reach me at support@oddduckaudio.com.

Postal address: Office 719, 18 Young St, Unit LGE, Edinburgh EH2 4JB, United Kingdom

I'm the "controller" of the personal data described here, under UK data protection law (the UK GDPR and the Data Protection Act 2018).

What I collect, and why

The mailing list. If you leave your email to hear when a plugin is out, you get one email when a plugin is released, and one when there’s a sale, and nothing else: no newsletters, and your address goes to nobody. The one exception is a sign-up box that offers a discount: sign up there and you also get one email with the code, once. Sale emails go only to people who signed up from 1 October 2026, when the form started saying so; if you signed up before then, you get release emails only. The legal basis is your consent (UK GDPR and EU GDPR Article 6(1)(a), and the Privacy and Electronic Communications Regulations for the emails themselves).

The tick box. The form uses Cloudflare Turnstile to check that a person, not a script, is signing up. While you're on a page with a form, Cloudflare's Turnstile script looks at your IP address, your browser (its user agent) and a fingerprint of your connection, only to tell people from bots, never for advertising or tracking. I get back a pass or a fail, nothing else. Cloudflare does this as my processor, and also uses these signals under its own Turnstile privacy policy to improve its bot detection.
What I keep. Your address, the page you signed up on, when you signed up, that it passed the tick box, which version of the sign-up wording you saw (so I can show what you agreed to), and a note of which release and sale emails, and any discount codes, you've been sent (so nobody gets one twice). I don't record your IP address or browser.
Where. Only in the licence server's own store at Cloudflare, not in a mailing-list service. Resend delivers each email, so it handles your address while it does.
How long. Until you leave.
Leaving. Every email has a link at the bottom, and one click takes you off at once. Your email program's own "unsubscribe" button does the same. Or email me.
Beta testers are added to the release list with their beta key, and can leave it at any time with the link in any release email. Leaving the list doesn't affect the beta key.
Buyers are added only if they ask: the thanks page after a purchase offers a "Yes, add me" button, which adds the address you paid with. The record notes that you pressed it, which plugin you'd bought, and which version of its wording you saw. Leave in one click, like everyone else; leaving doesn't affect your licence.
The discount code when you download a free plugin. Pressing a download on a free plugin’s page (Torn, 9Volt) opens a small box. “Just download” downloads it with nothing asked. Or leave your email and ask for the discount code: the plugin downloads all the same, and I email you the code once, with a link to one of my plugins you might like. That’s all, unless you also tick the box to hear about new plugins and sales, which puts you on the list above. If you only asked for the code, you’re not on the list: I keep your address, the plugin’s page, when, that it passed the tick box, which version of the wording you saw, and when the code went, only so that it goes once. The email has a link that deletes all of that at once, or email me. The legal basis is your consent, as for the list.
When you leave, I delete your address and everything stored with it: the dates, the wording record and the note of what you were sent. All I keep is a one-way scrambled form of the address (it can't be turned back into the address), only so that beta testers who leave aren't added back automatically. If you sign up again yourself later, that is a new sign-up and is recorded as one.

Free trials. When you start a trial inside a plugin, I receive your email address, which plugin it is, and a machine code. The machine code is a 32-character code the plugin works out from your computer. It doesn't contain your name, your files or anything you've made. I store these with the start and end dates of the trial, so that the same computer can't restart the trial by reinstalling. The legal basis is providing the trial you asked for, plus my legitimate interest in stopping repeat trials. Trial records are deleted automatically after one year. I email you once when the trial starts, to say until when it runs and what happens after; that is part of the trial, not marketing. That email has one button: “Yes, email me before it ends, and about new plugins and sales”. Press it (or tick the same box in the plugin, where it has one) and you get one email two days before the trial ends and one when it has ended, and you join the mailing list (below) for releases and sales. I keep that you said yes, when, and the wording, with the trial record. Nobody is signed up by starting a trial, and the link in every one of those emails takes you off at once.

Purchases. Plugins are sold through Link, part of Stripe, which acts as the reseller: it takes the payment, handles tax, fraud and refunds, and sends your receipt. I never see or store your card details. From Stripe I receive your email address, your country, what you bought and a payment reference. I use them to create your licence key and email it to you. The legal basis is performing our contract. How Stripe and Link use your data is covered by Stripe's privacy policy.

Your licence. For each key I store the email address, the plugins it covers, the payment reference, and the machine codes of up to three computers you've activated. This is how activation, moving a licence to a new computer, and re-sending lost keys work. It is kept for as long as the licence exists, and sales records are kept for as long as UK tax law requires (currently about six years).

Support. If you email me, I keep the conversation for as long as it's useful for helping you, and then delete it.

The contact form. A message you send from the contact page is emailed to support@oddduckaudio.com through Resend, with your name and address so I can reply, and is not stored on the website. It then sits in the support inbox like any email to me, as above. To stop one person flooding the form, the licence server keeps a count of recent attempts against a one-way scrambled form of your IP address (the address itself is not kept); it is deleted automatically within an hour. The form uses the same Cloudflare Turnstile tick box as the sign-up. The legal basis is my legitimate interest in answering you.

What the plugins do

A plugin contacts my server (api.oddduckaudio.com) only when you start a trial, activate a key or release a computer. It sends the machine code, and your email or key. It gets back a signed licence file, which is stored on your computer and contains the same email and machine code. After that the plugin checks the file locally and never goes online again. There is no telemetry, no crash reporting and no usage tracking, and nothing about your audio or sessions ever leaves your computer.

The website

This site sets no cookies of its own and shows no adverts; the only cookies are Google’s and Meta’s, and only if you allow them (next section). It keeps a few small notes in your browser’s own storage: what’s in your cart, whether you’ve closed or used the discount sign-up box, so it doesn’t keep coming back, your answer on the cookie bar, so it doesn’t ask again, if you pressed Accept, a note that a purchase has already been reported to Google and Meta, so it isn’t counted twice, and, if you pressed Accept, until you close the tab, the campaign tag of the link you arrived by. These stay until you clear your browser’s site data, except the campaign tag, which goes when the tab closes. Only the cart and the campaign tag ever leave your device, and only when you go to the checkout (below). Two third-party scripts run on it, both Cloudflare’s: Turnstile, on pages with a sign-up form or the contact form, wherever the discount box appears, and in the download box on the free plugins’ pages (see the mailing list, above), and Cloudflare Web Analytics, on every page. Web Analytics counts visits so I can see which pages are read: the page, where you came from (the referrer), your country, and your device type, browser and operating system. It uses no cookies or local storage, does not fingerprint you by your IP address or browser, and does not follow you across other sites; I see totals, never individual visitors. Cloudflare does this as my processor. The fonts are served from here, not from Google. Like any website host, Cloudflare processes your IP address to deliver the pages and protect them from abuse, and may keep it in short-lived logs.

When you download a plugin, I count it: one number per file per day, so I know which plugins people are downloading. The count holds nothing about you: no IP address, no browser details, nothing that could tell one person from another.

On a plugin page you can play in your browser, I count what gets pressed, so I know whether the page is worth having: Play, another loop, Try, Bypass, Add to cart, and whether it played for 30 seconds. Each is counted at most once a visit, as one number per page per day. The count holds nothing about you: no cookie, no IP address, no browser details, nothing that could tell one person from another.

Google Ads, Meta, and their cookies

I advertise on Google, and on Facebook and Instagram (Meta). To know whether an ad is worth paying for, I ask Google Ads and the Meta Pixel to count the sales they lead to. That needs their tags and their cookies, so it happens only if you press Accept on the bar at the bottom of the page. Until you do, nothing from Google or Meta loads and none of their cookies is set; press Reject and it stays that way.

Google Ads.

What it records. That you arrived from one of my Google ads, and, if you then buy something, that a purchase happened, what it was worth (the amount, without tax) and a reference for the checkout, so it is counted once. Google does not get your name, your email address or your card details from me.
The cookies. Google’s tag sets its advertising cookies on this site (their names start _gcl), and Google’s own cookies on its domains may be read, to link an ad click to the sale. They are kept for up to 90 days from your last visit here. I don’t use them for personalised ads or remarketing, and I don’t use Google Analytics.
The legal basis is your consent (the Privacy and Electronic Communications Regulations for the cookies, and UK GDPR Article 6(1)(a)). Google processes this data under its own terms and privacy policy; how Google uses information from sites that use its services explains more.
Changing your mind. “Cookie settings” at the bottom of every page brings the bar back. Press Reject there and Google is told to stop, and its cookies on this site are deleted. Your browser’s settings can also clear or block them.

The Meta Pixel (Facebook and Instagram ads).

What it records. Only two kinds of event are sent: a page view for each page of this site you visit, and, if you buy something, that a purchase happened, what it was worth (the amount, without tax) and a reference for the checkout, so it is counted once. The pixel’s automatic extras, which record the buttons you press and details read off the page, are switched off. Meta can match these to a click on one of my ads, and to your Facebook or Instagram account if you’re logged in to one in the same browser. Meta does not get your name, your email address or your card details from me.
The cookies. The pixel sets _fbp on this site, and _fbc if you arrived from a Facebook or Instagram ad; Meta’s own cookies on its domains may be read too. They are kept for up to 90 days from your last visit here. I use what the pixel reports only to count what my ads lead to; Meta also uses it for its own purposes, including delivering and improving ads, as its privacy policy describes.
The legal basis is your consent, as for Google.
Who is responsible. For collecting this data on this site and sending it to Meta, Meta Platforms Ireland Limited and I are joint controllers; once Meta has it, Meta is responsible for what it does with it, under its own terms and privacy policy. Meta has agreed to handle requests about the data it holds, so for those you can go to Meta directly, or ask me and I’ll pass it on. In your Facebook or Instagram settings, “Your activity off Meta technologies” shows and clears what sites have sent it.
Changing your mind. The same “Cookie settings” link: press Reject and the pixel is told to stop, and its cookies on this site are deleted.

Campaign tags. The links in my ads and posts carry a campaign tag in the address (the part starting utm_, for example utm_source=facebook&utm_campaign=compressor-bundle-launch). If you arrive by one, the site keeps the tag in your browser until you close the tab, but only once you press Accept on the cookie bar: until you answer, it is only held by the open page, and if you press Reject, or never answer, it is dropped. If you buy, it is sent with the order and stored with it at Stripe only if you’d pressed Accept, so I can see which ad or post led to the sale. It is the campaign’s name, not anything about you, and it is kept in your browser’s session storage, not in a cookie. If the link carried a Facebook click id, only the fact that it had one is kept, never the id. The copy I keep is never sent to Google or Meta; but if you’ve pressed Accept, their tags see each page’s full address, tags and click ids included, as part of the visit they record (above). The legal basis for keeping the tag with your order is my legitimate interest in knowing which of my ads pay for themselves; it is kept with the sales record, for as long as that is kept (see your rights to object, and I’ll remove it).

The videos. The video at the bottom of a plugin’s page plays from YouTube (youtube-nocookie.com), and loads only when you press play; until then the picture is served from this site and nothing reaches YouTube or Google. Once you press play, YouTube’s own privacy policy applies.

Who else handles it

I use a few services to run this. Cloudflare, Resend and Gmail only process your data on my instructions; Google Ads, Meta, and Stripe are separate companies with their own responsibilities, as each entry says:

Cloudflare: hosts the website and the licence server, stores the mailing list, trial and licence records, runs the sign-up tick box (Turnstile), and counts visits (Web Analytics).
Resend (Plus Five Five, Inc., USA): sends the licence and release emails. Its data processing agreement is part of its terms; this site's mail goes out through its EU region.
Google (Gmail): support email is delivered to a Gmail inbox.
Google (Google Ads): only if you allow its cookies, counts the sales my ads lead to (see above). Google is an independent company here, under its own privacy policy, and is certified under the EU–US Data Privacy Framework and its UK Extension.
Meta (the Meta Pixel): only if you allow its cookies, counts the visits and sales my Facebook and Instagram ads lead to (see above). Meta Platforms Ireland Limited is a joint controller with me for collecting that data here, and its own controller after that, under its own privacy policy; its US parent, Meta Platforms, Inc., is certified under the EU–US Data Privacy Framework and its UK Extension.

Stripe and Link handle payments as a separate, independent company, under their own privacy policy.

Some of these companies are based in the United States. Where your data leaves the UK or the EU, it is protected by the approved safeguards for international transfers: for Resend, its agreement uses the EU standard contractual clauses with the UK Addendum, and it is certified under the EU–US Data Privacy Framework and its UK Extension (the UK–US "data bridge"). If you’ve allowed Google’s and Meta’s cookies, what their tags collect can go to Google LLC and Meta Platforms, Inc. in the United States, both certified under the same Framework and UK Extension.

I don't sell your data, share it with advertisers, or use it for anything not listed here. Google Ads and Meta get only what their sections above say, and only if you allow them.

Your rights

You can ask me to show you what I hold about you, correct it, delete it, or give you a copy. You can also object to how I use it (for example, the campaign tag kept with an order), or withdraw consent for the mailing list, which the link in every list email does at once, or for Google’s and Meta’s cookies, which “Cookie settings” does. Email support@oddduckaudio.com and I'll reply within a month. If you ask me to delete your licence record, I will no longer be able to re-send your key or activate it on a new computer, so I'll check that's what you want first.

If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. I'd appreciate the chance to put it right first.

Changes

If this policy changes, the new version will be posted here with a new date. If a change affects how I use data I already hold, I'll email the people it affects.