Privacy

Last updated 27 September 2026.

The short version

• The site has no cookies and no tracking. It counts visits with Cloudflare Web Analytics, which uses no cookies and keeps no profile of you.
• The plugins only go online when you start a trial or activate or release a licence. After that, they never contact anything again.
• I keep your email address, and a code for each computer you activate, so your licence works. I never sell them or use them for ads.
• Payments are handled by Stripe (as Link). I never see your card details.
• The mailing list is one email when a plugin is released, and one click to leave.

Who is responsible for your data

Odd Duck Audio is the trading name of Paul Bell, a sole trader based in Scotland, United Kingdom. You can reach me at support@oddduckaudio.com.

I'm the "controller" of the personal data described here, under UK data protection law (the UK GDPR and the Data Protection Act 2018).

What I collect, and why

The mailing list. If you leave your email to hear when a plugin is out, you get one email when a plugin is released, and nothing else: no newsletters, no offers, and your address goes to nobody. The legal basis is your consent (UK GDPR and EU GDPR Article 6(1)(a), and the Privacy and Electronic Communications Regulations for the emails themselves).

• The tick box. The form uses Cloudflare Turnstile to check that a person, not a script, is signing up. While you're on a page with a form, Cloudflare's Turnstile script looks at your IP address, your browser (its user agent) and a fingerprint of your connection, only to tell people from bots, never for advertising or tracking. I get back a pass or a fail, nothing else. Cloudflare does this as my processor, and also uses these signals under its own Turnstile privacy policy to improve its bot detection.
• What I keep. Your address, the page you signed up on, when you signed up, that it passed the tick box, which version of the sign-up wording you saw (so I can show what you agreed to), and a note of which release emails you've been sent (so nobody gets one twice). I don't record your IP address or browser.
• Where. Only in the licence server's own store at Cloudflare, not in a mailing-list service. Resend delivers each email, so it handles your address while it does.
• How long. Until you leave.
• Leaving. Every email has a link at the bottom, and one click takes you off at once. Your email program's own "unsubscribe" button does the same. Or email me.
• Beta testers are added to the release list with their beta key, and can leave it at any time with the link in any release email. Leaving the list doesn't affect the beta key.
• When you leave, I delete your address and everything stored with it: the dates, the wording record and the note of what you were sent. All I keep is a one-way scrambled form of the address (it can't be turned back into the address), only so that beta testers who leave aren't added back automatically. If you sign up again yourself later, that is a new sign-up and is recorded as one.
• If you signed up before 27 September 2026: if the form you used said you'd get an email when things are released, you're on the list as before. If it only mentioned one plugin, you'll get one email asking whether you want release emails. To say yes, sign up again on the site; if you don't, your address is deleted after 7 days.

Free trials. When you start a trial inside a plugin, I receive your email address, which plugin it is, and a machine code. The machine code is a 32-character code the plugin works out from your computer. It doesn't contain your name, your files or anything you've made. I store these with the start and end dates of the trial, so that the same computer can't restart the trial by reinstalling. The legal basis is providing the trial you asked for, plus my legitimate interest in stopping repeat trials. Trial records are deleted automatically after one year.

Purchases. Plugins are sold through Link, part of Stripe, which acts as the reseller: it takes the payment, handles tax, fraud and refunds, and sends your receipt. I never see or store your card details. From Stripe I receive your email address, your country, what you bought and a payment reference. I use them to create your licence key and email it to you. The legal basis is performing our contract. How Stripe and Link use your data is covered by Stripe's privacy policy.

Your licence. For each key I store the email address, the plugins it covers, the payment reference, and the machine codes of up to three computers you've activated. This is how activation, moving a licence to a new computer, and re-sending lost keys work. It is kept for as long as the licence exists, and sales records are kept for as long as UK tax law requires (currently about six years).

Support. If you email me, I keep the conversation for as long as it's useful for helping you, and then delete it.

What the plugins do

A plugin contacts my server (api.oddduckaudio.com) only when you start a trial, activate a key or release a computer. It sends the machine code, and your email or key. It gets back a signed licence file, which is stored on your computer and contains the same email and machine code. After that the plugin checks the file locally and never goes online again. There is no telemetry, no crash reporting and no usage tracking, and nothing about your audio or sessions ever leaves your computer.

The website

This site sets no cookies and runs no adverts. Two third-party scripts run on it, both Cloudflare’s: Turnstile, on pages with a sign-up form (see the mailing list, above), and Cloudflare Web Analytics, on every page. Web Analytics counts visits so I can see which pages are read: the page, where you came from (the referrer), your country, and your device type, browser and operating system. It uses no cookies or local storage, does not fingerprint you by your IP address or browser, and does not follow you across other sites; I see totals, never individual visitors. Cloudflare does this as my processor. The fonts are served from here, not from Google. Like any website host, Cloudflare processes your IP address to deliver the pages and protect them from abuse, and may keep it in short-lived logs.

When you download a plugin, I count it: one number per file per day, so I know which plugins people are downloading. The count holds nothing about you: no IP address, no browser details, nothing that could tell one person from another.

Who else handles it

I use a few services to run this. They only process your data on my instructions:

• Cloudflare: hosts the website and the licence server, stores the mailing list, trial and licence records, runs the sign-up tick box (Turnstile), and counts visits (Web Analytics).
• Resend (Plus Five Five, Inc., USA): sends the licence and release emails. Its data processing agreement is part of its terms; this site's mail goes out through its EU region.
• Google (Gmail): support email is delivered to a Gmail inbox.

Stripe and Link handle payments as a separate, independent company, under their own privacy policy.

Some of these companies are based in the United States. Where your data leaves the UK or the EU, it is protected by the approved safeguards for international transfers: for Resend, its agreement uses the EU standard contractual clauses with the UK Addendum, and it is certified under the EU–US Data Privacy Framework and its UK Extension (the UK–US "data bridge").

I don't sell your data, share it with advertisers, or use it for anything not listed here.

Your rights

You can ask me to show you what I hold about you, correct it, delete it, or give you a copy. You can also object to how I use it, or withdraw consent for the mailing list, which the link in every list email does at once. Email support@oddduckaudio.com and I'll reply within a month. If you ask me to delete your licence record, I will no longer be able to re-send your key or activate it on a new computer, so I'll check that's what you want first.

If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. I'd appreciate the chance to put it right first.

Changes

If this policy changes, the new version will be posted here with a new date. If a change affects how I use data I already hold, I'll email the people it affects.