Privacy & Cookie Policy - Tin Whistle Tab

1. Who we are

Tin Whistle Tab ("we", "us") runs www.tinwhistletab.com, a site for tin whistle tabs, backing tracks, practice tools and a small player community. It is operated by an individual, not a company. For anything in this policy, write to orkithewhistler@gmail.com or use the contact form. We are the data controller for the processing described here.

2. What we collect, and why

You can read every tab, use the finger chart, the composer and the practice tools without telling us who you are. We collect data only where a feature needs it:

Feature	Data	Why, and legal basis	Kept for
Account	Email, name, optional username and picture, a hashed password (or your Google account id if you sign in with Google), sign-up and last-login dates, where you came from on your first visit (for example "google" or "newsletter")	To run your account, saved tabs, uploads and personal bests. Contract (Art. 6(1)(b) GDPR).	Until you delete the account
Newsletter	Email, which form you used, confirmation and unsubscribe dates, delivery and bounce status	To send the weekly email you asked for. Consent, confirmed by the double opt-in link (Art. 6(1)(a)). Every email has an unsubscribe link.	Until you unsubscribe; the address is then kept on a suppression list so we do not email you again
Community posts and comments	The text you post, your display name, the time, and a salted hash of your IP address (rate limiting only, never reversible to an address). Anonymous posters also give an email that is used once to confirm the post.	To publish and moderate the discussion under each tune. Contract and legitimate interest in keeping the forum usable (Art. 6(1)(b) and (f)).	While the post is live; unconfirmed anonymous posts are purged
Votes and "helpful" marks	Your user id, or for anonymous visitors a random id in a first-party cookie	One vote per person. Legitimate interest (Art. 6(1)(f)).	While the voted item exists
Contact form, song requests, tab submissions, reports	What you type, plus your email if you give one	To answer you or to tell you when a requested tune is added. Legitimate interest and, for the notification email, consent (Art. 6(1)(a) and (f)).	Up to 24 months, then deleted
Academy reservation	Name, email, chosen package, optionally your country	To email you when the course opens. Consent (Art. 6(1)(a)). We do not take card details or payments on this site.	Until the course launches or you ask us to remove it
Practice and play modes	Microphone audio is analysed in your browser to detect notes and is never uploaded. Signed-in players' best scores are stored.	To make the feature work. Contract (Art. 6(1)(b)).	Scores: until you delete the account

Server logs at our hosting provider record IP addresses and request details for a short period for security and debugging (legitimate interest). We do not sell personal data and we do not use it for automated decisions with legal effect.

3. Cookies and similar storage

The banner you saw on your first visit controls everything in the "Optional" group. You can change your answer any time via in the footer. Declining does not limit the site in any way. We also honour the Global Privacy Control browser signal and treat it as a decline.

Strictly necessary (no consent needed)

next-auth.session-token, next-auth.csrf-token, next-auth.callback-url: keep you signed in and protect forms (30 days / session).
twt_consent: remembers your cookie choice (6 months).
ttw_ref: remembers, for one week, where your visit came from (for example "google" or "newsletter") so we can see which channel brings players who sign up.
twt_anon: a random id so anonymous visitors can mark a post helpful or upvote a song request once (1 year).
Browser storage (localStorage) for the tab display style you picked, the local tunebook, "already subscribed" so we stop showing you newsletter forms, and how recently the newsletter prompt appeared.

Optional (only after you accept)

PostHog analytics (PostHog Inc., hosted in the United States): ph_* cookies and storage, up to 1 year. Records pages viewed, buttons used and, on a sample of visits, a session replay of how the page was used. Replays mask everything you type. Before you accept, PostHog runs without any cookie and forgets you at the end of the page view.
Meta Pixel (Meta Platforms): _fbp and _fbc cookies, 90 days. Measures whether our Facebook and Instagram ads bring visitors, and lets Meta build audiences. Not loaded at all unless you accept.

Cookieless measurement

Vercel Web Analytics and Speed Insights count page views and page speed without cookies or persistent identifiers. Embedded YouTube videos use YouTube's privacy-enhanced mode, which sets no cookies until you press play; once you do, Google's privacy policy applies.

4. Who processes data for us

Vercel Inc. (USA): hosting, image storage, cookieless analytics.
Neon (database hosted in Frankfurt, Germany, AWS eu-central-1): all account and content data.
Resend (USA): sends our emails and reports delivery, bounces and complaints back to us.
PostHog Inc. (USA): product analytics and session replay, with your consent.
Meta Platforms (Ireland / USA): advertising measurement, with your consent.
Google: optional "Sign in with Google", and YouTube embeds.
Cloudflare Turnstile: may check that a community post comes from a person, not a bot.

Providers in the United States are used under the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. We do not share personal data with anyone else, except if the law requires it.

5. Affiliate links

Some links to whistles and books go to Amazon with our Associates tag. As an Amazon Associate we earn from qualifying purchases. Clicking such a link takes you to Amazon, whose own cookies and privacy policy apply from that point. We record only that an affiliate link was clicked, as part of the analytics described above.

6. Your rights

Wherever you live, and in particular under the GDPR, the UK GDPR and the California CCPA/CPRA, you can:

ask what personal data we hold about you and get a copy;
correct it (name, username and picture directly on your profile page);
delete it: the "Delete account" button on your profile removes your account, uploads, posts, scores and newsletter subscription at once, and every newsletter email carries an unsubscribe link;
withdraw consent at any time (cookie settings in the footer, unsubscribe links) without affecting what happened before;
object to or restrict processing based on legitimate interest, and receive your data in a portable format;
complain to your local data protection authority. We would appreciate the chance to sort it out first.

Email orkithewhistler@gmail.com for anything you cannot do yourself. We answer within 30 days. We never discriminate against you for exercising a privacy right.

7. Children

The tabs are for everyone, but accounts, the community and the newsletter are for people aged 16 or older (13 in the United States). We do not knowingly collect personal data from younger children; if you believe a child has given us data, tell us and we will delete it.

8. Security

Everything is served over HTTPS, passwords are stored as bcrypt hashes, and admin access is limited to the site owner. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the relevant authority as the law requires.

9. Changes

When this policy changes in a way that matters, we update the date at the top and, for account holders and subscribers, mention it in the next email. Older versions are available on request.