Privacy
This site collects almost nothing, deliberately. There is no account to create, no newsletter to join and nothing to buy, so there is very little reason to hold data about you. What follows is the whole of it.
The short version
- I do not store your IP address. Not in plain text, and not hashed.
- There is no login anywhere on this site, and no password to lose.
- I do not send marketing email and I do not have a mailing list.
- I do not sell, rent or share anything with anyone for advertising.
- Analytics only runs if you accept the banner. Decline and none of it loads.
- Nothing measured here is linked to your identity. There is no account to link it to, and the visitor id analytics stores is anonymous.
- Frets runs entirely in your browser. It has no account and no server, and it never sends anything anywhere on its own. The only way anything from Frets reaches me is if you choose to: press the feedback button while you are in it, and the screen you were on, and the tuning, scale or root you had selected, travel with the report you write. Every one of those is listed on the feedback page before you send, and you can take any of them off. Nothing else about your practice ever leaves your device.
What I store
Three things, each because you chose to send it.
Contact form
Your name, email address, the enquiry type you picked, and your message.
So I can read what you sent and reply to you. It is emailed to me and kept in a database so a failed email cannot lose it.
Kept until I have dealt with it and for as long as the conversation is useful. Ask and I will delete it.
Research survey responses
Your answers, plus a one-way hash of your browser configuration used only to stop the same browser submitting twice.
The surveys are research instruments. The hash is a duplicate check, not an identifier, and it is not linked to anything else.
Kept as research data. No name or email address is collected with it.
Feedback
Your message, the page you were on, which theme you were using and the size of your browser window. From a Frets screen it also carries the screen name and the tuning, scale or root you had selected. An email address only if you choose to give one.
So a report about a specific screen arrives with enough context to act on. Everything collected is shown to you before you send it and anything except the page can be removed. It is emailed to me and kept in a database so a failed email cannot lose it.
Kept until I have acted on it. Ask and I will delete it.
Two of those three, the contact form and the survey, sit in database tables that have a column for a hashed IP address. It has never been written to, and the code that saves them leaves it out on purpose. The feedback table does not have the column at all. I am saying so here because a column existing is the sort of thing someone could find and reasonably assume the worst about.
What stays in your browser
These are written to your own device and are never sent to me. Clearing your browser data removes all of them.
| Key | What it holds |
|---|---|
| theme | Whether you chose light, dark or ember. |
| library-recent-searches | Your recent searches on the Library page. |
| frets:progress | Your practice progress in Frets. |
| frets.onboarding.v1 | Whether you have seen the Frets intro. |
| frets.howItWorks.v1 | Whether you have dismissed the Frets explainer. |
| analytics_consent | Whether you accepted or declined analytics. |
| pendo_visitor_id | A random id for analytics. Only written if you accept, and tied to nothing else. |
| research:fp | A random id used for the survey duplicate check when your browser blocks the normal method. |
| experiment_progress | Your place in the research study, which is currently offline. |
| admin-secret | Used only by me, on my own machine, for admin tooling. |
Who else is involved
Running a site means other companies are in the path. This is all of them.
Vercel
Hosts the site, so it sees the ordinary request information any web server sees, including your IP address, which I do not store. Vercel Web Analytics also counts page views. It sets no cookie and builds no cross-site profile, and the experiment routes are excluded from it entirely.
Cloudflare
DNS and CDN for the domain, and the Turnstile check on the contact form, the feedback form and the survey. Turnstile is a bot check that runs without cookies and without the picture puzzles. Cloudflare also forwards inbound mail for my domains, so the notification carrying your message passes through it on the way to me.
Sentry
Error reports when something breaks. Events are scrubbed before they are sent, and session replays mask all text.
Pendo
Which pages and buttons get used, under a random id. Loads only if you accept the cookie banner. Decline and nothing is sent.
SendGrid
Delivers the contact form and feedback notifications to my inbox. Your message passes through it to reach me.
Neon
The database the contact form, feedback reports and survey responses are stored in.
PostHog
Server-side analytics: counts when the contact form, feedback form, survey, and library import are used. No experiment data is sent. Loads only if the server is configured with a PostHog project token.
Spotify
Two things. The site asks Spotify what I am listening to and shows the answer, which tells them nothing about you because the request is mine. The home page also embeds a Spotify player, and an embed is a frame served by Spotify, so loading that page tells them your browser asked for it and their cookies and terms apply inside it.
YouTube
Embeds the BBQ channel videos on the home page. An embed is a frame served by YouTube, so loading the page tells them your browser asked for it, and their cookies and terms apply inside the player.
SoundCloud
Embeds a music player on the home page, on the same terms as the other embeds: the frame is theirs, so the request reaches them directly.
ReverbNation
Embeds the band players on the home page, on the same terms as the other embeds.
Book and podcast metadata sources
Cover images and details for the Library page. Your browser loads the images, so those services see the request.
The research study
My thesis study is offline while it waits for approval from the University of Nebraska Omaha Institutional Review Board, so nobody can take part right now and no participant data is being collected.
When it does run it has its own consent form, which is the document that governs it rather than this page. It collects what a learning study collects: answers, timings and the code participants write. No participant data is sent to analytics or to error tracking, which is a constraint of the approved protocol and not just a preference.
Asking me to delete something
If you have sent me anything through the contact form or the feedback form and want it gone, say so through the contact form and I will delete it. There is no process to navigate. It is one person and a database.
Changes
If I add anything that collects more than this page describes, this page changes in the same commit. That is enforced by tests rather than by good intentions: the storage keys and the third parties above are checked against the code, and adding either without listing it here fails the build.
Last updated 22 August 2026.