Privacy Policy
1. Who we are
MIDI DUMB ("we", "us") operates the MIDI DUMB RPG application and website (the "Service"). This policy explains what personal data we collect, why, and your rights over it. The data controller is [MIDI DUMB legal entity name & address — TBD].
2. What we collect
We collect the following so we can run the Service and make it better:
| Category | Examples |
|---|---|
| Account data | Your name and email address, and authentication data when you sign in (including via Google sign-in if you choose it). |
| Your saved content | The synths in your arsenal, the presets, hotloads, and randomize history you create and save. |
| In-app activity / usage | Essentially everything you do in the app — which features you use, actions such as randomize/save/load, sessions, and similar interaction data — so we can understand how the app is used and improve it. |
| Technical data | Basic device/browser information, the version of the MIDI DUMB app you have installed, and logs needed to operate the Service, keep it up to date, and diagnose problems. |
| Billing data (when payments launch) | Your Credit balance, Credit purchases and membership status, and payment metadata. Card details are handled by our payment processor — we do not store full card numbers ourselves. [Confirm with processor.] |
We do not intentionally collect special-category (sensitive) personal data.
3. Why we collect it
- To provide the Service — create your account, store and sync your presets and settings, and let you use the app.
- To improve the product — understand how people use the app and make it better (this is the core reason we collect in-app activity).
- To communicate with you — onboarding, important notices, and (if you opt in) product updates.
- To process payments — Credit purchases, membership billing, and account management, once payments launch.
- To keep the Service secure — prevent abuse and diagnose problems.
[Legal bases (GDPR): contract, consent, and legitimate interests — lawyer to map each purpose to a basis.]
4. Consent
When you create an account you tick a box agreeing to our Terms of Service and this Privacy Policy. That agreement includes your explicit consent to the collection and processing of your data as described here, including your in-app activity, for the purpose of operating and improving the Service. You can withdraw consent by contacting us or deleting your account (see "Your rights").
5. Who processes your data (sub-processors)
We use trusted third-party providers to run the Service. They process data on our behalf under their own terms:
| Provider | Role |
|---|---|
| Supabase | Database, authentication, and storage (your account, presets, and settings). |
| Vercel | Website and app hosting / delivery. |
| Resend | Sending transactional and onboarding emails. |
| Google (if used) | Sign-in with Google, if you choose that option. |
| [Payment processor — e.g. Stripe, TBD] | Payment processing, when payments launch. |
6. Cookies & local storage
We use cookies and browser local storage that are necessary to run the Service — for example, to keep you signed in and to remember your preferences (such as your light/dark theme). [If any non-essential/analytics cookies are added, a consent banner and this section must be updated — lawyer to confirm.]
7. Sharing & selling
We do not sell your personal data. We share it only with the sub-processors listed above so the Service can function, or where required by law. We may share aggregated or anonymized data that does not identify you.
8. Data retention & your saved work
We keep your data for as long as your account exists and as needed to provide the Service. Your
saved presets, hotloads, and history remain yours and stay in your account — regardless of your
Credit balance or whether you have a membership, and they stay readable and exportable. For your own
safety we recommend keeping a local backup by exporting your data as an .mdbundle file. If
you delete your account, we delete or anonymize your personal data within a reasonable period, except
where we must retain it by law.
9. Your rights
Depending on where you live (e.g. under GDPR or CCPA), you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data ("right to be forgotten");
- export / receive a copy of your data (portability);
- object to or restrict certain processing, and withdraw consent;
- [CCPA: the right to opt out of "sale/share" — we do not sell, but confirm wording.]
To exercise any of these, contact us at yakirbt@mididumb.com. We will respond within the timeframe required by applicable law.
10. Security
We take reasonable technical and organizational measures to protect your data, and we rely on the security of our sub-processors (Supabase, Vercel, Resend). No system is perfectly secure, and we cannot guarantee absolute security.
11. International transfers
Our providers may process and store data in countries outside your own. [Where required, we rely on appropriate safeguards such as Standard Contractual Clauses — lawyer to confirm per provider & region.]
12. Children
The Service is not directed to children under [age — TBD with lawyer], and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. We will update the "Last updated" date and, for material changes, notify you or ask you to re-accept where appropriate.
14. Contact
Questions about your privacy or this policy? Contact us at yakirbt@mididumb.com.