Privacy Policy

Last updated: 13 October 2026

This site is small and so is the data it touches. This page says exactly what is collected, why, and what your rights are — in plain language, because there is not much to hide behind.

Who is responsible

The data controller is the individual operator of Pointless Audio, based in Italy. For anything privacy-related, write to [email protected].

Cookies

This site sets no cookies. No consent banner appears because there is nothing to consent to: no advertising trackers, no profiling, no third-party pixels, no fingerprinting. The only thing stored in your browser is one value in session storage that remembers where your visit started (see Analytics); your browser deletes it when you close the tab.

Analytics

The site uses Cloudflare Web Analytics, a cookieless measurement tool. It counts page views in aggregate without setting cookies, without storing identifiers on your device, and without tracking you across sites. Details: Cloudflare Web Analytics.

We also run a small counter of our own, to learn which sites send people to us. When a page loads, and when you click a link to our store, it records the page, the website you came from (the domain only, never the full address), the campaign tag in the link if there is one, and your country as seen by Cloudflare. It records no IP address, no cookie and no identifier. Links to our Gumroad store carry two short labels, where your visit started and the page you came from, so that we can tell which source led to a download.

• Legal basis: legitimate interest (art. 6(1)(f) GDPR) in knowing which pages are read and which sources bring visitors. Nothing here identifies you.
• Processor: Cloudflare, Inc. (Workers and D1, data stored in the EU). See Cloudflare’s privacy policy.
• Opting out: if your browser sends Global Privacy Control or Do Not Track, our counter does nothing at all.
• Retention: 24 months, then deleted.

The newsletter (“The dev log”)

If you subscribe to the dev log, we process one piece of data: your email address.

• Legal basis: your consent (art. 6(1)(a) GDPR), given via double opt-in — you confirm the subscription from your inbox, so nobody can sign you up by accident.
• Processor: the list is managed by Kit (Kit.com, formerly ConvertKit, USA). Transfers outside the EU are covered by the EU–US Data Privacy Framework and standard contractual clauses. See Kit’s privacy policy.
• Retention: until you unsubscribe. Every email contains an unsubscribe link that works immediately, no questions asked.
• What we send: release notes, free plugins, occasional development notes. Roughly one email a month. No third-party offers, ever.

The beta program

If you join the beta, we process one piece of data: your email address, to send you pre-release builds of new plugins and to ask what went wrong.

• Legal basis: your consent (art. 6(1)(a) GDPR), given via double opt-in.
• Processor: Kit, as for the dev log.
• Your feedback: if you reply with feedback, we read it and use it only to fix the plugin.
• Retention: until you leave the beta. Every email contains an unsubscribe link.

If you downloaded a plugin

When you download a plugin from our Gumroad store, Gumroad shares with us your email address, the products you got, your country and the page you came from. We use them for three things only:

• Telling you about updates to the plugins you have: fixes, new versions, things you should know before you update.
• Telling you about our other plugins and the beta program, now and then. Never third-party offers.
• Counting downloads and where they come from. For this we keep your email only as a pseudonymous code that cannot be read back.

• Legal basis: our legitimate interest in staying in touch with people who use our plugins (art. 6(1)(f) GDPR), within the limits Italian law sets for emailing existing customers about similar products (art. 130(4), Italian Privacy Code). You can object at any time (art. 21 GDPR).
• Who gets your email: only people who left Gumroad’s “can contact” option on are added to our mailing list.
• Processor: Kit, as for the dev log. The counting data sits on Cloudflare, as for Analytics.
• Opting out: every email has an unsubscribe link that works immediately. Replying “stop” works too.
• Retention: until you unsubscribe. The counting data: 24 months.

This is different from the dev log and the beta: those you join yourself, with double opt-in.

Purchases and downloads

Plugins are sold and delivered through Gumroad (Gumroad, Inc.), which acts as the merchant of record and as an independent data controller for the checkout. Payment details, invoices and download delivery are handled entirely on Gumroad’s side — this site never sees your payment data. See Gumroad’s privacy policy.

The pocketgrid app

The app collects nothing. No accounts, no analytics, no advertising, no crash reporting, no third-party SDKs. There are no servers on our side for it to send anything to — in App Store terms, Data Not Collected.

• Your norns. The app talks to a norns on your own network — over Wi-Fi, the norns’ own hotspot, or a USB cable. It sends the keys and encoder movements you make, and receives the lights the running script draws. That traffic stays on your local network and never reaches us.
• Your settings. Colours, sensitivity, the address of your norns and the pages you have taught the app live on your device only, and go away when you delete the app.
• Nothing else. The app asks for no permissions beyond the local network it needs to reach your norns. It has no access to your files, your microphone or your location, and does not want any.

Your rights

Under articles 15–22 GDPR you can request access, rectification, erasure, restriction, portability, and object to processing. Write to [email protected] and it will be handled directly. You also have the right to lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali).

Changes

If this policy changes, the date at the top changes with it. No silent edits.