Contents
Draft for review. This is a plain-language first draft. It must be reviewed by a qualified lawyer before Terra Studio is offered commercially, and the details in square brackets must be filled in.
The short version
- You can listen in the Playground without an account. We don’t ask who you are.
- With an account we keep what you need to sign in and what you choose to save.
- All sound is made on your own device. We never hear what you listen to.
- No advertising, no tracking cookies, no third-party analytics.
- You can download everything we hold about you, or delete your account, from your account page at any time.
Who we are
Terra Studio is run by [Company name], [Registered address]. We are the data controller for the information described here. Contact: [Contact email].
What we collect, and why
| What | Why | How long |
|---|---|---|
| Your email address, and a securely hashed password if you use one | To create your account and let you sign in. Legal basis: providing the service you asked for (contract). | Until you delete your account |
| If you sign in with Google, GitHub, Discord or Microsoft: the account id and email that service shares | The same as above | Until you delete your account |
| Your display name | To greet you in the Studio | Until you delete your account |
| That you confirmed you are 18 or over, and which version of the safety notice and terms you accepted, with the date | To show you the notice again when it changes, and to keep a record that you saw it (contract and legal obligation) | Until you delete your account |
| Your plan (Grove or Canopy) and when it ends | To give you the features of your plan (contract) | Until you delete your account |
| Saved presets (names and sound settings) | So you can come back to them (contract) | Until you delete them or your account. Deleted presets are removed for good after 30 days. |
| Share links you make. We store only a scrambled form of each link, never the link itself. | So the people you send a link to can listen (contract) | Until you revoke them or delete your account |
| Listening history: when you listened, for how long, the scene name and any notes you write | To show you your own listening history (contract) | Until you delete entries or your account |
| Your journal: your entries and the names of any extra journals, encrypted on your device before they reach us, and your journal key, locked with your journal passphrase and your recovery code. We cannot read any of it. | So you can keep your journal and open it on any device (contract) | Until you delete entries, delete or reset your journal, or delete your account |
| If you connect Notion (Canopy): an encrypted access token, the name of your Notion workspace and the page you chose. Entries you choose to send are passed to Notion and not kept by us. | To send your chosen journal entries to your own Notion (contract) | Until you disconnect Notion or delete your account |
| Signed-in devices: browser and device type, and when each was last used | So you can see where you are signed in and sign other devices out (contract, security) | Until that session ends or is signed out |
| Security log: sign-ins, failed sign-ins, password and email changes, plan changes. Each entry holds a salted, one-way hash of your IP address, never the address itself. | To protect accounts from misuse (legitimate interests) | 90 days, then deleted automatically |
| Rate limit counters, keyed by a salted hash of your IP address or email | To stop automated attacks such as password guessing (legitimate interests) | A few minutes to a day, then expire on their own |
| Gifts of Canopy you buy: that you bought one, its length, and the gift link, encrypted with a key only our server holds; whether it has been used, and by which account. Payment details stay with Stripe. | So the link reaches the person you give it to, and you can see it again (contract) | The link: until it is used (then it is erased). The record that a gift was bought and used: kept with the gift; if you delete your account, it no longer says who bought it |
| Error reports, only if you turn them on (they are off unless you do): what went wrong, scrubbed of anything that looks like an address, link, id or number; which page; your browser and its version; phone, tablet or computer; and the app’s version. Never your account, IP address, cookies, what you wrote or what you listen to. | To find and fix problems (consent, which you can withdraw at any time in the Studio’s About panel) | 30 days, then deleted automatically |
| Waitlist: your email address, if you ask to hear when Canopy opens | To send you that one email (consent, which you can withdraw at any time) | Until Canopy opens and we have written to you, or until you ask us to remove it |
We don’t collect your location, contacts, microphone or camera. Terra Studio’s security settings tell your browser to refuse those even if something asked.
Cookies and storage on your device
We use only what is strictly necessary for the site to work, so there is no cookie banner.
- Sign-in cookies (names starting with
sb-): keep you signed in. They can’t be read by scripts on the page. - terra_next: remembers which page to return to after signing in. Lasts 15 minutes.
- terra_share: set when you open a shared mix, so its sounds can load. Lasts one hour.
- Local storage: your Calm visuals choice, your visual theme, light or dark mode, larger text, the list view of sounds, your favourite scenes, your last mix (so it comes back next time), whether to send error reports, and whether you closed the Playground banner. These never leave your device.
- Journal entries written offline: kept on your device only until they can be sent, and encrypted exactly as they would be when sent, so they cannot be read there either.
- Offline app (Canopy): a copy of the Studio, your first page of presets and the sounds you have played, stored by your browser so you can listen offline. Signing out removes it.
Who processes data for us
These companies process data on our behalf, under contracts that require them to protect it:
- Supabase: database and sign-in. [Region where your project is hosted]
- Vercel: hosting. Its servers handle every request, which includes your IP address, and keep short-lived logs.
- Upstash: rate limit counters (hashed keys only).
- Cloudflare: Turnstile, the check that you are a person, on sign-up, sign-in and the waitlist. It sees your IP address and some browser details for that check.
- [Email provider]: sends sign-in links, password resets and the waitlist email.
- GitHub: stores encrypted weekly backups of the database for 90 days.
If you connect Notion to your journal, the entries you choose to send go to your own Notion workspace, under Notion’s terms. Nothing goes to Notion unless you send it.
[Describe any transfers outside the UK or EEA and the safeguards used, for example Standard Contractual Clauses.]
Your rights
Under the GDPR and similar laws you can:
- Access and take your data: download everything from your account page.
- Correct it: change your name and email on your account page, or ask us.
- Delete it: delete your account from your account page. Your presets, share links and journal are removed straight away. Security log entries expire within 90 days, and backups within 90 days.
- Object to processing based on our legitimate interests, or ask us to restrict it.
- Withdraw consent to the waitlist at any time.
- Complain to your data protection authority. [Name the lead authority, for example the ICO in the UK.]
To use any of these rights, write to [Contact email]. We reply within one month.
Age
Terra Studio is intended for adults aged 18 and over. We don’t knowingly hold accounts for anyone younger.
Changes
If we change how we use your data, we will update this page and, for important changes, tell you by email or when you next sign in.