Privacy

Last updated October 25, 2026

This explains what Tightband collects, why, who handles it for us, how long we keep it, and what you can ask us to do with it.

Who we are

The controller of your personal data is Nolan Consulting LLC, 55255 Fallow Rd, Pacific Junction, IA 51561, USA. Contact us about anything on this page at help@tnolan.ai.

What we collect

• Account: your email address and a password, which our sign-in provider, Supabase, stores only as a hash.
• Purchases: your plan and its status, the plug-ins you've bought, and a record of each purchase (including whether it was refunded or disputed). Stripe holds your name, billing details and card; we never see or store card numbers. For a plug-in, we also keep your confirmation that you wanted the download right away (see Refunds).
• Plug-in licenses and trials: if you buy or try a plug-in, the license file we make for you carries your email address, the plug-ins it covers and, for a trial, its dates. We keep a copy so we can give it to you again.
• Your computers: when you activate a plug-in, the computer's code from the plug-in (worked out from the computer's hardware ID, which itself never leaves your computer), the computer's name, and when you activated or deactivated it. We use these to keep plug-ins to 2 computers per account and trials to one.
• Sign-up protection: when you make an account we keep a one-way hash of your IP address and of the email address you used, to limit how many accounts can be made from one place.
• Waitlists: the email you give us when you ask to hear about a product.
• Technical logs: our hosting providers record requests to the site and our servers, including your IP address and browser details, to run and secure the service.
• On your device: your settings, practice progress and calibration, your signed-in session, and the riffs you've downloaded are kept in your browser's storage, not on our servers. Clearing your browser's site data removes them.

Your microphone and audio input

When you plug in, the app processes your instrument's signal live in your browser for the amp and the timing coach. That audio never leaves your device: it is not uploaded, and we never receive it. If you turn on Record yourself, your takes are kept in that browser tab's memory so you can play them back and compare them with the part you're learning; at most three are kept, and they are gone when you delete them, when newer takes replace them, or when you close or reload the tab. Save WAV downloads a take as a file to your device, where it stays unless you choose to share it.

Why we use it, and our legal basis

• To provide what you signed up for or bought (your account, Pro, plug-ins, license files, downloads and password resets): necessary to perform our contract with you.
• To keep records of sales, refunds and disputes: necessary to comply with our legal obligations (tax and accounting), and in our legitimate interest in handling refunds and chargebacks correctly.
• To protect the service (sign-up limits, technical logs, stopping abuse of free trials): our legitimate interest in keeping Tightband secure and working.
• To count visits to the site without cookies (Vercel Web Analytics, which doesn't follow you across sites): our legitimate interest in knowing which pages work.
• Waitlist emails: your consent, which you can withdraw any time by emailing us.

Stripe sends your payment receipts, Supabase sends sign-in emails such as password resets, and we send one email per waitlist you joined. We don't sell your data or use it for advertising profiles.

Who processes it for us

• Supabase: accounts and sign-in (including password-reset emails), our database, content storage, licenses and downloads.
• Stripe: payments, subscriptions, receipts and the billing portal.
• Vercel: hosting the site, and counting visits without cookies.
• Google Fonts: the sales page loads its fonts from Google, so Google receives your IP address when your browser fetches them.

Each processes data only to provide its service to us. The app loads all of its own code, including the sign-in library, from our site.

International transfers

Supabase (our database is in the United States, in AWS us-east-2), Stripe and Vercel are based in or process data in the United States. If you are in the EU, the UK or Switzerland, your data is transferred there under the safeguards in these providers' data processing terms, such as the European Commission's Standard Contractual Clauses and the UK addendum to them.

How long we keep it

• Account, purchases, licenses and trials: for as long as you have an account. When we delete your account, these records are deleted with it.
• Payment records at Stripe: Stripe keeps transaction records for as long as financial and tax law requires, even after your account here is deleted.
• Sign-up protection hashes: deleted automatically after 24 hours.
• Waitlist emails: until you ask us to remove them.
• Technical logs: for the limited period our hosting providers keep them.

Your rights

Depending on where you live (including under the EU and UK GDPR), you can ask us to: give you a copy of your data, in a portable format; correct it; delete it and your account; restrict how we use it; or stop using it where we rely on legitimate interests. Where we rely on your consent you can withdraw it at any time. To do any of this, email help@tnolan.ai from the address on your account. We'll reply within one month. Deleting your account cancels any active plan.

You can also complain to a data protection supervisory authority, in particular the one in the country where you live or work (in the UK, the Information Commissioner's Office). We'd appreciate the chance to sort it out first.

Children

The service isn't directed at children under 13, and we don't knowingly collect their data.