Privacy policy

Last updated 11 November 2026.

This page explains what personal information sOURnd collects, why, who sees it and what you can ask us to do with it.

Who is responsible

James Harold Gordon Cartwright, trading as Box Of Rules, C/O Brennan Herriott & Co, 1 Blatchington Road, Hove, England, BN3 3YP, is the data controller. Contact hello@sournd.com.

What we collect and why

What	Why	Lawful basis
Your email address, and the engines and plans you buy	To sell you engines, send receipts and sign-in links, and let you download	Contract
Your country, the country your connection comes from, and your VAT number if you give one	To charge the right VAT and keep the evidence HMRC requires	Legal obligation
Your PayPal payer email, country and payment references	To confirm and, if needed, refund payments	Contract, legal obligation
Invoices and credit notes	UK tax records	Legal obligation
Plugins registered and revenue reported before 10 November 2026, when the royalty ended	To run the commercial licence we had then	Contract
Messages you send through the contact form, with your browser type and the page you came from	To answer you and sort out problems with the site	Legitimate interest
Your email if you join the newsletter, with the time and IP address you signed up from	To send occasional news about engines, and to show you asked for it	Consent (unsubscribe any time)
Whether our emails are opened and which links in them are clicked	To know receipts and sign-in links arrive and work	Legitimate interest
Ask sOURnd conversations: your questions and the answers, the page you asked from, any rating you give, the country your connection comes from (not your IP address) and, if you are signed in, your email	To answer you, and to improve sOURnd and its answers. Anything that looks like a password, key or card number is removed before we store it	Legitimate interest
Audio you upload to hear an engine	Only to make that preview (see below). It is not kept	Legitimate interest
The browser that signed in, and when (remembered sign-in)	To keep you signed in and let you sign out everywhere	Contract
How the site is used (see Analytics below)	To see which pages help people and fix what does not	Legitimate interest, or consent for Google Analytics and Microsoft Clarity
Server and security logs	To keep the site running and safe from abuse	Legitimate interest

We do not sell personal information and do not use it for advertising. We never make decisions about you by automated means alone.

Previews on our server

Paid engines and synths play on our server, so their code never reaches your browser.

Your own audio on an effect page. The file you pick is sent to our server, which uses only its first 10 seconds (30 seconds if you own the engine or your plan covers it) to make the preview. The upload and its decoded copy are deleted straight after, whether the preview works or not. They are never cached, kept or used for anything else.
Synth pages. Only note timings and dial settings are sent. A MIDI file you choose is read in your browser and never uploaded.
What we keep. Previews of our built-in test sounds and of synth note lists are cached on the server so the same request is fast next time. Your uploads are not.
Fair use limits. To stop abuse, preview requests are counted per IP address and per session cookie. Only the counts are kept, for up to a day.

Analytics

Matomo, for everyone, without cookies. We run our own Matomo at stats.boxofrules.com. It records the pages you view (with sign-in links and other private parts of addresses removed), how long you stay, the site that sent you, your IP address, browser, device type and approximate location, and actions such as adding to the cart, starting a checkout, claiming a free engine or signing in. It sets no cookies, respects Do Not Track, and the data stays with us.
Google Analytics, only if you allow it. It records the same kind of information plus purchases (what was bought and the amount, never your email), with your IP address shortened. It never runs when your browser sends Global Privacy Control. Change your choice on the cookie policy.
Microsoft Clarity, only if you allow it. Clarity shows us how pages are used: where people click, tap and scroll, how the pointer moves, and a replay of the visit built from those, along with your browser, device type, approximate location and the pages you came from and viewed. What you type into a form is hidden before it leaves your browser. Clarity does not run on Your engines, sign-in links, checkout or any other signed-in page, so it never sees your email, your purchases or your keys. It never runs when your browser sends Global Privacy Control. We use it only to improve the site, with advertising use switched off. Microsoft keeps recordings for up to 30 days and the other Clarity data for up to 13 months.

Only the services that run sOURnd for us, each under contract:

PayPal takes payments. PayPal is also a controller of the payment data you give it.
Postmark sends our emails and tells us when they are opened and which links are clicked.
DigitalOcean hosts the site and database, in London.
Cloudflare protects and delivers the site, checks Ask sOURnd is used by a person (Turnstile), and stores download files.
Anthropic writes answers to Ask sOURnd questions from our own documentation. We send the question, never your email.
Google runs Google Analytics, only if you allow it.
Microsoft runs Clarity, only if you allow it. Microsoft also uses Clarity data for its own purposes, as its privacy statement describes.

Matomo runs on our own server, so that information is not shared.

Some of these are based outside the UK, mainly in the United States. Where your information leaves the UK, it is protected by the safeguards UK law requires, such as the UK extension to the EU-US Data Privacy Framework or the UK international data transfer agreement.

We may also disclose information if the law requires it.

How long we keep it

Orders, invoices, credit notes and VAT evidence: 6 years after the end of the tax year, as HMRC requires.
Licences: for as long as the licence exists.
Sign-in links: 30 minutes. Remembered sign-ins: 30 days from last use, or until you sign out.
Newsletter: until you unsubscribe.
Contact messages: up to 2 years after the conversation ends.
Plugin registrations and royalty reports from before 10 November 2026: 6 years from that date.
Ask sOURnd conversations: 12 months, then deleted.
Analytics: Matomo visit logs 13 months; Google Analytics 14 months; Microsoft Clarity recordings 30 days and its other data 13 months.
Uploaded audio: not kept after the preview is made.

Your rights

You can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email hello@sournd.com; we reply within one month. We may need to keep some records, such as invoices, for as long as the law requires.

If you are unhappy with how we handle your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Children

sOURnd is not meant for children under 13, and we do not knowingly collect their information.

Cookies

See the cookie policy.