Privacy Policy

Last updated: 17 July 2026

tb303.com is run by David Elfström Lilja (I/O Lab), Sweden. This page explains what data the site handles, why, and what rights you have. Short version: we collect the minimum needed to run the synth and its community, we do not sell anything to anyone, and analytics only runs if you say yes.

Data we store, and why

Data	Why	Kept
Email address, username, display name, password (stored as a secure hash, never readable)	Your account: signing in, saving patterns, posting in the community. Legal basis: performing the service you asked for.	Until you delete your account
Profile content you add: bio, location, links, avatar, cover image	Shown on your public profile because you chose to put it there.	Until you remove it or delete your account
Content you create: patterns, posts, comments, likes, follows	That is the product. Public patterns and posts are visible to others.	Until you delete it. Deleted posts and comments are hidden immediately and purged from backups over time.
IP address and browser identifier in session and rate-limit records	Security: keeping sessions valid, stopping abuse and spam. Legal basis: legitimate interest.	Sessions up to 30 days, rate-limit records hours to days
Reports you file about content	Moderation.	Until handled, then archived

What stays on your device only

Your saved patterns bank, knob settings, MIDI mappings and similar preferences are stored in your browser's local storage. They never leave your device unless you explicitly save or share a pattern through your account.

Cookies

Cookie	Type	Purpose
`tb303_sid`	Necessary	Keeps you signed in. 30 days.
Google Analytics	Optional	Set only if you accept analytics in the consent dialog. You can decline and everything still works.

Your consent choice itself is remembered in local storage, not in a cookie.

Third parties we use

Loopia (Sweden): hosting. All data lives on servers in the EU.
Resend: delivers account emails such as verification messages.
Google Analytics: visitor statistics, only after you opt in.
Gravatar (Automattic): if you have not uploaded an avatar, the community shows a generated placeholder from Gravatar. Your browser requests that image directly, which reveals your IP address to Automattic like any image load. Upload an avatar and no Gravatar request is made.

No data is sold, rented or shared for advertising. There is no ad tech on this site.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, or have it deleted. Email mail@davidlilja.se and it will be handled promptly. You can also complain to the Swedish data protection authority, IMY.

Changes

If this policy changes in a way that matters, the date above is updated and significant changes are announced on the site.