Privacy Policy

1. Who is responsible

Van Moose, Amsterdam, the Netherlands, is the controller for the personal data described here. This policy covers the website audio.vanmoose.com and the plugin downloads served from dl.vanmoose.com.

Questions, requests, or complaints: info@vanmoose.com.

2. What we collect, and why

There is no account system on this site. Data reaches us in exactly four ways:

• Waitlist — your email address, and nothing else. Used only to email you when new plugins ship. Legal basis: your consent, given by submitting the form. There is a second way onto this list: an opt-in box on the contact form, which ships unticked and subscribes you only if you tick it yourself.
• Contact form — your name, email address, chosen topic, and message. Used only to answer you, and never added to the mailing list unless you ticked the opt-in box. Legal basis: your request, and our legitimate interest in supporting the people who use our plugins.
• Download counts — when you download a plugin we store one row: which plugin, which format, which platform, and the timestamp. No IP address, no browser fingerprint, no email. It tells us which plugin is worth continuing; it cannot tell us who you are.
• Windows vote — to keep the vote count honest we store an irreversible SHA-256 hash of your IP address combined with a server-side secret. The raw IP is never written down, and the hash cannot be turned back into an address.

3. What happens in your browser stays in your browser

Every playable plugin and the MooseSynth run locally through the Web Audio API and WebAssembly. The audio is generated and processed on your device. Nothing is streamed to us, nothing is recorded, and the site never asks for microphone access.

If you connect a MIDI keyboard, your browser asks your permission first and the note data stays local — it is used to play the synth in the page and is not transmitted or stored.

4. Cookies and local storage

No tracking cookies, no advertising cookies, no third-party pixels. What we do set is functional only, and none of it contains an identifier for you:

• locale — remembers whether you want English or Dutch. One year.
• A cabinet-skin cookie — remembers the synth look you picked. One year.
• Local storage: your chosen scale mode in the synth, and an audio_vote_windows flag so the vote button knows you already voted. Both stay in your browser and are never sent to us.

Because these are strictly functional and store no identifier, no consent banner is required — and we would rather not show you one.

5. What we deliberately do not do

• No analytics.
• No advertising networks, retargeting pixels, or social media embeds.
• No profiling and no automated decision-making.
• We never sell, rent, or trade personal data.

6. Where the data lives

The website, the database, and the email that leaves it all run in the EU — Frankfurt, Ireland, and Paris. The sending itself goes through Truncus, the EU-resident email service we build ourselves, so your address is not handed to a third-party mail vendor to get a message out. Our hosting provider keeps short-lived request logs, which include IP addresses, for operations and abuse prevention.

Two things sit outside that, and we name them because they involve a transfer out of the EU: the mailbox that receives your contact message runs on Google Workspace, and plugin downloads are served through a content delivery network, which sees the IP address of the request. Both are covered by standard contractual clauses.

7. How long we keep it

• Waitlist email: until you unsubscribe. Every email has an unsubscribe link, and emailing info@vanmoose.com works just as well.
• Contact messages: kept in the mailbox for as long as the conversation is useful, and deleted on request.
• Download counts and vote hashes: kept indefinitely as aggregate statistics — neither identifies you.
• Rate-limiting data: IP addresses used to shed abuse bursts live in server memory for at most ten minutes and are never written to the database.

8. Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or hand it over in a portable form. You can withdraw consent for the waitlist at any moment, without giving a reason.

Email info@vanmoose.com and we will act on it. If you think we handled it badly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

9. Young musicians

If you are fourteen and making music on your computer, you are exactly who these plugins are for. Download them, play with them, break them — that is the best thing that can happen here. Nothing on this site asks a visitor for personal data in order to use it: the demos and the downloads need no account and no email address.

The one place age matters is the mailing list, because consent for marketing email works differently under 16. If you are younger than that, ask a parent before ticking the box — and if an address ended up on the list without that, write to us and it comes straight off.

10. Changes to this policy

If what we store changes, this page changes in the same release. The date at the top is the honest one — there is no separate archive to check.