Privacy Policy

1. What we collect

• Account data: email address, username, password (stored hashed), and optional profile details such as bio, location, links and avatar.
• Content data: the MIDI files you upload plus their titles, descriptions, tags and metadata, and your comments.
• Activity data: downloads, favourites, follows and other interactions.
• Technical data: IP address, device and browser information, and log data used for security and abuse prevention.
• Consent data: your marketing email preference, when you gave it and the exact wording you agreed to.

2. Why we use it

• To operate your account and show your profile and uploads.
• To deliver files, previews and download links.
• To count downloads and favourites and to power search, ranking and recommendations.
• To prevent spam, fraud and abuse and to keep the platform secure.
• To handle copyright complaints and moderation.
• To send marketing emails — only if you opted in.

3. Legal bases

Where data protection law such as the GDPR applies, we rely on contract performance (running your account), legitimate interests (security, abuse prevention, improving the service), consent (marketing emails and non-essential cookies) and legal obligations (responding to lawful requests). [CONFIRM WITH COUNSEL.]

4. Who we share data with

We do not sell your personal data. We share it only with:

• infrastructure providers: hosting, database/authentication and storage/CDN partners that deliver the platform and your files;
• advertising partners, which may set their own cookies as described in the Cookie Policy;
• professional advisors, and authorities where the law requires it.

Some providers may process data outside your country. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses. [CONFIRM PROVIDER LIST AND TRANSFER MECHANISM.]

5. What is public

Your username, avatar, profile details, uploads, comments and public counts (such as downloads and followers) are visible to anyone. Your email address is never shown publicly. Do not put anything in your profile or file descriptions that you do not want to be public.

6. Advertising, Google AdSense and cookies

TUFF MIDI is free to use and can be supported by third-party advertising. Where advertising is switched on, it is served by Google (Google AdSense / Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC).

• Advertising cookies and local storage — Google and its advertising partners may store and read cookies, identifiers and similar information on your device to deliver ads, cap how often an ad is shown, detect invalid traffic and measure ad performance.
• Personalized vs non-personalized ads — with your consent, ads can be selected based on your interests and previous activity. Without that consent we request non-personalized (contextual) ads only, which still require limited storage for frequency capping, reporting and fraud prevention.
• Data processed — typically your IP address, device and browser information, the page you are viewing and advertising identifiers. We do not send your email address, username or password to advertising partners.
• Legal basis — your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG for storing or reading information on your device. You can withdraw it at any time with effect for the future.
• International transfers — Google may process data outside the EEA, including in the United States, on the basis of the EU Standard Contractual Clauses and its certification under the EU-US Data Privacy Framework.

No advertising script is loaded and no advertising cookie is set before you have made a choice. You can review or change your decision at any time using the "Privacy choices" link in the footer, or on the Cookie Policy page. Google's own information about how it uses data in advertising is available at policies.google.com/technologies/partner-sites.

Visitors in the EEA, the UK and Switzerland are asked for consent before personalized advertising technology is used. Where Google's certified consent management platform (IAB Transparency & Consent Framework) is active, the consent signal recorded there governs which advertising vendors may process your data.

7. Email marketing

Marketing emails are opt-in. Every email includes a one-click unsubscribe link and you can change your preference at any time in account settings. Unsubscribing never affects your ability to use the platform. We will still send essential service emails, such as password resets and important account or policy notices.

8. How long we keep data

We keep account and content data while your account exists. After deletion we remove your profile and uploads, though backups and caches may retain copies for a limited period and we may keep records needed for security, dispute handling or legal compliance. [SPECIFY RETENTION PERIODS.]

9. Your rights

Depending on where you live, you may have the right to access, correct, export, delete or restrict processing of your data, to object to processing based on legitimate interests, and to withdraw consent at any time. Contact [PRIVACY EMAIL] and we will respond within the period required by applicable law.

You also have the right to complain to your local data protection authority.

10. Security and storage

Data is stored on managed cloud infrastructure with encryption in transit. MIDI files are held in private storage and served through signed, expiring download links. No system is perfectly secure, so please use a strong, unique password and tell us at [SUPPORT EMAIL] if you suspect a problem.

11. Children

TUFF MIDI is not intended for users below the minimum age set in our Terms of Service. If we learn that we hold data from someone below that age, we delete it.

12. Changes and contact

We may update this policy; the date at the top always shows the current version. Contact: [LEGAL ENTITY NAME], [ADDRESS], [PRIVACY EMAIL].