Who to contact
This policy covers Darbuka Studio at darbukastudio.com. For privacy enquiries, access or correction requests, deletion assistance or complaints, contact the studio operator at info@darbukastudio.com. We use information to provide and secure this learning service, manage subscriptions and answer support requests.
Information we collect
- Accounts: email address, verification status and timestamps, a salted password hash protected with a separate server secret, and hashed sign-in/session tokens. We do not store readable passwords.
- Learning: practice bookmarks, lesson identifiers, check dates, aggregate rhythm scores, BPM and checkpoint results. Guest practice summaries and display preferences are stored in your browser.
- Billing: Stripe customer, checkout, payment and subscription references, status and access expiry. Stripe processes payment details on its hosted checkout; we do not receive or store full card numbers or card security codes.
- Support and security: information you send by email, administrative actions and technical request information processed by our hosting provider, such as IP address, request metadata and error/security logs. We use these to operate, troubleshoot and protect the service.
Microphone and timing measurements
Microphone permission is requested only when you enable it. Audio analysis runs on your device; our app does not upload or store microphone audio. A completed check sends compact strike timing measurements to our server if you are signed in, so the server can calculate the result. Raw strike timestamps are not retained in the learning database; aggregate reports are saved. A failed save may temporarily keep timing measurements in your browser’s session storage for retry. You can stop the microphone at any time, and completed or cancelled checks stop it automatically.
Why we use information
We use account details to verify email, authenticate you, recover access and send service messages. We use learning records to show your progress, billing records to manage access and subscriptions, and support/security information to respond to you and protect the service. We do not sell your personal information or use advertising pixels on our application pages. We do not currently send marketing newsletters.
Service providers and overseas processing
Cloudflare provides hosting, D1 storage, email delivery/routing and security. Stripe processes payments and billing. Support email is forwarded to the operator’s Google-hosted inbox. These providers may handle information in Australia, the United States and other countries where they or their subprocessors operate; we do not promise Australian-only storage. The exact location depends on the provider and service. See Cloudflare’s privacy policy, Stripe’s privacy policy and Google’s privacy policy. We may also disclose information where legally required or reasonably necessary to investigate abuse or protect rights.
Retention and protection
Account and learning records remain while your account is active unless deleted. Sign-in links expire after 15 minutes, sessions after 30 days, and expired authentication tokens, sessions and rate-limit counters are removed by a daily cleanup. Guest records remain until you clear the relevant browser storage. Deleted account records are removed from the live application database; provider backups or logs may persist for their retention periods. Stripe and support records may be kept where needed for accounting, legal obligations or resolving disputes. We restrict administrative access and use HTTPS and hashed credentials, but no online service can guarantee absolute security.
Your choices, access and complaints
You can use the first three lessons without an account or microphone, clear browser storage, sign out all devices, manage your subscription and request account deletion. Without an email address we cannot provide verified-account features; without billing details we cannot activate a subscription. Email us to request access to or correction of information, or to raise a privacy complaint. We may verify your identity before acting. We aim to acknowledge requests promptly and respond within 30 days; if more time is needed we will explain why. If you remain concerned, the Office of the Australian Information Commissioner can explain complaint options, including whether it has jurisdiction.
Children and changes
A parent or guardian should oversee account use and payments for anyone under 18. Please contact us about information submitted without appropriate authority. We update this policy when our practices change and will bring significant changes to affected users’ attention.