Privacy

The short version: Baffle Studio contacts no third party, shows no advertising, and holds nothing about you unless you make an account. Visits are counted, on this server, in a way that cannot be traced back to you.

Who is responsible

This site is run by JHL, LLC, who decides what is done with the information described here. For anything on this page, write to contact@jaylyonvt.com.

Using Baffle without an account

Designing an enclosure, simulating it and reading the driver library need no account, and none of that reaches the server as personal data. The physics runs in your browser, and a design you have not saved has never left your machine. A share link carries the whole design in the part of the address after the #, which browsers never send to a server.

The server sees the ordinary things any web server sees: which page was asked for, and when. Your network address is used in memory to limit how often anyone can sign in or write, and Baffle does not record it in its database.

Counting visits

Baffle keeps a count of how often each page is read, so the people running it can tell what is worth working on. It is counted here, by this server, and no analytics company is involved.

What is stored is a daily tally: the date, the page, and a number. A page that is about one driver or one project is counted as its shape rather than its address, so the totals say how often driver pages are read and never which driver you looked at. If you followed a link from another site, the other site's host name is counted, and never the rest of the address, which can carry a search or a page that was private.

Counting how many people came needs a way to tell two visits apart, which is done without keeping anything about either. Your address and browser are hashed with a random number that is made in memory each morning and thrown away at midnight, and the result is what is stored. Today's number cannot be matched against yesterday's, and nothing kept anywhere could turn one back into an address, so "how many people came on Tuesday" is answerable and "was that the same person as Monday" is not.

Legitimate interests, Article 6(1)(f): a site's operator may reasonably want to know it is being read, and this is the least that answers it. Tallies are deleted after 400 days.

With an account

An account is needed for three things: saving a project, sharing one, and adding to the driver database. It holds:

• your email address, which is how you sign in;
• a one-way hash of your password. The password itself is never stored, and cannot be recovered from the hash;
• a display name, if you give one, which is optional;
• the date the account was made.

Alongside it: the projects you save, and a note on each driver, radiator or link you contribute recording that it was you.

Why, and on what legal basis

To give you what you asked for

Signing in, saving a project, sharing it. Performing a contract with you, in the words of Article 6(1)(b) of the GDPR.

To keep the shared library usable

Recording who contributed a driver, so a record can be traced and corrected. Legitimate interests, Article 6(1)(f).

To know the site is being read

A daily count of page views, with visitors distinguished by a hash whose key is destroyed nightly. Legitimate interests, Article 6(1)(f).

To stop abuse

Rate limits on signing in and on writing, keyed by account or by network address. Legitimate interests again.

Cookies and what is kept in your browser

Baffle sets one cookie, baffle_auth, and only once you sign in. It says which account you are, it cannot be read by scripts, it is not sent to other sites, and it lasts thirty days from your last visit. Signing out removes it.

Your browser also keeps a list of projects you have saved from that browser, so you can find them again. That list never leaves your machine.

There is no consent banner because there is nothing here to consent to. Both of those are needed for things you asked for, and neither is used to follow you. Counting visits needs your consent when it works by storing something in your browser, and this one stores nothing: the counting happens on the server and leaves your machine untouched. Baffle sets no advertising or analytics cookies, and loads no script, font or stylesheet from anyone else.

Who else sees it

Nobody. Baffle uses no analytics company, no advertising network and no third-party components loaded at runtime, so there is no one to share it with and nothing is sold. The site is hosted in the United States, and the company hosting it necessarily processes what passes through their machines.

If you are in the United Kingdom or the European Economic Area, that means what you save here is held outside it. There is no way around that while the site runs on one server, and there is no onward transfer to anybody: nothing is shared, sold or sent on. For an account and the projects in it, the transfer is what performing the service you asked for consists of, which is Article 49(1)(b) of the GDPR. If you would rather nothing of yours were stored in the United States, Baffle is fully usable without an account: the physics runs in your browser and an unsaved design never leaves your machine.

Two things you do are public by design, and worth knowing about: a driver you contribute is visible to everyone, as is the display name attached to it, and a project you share is readable by anyone holding its link.

How long it is kept

Visit tallies are deleted after 400 days, and the key that made the day's visitor numbers is gone by the following morning. Your account and your projects are kept until you delete them. Delete the account and the projects go with it, at once, rather than after a grace period.

What you can do about it

Under the GDPR you may ask for a copy of your data, have it corrected, have it erased, take it elsewhere, or object to how it is used. Two of those are buttons rather than requests:

• A copy of everything, as a file another program can read: your account page.
• Deletion, from the same page. Your projects are deleted with the account. What you contributed to the driver library stays, with your name taken off it, because other people's designs depend on those drivers and erasing you is a request to stop holding your personal data rather than to withdraw a measurement of a loudspeaker.

To correct something, or for anything else, write to contact@jaylyonvt.com. If you are in the UK or the EU and think this has been handled badly, you can complain to your national data protection authority.

Children

Baffle is a tool for designing loudspeaker enclosures and is not directed at children.

Changes

If this page changes in a way that matters, the change will be visible here. The repository this site is built from keeps its history, so what it said before is not lost.