Synthgarage Privacy Policy

Who we are

Synthgarage is published by Bucket Brigade, New Zealand. For privacy questions, contact support@synthgarage.com.

What the app handles, and where it goes

Your patch library — on your device

Imported SysEx files, the sounds decoded from them, names, tags, collections, and the file and folder names they came from. Stored locally on the device.

If you are signed into iCloud and iCloud is turned on for Synthgarage, this library is mirrored through Apple CloudKit to your own private iCloud database, so it appears on your other devices. That includes the record of which in-app purchases you have unlocked. That database belongs to your Apple Account. Bucket Brigade cannot read it, and has no administrative access to it.

A small device list is also kept in your iCloud (key-value storage): a random identifier per device, its platform, and the day it was last used. It lets the app count how many of your devices use it. The identifiers are never sent to us; only the count is, as part of telemetry.

Instrument and MIDI settings — on your device

The names of MIDI ports and interfaces you select, MIDI channels, and per-instrument connection settings. These are stored on the device only and are not mirrored, because a port name on one machine means nothing on another.

App preferences and diagnostics — on your device

Interface state, import options, and a diagnostic log used for troubleshooting. The log stays on the device and is shown only inside the app. It is not transmitted anywhere.

Handoff between your devices

If Handoff is turned on, the app lets Apple pass what you are looking at — the current screen, the selected synthesiser, collection or sound, and any search text or tag filter — to your other devices signed into the same Apple Account, so you can pick up where you left off. Apple carries this between your devices; it does not reach Bucket Brigade.

Purchases

Additional synthesiser support is sold as one-time in-app purchases. Purchases are processed by Apple, and payment details never reach the app or Bucket Brigade. The app receives from Apple’s StoreKit only the fact that a purchase is valid, and records which items are unlocked in your library (and so in your iCloud, as above).

Apple’s handling of your purchase is governed by Apple’s privacy policy.

Sharing a collection

You can share a collection as a .sgcollection file, sent however you like — AirDrop, email, a forum post. The file contains the collection’s name and comment, its sounds and their names, any comments on those sounds, and an author name only if you enter one (it is never filled in from your device or account name). Nothing goes through Bucket Brigade. Once sent, the file is in the recipient’s hands, and they can pass it on.

Optional cloud backup — to an account you connect

You may connect a cloud storage account so that Synthgarage keeps a plain copy of your sounds there. This is off unless you turn it on.

When enabled, the app copies to the folder it creates in your account:

• SysEx files you import, byte-for-byte as they arrived, and their original filenames
• sounds created in the app, and dumps received from an instrument, as .syx files
• folders named after the manufacturer and model the sounds are for

Supported services and the access requested

• iCloud Drive — the app’s own container: a folder belonging to this app
• Dropbox — files.content.write, app-folder scoped: write only, inside Apps/SynthGarage
• Any other folder — a folder you choose: that folder only

Google Drive and OneDrive are not offered in the current version. If they are added, this policy will be updated first to describe the access they request.

Two things follow, and both are deliberate:

• The permissions requested are the narrowest each service offers. Synthgarage cannot read the rest of your Dropbox, and does not ask to.
• The files go from your device to your account. They do not pass through Bucket Brigade, and we never hold a copy.

Sign-in uses OAuth. The resulting access token is stored in your device’s Keychain. It is deliberately not synchronised to your other devices through iCloud Keychain, though it may be included in your device’s own encrypted backup. The app also stores the connected account’s email address on the device, so Settings can show which account is connected. Disconnecting in Settings ▸ Backup deletes the token from the device; revoking access at the provider ends it entirely.

Your use of those services is governed by their own policies: Apple · Dropbox

Anonymised telemetry

Synthgarage sends anonymised telemetry through TelemetryDeck, a privacy-focused analytics service, so we can see which features are used and where the app fails — for example imports, sends, parse failures, iCloud sync activity, and library sizes in broad ranges. Telemetry is always on. It is not linked to your identity:

• TelemetryDeck receives no advertising identifier, account or email. It receives a pseudonymous per-install identifier, hashed on your device and again by TelemetryDeck and salted for this app, used only to count users of Synthgarage. It cannot be matched to you or to other apps.
• TelemetryDeck does not store IP addresses.
• Signals are not used to build a profile, are not combined with data from other sources, and are never used for advertising.

Your content is not included unless you turn it on. In Settings ▸ General you can choose to send collection names and copies of sounds that failed to import or send (the SysEx message, which includes that sound’s name), to help us fix bugs. This is off by default. When it is on, these are sent separately from all other signals, with nothing that links them to you, your device or your other activity. Turning it off stops them at once, including any not yet sent.

Crash reports from Apple

If you have chosen to share analytics with app developers in your device settings, Apple may pass crash reports to us. That is governed by Apple’s policy and your device settings.

What the app does not do

• No advertising, and no advertising identifiers.
• No tracking across apps or websites, and no data shared with anyone for tracking. The telemetry above is not tracking as the App Store defines it: it is not linked to your identity and is not combined with data from other companies.
• No Synthgarage account, and no personal details collected to use the app.
• No sale or sharing of personal information.
• No attribution SDKs, no advertising SDKs, and no third-party crash reporter.
• No copy of your library reaches Bucket Brigade. Your library lives on your device, in your own iCloud, and in any cloud storage account you connect.

The app connects over the network only to: Apple (iCloud, Handoff, in-app purchases), Dropbox (only if you connect it, to sign in and write to your account), and TelemetryDeck (the telemetry above).

Legal basis for processing

For users in the UK and EU: your library is held on your own device, in your own iCloud, and in cloud storage accounts you connect, so Bucket Brigade does not process it at all. For the processing that remains:

• Performance of a contract: validating and restoring in-app purchases, which Apple carries out.
• Legitimate interests in understanding and improving the app: anonymised usage telemetry. You can object by contacting us; because it is anonymised we cannot single out your signals, so we would ask you not to use the app if you do not accept it.
• Consent: the collection names and failing sounds you choose to send (off until you turn it on, and withdrawn by turning it off).

Children

Synthgarage is not directed at children. It is intended for users aged 16 and over, and we do not knowingly collect personal information from anyone under that age. If you believe a child has provided us with personal information, contact support@synthgarage.com and we will delete it.

Security

Patch data is stored using the operating system’s own protections, including file-level encryption on a locked device. Cloud storage access tokens are held in the Keychain. The catalogue of synthesiser definitions shipped with the app is stored encrypted. No system is perfectly secure, and data held in your own iCloud or cloud storage account is protected by that provider and by the strength of your own account security.

Retention and deletion

• On your device: deleting the app removes its local data. Individual sounds, synthesisers and collections can be deleted in the app at any time.
• In your iCloud: managed through your Apple Account, in Settings ▸ Apple Account ▸ iCloud.
• In connected cloud storage: the folder is yours. Delete it, or revoke the app’s access, in that provider’s own settings. Disconnecting in the app stops further copies being written but does not delete what is already there — that is your copy to keep or remove.
• Shared collections: a file you have sent is in the recipient’s hands; deleting the collection in the app does not recall it.
• Telemetry: kept by TelemetryDeck for three months, then deleted. It is anonymised, and content you choose to send is unlinked, so individual signals cannot be traced back to you and located for deletion. Turning off content sharing stops it immediately.

Your rights

Depending on where you live, you may have rights to access, correct, delete, port or restrict the processing of your personal information, and to object to it, under the New Zealand Privacy Act 2020, the UK and EU GDPR, and comparable laws including the California Consumer Privacy Act where they apply to you.

Because Bucket Brigade holds no library of your data, most such requests are satisfied directly: the data is on your device and in accounts you control. Telemetry is anonymised and cannot be linked back to you, so there is no record of yours within it to access, correct or export. For anything you have sent us directly, such as an email, contact support@synthgarage.com and we will respond within 20 working days.

You may also complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz), or, if you are in the UK or EU, to your local data protection authority.

International transfers

Bucket Brigade is based in New Zealand. Because we hold no copy of your library, transfers of your data happen between you and the services you choose — Apple, Dropbox — and the people you share with, under those providers’ own terms and safeguards, rather than to us. Anonymised telemetry is processed by TelemetryDeck on our behalf and carries no information that identifies you.

Changes

If this policy changes materially, the updated version will be posted with a new effective date, and where the change requires it you will be told in the app.

Contact

Bucket Brigade

Publisher, Synthgarage

Email: support@synthgarage.com