Privacy Policy
Archived copy. This version of our Privacy Policy took effect on 1 October 2026. It was replaced on 2 October 2026. The current version is at music.swaco.co/privacy.html.
Effective: 1 October 2026
This policy explains what SwaCo LLC ("SwaCo", "we") collects when you use swaco.co, music.swaco.co (including the Community) and guitar.swaco.co (School of Guitar and Guitar Studio), why, who sees it, how long we keep it, and what you can do about it. It is written to be read, not skimmed; it is short because we collect little.
1. The short version
- Most of what you do stays in your browser. The guitar tools keep your recordings, scores and settings on your device. We never see them unless you deliberately send them to us.
- We have no analytics, no advertising, no tracking pixels, no third-party scripts, and we never sell personal information.
- We collect what an account, a forum, a lesson booking, a donation, or a giveaway entry needs, and nothing else.
- Everything we store is in the United States, with the providers listed in section 4.
2. What we collect, and why
2a. Visiting any of our sites
Our servers and content-delivery network receive your IP address, browser type, and the pages you request, as any website does. We do not use this to identify or profile you. Service logs may retain it for a limited time for security and debugging.
We set one cookie, swacoSession, only after you sign in. It holds your sign-in token (valid for one hour) so that one SwaCo account works across every *.swaco.co site. It is strictly necessary for sign-in; we set no other cookies. Sites also use your browser's local storage for your own settings (language, theme, progress), which never leaves your device.
2b. Creating an account
To create a SwaCo account we collect your email address, a password (stored only as a one-way hash by our identity provider, Amazon Cognito), a display name, and optionally the instruments and skills you choose, whether you give lessons, a bio, and a profile picture. If you sign in with Google, Google sends us your email address and name; we do not receive your Google password or access to your Google account.
Your display name, bio, skills, teacher status and profile picture are public on your profile page. Your email address is not shown to other users.
2c. Using the Community
Forum threads and replies you post are public, with your display name. When you offer or request a lesson we store the time slot, the skill, and which two users are involved, and show each of you the other's display name. We do not process payments for lessons, and we do not see or record lessons, which happen on third-party services the Teacher chooses.
2d. Donating
Donations are processed by Stripe. You enter payment details on Stripe's checkout page, not ours; we never receive your card number. Stripe shares with us your name, email address, the amount, and the payment status so we can see that a donation happened. Stripe's privacy policy governs its handling of your data.
2e. Entering a giveaway
We collect your email address and the interests you select. The entry is emailed to us and read in our mailbox; we do not store entries in a database. We keep only a count of how many people selected each interest, which contains no personal information. We use your email address only to contact you about the giveaway.
2f. Using the guitar tools (School of Guitar, Guitar Studio, Capture)
The tools run entirely in your browser. Your recordings, transcriptions, compositions, lesson progress and settings are stored on your device (in your browser's local storage and private file system) and are not transmitted to us. The microphone is used only while you have pressed a control that starts listening, and only locally.
Two things can leave your device, each only when you choose:
- Contributing a take. On the Capture page you may contribute a recording, its labels and metadata (tuning, capo, gear notes, device names, timestamps) to SwaCo for training and evaluating music- transcription models. We ask you to confirm this per take, keep a record of exactly what you agreed to, and store the take in a private, encrypted bucket linked to your account so that you can see and withdraw it. The Contributor Terms govern this. A recording may capture incidental room sound, including speech.
- Syncing to your own Google Drive. You may back up items to a folder in your Google Drive. This uses Google's
drive.filepermission, which lets the app see and change only files it created itself, never the rest of your Drive. The data goes from your browser to your Drive; it does not pass through SwaCo's servers, and SwaCo has no access to your Drive. After a Drive action, the browser also asks Google for the connected account's email or display name and aggregate storage use so it can show which account and quota are active. That status remains in browser memory only, is never sent to SwaCo, and can be cleared while revoking the Drive grant with Disconnect. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
2g. Loading a custom theme
Our sites let you restyle the page with a stylesheet from a URL you provide. If you do, your browser fetches that file from that address, and the operator of that address sees your request. That is your choice and not a SwaCo data flow.
3. What we do not do
We do not sell, rent, or trade personal information. We do not show advertising. We do not use analytics or tracking services. We do not share personal information with anyone except the service providers in section 4, or as section 5 describes. We do not build profiles of you across sites.
4. Service providers
| Provider | What they do for us | What they see |
|---|---|---|
| Amazon Web Services (US) | Hosting, storage, identity (Cognito), email delivery, databases, logs | Everything we store |
| Stripe | Payment processing for donations | Your payment details and contact information, under Stripe's policy |
| Sign-in with Google (if you choose it); sync to your own Google Drive (if you choose it); our business email; and, from the date below, storage of contributed takes on Google Cloud | Your Google identity for sign-in; your Drive account identity, storage quota, and the files your browser exchanges directly with your Drive; giveaway entries, which arrive as email; donation alerts, which arrive as email and carry the donor's name and the amount; contributed takes once they are stored on Google Cloud | |
| GitHub | Source-code hosting and deployment | No user data |
Each provider processes data under its own terms and only to provide its service to us.
A change in progress, as of 22 September 2026. Contributed takes are moving from Amazon Web Services to Google Cloud Storage. Until that move is finished they stay on Amazon Web Services; afterwards Google stores them for us, in the United States, on the same terms. Nothing else changes: we still ask for your consent per take, we still hold the recording as described in section 2f, you can still withdraw it, and what we may do with it is still governed by the Contributor Terms. This is a change of storage provider, not of what we collect or why.
5. When we might disclose information
We may disclose personal information if required by law or legal process; to protect the rights, safety or property of SwaCo, our users or others; to enforce our Terms; or to a successor if SwaCo is acquired or reorganised (we would notify you). We will tell you about legal demands for your data unless prohibited from doing so.
6. How long we keep it
| Data | Kept |
|---|---|
| Account, profile, avatar | Until you delete your account or ask us to |
| Forum posts | Until you delete them; we may keep deleted posts in backups for up to 90 days |
| Lesson slots and bookings | Until you delete your account; past bookings may be kept in aggregate without names |
| Donation records | As long as tax and accounting law requires (generally 7 years), at Stripe and in our records |
| Giveaway entries | Until the giveaway ends and prizes are delivered, then deleted from our mailbox |
| Contributed takes | Until you withdraw them. Superseded versions are deleted after 90 days. Models already trained on a take are not affected by withdrawal. |
| Server logs | A limited period for security and debugging |
| Data on your device | Until you clear it or your browser evicts it |
7. Your rights
Wherever you live, you can ask us to:
- see the personal information we hold about you;
- correct it;
- delete it, including your whole account;
- export it in a portable format;
- withdraw a contributed take, or object to a particular use;
- stop emailing you about anything other than your account.
Email swaco.llc@gmail.com from the address on your account. We will respond as promptly as we can, and within any period the law requires. We will not discriminate against you for exercising a right.
If you are in the European Economic Area, the United Kingdom or Switzerland: we are the controller of your personal data. We process it to perform our contract with you (accounts, lessons, contributions), on our legitimate interests in running and securing the Services, and with your consent where we ask for it (contributing a take, Drive sync). Your data is stored in the United States; by using the Services you understand this, and we rely on your consent and on the necessity of performing our contract with you for that transfer. You have the rights above plus the right to restrict processing and to complain to your data protection authority. We have not appointed an EU or UK representative.
If you are in California: the rights above are the rights to know, delete, correct, and opt out that California law gives you. We do not sell or share personal information for cross-context behavioural advertising and have not in the preceding 12 months. The categories we collect are those in section 2, for the purposes in section 2, from you directly and from Google if you sign in with it.
8. Children
The Services are not directed at children under 13 and we do not knowingly collect personal information from them. If we learn we have, we will delete it. Contributing recordings and taking or giving lessons are for adults (18+).
9. Security
Everything we store is encrypted at rest and in transit. Passwords are hashed by Amazon Cognito and are never visible to us. Contributed takes are in a private bucket reachable only through short-lived signed links. The browser never holds cloud credentials. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.
10. Changes
We will post changes here with a new effective date and, for material changes, notify account holders by email or on the Services.
11. Contact
SwaCo LLC · 20 W. Montgomery Ave, Apt 202, Ardmore, PA 19003 · swaco.llc@gmail.com