Privacy Policy
Effective: 2 October 2026
Last updated: 2 October 2026
This policy explains what SwaCo LLC ("SwaCo", "we") collects when you use swaco.co, music.swaco.co (including the Community) and guitar.swaco.co (School of Guitar and Guitar Studio), why, who sees it, how long we keep it, and what you can do about it. It is written to be read, not skimmed; it is short because we collect little.
1. The short version
- Most of what you do stays in your browser. The guitar tools keep your recordings, scores and settings on your device. We never see them unless you deliberately send them to us.
- We have no analytics, no advertising and no tracking pixels, and we never sell personal information. The only outside code our sites load is Google's sign-in library, which the guitar app fetches from Google only when you choose to sync with Google Drive (and any stylesheet you load, section 2g).
- We collect what an account, a forum, a lesson booking, a donation, or a giveaway entry needs; section 2 lists everything.
- We host the Services with Amazon Web Services in the United States. Our business email (Google), our payment processor (Stripe) and our content-delivery network's servers outside the United States may handle some data in other countries; section 4 says which.
- This is a summary; sections 2 to 11 say exactly what we do.
2. What we collect, and why
2a. Visiting any of our sites
Our servers and content-delivery network receive your IP address, browser type, and the pages you request, as any website does. We do not keep web-server access logs, and we do not use this information to identify or profile you. Sign-in and sign-in renewal requests to our identity provider, Amazon Cognito, are recorded, with the IP address, browser type and, for many of them, your account ID, in an activity log that Amazon Web Services keeps for 90 days; we use it only for security and troubleshooting. Our servers also keep error and diagnostic logs, which normally contain no personal information; we have not yet set an automatic deletion period for them.
We set one cookie, swacoSession, when you sign in. It holds your sign-in token, which contains your account ID and email address (and, if you sign in with Google, your name and your Google account ID), expires after about an hour, and is shared across *.swaco.co so that one sign-in works on every SwaCo site. Your browser's local storage also keeps the tokens that renew your sign-in for up to 30 days, which your browser sends only to our identity provider, Amazon Cognito; during Google sign-in, your browser's session storage briefly holds a one-time code that completes the sign-in and the page to return you to. Local storage also keeps your own settings and work (language, theme, progress and, in the guitar tools, much more), which stay on your device unless you choose otherwise (section 2f). During Google sign-in, our identity provider's sign-in page (on amazoncognito.com) and Google may set their own cookies, and Stripe's checkout page sets its own if you donate. All of these are needed for something you asked for (signing in, paying, or keeping your own settings and work), and we use none of them for tracking.
2b. Creating an account
To create a SwaCo account we collect your email address, a password (stored only as a one-way hash by our identity provider, Amazon Cognito), a display name, at least one instrument or skill, chosen from our list, if you register with an email address, and optionally whether you give lessons, a bio, and a profile picture. If you sign in with Google, Google sends us your email address, your name and whether Google has verified your email address, and our identity provider records your Google account ID; we do not receive your Google password or access to your Google account. Your public display name starts as your Google name or, if your Google account has no name, your email address, until you change it on your profile.
Every SwaCo account, including one created on guitar.swaco.co, has a public profile page, at an address that includes your account ID, showing your display name, bio, skills, whether you give lessons and your profile picture. Public means anyone, including search engines, can see it. The profile is created when you register, before you confirm your email address. We do not show your email address to other users, except as a display name as described above. Your profile picture is published as the file you upload, including any information your camera or phone stored in it, which can include where the photo was taken; remove that information before uploading if you do not want it public.
2c. Using the Community
Forum threads and replies you post are public, with your display name and account ID; the display name shown is the one you had when you posted. Lesson booking is paused while we prepare a new version of it. When it is open and a Teacher (Teachers and Students are defined in our Terms of Service) offers lesson times, every signed-in user can see them with the Teacher's display name and account ID. When a Student requests a lesson we store the time, the length, the skill, the status of the request, when it was made, and which two users are involved, with both of your display names, and show each of you the other's display name. If either of you deletes your account, the booking is deleted for both. We do not process payments for lessons, and we do not see or record lessons, which happen on third-party services the Teacher chooses.
2d. Donating
Donations are processed by Stripe. You enter payment details on Stripe's checkout page, not ours; we never receive your full card number. Stripe shows us your name, email address, the amount and the payment status, so we can see that a donation happened, together with limited card details (such as the card brand, last four digits, expiry date and country, and your billing postal code if Stripe asks for it) and the results of Stripe's fraud checks, which can include the IP address and approximate location the payment came from. When a donation is paid we also send ourselves an email alert with your name and the amount (not your email address), which we keep in our business mailbox. Stripe's privacy policy governs its handling of your data.
2e. Entering a giveaway
Our planned giveaway is paused and is not accepting entries. Entries received while the entry form was online, between 4 August and 2 September 2026, contain an email address, the interests selected and any "Other" detail typed. They were emailed to us and are read in our mailbox; we did not store them in a database, and we keep only a count of how many people selected each interest, which contains no personal information. We use an entrant's email address only to contact them about the giveaway. Nothing submitted while the giveaway is paused is an entry. If anything is still sent to the old entry address, it reaches our mailbox; it is not an entry, we do not use it, and we delete it when we find it.
2f. Using the guitar tools (School of Guitar, Guitar Studio, Capture)
The tools run entirely in your browser. Your recordings, transcriptions, compositions, lesson progress and settings are stored on your device (in your browser's local storage and private file system) and are not transmitted to us. The microphone is used only while you have pressed a control that starts listening, and only locally.
Two things can leave your device through the tools, each only when you choose:
- Contributing a take. Where contributing is open to you, you may contribute a recording, its labels and metadata (tuning, capo, gear notes, device names, timestamps) on the Capture page to SwaCo for training and evaluating music-transcription models. We ask you to confirm this per take, keep a record of exactly what you agreed to, and store the take in a private, encrypted bucket linked to your account so that you can see and withdraw it. The Contributor Terms govern this. A recording may capture incidental room sound, including speech.
- Syncing to your own Google Drive. You may move items to a folder in your Google Drive. Once an item is uploaded, the copy on your device is replaced by a placeholder and Drive holds the only copy. This uses Google's
drive.filepermission, which lets the app see and change only files it created itself, never the rest of your Drive. The data goes from your browser to your Drive; it does not pass through SwaCo's servers, and SwaCo has no access to your Drive. After a Drive action, the browser also asks Google for the connected account's email or display name and aggregate storage use so it can show which account and quota are active. That status remains in browser memory only, is never sent to SwaCo, and can be cleared while revoking the Drive grant with Disconnect. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sending us material directly. If we have agreed with you that you will send recordings, labels, transcriptions or diagnostic files by email or a shared folder, they are held in our business email or cloud drive (both provided by Google, which may store them outside the United States) and on the computers we use to work with them, under the agreement we have with you about them, and you can ask us to delete them.
2g. Loading a custom theme
Our sites let you restyle the page with a stylesheet from a URL you provide. If you do, your browser fetches that file from that address, and the operator of that address sees your request. A link to our sites can also include a stylesheet address; following such a link may apply that stylesheet for that page view or offer it for you to apply, and it is saved only if you confirm. Whenever a stylesheet is fetched, its operator sees your request in the same way. SwaCo receives nothing from either.
3. What we do not do
We do not sell, rent, or trade personal information. We do not show advertising. We do not use analytics or tracking services. We do not share personal information with anyone except: other users, as section 2 describes (your public profile and posts, and the details of a lesson shown to the other person in it); the service providers in section 4; the person delivering a giveaway prize, as a giveaway's Official Rules describe; and as section 5 describes. We do not build profiles of you across sites.
4. Service providers
| Provider | What they do for us | What they see |
|---|---|---|
| Amazon Web Services (US) | Hosting, storage, identity (Cognito), email delivery, databases, logs, and our content-delivery network, which keeps copies of public pages and profile pictures on servers in and outside the United States | Everything we store in our own systems |
| Stripe | Payment processing for donations, in the United States and other countries | Your payment details and contact information, under Stripe's policy |
| Sign-in with Google (if you choose it); sync to your own Google Drive (if you choose it); our business email, which Google may store outside the United States; and, once the move described below is complete, storage of contributed takes on Google Cloud | Your Google identity for sign-in; your Drive account identity, storage quota, and the files your browser exchanges directly with your Drive; giveaway entries and email you send us; donation alerts, which carry the donor's name and the amount; recordings and other material you send us directly; contributed takes once they are stored on Google Cloud | |
| GitHub | Source-code hosting and deployment | No user data |
Each provider processes data under its own terms. Some, such as Stripe (for example, to prevent fraud) and Google (for our business email), also use data for their own purposes under their own privacy policies. Services a Teacher chooses for a lesson (for example a video-meeting service) are not our service providers; they are independent services under their own terms and privacy policies.
A change in progress, as of 22 September 2026. Contributed takes are moving from Amazon Web Services to Google Cloud Storage. Until that move is finished they stay on Amazon Web Services; afterwards Google stores them for us, in the United States, on the same terms. Nothing else changes: we still ask for your consent per take, we still hold the recording as described in section 2f, you can still withdraw it, and what we may do with it is still governed by the Contributor Terms. This is a change of storage provider, not of what we collect or why.
5. When we might disclose information
We may disclose personal information if required by law or legal process; to protect the rights, safety or property of SwaCo, our users or others; to enforce our Terms; as part of the copyright notice and counter-notice process (Terms section 10); or to an affiliate, or to a successor or buyer in a merger, acquisition, reorganisation or sale of all or part of our business or assets (we would notify you). In an emergency involving danger of death or serious physical injury, we may disclose information to law enforcement without a court order. Where the law allows and it is practical, we will try to tell you about a legal demand for your data before we comply, unless we are prohibited from doing so or believe that telling you could put someone at risk or hinder an investigation.
6. How long we keep it
| Data | Kept |
|---|---|
| Account, profile, avatar | Until you or we delete your account, including an account whose email address was never confirmed |
| Forum posts | Until you or we delete them, or your account is deleted |
| Lesson slots and bookings | Lesson times a Teacher posts (open, booked or past): until the Teacher's account is deleted. Bookings: until the Teacher's or the Student's account is deleted (deleting either deletes the booking for both). We may keep counts that identify no one |
| Donation records | For at least as long as tax and accounting law requires, in our records, including the donation alert emails in our mailbox; Stripe keeps its own records under its own policy |
| Giveaway entries (4 August – 2 September 2026) | In our mailbox until we decide whether to run the giveaway, then deleted; you can ask us to delete yours at any time |
| Anything sent to the old giveaway entry address after 2 September 2026 | Deleted when we find it; never treated as an entry |
| Email you send us (requests, reports, copyright notices) | As long as we need it to handle the matter and keep a record of how we did |
| Contributed takes, and material you send us directly | Until you withdraw them. Withdrawn takes, and superseded versions of a take, stay in our storage bucket for up to 90 days before they are deleted. Material you sent us by email or shared folder: until you ask us to delete it. Models already trained on a take are not affected by withdrawal. |
| Server logs | Error and diagnostic logs: until we delete them; we have not yet set an automatic deletion period. Sign-in activity records kept by Amazon Web Services (account ID, IP address, browser type): 90 days. |
| Data on your device | Until you clear it or your browser evicts it |
Backups and copies we must keep. Deleted data may remain in backups, if we keep them, for up to 90 days. We may keep information after you ask us to delete it where the law requires us to (for example, when law enforcement asks us to preserve it), or where we reasonably need it to protect someone's safety, investigate misuse of the Services, or establish, exercise or defend legal claims, and only for as long as that purpose requires.
7. Your rights
Wherever you live, you can ask us to:
- see the personal information we hold about you;
- correct it;
- delete it, including your whole account;
- export it in a portable format;
- withdraw a contributed take, or object to a particular use;
- stop emailing you about anything other than your account.
Email swaco.llc@gmail.com from the address on your account or, if you have no account, from the address you used with us. We may need to confirm that a request comes from you. We will respond as promptly as we can, and within any period the law requires. We will not discriminate against you for exercising a right.
Some limits apply. We may keep information as section 6 describes. We do not delete other people's content, such as a reply that quotes you, and cannot delete copies held outside the Services, such as a calendar file another user saved; withdrawing a contributed take does not undo models already trained on it. Changing your display name does not change it on posts, lesson times or bookings you made earlier. These limits apply only as far as the law allows.
If you are in the European Economic Area, the United Kingdom or Switzerland: we are the controller of your personal data. We process it to perform our contract with you (accounts, lessons, contributions), on our legitimate interests in running and securing the Services, and with your consent where we ask for it (contributing a take, Drive sync). Your data is stored mainly in the United States (section 4 says where else it may be handled); by using the Services you understand this, and we rely on your consent and on the necessity of performing our contract with you for that transfer. You have the rights above plus the right to restrict processing and to complain to your data protection authority. We have not appointed an EU or UK representative.
If you are in California: the rights above are the rights to know, delete, correct, and opt out that California law gives you. We do not sell or share personal information for cross-context behavioural advertising and have not in the preceding 12 months. The categories we collect are those in section 2, for the purposes in section 2, from you directly, from Google if you sign in with it, and from Stripe if you donate.
Do Not Track. We do not track you across other websites, so our sites work the same way whether or not your browser sends a Do Not Track or Global Privacy Control signal. Apart from Google (when you use Google sign-in or Drive sync), Stripe (on its own checkout page) and any site a theme is loaded from (section 2g), no third party collects information about your activity on our sites.
8. Children
The Services are not directed at children under 13 and we do not knowingly collect personal information from them. If we learn we have, we will delete it, except anything the law requires us to keep (section 6). We do not ask for your date of birth, we do not keep your age, and we do not verify age; the guitar app asks once whether you are 13 or older and remembers, on your device, only that you said yes, when, and to which version of the question. Contributing recordings and taking or giving lessons are for adults (18+). If you are a parent or guardian and believe your child is using the Services in a way our Terms do not allow, email us; we may remove content or close the account.
9. Security
We use HTTPS for every connection, and data we store with Amazon Web Services is encrypted at rest. Passwords are stored only as a one-way hash by Amazon Cognito; when you register, sign in or reset your password, it passes over an encrypted connection through our servers to Cognito, and our code does not store or log it. Contributed takes are kept in a private bucket that contributors reach only through short-lived signed links. SwaCo's own cloud-account credentials are never sent to your browser. We take reasonable measures for a service of our size, but no system is perfectly secure and we cannot guarantee the security of your data. If we learn of a breach affecting your personal data, we will notify you, and any authority, as the law requires.
10. Changes
When we change this policy we post the new version here with a new "Last updated" date. If the change is material, it also gets a new effective date and an entry in the list below, and we make reasonable efforts to tell account holders, by a notice on the Services or by email. Where the law requires it, we will ask for your consent before using personal information we already hold in a materially different way from what this policy said when we collected it.
Changes to this policy:
- 2 October 2026: corrected and expanded what this policy says about the outside code our sites load, cookies, sign-in storage and sign-in records, Google sign-in and public profiles, the forum and lesson booking, donations, giveaway entries, the guitar tools and material sent to us directly, custom themes, where data is processed, sharing with other users, legal disclosures, how long we keep data, your requests, Do Not Track, children and security; narrowed three statements: when we tell you about a legal demand for your data (section 5), how we tell you about changes (section 10), and which stored data we say is encrypted (section 9); and added this list. The previous version is kept here.
- 1 October 2026: donation alerts to our business email carry the donor's name and the amount.
- 24 September 2026: added our postal address.
- 23 September 2026: described the Drive connection status the guitar app shows.
- 22 September 2026: recorded that contributed takes are moving to Google Cloud Storage, and added Google Drive sync to section 4.
- 14 September 2026: removed a fixed 30-day response time for requests.
- 8 September 2026: removed the description of Listen, which was retired.
- 2 September 2026: first published (revised 3 September 2026).
11. Contact
SwaCo LLC · 20 W. Montgomery Ave, Apt 202, Ardmore, PA 19003 · swaco.llc@gmail.com