Privacy policy

The controller of your personal data is Tomasz Król, a natural person living and working in the Netherlands.

This document does not state a legal form or a business registration status. The controller is the natural person named above.

Contact for all matters concerning personal data: contact@codextune.com. This is the only address for the requests described in section 11.

No Data Protection Officer has been appointed. The conditions for a mandatory appointment, set out in Article 37 GDPR, are not met in this case.

The contact form is the only place on this website where data entered by the user is collected. It covers four fields:

• name
• email address
• subject
• message

Purpose of processing: to answer the enquiry submitted. The data is not used for any other purpose. The email address is not added to a mailing list.

Legal basis: where the enquiry concerns a specific service, the basis is Article 6(1)(b) GDPR, that is, steps taken at the request of the data subject prior to entering into a contract. In all other cases the basis is Article 6(1)(f) GDPR, that is, the legitimate interests of the controller. Those interests consist in replying to a person who has made contact.

Whether provision is obligatory: providing the data is voluntary. It is neither a statutory nor a contractual requirement. Providing an email address is a condition of receiving a reply. The consequence of not providing it is that no reply can be sent. An enquiry may also be sent as an ordinary email to the address given in section 1, disclosing only such data as the sender considers necessary.

Retention period: 24 months from the last message in the exchange. After that period the correspondence is deleted. If the correspondence leads to a contract, accounting records may be subject to separate retention periods under tax and accounting law.

Protection against abuse: when the form is submitted, the sender’s IP address is held for one hour in the memory of the process handling the request. This serves solely to limit the number of submissions sent from the same source. The data is not written to a database or to a file and ceases to exist after that period. The legal basis is Article 6(1)(f) GDPR, and the legitimate interest is the protection of the website against automated abuse.

This website is hosted by Vercel Inc. The hosting infrastructure records technical request data, as every web server does. That data includes in particular the IP address, the date and time of the request, the address of the requested resource, the response code, and the browser and operating system information sent by the browser.

This recording takes place whether or not the user submits any data, and is inherent in the operation of a server.

Purpose of processing: to keep the website available and secure, to detect abuse, and to diagnose faults.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is the maintenance of a functioning and secure website.

Retention period: logs are deleted automatically after a short period determined by the hosting provider under the service plan in use. The controller does not copy them, does not export them to other systems, and does not combine them with data from the contact form.

This website uses Vercel Web Analytics, provided by Vercel Inc., to measure traffic. The tool does not use cookies and does not identify individual persons.

Information collected:

• the address of the page visited and its path pattern
• the referring address, only where it originates outside this website
• the date and time of the visit
• an approximate location derived from the connection, at country, region and city level
• the device type and the name and version of the browser and operating system

How visitors are counted: instead of an identifier stored in the browser, a hash is calculated on the server from the data of the incoming request. That hash is not stored on the user’s device and is discarded after 24 hours.

What the tool does not do: it does not store or read any information on the user’s device, it does not build profiles, it does not track users across websites, and it does not allow a browsing history to be reconstructed or linked to an identified person.

What the controller receives: aggregate figures only, in the form of visit counts per page and summaries of traffic sources. The controller has no access to individual visits or to visitors’ IP addresses.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is establishing the overall number of visits and which content is viewed, in order to develop the website. The right to object to this processing is described in section 11.

Retention period: aggregate reports remain available in the statistics dashboard for a period determined by the service plan in use. They contain no data by which a person could be identified.

The provider’s account of its processing: vercel.com/docs/analytics/privacy-policy.

This website sets no cookies. It also makes no use of browser local storage (localStorage), session storage (sessionStorage), the IndexedDB database, or the Cache Storage API.

This statement has been verified by measurement rather than assumed. In a clean browser profile, every page was opened in turn in both language versions, each was scrolled in full, both online tools were used, and the browser’s storage and cookie list were then inspected. The result was zero cookies and empty storage. The verification was carried out on 9 August 2026 and is repeated after every change to code that runs in the browser.

The choice of language version is not stored either. The Polish and English versions have separate addresses (/pl and /en), so the language follows from the address of the page and does not need to be remembered.

Why there is no consent banner. The consent requirement in Article 5(3) of Directive 2002/58/EC, implemented in Dutch law as article 11.7a of the Telecommunicatiewet, applies to storing information on a user’s device or gaining access to information already stored on it. This website does neither, including for the visit statistics described in section 4. The consent requirement therefore does not arise and a banner is not required. Displaying one would suggest that the website stores data on the user’s device, which would not be accurate.

The only cookies that may appear in the browser in connection with this website are third-party cookies following the deliberate playing of a video. This is described in section 8.

Data is not sold and is not disclosed to other parties for their own purposes. The following parties process data solely on the controller’s instructions, under data processing agreements, to the extent necessary for the website to operate:

• Vercel Inc., hosting of the website and the visit statistics described in section 4. Terms: vercel.com/legal/privacy-policy.
• Resend, delivery of messages sent through the contact form to the controller’s mailbox. It has access to the content of the message, because that content is the body of the email being sent. Terms: resend.com/legal/privacy-policy.
• Cloudflare, Inc., operation of the website’s domain and forwarding of messages sent to the contact address given in section 1 to the controller’s mailbox. It has access to the content of such a message, because forwarding consists of receiving it and passing it on. This concerns messages written directly to that address, not the contact form, which does not use this route. Terms: cloudflare.com/privacypolicy.

Data may be disclosed to competent public authorities only to the extent and in the cases required by applicable law.

A separate note concerns Sanity, which the controller uses to draft the website’s own content. That system is not connected to the contact form, and the public website retrieves no data from it. User data is not transferred to it. It is named here so that its absence from the list above is not read as an omission.

Vercel Inc., Resend and Cloudflare, Inc. are established in the United States. Using their services involves transferring personal data outside the European Economic Area.

Basis for the transfer: the Standard Contractual Clauses adopted by the European Commission, referred to in Article 46(2)(c) GDPR, incorporated into the data processing agreements concluded with those parties. To the extent that a given party holds a current certification under the EU-US Data Privacy Framework, the transfer may additionally rely on the European Commission’s implementing decision on the adequacy of that framework.

Obtaining a copy of the safeguards: a copy of the Standard Contractual Clauses, or information on where they have been made available, may be obtained free of charge by writing to the address given in section 1.

The recordings presented in the Music Production and Sound Effects sections are stored on YouTube, operated by Google. This is the only part of the website that involves a connection to a third party, and it is therefore described in detail.

Before a recording is played. No connection to Google’s servers takes place until a recording is clicked. The thumbnails are stored on this website’s own server rather than retrieved from Google. This has been verified by measurement in a clean browser profile: a full pass through every section in both language versions generated no request to any Google domain and no cookie.

After a recording is played. Clicking a tile loads the player from the youtube-nocookie.com domain, that is, from YouTube’s data-restricted mode. From that moment the browser communicates with Google’s servers, which receive the user’s IP address, browser information, and information about the recording being played and the page on which it is played. The player is loaded solely as a result of the user’s own action.

Measured result. In a test carried out in a clean browser profile, playing a recording produced connections to the player, to the video stream and to supporting Google domains. No connection to the doubleclick.net advertising domains was observed, and no cookies were present after more than ten seconds of playback. The behaviour of the player remains outside the controller’s control and may change. The controller receives no data or statistics from it.

From the moment the player is loaded, Google’s terms apply: policies.google.com/privacy. The recordings may also be viewed directly on YouTube, on terms chosen by the user.

BoltPass. Passwords are generated entirely in the user’s browser, using the random number generator built into the browser. Generated passwords and generator settings are not transmitted or stored anywhere. The controller has no access to them.

Cloud Simulator. Calculations are performed entirely in the user’s browser. The one exception is searching for a city in order to retrieve real weather data. In that case the user’s browser sends a request directly to Open-Meteo. The request contains the name of the place searched for and, as with any internet connection, the user’s IP address. The response is returned directly to the browser and does not pass through the controller’s server. Until a city is searched for, no data leaves the browser.

This website does not involve:

• automated decision-making or profiling, including within the meaning of Article 22(1) and (4) GDPR
• advertising or advertising networks
• tracking pixels or social media plugins
• the sale, exchange or disclosure of data for marketing purposes

The controller does not obtain data about users from any other source. All data processed comes directly from the user or from the technical parameters of the user’s connection to the server.

None of the processing described in this policy relies on consent within the meaning of Article 6(1)(a) GDPR. There is therefore no consent that would need to be withdrawn.

In connection with the processing of your data, you have the following rights:

• the right of access to your data and to obtain a copy of it (Article 15 GDPR)
• the right to rectification of inaccurate or outdated data (Article 16 GDPR)
• the right to erasure (Article 17 GDPR)
• the right to restriction of processing (Article 18 GDPR)
• the right to data portability in a structured, commonly used, machine-readable format (Article 20 GDPR)
• the right to object to processing based on Article 6(1)(f) GDPR, that is, to the processing described in sections 2, 3 and 4 (Article 21 GDPR)
• the right to lodge a complaint with a supervisory authority, described in section 12

Requests should be sent to contact@codextune.com. No form and no particular format is required.

Exercising these rights is free of charge. A reply is provided without undue delay and in any event within one month of receipt of the request. Where requests are complex or numerous, that period may be extended by a further two months, in which case the person making the request will be informed together with the reasons for the delay (Article 12(3) GDPR).

You have the right to lodge a complaint with a supervisory authority if you consider that the processing of your data infringes the GDPR.

Given the controller’s place of establishment, which is the Netherlands, the competent authority is Autoriteit Persoonsgegevens, the Dutch data protection authority: www.autoriteitpersoonsgegevens.nl.

Under Article 77(1) GDPR, a complaint may also be lodged with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement. Exercising this right does not require contacting the controller first.

This policy describes the position as at the date stated at the beginning of the document. If the scope or manner of processing changes, the document will be updated and the date of revision changed.

No archived versions are maintained. The version currently published at this address is the one that applies.