Synth.Directory

last changed 10 September 2026

Privacy

Synth.Directory is run by Box Of Rules, a sole trader in Brighton, England, who is the data controller for this site. This page says what is stored about you, why, for how long, and how to get it changed or removed. The short version: an account needs an email address, everything you contribute is public under your handle, and nothing is sold or shared for advertising.

1. What is stored

  • Reading without an account: nothing personal. Server logs record the IP address, the page and the browser type for up to 30 days, for security and to keep the site up. A click on a record is counted for popularity, one per record per hour, without storing who clicked.
  • An account: your email address, a hashed password, your handle and display name, when you joined and when you last logged in. Two-factor codes and sign-in providers, when offered, are stored the same way.
  • Contributions: every claim, source, edit, image, sample, video link, preset, rating and favourite you add is stored with your account and the time. Claims, sources, edits, images, samples, videos and presets are public and credited to your handle; ratings and favourites are shown as counts only. Rejected contributions and the reviewer's reason are kept so the audit trail stays complete.
  • API tokens: the token name, a hash of the token, how many requests it has made and when it was last used.
  • Newsletter: your email address, the date you signed up and the fact that you did so here, held in the site's own subscriber list, separate from Box Of Rules. Every message has a one-click unsubscribe.
  • Corrections and takedown notices: the notice itself, including your name and contact details, kept for six years as a legal record.
  • Contact messages: your name if given, email, message and a hashed IP address, kept for up to two years, or twelve months once archived.

2. Why, and the legal basis

Running your account, publishing your contributions and answering your notices is performance of the contribution terms you agreed to. Server logs, spam protection and the popularity count are our legitimate interest in keeping a public reference work working and honest. Analytics and the newsletter run only on your consent, which you can withdraw at any time.

3. Cookies and local storage

  • Strictly necessary: a session cookie that keeps you logged in and protects forms, and a cookie remembering your cookie choice for a year.
  • Preferences: your light or dark choice, your language, and whether infinite scroll is on, kept in a cookie or in your browser's local storage. They identify nothing about you.
  • Analytics, only if you allow it: Google Analytics 4 counts visits with IP addresses anonymised. It loads only after you choose "Allow analytics" in the cookie notice, and never before. Choose "Only what is needed" and it never loads. To change your mind, clear this site's cookies and the notice returns.
  • No advertising cookies, ever.

4. Third parties

  • Cloudflare sits in front of the site for security and caching and sees the same request data as our own server.
  • Cover art is loaded straight from the Cover Art Archive (Internet Archive), so their servers see your IP address when a cover is shown. We never host it.
  • YouTube videos load only when you click to play them; from that moment Google's own privacy policy applies.
  • Account and newsletter email is sent through a transactional email provider that processes your address on our behalf and does not use it for anything else.
  • Nobody buys, rents or is given your data. Public contributions are public and, under the site licences, may be copied by anyone, including by search engines and AI systems.

5. How long

Your account lasts until you delete it. When you do, the email address and password are removed within 30 days; contributions already published stay, credited to your handle, because other contributors and the audit trail depend on them, unless you also ask for the handle to be replaced with "a former contributor". Server logs go after 30 days, the newsletter address as soon as you unsubscribe, takedown notices after six years.

6. Your rights

Under UK GDPR you can ask for a copy of what is held about you, have it corrected or erased, object to processing, or take it with you in a usable format. Write to [email protected] and a person answers within a month. If you are unhappy with the answer you can complain to the Information Commissioner's Office at ico.org.uk.

7. Children

The site is not aimed at children and accounts are for people aged 13 or over. If you think a child has made one, tell us and it is removed.

8. Where data lives

The site and its database run on servers in the European Union. Google (analytics, only with consent) and Cloudflare may process data in the United States under the UK and EU adequacy arrangements and standard contractual clauses.

9. Changes

Changes are dated at the top of this page. Anything that widens what is collected is announced on the site before it takes effect. The contribution terms are at Terms.