Good Plugins
Good Plugins · legal

privacy

Last updated 30 July 2026

1. Who we are

Good Plugins (“we”, “us”) makes FLEXTRACT, a macOS application, and operates thegoodplugins.com. The data controller is [[LEGAL ENTITY NAME]], [[REGISTERED ADDRESS]].

For any privacy question, or to exercise any right in section 7, email support@thegoodplugins.com.

2. What we collect, and why

We collect only what the product needs to function. There is no advertising, no tracking pixel, no analytics profile and no third-party data broker.

2.1 If you join the beta

The beta form asks for your email address and name, and optionally your city, studio or label name and social handle. We use these to decide who to invite in each wave and to send you a licence serial when your place opens. Name, city, studio and socials are optional — the form works with an email alone.

A separate marketing consent checkbox records whether you agreed to product updates. It defaults to off, and we do not send marketing unless you tick it.

2.2 If you create an account

We store your email address and a cryptographic hash of your password. We never store, log or transmit your password in readable form, and we cannot recover it — we can only send you a reset link.

2.3 If you activate FLEXTRACT on a Mac

Licences allow two machines, so we have to know which machines. For each activation we store:

  • A hashed machine fingerprint. The app takes your Mac’s hardware identifier, hashes it before it leaves your computer, and the server hashes it again before storing it. We never receive or hold the raw hardware identifier, and the stored value cannot be reversed back to it.
  • A machine name — the computer name you set in macOS, for example “Youssef’s MacBook Pro”. This exists so you can tell your two machines apart on your account page and remove the right one.
  • The app version, and the dates of activation and of the most recent licence check.

FLEXTRACT does not read, upload or transmit your projects, audio, samples or file names. Extraction happens entirely on your computer. The only thing the app sends us is a licence check: your serial and the hashed machine fingerprint.

2.4 If you join the waitlist

Your email address and which part of the site you signed up from, so we know whether you asked about FLEXTRACT or about producer packs.

2.5 Server logs

Our hosting provider keeps standard request logs (IP address, timestamp, requested path) for a short period for security and debugging. We deliberately do not write licence serials or personal data into our own application logs; email addresses in diagnostic messages are masked.

3. What we do not do

  • We do not sell, rent or share your personal data with anyone for their own purposes.
  • We do not use advertising or cross-site tracking technology.
  • We do not build behavioural profiles.
  • We do not access your audio, projects or files.
  • We do not use your data to train machine-learning models.

4. Cookies and local storage

We set no advertising or analytics cookies. The site stores two things in your browser’s local storage, both strictly functional:

  • your light/dark theme choice;
  • your sign-in session, if you have an account, so you are not asked to sign in on every page.

Clearing your browser storage removes both and signs you out.

5. Who processes your data for us

We use a small number of service providers (“processors”) who handle data on our instructions only:

  • Supabase — database and account authentication. Our database is hosted in London, United Kingdom (eu-west-2).
  • Vercel — website and API hosting, and request logs.
  • Resend — sending transactional email such as your serial and password resets.
  • Lemon Squeezy — will process payments when Pro goes on public sale. They act as merchant of record and handle card data; we never see or store card details. This is not active during the beta.

Some of these providers are established in the United States, so your data may be transferred outside the UK/EEA. Those transfers rely on the providers’ standard contractual clauses. [[CONFIRM WITH COUNSEL]]

6. How long we keep it

  • Beta applications — until the beta programme closes, or until you ask us to delete them.
  • Accounts and licences — for as long as your account exists. Delete your account and we remove it.
  • Activation records — until you remove that machine on your account page, or your licence ends.
  • Waitlist — until you unsubscribe or ask for removal.

7. Your rights

Depending on where you live you may have the right to: access the data we hold about you; correct it; have it deleted; restrict or object to our processing; receive a copy in a portable format; and withdraw consent for marketing at any time.

Email support@thegoodplugins.com and we will respond within 30 days. We will not charge you, and we will not make you justify the request.

If you are in the UK or EEA and you think we have handled your data badly, you may complain to your national data protection authority. We would rather you told us first, but that right is yours regardless.

8. Security

All traffic is encrypted in transit. Passwords are stored only as hashes. Machine identifiers are hashed twice — once on your computer, once on our server. Database tables are not directly readable by any client; every read goes through a specific, permission-checked function. Licence tokens are cryptographically signed so they cannot be forged.

No system is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your data we will tell you and the relevant regulator as required by law.

9. Children

FLEXTRACT is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.

10. Changes

If we change this policy we will update the date at the top. If a change materially affects how we use data you have already given us, we will email you about it rather than relying on you noticing.