Privacy Policy

1. Who we are

This website is operated by:

Mat White, trading as INLine COMPUTERS
Blue Lias Cottage
Sandford
BS25 5AF
UK

Contact: [email protected]

This policy explains how we handle your information when you use imgtool.app, including the Music Visualizer and other browser-based tools.

2. Lawful bases for processing

We process personal data under the following UK GDPR Article 6 lawful bases:

• Analytics (Google Analytics 4): consent — Article 6(1)(a)
• Payments and licence validation (Lemon Squeezy, our verification worker): contract necessity — Article 6(1)(b)
• Support and purchase-related correspondence: contract necessity where needed to provide or remedy a pass, and legitimate interests for service support and fraud prevention — Article 6(1)(b) or 6(1)(f), depending on the request
• Optional feedback: consent where you choose to submit information — Article 6(1)(a)
• Cloudflare server logs and security: legitimate interest — Article 6(1)(f) — for fraud prevention, DDoS protection, and service availability

3. Media files — your audio, images, and video

The Music Visualizer processes all media locally in your browser using the Web Audio API, Canvas API, and WebCodecs where available.

• Your audio, image, and video files are never uploaded to ImgTool.app servers.
• Processing happens entirely on your device — the visualizer, rendering, and video export all occur in your browser tab.
• This means ImgTool.app has no access to your unreleased music, private audio, or any media you use in the tool.
• Exported video files are saved directly to your device — they are not transmitted to us.

4. Analytics (Google Analytics 4)

We use Google Analytics 4 (GA4) to understand how people use the site — for example, which features are most used, how long people spend on the page, and where visitors come from. This helps us improve the product.

• GA4 is only loaded if you click "Accept analytics" on the consent banner. ImgTool uses a basic consent approach: it does not load Google's analytics tag or send Google an analytics consent ping before you opt in.
• If you decline, GA4 is not loaded and your visit is not tracked by Google Analytics.
• Your preference and its timestamp are stored in your browser's localStorage. You can reopen the consent prompt using an Analytics preferences control on tagged pages and withdraw consent at any time. The site may ask again after roughly six months so your choice can be refreshed.
• When consent is given, analytics events can include broad product-usage signals such as page views, button clicks, tutorial steps, export starts, export completions, pricing/upgrade clicks, which feature categories are used, which visualizer styles are selected and used in completed exports, whether a built-in or uploaded background was chosen, and coarse duration ranges such as 3-4m, 4-10m, or 30-60m. Style information uses the app's preset identifiers, not your track titles or custom text.
• If you arrive through an advert or campaign link and accept analytics, GA4 may receive short campaign labels such as source, medium, campaign name, campaign ID and advert variant. Our GA4 page-location setting removes all other page-address details, including payment and licence information and advertising click IDs.
• Analytics events do not include your filenames, track names, exact audio/video length, media content, lyrics, artwork files, or exported video files.
• To understand repeat use, the app may send a simple local browser status such as new_this_browser or returning_this_browser after analytics consent. This is based on local browser storage and is not an account or login.
• GA4 uses cookies and an online identifier after consent. Google may process the request IP address to derive coarse location information before discarding it from event and user data. We therefore describe GA4 data as pseudonymous rather than anonymous.
• Advertising storage, advertising user data, ad personalisation and Google Signals remain disabled for ImgTool analytics.
• GA4 does not include your media files or any personal information you enter into tool inputs.

Open analytics preferences

5. Cloudflare

ImgTool.app uses Cloudflare for content delivery, DNS, and security services. When you visit the site, your request passes through Cloudflare's network.

• Cloudflare may process standard server log data including your IP address, browser user agent, and request timestamps.
• This data is used for performance optimisation, DDoS protection, and abuse prevention.
• Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.

6. Payments (Lemon Squeezy)

When you purchase a paid pass, including the 10-Day Release Pass, 30-Day Creator Pass, or Annual Pass, payment is handled by Lemon Squeezy (lemonsqueezy.com), who acts as the Merchant of Record for all transactions.

• Lemon Squeezy collects and processes payment information (card details, billing address, email address) to complete your transaction.
• ImgTool.app never stores or has access to your card details.
• Lemon Squeezy handles VAT/tax compliance on our behalf.
• Your email address is collected by Lemon Squeezy to deliver your licence key and order receipt.
• When you activate or revalidate a paid pass, ImgTool.app sends the licence key, a browser-generated device identifier, the product reference, and pass timing data to our verification worker so the pass can be confirmed for this device.
• Our verification service receives licence and transaction metadata from Lemon Squeezy, which may include your name and email address. It returns and caches only the status, product, device-instance, and expiry fields needed to manage access. We do not receive your full card details.
• Lemon Squeezy's privacy policy is available at lemonsqueezy.com/privacy.

7. Cookies and local storage

ImgTool.app uses browser localStorage for necessary preferences and features you ask it to remember locally on your device. Google Analytics may set analytics cookies only after you accept optional analytics.

• Analytics consent — whether you've accepted or declined GA4, plus a local timestamp so the site can refresh that choice after an appropriate interval (currently about 6 months on this browser).
• Preview quality preference — your preferred preview resolution setting.
• Saved presets — visualizer settings you've saved (stored entirely on your device).
• Recent exports and resume state — recent export cards and last-session restore data are stored locally so the homepage and visualizer can help you pick up where you left off.
• Channel / release kit — if you save release defaults, colours, or branding locally, they stay in your browser and are not uploaded to our servers.
• Browser device identifier — a random local identifier is stored so paid pass validation can be tied to this browser/device without requiring an account.
• Licence key and pass state — if you activate a paid pass, the key, expiry time, and limited pass-status metadata are stored locally so the app knows your pass is active. If normal browser storage is unavailable, the app may keep this necessary information for the current tab or page session and warn you that you may need to enter your key again. Validation requests are described in the payments section above.
• Optional Creator Hub history — if you turn it on, this browser remembers session totals, export counts, recent track names, preferred styles, and milestone progress. This stays on the device unless you separately accept analytics. You can turn the history off and erase it from the Creator Hub without deleting saved projects or an active licence.

Third-party services may set or request their own cookies or similar identifiers in accordance with their own policies. In practice, this can include Google Analytics after consent, Lemon Squeezy during checkout, and Cloudflare for security/performance. ImgTool.app's analytics events only begin after you accept the analytics banner on this browser. Analytics cookies are configured with a non-rolling lifetime of up to approximately six months.

8. External content and static resources

Some pages request fonts from Google Fonts and interface files from jsDelivr. Those providers receive ordinary connection information such as your IP address, browser details, and request time. They do not receive the media files you load into ImgTool.

Homepage video previews use local poster images. A YouTube player is loaded only after you choose to play a video. At that point YouTube receives connection information and may use cookies or similar technologies under Google's privacy policy. You can instead follow the external YouTube link.

9. Support, feedback, and referrals

When you contact support or submit feedback, we receive the information you choose to provide, such as your email address, message, and optional diagnostic details. We use it to answer you, investigate problems, and improve the service. Please avoid putting unnecessary personal or confidential information in free-text fields.

Google hosts the optional feedback form and processes ordinary service information under its privacy policy. If you request a paid-user reward, we use the purchase email you provide to check eligibility. A referral request can also contain the referred purchaser's email; please obtain their permission before sending it. We do not publish a message or use it as a testimonial without permission.

10. Advertising

This release does not load Google AdSense or Google's advertising consent manager. Optional site analytics are covered by the analytics choices above. Lemon Squeezy's checkout uses the payment provider's separate privacy and cookie policies.

11. Data we do NOT collect

• We do not collect, store, or transmit your audio files, images, or video files.
• We do not require you to create an account or provide personal information to use the free tier.
• We do not sell your data to any third party.
• We do not use your data for purposes other than operating and improving this service.

12. Data retention

• Google Analytics 4: user-level data, key-event data, and other event-level data covered by GA4's retention controls are retained for 2 months. "Reset on new user activity" is disabled, so return visits do not restart the user-identifier retention period. Google removes expired detailed data during its monthly deletion process. Standard aggregated reports are not governed by these retention controls and may remain available for longer. These server-side settings are separate from the browser cookie and consent-choice lifetimes described above.
• Licence validation: the verification worker caches the limited pass-status response for between approximately 10 seconds and one hour. Separate security and infrastructure logs may be retained by the service provider for the period needed to operate and protect the service; we are confirming the deployed logging configuration rather than publishing an unsupported fixed period.
• Support and feedback: retained while we respond and investigate, then reviewed for deletion. Information may be kept longer where it is needed for a transaction, dispute, fraud prevention, or a legal obligation.
• Lemon Squeezy purchase records: retained by Lemon Squeezy under its own privacy, transaction, tax, and legal-retention rules.
• LocalStorage data on user devices: stored until cleared by the user or until the site removes it on a scheduled refresh (currently approximately 6 months for analytics consent).

13. International data transfers

Some providers may process information outside the United Kingdom, including Google, Lemon Squeezy, Cloudflare, YouTube, and providers used for support email. The appropriate safeguard depends on the provider, its role, and the destination. We review the applicable adequacy decision, UK-US Data Bridge certification, or contractual safeguard for each service and will provide information about the relevant safeguard on request.

14. Your rights and complaints (UK & EEA users)

Depending on the circumstances, you may ask to access, correct, or erase personal information, restrict its use, or receive a portable copy. You may object to processing based on legitimate interests. You can withdraw consent at any time; this does not affect earlier lawful processing. Given the nature of the service, most free-tier users have no account record held by us. If your request concerns a Lemon Squeezy transaction, you may also need to contact Lemon Squeezy.

To exercise a right or raise a data-protection complaint, email [email protected]. We will acknowledge a data-protection complaint within 30 days, investigate the concerns you raise, and explain our outcome.

You also have the right to lodge a complaint with the ICO (UK) or your local data protection authority.

15. Changes to this policy

We may update this policy as the service evolves. Material changes will be noted by updating the "Last updated" date at the top of this page. If an analytics purpose or consent request changes materially, we will ask for a fresh choice rather than treating continued use as consent.

16. Contact

Questions about this policy? Contact us at: [email protected].