BASHERY

Bashery Privacy Policy

Who we are and what this covers

Bashery is made by its two cofounders, @sashyo and @pettyvendetta, an independent team, reachable at support@bashery.app. This policy applies to the whole Bashery family:

• the Bashery drum-accompaniment app;
• VidSynth, a video synthesiser you run in the browser at vidsynth.bashery.app;
• the Studio at studio.bashery.app (make packs in the browser, and the synths you play in the page);
• the Web Kit at drum.bashery.app (a browser drum controller that can pair with the app); and
• the website at bashery.app (the landing page, demo, contact form, and this policy).

1. Playing collects no personal data

Bashery never asks you to create an account or sign in to play. Playing does not collect your name, email address, phone number, contacts, location, advertising ID, or any other personal identifier, and the app contains no analytics or tracking.

The one exception is sharing packs, which is optional and is described in section 7. Browsing the pack store and taking a free pack still need no account. An account is only involved if you choose to post a pack, or to get back a pack you already have on another device.

2. Processing happens on your device

When you play, Bashery listens to the timing of your drum hits and generates a backing band. All of it - the beat detection, the chords, the bass, keys, pad and lead, and the sound itself - is computed locally on your phone. Your drumming is not recorded or uploaded. Chord MIDI files you import are read on your device only and are not uploaded.

3. The Web Kit and the pairing relay

The Web Kit at drum.bashery.app lets a browser act as a drum controller for the phone app. When you pair them, the two devices exchange messages through a secure relay so they can talk across networks.

• What passes through: only musical event data - which pad or note was hit, its velocity, and timing - plus connection housekeeping. No personal information is involved.
• Pairing code: a random six-character code links your own two devices for the session. It is not tied to your identity.
• No storage: the relay forwards these messages live between your paired devices and does not store them.
• The Web Kit keeps your settings and pairing code in your browser's local storage, on your device. If you never use the Web Kit, no data leaves your device through the relay.

4. VidSynth: camera, microphone, and video

VidSynth is a video synthesiser in the Bashery family, a web app you run in the browser at vidsynth.bashery.app (installable to your home screen, but not a store app). Like the drum app, it runs entirely on your device and sends nothing to us.

• The source you choose: the visuals can be fully generated (no camera or files), your device's live camera, or a video file you pick. Camera frames and imported video are processed on your device, in real time, to make the visuals. They are not uploaded and never leave your device unless you record and share a clip yourself.
• Microphone (optional, off by default): if you turn on the audio-reactive mode, VidSynth listens to sound so the visuals can move with it. The audio is analysed on your device in real time and immediately discarded - never recorded, never stored, never uploaded. The microphone closes the moment you turn the mode off or leave the app.
• Recording: you can record what you see to a video file. The recording is saved to your device and goes nowhere else unless you choose to share it. If a recording includes the camera or the microphone, that footage is part of the file you control.
• MIDI: a MIDI controller can play VidSynth, the same way it can play the drum app.
• VidSynth makes no analytics, advertising, or tracking requests. The web version loads only its own files from vidsynth.bashery.app, then runs offline.

5. The Synths site

The Studio at studio.bashery.app is where packs are made, and its synths are ones you play on screen. They make their sound in the page, on your device - there is nothing to connect and no account.

• On your device: the synth runs locally, and your settings (the octave and the knob positions) are kept in your browser's local storage. No microphone, camera, or MIDI is used.
• The coin counter: a shared, global click counter (an arcade easter egg). Tapping the coin slot sends an anonymous "+1" to our relay and shows the running total. It carries no personal information - it is just a number everyone adds to.

6. The website and the contact form

The bashery.app website is a static landing page (with a demo video and this policy). It uses no cookies, and it serves its own fonts, so simply visiting it makes no third-party tracking or font requests.

• Contact / beta-request form: if you choose to use it, the form collects the name, email address, and optional message you type. It is delivered to us through Web3Forms, a form-handling service that passes the submission on to us (Web3Forms has its own privacy practices). We use it only to reply to you or to organize beta access, and we do not sell, share, or advertise with it.
• Retention: we keep contact-form messages up to 24 months after our last interaction with you, then delete them. You can ask us to delete yours sooner (see section 13).
• Don't want to share these details? Simply don't submit the form - email us at support@bashery.app instead.

7. The pack store (the Shed)

Sharing packs is the one part of Bashery with accounts, and it is optional. You can browse the Shed and take a free pack without signing in to anything. An account is only needed to post a pack of your own, or to get back a pack you have already taken on a different device.

If you do sign in, this is everything we hold.

• Your email address. It is the whole identity. There are no passwords.
• Sign-in codes. Kept only as a one-way hash, valid for ten minutes, usable once, and deleted the moment they are used.
• Your devices. A random identifier made on the device itself, plus the name that device reports, so a pack can be restored to it. Up to three, and you can remove them at bashery.app/account. The identifier is not derived from your hardware or from you.
• Your packs. The ones you post, and the ones you take while signed in, so they come back on your next device. Taking a pack while signed out records nothing.
• Your public profile, if you claim a handle: the handle, a display name, a short bio and a picture. These are public by design, because they are your shopfront.

Staying signed in. If you tick "stay signed in", the app or browser keeps one long-lived token so it can start a session again without another emailed code. It is tied to that single device, it expires after 90 days, and it is the only thing kept. Signing out removes it. The short-lived session token itself is never written to disk in the apps, and in a browser it lasts only as long as the tab.

We do not sell or share any of this, there is no advertising, and there are no trackers on the store pages.

8. Diagnostics and crash reports (opt-in)

To help fix problems, the app keeps a short technical log on your device - things like your device model, audio settings, and recent in-app events - and saves a crash report locally if the app stops unexpectedly.

This information is never sent automatically. It leaves your device only if you choose to share it - by tapping "Export diagnostics" or "Send report" - and only to the destination you pick (for example your own email or a chat app). You control whether and where it goes.

9. Permissions the apps use

• Internet: in the drum app, for the optional Web Kit pairing relay, and for the pack store if you use it (browsing the Shed, taking or posting a pack, signing in). Playing itself needs no connection at all. In VidSynth, only to load its own files (after which the web version runs offline).
• MIDI / USB: to connect an electronic drum kit or a MIDI controller.
• Bluetooth (optional): to find and connect a Bluetooth MIDI kit, and only while you are connecting one.
• Location, on Android 11 and below (optional): Android itself requires the location permission before an app may scan for Bluetooth devices, so the drum app has to ask for it to find a Bluetooth MIDI kit on those versions. We never read, use, store or send your location, and the permission is not declared at all on Android 12 and newer.
• Microphone (optional, off by default): in Bashery, only for the experimental "Acoustic kit" mode (listening for your kick, snare and cymbals); in VidSynth, only for the audio-reactive mode. In both, audio is analysed on your device in real time and immediately discarded - never recorded, never stored, never uploaded - and the microphone closes the moment you turn the mode off or leave the app. Neither mode turns itself on.
• Camera (VidSynth only, optional): used only when you choose the live-camera source, to turn the picture into visuals on your device. Frames are not recorded or uploaded by us.
• Video files (VidSynth only): used only when you pick a video to run through the synth. The file is read on your device; nothing is uploaded.

The drum app does not request the camera, contacts, or storage-wide access. For location, see the entry above: it is a Bluetooth scanning requirement on older versions of Android, and nothing to do with where you are. VidSynth does not request location or contacts.

10. Third parties

• Cloudflare operates the relay that forwards Web Kit pairing messages, and hosts the website. Standard network operation may involve transient technical logs at the infrastructure level; Bashery does not store the contents of your sessions.
• Resend delivers the six-digit sign-in codes for the pack store. Your email address is passed to it for that one purpose, under its own privacy practices.
• Web3Forms processes contact-form submissions so they reach us, as described in section 6, under its own privacy practices.
• YouTube (Google) hosts the demo videos embedded on our website. They are embedded in privacy-enhanced mode (youtube-nocookie.com), which sets no cookies until you press play, but loading a page that has one does contact Google and reveals your IP address to it. This applies to the website only. Nothing in the apps embeds video.
• Google Play distributes the Bashery app and may collect its own data under Google's policies. (VidSynth and the Synths are web apps and are not distributed through any store.)

We do not sell or share your information, and we do not use it for advertising or marketing.

11. Children

Bashery, VidSynth and the Synths are not directed at children under 13. They collect no personal data from anyone, and the contact form should only be used by adults.

12. Changes to this policy

If this policy changes, we will update the date at the top of this page.

13. Your rights and contact

You can ask us to access, correct, or delete the details you submitted through the contact form at any time. For that, or any privacy question, email support@bashery.app.

---