Privacy Policy
Last updated
1. Who is responsible
Clark kHz LLC d/b/a Phase Ctrl ("we") is a Wyoming limited liability company, and is responsible for personal information collected through phasectrl.com. We are an independently owned and operated business.
We do not publish a postal address. Reach us through the contact page, or for anything covered by this policy, at privacy at phasectrl dot com.
2. What we collect, and why
We have tried to make this list exhaustive rather than illustrative.
The "Lawful basis" column is the GDPR / UK GDPR justification, and matters if you are in the EEA or the UK. US state privacy laws do not use it; your rights under those laws are in section 6 either way.
Account data
| Data | Why | Lawful basis |
|---|---|---|
| Email address | Sign-in, verification, license delivery | Contract |
| Password (hashed by Firebase Authentication — we never see it) | Sign-in | Contract |
| Display name, Instagram handle, website (optional) | Personalizing the account area | Contract |
| Email verification status | Gating downloads | Contract |
Download and license data
| Data | Why | Lawful basis |
|---|---|---|
| Which products and versions you downloaded, with timestamp | Support, fraud prevention, license enforcement | Legitimate interests |
| IP address and user agent at download time | Abuse detection | Legitimate interests |
We keep download records for as long as your account exists, because they are what entitles you to the versions you have paid for. Deleting your account deletes them with it, and you can ask us to remove them sooner — see section 6.
Free demo requests
You can download a free demo without an account, by giving us an email address.
| Data | Why | Lawful basis |
|---|---|---|
| Email address and which demo you asked for | Linking the demo to your account if you register later, and support | Legitimate interests |
| Time of the request | Support, and telling one request from another | Legitimate interests |
| IP address, for a short period | Rate limiting the form against abuse | Legitimate interests |
We do not verify this address, and we do not treat it as proof of identity. If you later register an account and verify the same address, the demo appears in that account.
Asking for a demo does not subscribe you to anything. The form has a separate, unchecked box for that, and the download works whether or not you check it.
A demo request is not attached to an account, so there is no account lifetime to tie it to. We keep it for as long as that product is still available to download, and delete it once the product is not. You can ask us to remove it sooner — see section 6. The rate-limiting IP is separate and is kept for 10 minutes.
Mailing list
If you subscribe, we store your email address, the page you subscribed from, the time, and a truncated IP address for abuse triage. Basis: consent. You can withdraw it at any time using the unsubscribe link in any email, which takes effect immediately.
You can subscribe from the newsletter form or from the optional box on a free demo request. In both cases it is a deliberate opt-in, never a side effect of doing something else, and we record which one it came from.
Delivery is handled by Resend (Plus Five Five, Inc.), who process the address on our behalf.
Analytics
We use Google Analytics 4 on this site, and only after you accept the cookie banner. Decline, and no analytics script is loaded and no analytics cookie is set — on these pages, the request to Google is never made at all.
When enabled, GA4 collects pages viewed, approximate location, device and
browser type, and a randomly generated identifier stored in a _ga cookie for 2
years. The location is worked out from your IP address, which Google does not
store — that is how GA4 behaves by default rather than a setting we switched on.
Advertising signals are denied in every case, whether or not you accepted the banner, so nothing collected here is used to personalize ads or build an advertising profile.
Our listings on Gumroad are measured too, and the choice you make here does not reach them. While we sell through Gumroad, their product pages carry our Google Analytics measurement ID, so what you do there — viewing the listing, adding to the cart, and completing a purchase, along with its value — is reported into the same Analytics property as this site. Gumroad loads that tag on their own pages: our banner does not run there and cannot switch it off, so this happens whether you accepted or declined here. What applies instead is Gumroad's own privacy notice and cookie controls. If you did accept here, the two visits may also be recognized as one, which is how we can tell that a purchase followed from trying a demo on this site.
Basis: consent, for the analytics we run on these pages. The Gumroad measurement described above is Gumroad's own collection on their pages, under their notice rather than this one.
Cookies we set ourselves
| Cookie | Purpose | Lifetime |
|---|---|---|
__session |
Keeps you signed in. HttpOnly, so scripts cannot read it. | 5 days |
phasectrl_consent |
Remembers your cookie choice so we stop asking. | 1 year |
_ga, _ga_* |
Google Analytics, only after consent. | 2 years |
The first two are strictly necessary or set on your explicit instruction, and are not used for tracking.
Other storage on your device
Cookies are not the only thing a site can keep in your browser, so this is not covered by the table above.
| What | Where | Purpose | Lifetime |
|---|---|---|---|
phasectrl_cart |
localStorage |
Remembers what you put in your cart. | Until you clear it or check out |
Your cart is stored on your device. It holds only the identifiers of the products you added — no prices, and nothing about you. It is sent to us when you open the cart panel or start a checkout, because that is when we have to turn those identifiers into names and prices.
It is emptied when you empty it, and when a payment succeeds. Clearing your browser's site data removes it, the same as a cookie.
This is strictly necessary storage, set on your explicit instruction — you added something to a cart — so it does not depend on the cookie banner.
If you are signed in, we also keep a copy, so your cart follows you between devices. It holds the same product identifiers and nothing else, is tied to your account, and is never shared. When you sign in on a device, the cart on that device and the one on your account are combined — you keep everything from both, which does mean something you removed on one device can come back from another. Your cart page always lists exactly what you are about to pay for.
Basis: legitimate interests — keeping a shopping cart working across your devices. Signing out leaves the cart on that device and does not delete the copy on your account; emptying your cart does.
3. What we do not do
- We do not sell personal information, or share it for cross-context behavioral advertising. See section 6.
- We do not run advertising trackers, pixels, or social embeds.
- We do not collect the content you process with our software. The apps do not phone home with your material.
4. Where your data is processed
We are a US company and your data is stored and processed in the United States. Our infrastructure runs on Google Cloud Platform in us-central1 (Iowa, USA).
If you are in the EEA or the UK, that means your data is transferred outside your region, to a country whose surveillance and redress laws differ from your own. Those transfers rely on [Standard Contractual Clauses / the UK Addendum / the EU-US Data Privacy Framework] with the relevant provider.
Processors we use:
- **Google (Firebase / Google Cloud)** — hosting, authentication, database, file storage, analytics.
- **Resend (Plus Five Five, Inc.)** — transactional and marketing email.
- **Stripe** and **Gumroad** — payment processing, and **merchant of record** for purchases. That is more than a processor relationship: for the sale itself they are the seller, and they decide independently what they collect and keep in order to take payment, calculate tax and meet their own legal obligations. They are controllers in their own right for that data, and we never receive your card details. See their privacy notices for what they hold; this policy covers only what reaches us — which for a purchase is the email address, what was bought, and when. Gumroad also runs our Google Analytics measurement ID on their listing pages, outside the control of the banner on this site — see Analytics in section 2.
5. How long we keep things
| Data | Retention |
|---|---|
| Account data | Until you delete your account |
| Download events | As long as the account exists |
| Demo requests | As long as that product is available to download |
| Rate-limiting IPs | 10 minutes |
| Mailing list entry | Until you unsubscribe, then a suppression record only |
| Saved cart | 30 days after you last change it, then deleted automatically |
| Analytics | 14 months (GA4 retention setting) |
The saved cart's 30 days is enforced by the database itself, not by a job that has to remember to run.
6. Your rights
Which rights you have depends on where you live, but we apply the list below to everyone rather than asking you to prove residency first.
You may ask us to:
- **tell you** what personal information we hold about you, where it came from, and who we shared it with;
- **give you a copy** of it in a portable format;
- **correct** anything inaccurate;
- **delete** it;
- **stop** using it — withdraw consent, or opt out of analytics, at any time.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. We have never done so. There is therefore no "Do Not Sell or Share My Personal Information" process to complete — the answer is already no, for everyone.
We will not discriminate against you for exercising any of this: no price change, no degraded service, no withheld download.
To exercise a right, email privacy at phasectrl dot com from the address on your account, or use the account page to change or delete your details directly. We respond within 45 days, and will tell you if we need the extension that California law allows. There is no charge. If we cannot verify that the request is yours, we will say so rather than act on it.
If you are in California, you may also designate an authorized agent to act for you, and you may appeal a refusal by replying to our response. Residents of other states with comparable privacy laws have substantially the same rights and the same appeal route.
If you are in the EEA or the UK, you additionally have the right to restrict or object to processing, and to complain to your supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, your national data protection authority.
Complaints from the US can go to your state attorney general, to the California Privacy Protection Agency if you are a California resident, or to the Federal Trade Commission. We would rather you emailed us first.
7. Security
Passwords are hashed by Firebase Authentication and never reach our servers in readable form. Session cookies are HttpOnly, Secure and SameSite=Lax. Access to production data is limited to named administrators. Paid binaries are not publicly readable and are served only through short-lived signed links tied to a verified account.
No system is perfectly secure. If you believe you have found a vulnerability, please email security at phasectrl dot com before disclosing it publicly.
8. Children
The service is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it. This is the threshold the US Children's Online Privacy Protection Act sets; in the EEA and the UK the equivalent age of consent for online services is 16, and we treat that as the threshold for visitors there.
9. Changes
We will post changes here and update the date above. Material changes will be emailed to account holders.