The short version
The licence: a serial signed for your machine ID. We receive that ID once, to issue and re-issue your licence, and nothing else about your computer.
This website: no cookies, no tracking, no third-party scripts, no external fonts or embeds. One local browser preference stores which of the three skins you picked.
Buying: your payment and billing details go to our merchant of record, not to us. We receive your name, email, country, machine ID and order details, because we have to issue the licence, support the order and keep tax records.
What the plugin stores, and what it sends
GoaSynth reports nothing: no telemetry, no analytics, no crash reports, no usage measurement, no advertising or analytics SDK, and no contact with us of any kind. Several of its features do write files on your own machine — the licence system, the preset bank, the AI designer's local memory and two small preferences — and exactly one of them can reach the internet, if you deliberately switch it on. Everything it writes stays on your own computer, on your own disk:
The machine ID
Unlicensed, the plugin shows a 20-character MACHINE ID on its activation screen. It is a one-way fingerprint derived from your computer's hostname, your user name, its network adapter addresses and the OS device id: those values cannot be recovered from it, but it is stable for that machine — which is exactly what makes a serial useless if it is passed to someone else. Treat it like a device serial number. It identifies a computer, not a person, and we recommend not posting it in public.
We receive it once — through the store's checkout, or by email — and use it to sign your licence serial. It is stored alongside your order record for as long as we must keep order data (§6), which is also what lets us re-issue a serial free of charge when you change hardware.
| What | Where | Why |
|---|---|---|
| Your presets | %APPDATA%/GoaSynth/Presets |
So your own patches are there next time |
| Preset browser state (your starred favourites and the last folder, tag, search and sort you used) | %APPDATA%/GoaSynth/browser.json |
So the patches you starred, and the filter you left the browser on, are still there next time. Plain local storage: preset names and filter text only - no audio, no credentials, and nothing about you. Delete the file and the browser simply starts fresh |
| Drawn wavetables and settings | Inside your DAW project, plus the plugin's own state files | So a project reopens exactly as you left it |
| Shared bank, if you use it | C:\Users\Public\Documents\GoaSynth |
So presets can be shared between accounts on one computer |
| Your licence serial | %APPDATA%/GoaSynth/License/license.txt |
So the plugin unlocks on this machine without asking again |
| Activation ledger and 24-hour trial stamp | C:\Users\Public\Documents\GoaSynth\License (machines.txt, trial.txt) |
So one serial stays bound to the machine it was issued for, and the trial cannot be reset by creating a second user account on the same computer |
| Cloud AI settings, if you use them | %APPDATA%/GoaSynth/ai.txt |
Your chosen engine, and your own API key or server URL |
| Learned AI memory, if you use the AI designer | %APPDATA%/GoaSynth/Learned |
The text briefs you typed and the parameter values a cloud model returned, so later LOCAL generations can borrow that character offline. It is plain local storage: no credentials, no model replies in raw form, and deleting the folder forgets all of it |
| Microtuning and interface preferences | %APPDATA%/GoaSynth/tuning.scl, %APPDATA%/GoaSynth/zoom.txt, %APPDATA%/GoaSynth/size.txt |
A copy of the Scala tuning file you loaded, your window zoom setting and the window size, so all three survive a restart |
None of that is transmitted anywhere. Uninstalling the plugin and deleting those folders removes
all of it — including the activation, which means a reinstall will need the same serial again (or a
fresh one from us, free, if the machine ID has changed). Preset packs you export
(.goapack) are files you create and send yourself; we are not involved.
Optional cloud AI — the only request the plugin can make
The AI patch designer's default LOCAL engine runs entirely inside the plugin and needs no network at all, so on a machine that has never been online every feature works. If you deliberately switch the engine to GEMINI, OPENAI or a CUSTOM base URL, the plugin makes a direct request from your computer to the provider you chose, using the API key or server address you entered. What is sent is the text brief you typed together with a compact list of parameter names and ranges; your presets, project files and audio are not included, and the request never passes through us.
A reply that survives validation is archived locally (see the table above) so the offline LOCAL engine can reuse its character later; that archive is never transmitted, by us or by the plugin.
In that case that provider is the recipient of the data: their terms and privacy policy govern it, and their charges apply, not ours. We receive nothing, store nothing, and cannot see your prompts. Leave the engine on LOCAL — or point CUSTOM at a server you host yourself, such as Ollama or LM Studio — and the plugin makes no network request at all.
This website
The site is a set of static files. It sets no cookies and runs no analytics, tracking pixels, heatmaps, A/B testing or advertising scripts. There are no embedded videos, no social widgets, no comment systems, and no third-party fonts, stylesheets or scripts loaded from a CDN — everything is served from this domain.
Two things you should still know about:
-
A local preference. When you click one of the three skin cards, the site remembers
your choice in your browser's
localStorage(keygoasynth-skin) so the next page you open matches. It is a functional preference, not a tracking identifier, it is never sent to us, and clearing your browser data removes it. - Server logs. Our hosting provider records standard access logs — IP address, user agent, requested file and timestamp — for security and abuse prevention. We do not analyse them for marketing, do not build profiles from them, and they are deleted after 14 days.
Buying a licence
Purchases are processed by Lemon Squeezy, who acts as the seller of record. They are the data controller for the payment itself: your name, billing address, email address, country and payment method details are collected and stored by them, under their privacy policy. We never see or store your card or bank details.
What we receive from them is limited to the order information we need to run the shop and the support desk:
- your name and email address,
- your billing country (used to determine tax, and to answer support questions),
- the machine ID you supply, used to sign your licence serial,
- the order reference, the amount paid, the product bought and its refund status.
We do not ask for your operating system, your DAW, your hostname, your phone number or your physical address, because the plugin does not need any of them. If you would rather not put your machine ID into a checkout form, email it to us instead — it is the same ID and the same result.
Support emails
If you write to us, we see your email address and whatever you choose to include — which often means a DAW screenshot or a project file name. We use it only to answer you, keep it in our mailbox, and do not add you to any list. Please send the smallest thing that solves the problem, and don't send anything you would rather keep private; nothing in a support attachment is needed to diagnose a plugin issue except the DAW name, version and steps.
Legal bases and retention
| Purpose | Legal basis (GDPR Art. 6) | Kept for |
|---|---|---|
| Delivering your purchase, licence and support | (b) performance of a contract | For as long as the licence exists; order records per the next row |
| Invoices and tax/accounting records | (c) legal obligation | 10 years (Serbian accounting and tax law) |
| Refunds, abuse and fraud prevention | (f) legitimate interest | Same as the order record |
| Support correspondence | (f) legitimate interest, or (b) as part of the contract | 24 months after the last message |
Your machine ID and the serial issued for it are kept with the order record for the same period, because together they are the record of which licence belongs to whom — and because that is what lets us release a binding and issue a new serial when you change computers.
We do not use your data for automated decision-making, profiling, scoring or advertising, and we do not sell it to anybody.
Who else sees the data
A short list, because there is nothing else:
- Lemon Squeezy — checkout, payment, tax, invoices, refunds (and the controller for the payment data).
- Gmail (Google) — our mailbox for orders and support.
- GitHub Pages (GitHub, Inc.) — serves this website and its access logs.
- Tax and financial authorities, where we are legally required to report or retain records.
Anyone acting on our behalf does so under a data processing agreement, and only for the purposes listed above. We use no advertising networks, no data brokers and no analytics vendors, so there is nobody else to list.
If you use a cloud AI engine inside the plugin, the AI provider you chose is a recipient of the prompts you send them — but under your account with them, not ours. We are not a party to that processing and receive none of it.
International transfers
Our store and email providers may process data outside the European Economic Area, for example in the United States. Where that happens they rely on appropriate safeguards — the EU Standard Contractual Clauses or an approved adequacy framework such as the EU-US Data Privacy Framework — and their privacy policies describe the mechanism they use.
Your rights
Under the GDPR you can ask us for access to your personal data, correction of anything wrong, erasure, restriction of processing, a portable copy, or to object to processing based on legitimate interests. Where processing rests on consent, you can withdraw it at any time.
Write to goasynth.privacy@gmail.com and we will respond within one month. If your request concerns a payment, invoice or the checkout itself, it is more efficient — and sometimes only possible — to go to Lemon Squeezy directly, since they hold that data. Note that tax law can oblige us to keep invoice records even after you ask us to delete everything else.
If you believe we have handled your data badly, you may complain to the data protection authority in your country. We would appreciate the chance to fix it first.
Marketing and tracking
We do not run a newsletter, do not send marketing email and do not retarget you after you leave. If a store's checkout offers to keep you updated about the product, that choice is yours and defaults to no; you can unsubscribe from any such message with one click.
Children
GoaSynth is a music production tool, not a product aimed at children, and this website is not directed at anyone under 16. We do not knowingly collect personal data from children; if you believe a child has sent us data, write to us and we will delete it.
Controller and contact
The controller for data described in §4–6 and §8 is David Jeremic, Cetinjska 26, 11080 Beograd (Zemun), Serbia — goasynth.privacy@gmail.com. For all payment data, the controller is Lemon Squeezy.
This policy is dated at the top of the page and covers version 1.1 of GoaSynth. If we ever add something that collects data — a mailing list, an embedded audio player, an analytics service — this page will be updated before that feature goes live.