Privacy

Last updated 11 August 2026

Shadowly is run by Tomas Johnny, an independent developer, who is the data controller for the information described here. This page explains what the service stores about you, what it never receives at all, and how to get your data back or deleted. If anything is unclear, or you want to exercise any of the rights below, write to tomasjohnny94@gmail.com.

Your audio never reaches us

This is the part worth reading first, because it is unusual and because it shapes everything else.

The audio files you practise with are never uploaded. They are opened and decoded inside your browser. No copy is sent to us or to anyone else.
Your recordings are never uploaded. When you speak a phrase back, that recording is stored in your own browser and stays there. There is no recordings table on our servers and no file storage in our stack.

A consequence you should know about: because recordings live only in your browser, clearing your browsing data deletes them, and browsers can also discard local storage on their own when a device runs low on space. We cannot recover them, because we never had them. Export anything you want to keep.

What we do store

If you use Shadowly without an account

Nothing. Your phrase splits and settings are saved in your own browser. We do not set an identifier for you and there is no record of your visit beyond ordinary server logs.

If you create an account

Your email address, because it is how you sign in. There is no password.
Sign-in tokens and session records, so a link emailed to you can be used once and so you stay signed in. Sign-in links expire 24 hours after being issued.
Your practice data: for each file you split, its file name, its length, a fingerprint of its contents, the times of your phrase boundaries, any per-phrase gap you set, phrase labels, and your repeat, gap and speed settings.

The fingerprint is a one-way hash. It lets the same file be recognised on another device so your work reappears; it cannot be turned back into audio.

If you subscribe

Payments are handled by NOWPayments. We never see or hold your wallet, your keys or your funds, and we do not ask you to connect a wallet to this site — you pay from wherever you keep your coins, on their page.

We keep a record of each purchase: which period you bought, its price, the payment identifiers NOWPayments gives us, which coin you paid in, the amount received and the date your access ends. That last date is what tells the app whether your paid features are on.

Please note that a blockchain is a public, permanent record. We do not publish anything to it and we do not link your wallet address to your account in our database, but the transaction itself is visible to anyone and cannot be deleted by us or by you.

Cookies

Shadowly sets cookies only to sign you in and to protect the sign-in form against cross-site request forgery. Both are strictly necessary for the service to work, and there is no way to use an account without them.

Beyond those, Google Analytics sets cookies to recognise a returning browser and to work out whether two page views belong to one visit. They are not necessary for the service — everything in the editor works with them blocked, and blocking them costs you nothing.

Analytics

We use Google Analytics to count visits and see which pages people actually use. It tells us that a guide was read or that the editor was opened; it does not tell us who you are, and we make no attempt to connect it to your account.

What Google receives is what any third-party script receives directly from your browser: the page you are on, where you arrived from, your approximate location, your device and browser, and an identifier held in the cookies described above. Your IP address is used to derive that approximate location and is not stored by Google Analytics.

None of your audio is involved. The files you practise with and the recordings you make never leave your device, so there is nothing about them for any analytics service to receive — not their contents, not their names, not their length.

You can opt out for every site at once with Google’s browser opt-out add-on, or by blocking the script or its cookies. How Google handles data from sites that use its measurement tools is described at policies.google.com/technologies/partner-sites.

Advertising

Shadowly does not currently serve third-party advertising, and no advertising network receives anything about you. If that changes, this page will be updated before any such advertising appears, and the subscription will continue to remove ads entirely.

Who else handles your data

NOWPayments — payment processing. They receive the amount due and a reference to your order, and they see the blockchain transaction that pays it. They do not receive your email address from us.
Google — delivery of sign-in emails. They receive your email address and the sign-in link.
our hosting and database provider— runs the servers and the database your account and practice data sit on. We’ll name them if you ask.
Google Analytics — counting visits and page views. Like AdSense below, it receives nothing from us: its script runs in your browser and sees only what your browser tells it. It gets no account of yours, no file of yours and no recording of yours.

We do not sell your data, and we do not share it with anyone for their own marketing.

How long we keep it

Account and practice data is kept while your account exists. Sign-in tokens expire within 24 hours and sessions expire on their own. Billing records are kept as long as tax and accounting rules require, which is typically several years and is not something we can shorten on request.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything attached to it. Write to tomasjohnny94@gmail.com from the address on the account and we will action it within 30 days.

Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to your national data protection authority.

Children

Shadowly is not directed at children under 16, and we do not knowingly create accounts for them. If you believe a child has an account, tell us and we will remove it.

Changes

If this page changes materially, the date at the top changes with it, and we will tell account holders by email before the change takes effect.