Privacy
What we hold, and what we don't.
This page lists every piece of data KODA keeps, why we keep it, and how to get rid of it. It describes what is actually built, nothing more. When we ship something that changes what we collect, this page changes with it.
Last updated 17 August 2026 · Koda Sampler, Inc.
The short version
- We keep what your account needs to work: your email, your licenses, and the machines you've activated them on.
- Our servers count things like downloads and activations. The counts hold no IP addresses, and after 90 days only id-free daily totals survive.
- The KODA apps send light diagnostics: version, OS, and whether installs succeed. One switch turns it off. The engine inside your DAW makes no network connections at all.
- We don't sell data. There are no ads and no third-party analytics anywhere.
- Email support@kodasampler.com and we'll show you what we hold, correct it, or delete it.
01 · Who we are
Who we are
KODA is made by Koda Sampler, Inc., a United States company: 1119 N Las Palmas Ave, Los Angeles, CA 90038, USA. We are the company responsible for your data across every KODA property: this site, the account dashboard, the vendor portal, and the desktop apps. For anything on this page, write to support@kodasampler.com.
Two companion documents cover the rest of the relationship: the Terms of Service for the websites and your account, and the EULA for the software itself.
02 · Your account
What an account stores
When you create a KODA account we store your email address, a display name if you set one, and an avatar if you upload one. Sign-in runs on Supabase, our account provider, which holds your credentials in hashed form. We also record which access groups your account belongs to, such as early access, because that decides which products you can see and download.
03 · Licensing and activation
Licenses and your machines
Licenses are managed by Keygen, our licensing provider, and the license terms themselves live in the EULA. When you activate a product on a machine, Keygen stores a record of that machine: its name, its platform, and a device fingerprint, a one-way hash built from the machine's hostname, operating system and processor architecture plus a random per-install identifier. That record is what makes seats work, and it's what lets you free a seat up later from your account dashboard or the KODA Product Manager.
A device's name is usually its hostname, and hostnames often contain a person's name ("Alex's MacBook Pro"). If you'd rather not share that, rename your computer before activating.
Keygen's servers see the IP address of activation calls the way any web server does. We do not copy machine records or IP addresses into our own analytics.
04 · Server counts
What our servers count
Our servers keep operational counts: when a license activates or renews and whether it succeeded, when a download runs and how many bytes it moved, and which country a request came from, read from the request itself. These exist so we can answer questions like "did the last update break activations" and "how many installs are alive this week".
Raw counts are tied to your customer id where the server knows it, or to nothing at all. They never contain your IP address, and they expire after 90 days. What survives past 90 days is arithmetic: daily totals with every id dropped.
05 · Feedback and support
Bug reports and feedback
Reports from the Feedback tab in your account dashboard go into our issue tracker, ClickUp, so they actually get fixed. New reports are labeled with your customer id, not your email address. Our team looks the id up when we need to reply. Whatever you write in a report travels with it, so leave out anything you wouldn't put in a bug tracker.
06 · Email
When we email you
Account email, such as confirmation and password-reset messages, comes from our sign-in provider. Messages you send through the contact form reach us through Resend, an email relay. If you joined the mailing list, that address lives in MailerLite, you put it there yourself, and every mail has an unsubscribe link. We don't buy lists and we don't share ours. If you write to us, we keep the correspondence so we can actually help.
07 · The apps
What the apps on your computer send
The KODA Product Manager and the KODA Packager talk to our servers to do their jobs: signing in, activating and renewing licenses, reading the releases feed, downloading products. The one background job, the license renewer, keeps your activation certificates fresh once a day. It is described in the Manager and you can turn it off in Settings.
Since Manager 0.12 and Packager 0.5.3, the apps also send app diagnostics: which version they are, what OS they run on, and, in the Manager, whether an install or update succeeded or failed (a coarse failure category, never the error text, never a file name). Diagnostics are labeled with a random id you can see in the app's settings; it has no link to your account. This is on by default. The switch to turn it off lives under Diagnostics and usage, and turning it off also discards anything queued but not yet sent. Diagnostics only leave the machine when the app was already talking to us: at launch, on Refresh, and after the daily renewal. Never on a timer.
The Manager also has a separate Crash reports switch. Crash reporting itself has not shipped; the switch exists so your choice is already made when it does, and this page will say exactly what a crash report holds before the first one is ever sent.
The KODA engine, the part that loads inside your DAW, makes no network connections at all, for any reason. That is a design rule, not a setting.
Any further diagnostics will be described here before they ship, each with its own switch.
08 · The line
What we never collect
This list is copied from our engineering spec, where it is binding. A feature that wants an item on this list doesn't get built.
- Your audio, or anything rendered from it
- MIDI, notes, or anything you play
- Project or session names
- File names or paths from your machine
- Keystrokes or screen contents
- Your IP address, in any KODA store
- Precise location. A request’s country is as close as we look
- Full-memory dumps
- An inventory of other plugins you own
- Advertising or cross-site identifiers
10 · Processors
Who works on our behalf
These companies process data to provide their service to us, and for nothing else. Most run in the United States, so data you give us crosses borders.
| Company | What they do for us | Where |
|---|---|---|
| Cloudflare | Runs our servers, file delivery, and the operational counts described above | United States, global network |
| Supabase | The account database and sign-in | United States (us-east-1) |
| Keygen | Licensing and activation | United States |
| Vercel | Hosts this website, the account dashboard, and the vendor portal | United States |
| ClickUp | Bug and feedback triage | United States |
| Sentry | Error monitoring for our servers | United States |
| Resend | Delivers contact-form messages to us | United States |
| MailerLite | The mailing list, if you joined it | European Union |
Where data leaves the EEA or the UK, the transfer rests on safeguards such as Standard Contractual Clauses, as implemented by these providers. We may also disclose data if the law requires it, or as part of a merger, acquisition, or sale of assets; this policy follows the data if that ever happens.
11 · Retention
How long we keep things
| Data | How long |
|---|---|
| Account data | For as long as your account exists |
| Raw server counts and app diagnostics | 90 days, then deleted |
| Daily totals derived from them | Kept. They carry no ids at all |
| Server error reports | 90 days |
| The change ledger (grants, revokes, admin actions) | Kept, as the history of accounts and licenses |
| Feedback reports in our tracker | Until you ask us to remove yours |
| Mailing list address | Until you unsubscribe |
12 · Your rights
Your rights
Email support@kodasampler.com from your account address and we will show you what we hold on you, correct it, or delete it. We aim to complete requests within 30 days.
Deleting your account removes your personal details from our stores. The record that a license was granted survives without them, because license history is a contract record. If you're in the EU or the UK, these are your GDPR rights. We answer them the same way for everyone, everywhere, and we never treat you differently for using them.
For the formally minded: where GDPR applies, we process data to perform our contract with you (accounts, licenses, delivery), with your consent (the mailing list), under our legitimate interest in keeping the service secure and working, and to meet legal obligations. We do not sell or share personal data as the CCPA defines those terms. You can complain to your local supervisory authority, though we'd rather you email us first so we can just fix it.
13 · Children
Children
KODA isn't directed at children under 16 and we don't knowingly hold their data. If you believe a child has given us personal data, email us and we'll delete it.
14 · Changes
Changes to this page
We update this page whenever a shipped feature changes what we collect, and every revision is dated here.
- 17 August 2026App diagnostics added: Manager 0.12 and Packager 0.5.3 send version, OS and install outcomes, each with an off switch under Diagnostics and usage.
- 17 August 2026First published.