Privacy
Last updated 1 November 2026
ALL 12 is run by Tomáš Novotný, who is responsible for your data (the data controller). It collects as little as it needs to work. This page lists all of it.
You can use ALL 12 without an account. To create one, you need an e-mail address and a password; we can't create an account without them. Everything else you give us is optional.
Cookies and browser storage
ALL 12 uses no advertising or tracking cookies, which is why it doesn't ask for cookie consent. It sets only these cookies, all on its own domain:
| Cookie | What it's for | Kept for |
|---|---|---|
csrftoken | Protects what you send to the app against cross-site request forgery. | 1 year |
sessionid | Keeps you signed in. Set only when you sign in. | 2 weeks |
all12.palette | Remembers the colour theme you picked. Set only if you pick one. | 1 year |
Your settings, such as the metronome, drum machine and practice setup, are saved in your browser's local storage, on your device. If you're signed in, your drum patterns and the setup of each practice session are also saved to your account (see below).
Usage statistics
When you open a page, we record which page it was and when, but not who you are: the record isn't linked to your account, even when you're signed in. This tells us which parts of the app people use, so we know what to improve. We rely on our legitimate interest in that (GDPR Art. 6(1)(f)).
To count how many people visit each day without using a cookie, we combine your IP address and your browser's user agent with a random value, and store only a one-way hash of the result. Your IP address and user agent are not stored with the statistics. The random value is replaced every day and the old one is deleted, so afterwards the hash can't be traced back to you or linked to your visits on other days.
Your right to object. You can object to these statistics at any time by e-mailing tom.novota@gmail.com. Since they aren't linked to your account and the daily hash can't be traced back once the day is over, nothing in them points to you afterwards.
Your account
If you create an account, we store your e-mail address, your password (only as a secure hash), your two-factor authentication setup, and what you save in the app: drum patterns, practice settings and practice history. We need this to provide the app to you (GDPR Art. 6(1)(b)). Account e-mails, such as address verification and password reset, are sent through Resend.
Feedback
When you send feedback, we store your message and, if you fill them in, your name and e-mail address. We use it to improve the app and to reply to you, which is our legitimate interest (GDPR Art. 6(1)(f)).
Server logs
Like any website, our web server logs requests, including IP addresses. We rely on our legitimate interest in keeping the service secure and fixing problems (GDPR Art. 6(1)(f)).
Who handles your data
- Oracle Cloud hosts our server and database, in Frankfurt, Germany, inside the EU.
- Resend sends account e-mails. It is based in the United States and certified under the EU-US Data Privacy Framework, which the EU recognises as protecting your data adequately.
We don't sell your data or use it for advertising. We don't make automated decisions about you or use your data to profile you.
How long we keep it
- Account data: until you ask us to delete your account.
- Usage statistics: 24 months.
- Feedback: 24 months.
- Server logs: 14 days.
Your rights
Under the GDPR you can ask us for a copy of your data, have it corrected or deleted, restrict how we use it, object to how we use it, and get your account data in a portable format. You can also complain to a data protection authority. In the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ).
Contact
Tomáš Novotný, tom.novota@gmail.com. You can also use Send feedback at the top of any page; leave your e-mail address there so we can reply.