Last updated: August 2026 — Beta draft
HITLOCH is operated as a beta product. This policy covers the HITLOCH web application at hitloch.com and describes what data it processes and why.
Account data: the email address and password (stored as a salted hash, never in plain text) you register with, plus an optional username and display name for each profile you create (producer and/or artist).
Profile content: anything you choose to add to a profile — bio, location, genres, tags, languages — and any profile picture you upload.
Content you upload: beat and loop audio files, cover art, and any text you write (beat descriptions, messages, feedback).
Usage and security data: every login attempt (success and failure), registration, password change, and account lockout is logged together with the request's IP address and user agent, for account security and abuse prevention — this is the only systematic use of IP addresses on the platform.
Cookies: see the dedicated section below.
HITLOCH does not run any analytics or advertising trackers, does not sell or share data with third-party marketers, and does not use any third-party processor beyond the infrastructure needed to run the service itself (see Hosting, below). If that changes — for example, adding product analytics — this page and the cookie banner will be updated first.
To provide the core service: creating and authenticating your account, storing and serving the beats/loops/profiles you and other users create, and enabling the producer↔artist collaboration workflow the product exists for. Security logging exists to protect accounts against unauthorized access (brute-force login attempts, credential stuffing).
HITLOCH sets one strictly necessary cookie for your login session, and one functional cookie that remembers whether you're viewing the app as a producer or an artist when you have both profiles. Neither is used for tracking, advertising, or analytics, and neither is shared with any third party. Because they're strictly necessary for the site to function, they aren't covered by the consent banner — there's nothing optional to opt in or out of yet. If that changes, the banner and this section will be updated to reflect it honestly rather than silently.
The application, database, and all uploaded files are self-hosted on infrastructure we control — there is currently no third-party cloud storage or CDN provider in the data path.
Account and content data is kept for as long as your account exists. Security logs (login/lockout events) are retained separately from your account for legitimate security-audit purposes, and may persist briefly after account deletion for that reason — see Account Deletion below.
You can permanently delete your account at any time from Settings. This removes your login credentials, email, and the personal fields on your profile(s). Content you created that a collaboration partner still relies on (a shared beat, a message, a piece of feedback) is preserved for them, but is no longer attributed to your identity — it shows as coming from a "Deleted user"/"Deleted producer"/"Deleted artist" instead. This reflects a deliberate choice to anonymize rather than break other people's data when you leave, consistent with data-minimization principles.
Beyond deleting your account yourself, you can update or correct your account and profile data at any time from Settings. For anything Settings doesn't cover (e.g. a full export of your data, or a question about what's stored about you), contact us at the address below.
[Contact address to be added before public launch.]