Privacy Policy

Who is responsible

guitarbase.info is operated by a private individual. For anything in this policy — access to your data, correction, deletion, or a complaint — write to privacy@guitarbase.info.

What we collect

If you create an account

• Email address — required to register and to sign in.
• Password — stored only as a scrypt hash. We cannot read your password, and we never keep it in plain form.
• Username — generated automatically from the part of your email address before the @ sign.
• Optional profile details you choose to add: display name, first and last name, avatar image, short bio.

What you post

Reviews and ratings, comments, photos you upload, guitars you mark as owned or wanted, and your favourites. Anything you post publicly is visible to everyone, with your username next to it. Uploaded photos are checked by a moderator before they appear.

Technical data

• A session cookie, so you stay signed in between visits. It is set only after you sign in.
• Your IP address, used to limit how many sign-in and registration attempts can come from one place. It is kept only as a counter key for the length of that window — 15 minutes for sign-in, one hour for registration — and then deleted automatically.
• Ordinary web server access logs, kept by the server and the reverse proxy.

Analytics — only if you agree

If you accept in the banner, Google Analytics records which pages you visit, approximately where you are, what device and browser you use, and how you arrived at the site.

If you decline, the tag runs in Google's consent-denied mode: it stores nothing on your device and sends Google only a cookieless signal that a page was viewed. Advertising features stay switched off either way — we never ask for advertising consent because we never use it.

Cookies and local storage

Nothing above is used for advertising or shared with advertisers.

Why we are allowed to do this

• Your account and what you post — we need this to provide the service you signed up for.
• Security and rate limiting — our legitimate interest in keeping the site working and resistant to abuse.
• Analytics — your consent, and nothing else. You can withdraw it at any time.

Who else sees your data

• Google receives analytics data if — and only if — you consent. Google acts as our processor and may transfer that data to the United States. See Google's privacy policy.
• Our hosting provider stores the site's database and uploaded files on our behalf.

We do not sell your data and we do not use it for advertising.

How long we keep it

• Account details and content you posted: until you ask us to delete them.
• Rate-limiting records: minutes to an hour, then pruned automatically.
• Analytics: for the retention period set in our Google Analytics property, after which Google deletes the event-level data.

Your rights

If you are in the EU/EEA or the UK you have the right to access your data, correct it, have it deleted, restrict or object to how we use it, and receive a copy in a portable format. Wherever you are, we will honour these requests.

Some of it you can do yourself, right now:

• Edit your profile and change your password on your account page.
• Delete comments you posted, and remove favourites and ownership marks.
• Change or withdraw your analytics consent with Cookie settings — also linked at the bottom of every page.

There is no self-service account deletion yet. To delete your account and the content attached to it, email privacy@guitarbase.info and we will do it by hand.

If you think we have handled your data badly, you can complain to your local data protection authority.

Children

The site is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will remove it.

Changes to this policy

If this policy changes we will update the date at the top. If the change affects what we do with analytics, the consent banner will ask you again rather than assume your previous answer still stands.