The short version
- Your guitar recording never leaves your device. There is nowhere to send it: the site is static files and has no server that accepts uploads.
- No accounts, no sign-in, no cookies, no analytics, no advertising, no tracking pixels.
- Your recordings aren’t stored in your browser either — close the tab and the clip is gone. The only thing the site keeps there is a copy of its own files, so it still opens without a connection.
- The microphone is only used while you are actually recording, and only in the page.
- The host, Vercel, keeps ordinary web server logs for a short time. That is the only place any data about you exists.
What happens to your audio
When you drop in a file or record with the microphone, the audio is decoded and analysed by JavaScript running inside your own browser tab. The pitch tracking, the notation and the MusicXML, MIDI, tab and SVG exports are all produced on your machine. No part of the recording, and no result derived from it, is transmitted anywhere.
The audio is held in memory only. It is not written to disk, not put in local storage, and not kept once you reload or close the page. Exported files are written by your browser straight to your downloads folder.
What the site keeps in your browser
So that Riff still opens when you are offline, the page installs a service worker that saves copies of the site’s own files in your browser’s cache storage: the page itself, its script and stylesheet, the fonts, the icons and an “you’re offline” notice. These are the same files every visitor downloads.
Nothing you record, drop in or export is ever saved there, and no identifier, setting or tracking value is stored. The site sets no cookies and uses no local storage. To remove the saved files, clear the site data for riff.molosolo.com in your browser’s settings; the app simply downloads them again next time.
Microphone access
Pressing “Record 15 seconds” asks your browser for permission to use a microphone. The stream is used to produce the recording you see, and is stopped as soon as recording ends. Permission is managed by your browser, and you can withdraw it at any time in its site settings. If you never press record, the microphone is never touched.
What the host can see
The site is hosted by Vercel Inc. Like any web server, Vercel receives the technical details of each request — your IP address, the page requested, the time, your browser’s user agent — and keeps them in runtime logs for a short period (on the free plan, around an hour) so the service can be operated and abuse investigated. Vercel is certified under the EU–US Data Privacy Framework and its data processing agreement includes the EU Standard Contractual Clauses.
Nothing about your music is in those logs, because your music is never requested from the server.
Third parties
The page loads no third-party scripts, fonts, images or frames. The typefaces, including the Bravura music font used for the notation, are served from this site itself.
There is one outbound link, the “Support this app” button, which opens Ko-fi in a new tab. Ko-fi is a separate service with its own privacy policy, and it only learns anything about you if you choose to follow that link.
Who is responsible
Riff is a personal, non-commercial project by Molo Solo. For anything to do with this statement, write to onlymolosolo@gmail.com.
Your rights
Under the GDPR you have the right to access, correct, erase, restrict or object to the processing of your personal data, and to lodge a complaint with your national supervisory authority. In practice there is very little to exercise those rights against here: the only personal data connected to this site is the short-lived server log described above. If you would like to ask about it, write to onlymolosolo@gmail.com.
Changes
If the way this site handles data ever changes, this page changes with it, and the date at the top is updated.