Privacy Policy
Last updated: August 29, 2026
Who are we?
Matari Audio was founded by Daniel Elmaliah, known as Derpcat. support@matari-audio.com.
Data we handle
When you start a beta, create a license, download a protected build, or contact support, we may process your email address, Polar customer and license identifiers, entitlement dates, activation identifiers, hashed machine and request values, a machine label, platform, plugin version, IP-derived security information, and support messages. In-plugin diagnostics include redacted operating-system, hardware, plugin-host and bounded BUFFR activity details. When BUFFR confirms a panic or matches an operating-system crash record, it may send that bounded report automatically after reopening; normal plugin disable, unload and unconfirmed process exits are not sent automatically. Available crash evidence may describe the shared DAW process or other loaded plug-ins. Matching repeat crashes are grouped into one private report. Crash statistics may link the report to the same pseudonymous installation used for usage measurement so we can count affected installations and identify patterns by version, operating system, architecture, CPU, graphics adapter, and host. In-plugin reports are stored as private GitHub issues accessible only to authorized maintainers and processed under GitHub’s privacy statement. Support requests submitted through the website are emailed to our support inbox using Resend. These emails include your message, verified reply address, plugin, and optional version. We do not collect computer names, usernames, hardware serial numbers, project files, recorded audio or MIDI in diagnostics, and we do not receive or store your full payment-card number.
Why we use it
We use this information to issue and verify licenses, prevent abuse, provide downloads and support, reconcile Polar events, diagnose failures, and meet legal obligations. We do not sell personal information. Google Analytics and affiliate advertising measurement are loaded only after you accept analytics and advertising measurement.
Polar checkout and portal
Polar Software, Inc. provides hosted checkout, customer accounts, license-key benefits, transactional email, and the customer portal. Polar acts as merchant of record for purchases and processes checkout data under its own buyer terms and privacy policy.
Product update email
When Polar grants a BUFFR license, we share the customer email address, Polar customer identifier, and BUFFR ownership status with Loops so we can send important product updates. New license holders are subscribed by default. Users may separately opt in to BUFFR Preview release emails. Existing unsubscribe and suppression choices remain in place, and every update includes an unsubscribe link.
Product reviews
Yotpo displays product reviews and sends review invitations to eligible paid customers. For a positive-value purchase, we send Yotpo the Polar order and customer identifiers, email address, product, order date, and digital-fulfillment status so it can match a review to the purchase. Free beta and alpha access is not sent as a verified purchase. Review invitations are transactional and do not subscribe you to Matari marketing.
Cloudflare and Turnstile
Cloudflare hosts and protects this site, stores license and release data for us, and may process network and security information. Cloudflare Turnstile runs browser challenges and sends a short-lived token for server-side bot verification. Its browser signals and token are handled under Cloudflare’s privacy terms.
Campaign measurement
We record a bounded campaign source, medium, campaign name, content label, page, product, event name, and referrer hostname for aggregate reporting. We do not put a visitor identifier, email, full referrer, query string, IP address, user agent, advertising click ID, license key, or machine value in that marketing dataset. Browser product events are suppressed when Global Privacy Control is enabled.
Google Analytics
When enabled and accepted, Google Analytics measures page views, product interactions, downloads, checkout starts, and completed purchases. The Google tag is loaded only after you accept analytics and advertising measurement. We do not intentionally send names, email addresses, license keys, or payment details to Google Analytics. See How Google uses information from sites or apps that use its services and Google’s Privacy Policy.
Plugin usage measurement
When BUFFR opens, it checks access and records a pseudonymous installation, one random identifier for that host-process session, operating system, plugin version, access type, and country-level location derived by Cloudflare. This lets us count active and returning installations, session frequency, supported versions, and broad regional use. The usage dataset does not store your email, license key, raw IP address, computer name, DAW, project, audio, MIDI, or city-level location. Individual session records are retained for up to 90 days; daily summaries and inactive installation records are retained for up to 395 days.
Cookies and local storage
We use strictly necessary signed cookies for short-lived activation, license-management, and protected-download access. The machine-management cookie expires after 20 minutes and the BUFFR checkout activation cookie expires after 30 minutes. Affonso affiliate tracking remains disabled until you accept advertising measurement; after acceptance, its referral cookie lasts 30 days and the referral is passed to Polar checkout for purchase attribution. Your advertising choice is stored for 180 days. After you accept measurement, page-experiment cookies keep your test group consistent and record a first download for up to 90 days. The group and enrollment time are passed to checkout so we can compare paid outcomes; no experiment visitor ID is created. See the Cookie Policy.
Retention and security
License, entitlement, activation, and audit records are retained while needed to operate the product, resolve disputes, prevent fraud, and satisfy legal obligations. Short-lived sessions expire automatically. We use access controls, signed tokens, hashed identifiers, and encrypted transport, but no system can guarantee absolute security.
Your choices
You may ask us to access, correct, or delete information we control, subject to records we must keep. Polar account and checkout requests should also be made through Polar or its privacy contact. Contact us first and we will route the request when appropriate.