Privacy Policy
The short version: no third-party ad networks, no selling your data, no data brokers. We collect the minimum needed to run the commons, keep analytics first-party and minimal, and disclose every service provider below.
What we collect
- Account: your handle, email address, and a salted hash of your password (we never store or see the password itself).
- Content you choose to post: posts, replies, chat and direct messages, “now spinning” entries, your profile tagline and scenes, and any files you attach (audio, images, video).
- First-party visit beacons: a random anonymous identifier stored in your own browser, the page path, and the referring domain. No IP addresses are stored, no fingerprinting, no cross-site anything. This exists only so we know which parts of the site people use.
What we don’t do
- No third-party advertising networks or cross-site ad tracking.
- No selling, renting, or brokering your data.
- No third-party analytics products; our visit beacons are our own and anonymous.
- No training AI models on your content, and our pages and your uploads are served with headers that tell outside AI crawlers to keep out.
If any of this ever changes — for example sponsorships or memberships — this page changes first, with a new effective date, before the practice does.
Service providers & embeds
- Cloudflare hosts and delivers the site.
- Typefaces are self-hosted — no font CDN sees your visits. (Removed Google Fonts, Nov 2026.)
- Official music players (Bandcamp, YouTube, Spotify) are embedded on the specific pages that feature them; when those pages load, those services may set their own cookies under their own policies — that’s also how the bands get paid for plays.
- Stripe (web) and Apple / Google (apps) process payments.
Cookies
From us, one cookie: your session, so you stay signed in. It is HttpOnly, Secure, and first-party. Embedded players may set their own, as noted above.
Payments
Tips and purchases are processed by Stripe (on the web) or by Apple and Google (in the apps). Card numbers never touch our servers. We receive only confirmation that a payment happened.
Direct messages
DMs are private between participants and are not published. Site operators do not read DMs except as required to investigate abuse reports or by law.
Your rights
- Delete your account any time in Settings → Delete account (in the apps and on the web). Your account, sessions, and personal profile are removed; your public posts are anonymized to “[deleted]” so conversations aren’t torn apart.
- Export: email us for a copy of your data.
- California (CCPA) and EU/UK (GDPR) residents: the above covers access, deletion, and portability; we don’t sell data, so there is nothing to opt out of.
Age
StonerRock.com is for people 13 and older. If we learn an account belongs to a child under 13 we will delete it.
Changes
If this policy changes we will post it here with a new effective date, before the change takes effect.
Contact
Questions, exports, takedowns: [email protected]