Your camera stays on your device.

Who operates this site and how to contact us

This policy applies to GestureSynth.me, an independently operated browser instrument that is not an official Google, MediaPipe, YouTube or browser-vendor service. Send privacy questions to lisheng3698@gmail.com without including passwords, verification codes, recordings or other sensitive material.

The site has no accounts, payments, profiles, comments or uploads. We will update this policy before those information flows change.

Camera permission and on-device hand tracking

Camera access begins only after you choose Start and approve the browser prompt. Video is requested with audio disabled and processed locally by the hand-landmark model to control chords, pitch, volume, filter and octave.

Camera frames and landmark coordinates are not sent to our server, advertisers or analytics. We do not identify you, create a biometric profile or record video. Stop session, closing the tab or revoking camera permission ends access.

Audio generation, loops and downloads

Sound is synthesized locally with the Web Audio API. The site does not request a microphone. Sequencer notes remain in page memory, and exports are rendered in the browser as WAV or a WebM fallback and downloaded to your device.

We do not receive or review exported audio. You control downloaded files and any storage, backup or sharing service you use. Clearing site data does not delete saved downloads.

Information stored in your browser

localStorage remembers functional preferences such as musical key, sequencer visibility, instrument settings and tutorial completion. It also stores your analytics choice under gesturesynth.analytics-consent.v1. These values remain on the device and are not sent to our server during normal instrument use.

You can clear them with browser site-data controls or use a private window. Blocking storage prevents preferences from being remembered but does not change local camera processing.

Hosting, security and ordinary web requests

A visit sends ordinary request information such as IP address, time, URL, referrer, user agent, approximate network region and security signals. Cloudflare may process it for delivery, caching, abuse prevention and availability. Cloudflare Web Analytics may report page views and performance without advertising cookies.

Do not put personal information in a shared URL. Aggregate or security logs may be inspected for outages or abuse and retained as reasonably necessary.

Cloudflare privacy policy ↗ · Cloudflare Web Analytics information ↗

Google Analytics 4 and consent mode

GestureSynth.me uses Google Analytics 4 measurement ID G-ELSW1TGSYB for aggregate visits, navigation and performance. Google may receive page URL and title, referrer, browser, device, language, approximate region, session and engagement events, performance and consent state. We do not send names, email addresses, notes, camera frames, hand landmarks, audio, music or loop files.

Consent Mode v2 runs first. Analytics storage is denied unless this browser accepted it; ad storage, ad user data and ad personalization stay denied. Google may receive limited consent-aware cookieless pings while denied, but GA analytics cookies are not written. Rejecting or withdrawing consent returns analytics storage to denied and removes accessible GA cookies.

Use Privacy choices on any page to change analytics. The instrument works either way. Google controls information it receives under its own terms.

How Google uses information from partner sites ↗ · Google Analytics privacy information ↗

Third-party content and external links

A YouTube demonstration uses privacy-enhanced mode. Google may receive request and interaction information when it loads or plays. External sites receive information if you follow their links.

The site loads GA4 under the controls above, but no AdSense JavaScript or other advertising tag. The public ads.txt names an authorized seller; it does not request ads or set cookies.

Google privacy policy ↗

Google AdSense and advertising cookies

GestureSynth.me may enable Google AdSense only after approval and required consent controls are active. No AdSense code or ad unit is active now, so the site makes no Google advertising request. Third-party vendors, including Google, may later use cookies, IP addresses or similar identifiers to serve, limit, measure and personalize eligible ads.

Ad requests may include IP address, browser, device, page, advertising identifiers, consent signals and impression or click data, but never camera frames, hand landmarks, microphone audio or loop files.

If enabled, control personalized advertising through Google's Ads Settings, industry opt-outs, browser controls and the consent message. Refusing advertising storage will not stop the instrument or lessons.

Google Ads Settings ↗ · AboutAds opt-out choices ↗ · How Google uses information from partner sites ↗

Consent choices for the EEA, United Kingdom and Switzerland

The current first-party Privacy choices panel controls GA4 analytics storage and sends Consent Mode v2 signals. It is not a Google-certified advertising CMP and grants no advertising consent. Before an AdSense tag is enabled in the EEA, United Kingdom or Switzerland, GestureSynth.me will publish a Google-certified consent management platform supporting the IAB Transparency and Consent Framework, with required accept, refuse and withdrawal choices.

Advertising storage, ad user data and ad personalization remain denied. Without valid advertising consent, future ads may be limited or not requested. Camera permission is separate and never counts as consent to cookies.

Location and sensitive information

GestureSynth.me does not request precise geolocation. A hosting or advertising provider may infer a broad region from an IP address for security, language, legal or advertising purposes, but the instrument does not use GPS coordinates. We do not ask for health, religion, sexual orientation, financial account information or other sensitive traits, and we do not create audiences based on sensitive information.

The site does not offer housing, employment or credit products or select those ads by protected traits. Any future feature needing precise location or sensitive data would require a separate explanation and consent.

Children's privacy

GestureSynth.me is a general-audience music tool for adult beginners, independent musicians, teachers and families. It is not designed or directed primarily to children under 13 or below another country's applicable age. Public-domain song titles are harmony studies, not child targeting; the site offers no child accounts, social profiles, chat, prizes or child-targeted collection.

We do not knowingly collect personal information from a child. Camera frames and hand landmarks stay in the browser. A parent or guardian who believes a child emailed personal information can ask us to delete the message.

The site shows no personalized or interest-based ads. If a future page or user requires child- or teen-restricted treatment, we will apply Google's age restriction before serving ads. It disables interest-based advertising and remarketing for child-directed content; ads will remain off where that protection cannot be applied reliably.

Your choices and privacy requests

You can deny or revoke camera permission, stop the session, use Privacy choices to reject or withdraw optional analytics storage, clear localStorage, block third-party cookies, decline future advertising consent and avoid playing the embedded video. These choices do not require an account. Because the current service does not create a user profile, we usually cannot identify browser preferences as belonging to a particular person or recover them from another device.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to personal information we control. Email lisheng3698@gmail.com without attaching sensitive documents. Contact independent providers about information they control.

Security, retention and policy changes

We use HTTPS, a restrictive permissions policy and browser security headers to reduce unauthorized access. No website can promise absolute security, but keeping camera and audio processing on the device removes the need to transfer or retain the most private performance data. Functional browser preferences remain until you clear them; downloaded files remain until you delete them.

We may update this policy when providers or features change. The date above will change for material revisions, with any notice or choice required by law.