Legal

Privacy Policy

Last updated: 26 October 2026

This policy explains what personal data M8Studio ("we", "us") collects when you use m8studio.co.uk, the M8Artist and M8Studio desktop applications, and the web app — why we collect it, where it lives, and the rights you have under the laws of your country, including the EU/UK GDPR, US state privacy laws (such as the CCPA/CPRA), Canada's PIPEDA, Brazil's LGPD and Australia's Privacy Act.

1. Who is responsible for your data

The data controller is Miro Sedlacek, an individual developer operating the M8Studio project (a personal project, not a registered business). You can reach me at info@m8studio.co.uk for any privacy question, request or complaint.

2. What we collect

Website visitors

  • Contact form — your name, email address and message, sent to our server so we can reply.
  • Privacy-friendly analytics — we self-host Umami analytics. It is cookieless: it does not identify you across sites and does not store your IP address in clear form. It records pages viewed, referrer, approximate country, device type, browser and OS.
  • Session replay and heatmaps — our analytics records how the page was used: mouse movement, clicks, scrolling and page structure, for UX improvement. Text input fields are masked and form contents are not captured. Recording is automatically disabled for browsers sending Do-Not-Track or Global Privacy Control signals. See the Cookie Policy for details.
  • Server logs — like every website, our hosting platform briefly logs IP address, browser and requested URLs for security and troubleshooting.

App users (M8Artist, M8Studio plugin, web app)

  • Account data — email address, password (hashed by PocketBase, never stored in plain text), display name and profile details you enter. Registration is currently invite-only — accounts are created by the M8Studio team, not self-serve.
  • Authentication — login sessions use short-lived tokens stored in the app; password resets go to your email. We log authentication events for security.
  • Social data — friends list, friend requests, and chat messages you send, which are stored on our server so they persist between sessions and reach offline users. Deleting a message removes it.
  • Presence & scheduling — your online/offline status (updated by heartbeats), booked sessions and availability you set.
  • Call connection data — your IP address and connection metadata are used to establish the peer-to-peer link and are visible to the other participant — that is how WebRTC works. Signalling messages (connection setup offers/answers) pass through our server; call audio and video travel directly between participants.
  • Video — if you enable camera/talkback video in a call, it streams peer-to-peer like the audio — never through our servers. The optional M8Cam helper serves your local camera to the app on your own machine (localhost only).
  • TURN relay — when a direct peer connection cannot be established (restrictive firewalls/NAT), media briefly relays through our own TURN server with short-lived credentials. We do not inspect or store the audio/video.
  • Update checks — the apps check our server for new releases and report their current version. Downloads install only after you confirm, and only if the package signature hash verifies.
  • Local data — audio backups recorded by the plugin/app, settings, and caches stay on your device and are never uploaded.

3. What we do not collect

  • Your audio and video. Streams travel directly between call participants (peer-to-peer). They are not recorded, stored or transcribed on our servers. Local backups recorded by the app stay on your machine.
  • Advertising profiles. No ad trackers, no cross-site tracking, no behavioural advertising, no data brokers.
  • Passwords in plain text. Ever.

4. Why we process data (legal bases — GDPR/UK GDPR)

  • Contract (Art. 6(1)(b)) — to provide your account, calls, chat and the service you signed up for.
  • Legitimate interests (Art. 6(1)(f)) — cookieless, self-hosted analytics to understand site usage and keep the service secure (logs).
  • Legitimate interests (Art. 6(1)(f)) — session replay and heatmap recording for UX analysis; masked inputs, cookieless identification, 30-day retention, and automatic opt-out via DNT/GPC signals mean this is a minimal, proportionate use.
  • Legal obligation (Art. 6(1)(c)) — where we must keep records to comply with law.

5. Where your data is stored and who processes it

  • Website hosting: Krystal (United Kingdom) — static site files.
  • Application backend, accounts and analytics: our own virtual server on Oracle Cloud Infrastructure, running PocketBase (accounts, chat, presence, sessions) and self-hosted Umami (analytics). Data does not leave our infrastructure for third-party analytics or ads — because there are none.
  • Email: contact-form submissions are forwarded to our mailbox.

If data is processed outside your country (for example EEA/UK data on servers elsewhere), we rely on appropriate safeguards such as adequacy regulations or Standard Contractual Clauses required by Chapter V GDPR / UK data protection law.

6. Retention

  • Account and social data — kept while your account exists; deleted within 30 days of account deletion, except backups which rotate out shortly after.
  • Contact messages — kept as long as needed to handle your request, then removed.
  • Analytics aggregates — up to 24 months. Session replays auto-delete after 30 days.
  • Server logs — rotated regularly, typically weeks not years.

7. Your rights

EEA, UK and Switzerland (GDPR / UK GDPR / FADP)

You can request access, rectification, erasure, restriction, portability and object to processing — including objecting to session recording, which you can switch off by sending a DNT/GPC signal (see Cookie Policy). You may complain to your supervisory authority — in the UK, the ICO; in the EU, your national DPA.

United States (CCPA/CPRA and other state laws)

You have the right to know/access, delete and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those laws define it, and we do not use it for cross-context behavioural advertising, so there is nothing to opt out of — but you can still exercise access/deletion rights. We will not discriminate against you for exercising them.

Other countries

Canada (PIPEDA), Brazil (LGPD), Australia (Privacy Act/APPs), Japan (APPI) and most other jurisdictions grant broadly equivalent rights — access, correction, deletion and complaint to a regulator. We honour them for everyone, regardless of where you live.

To exercise any right, email info@m8studio.co.uk. We respond within one month (or the shorter period your law requires).

8. Do Not Track and Global Privacy Control

We honor both signals: if your browser sends DNT or GPC, session replay and heatmap recording are automatically disabled for your visit. Cookieless analytics (which identifies no individual) continues, as it qualifies as privacy-preserving audience measurement.

9. Security

HTTPS everywhere (HSTS), hashed passwords, short-lived TURN credentials, no public share links for analytics, server-side credential handling and least-privilege access to the backend. No method is 100% secure, but we minimise what exists to be breached.

10. Children

The service is intended for users aged 16 and over (13 in jurisdictions that permit it). We do not knowingly collect children's data; contact us to remove any such data.

11. Changes

If we change this policy we will update this page and the date above. Material changes will be announced on the updates page.

Questions, requests or complaints: info@m8studio.co.uk