Privacy Policy

This Privacy Policy (“Policy”) explains what personal data Pook Audio collects, why we collect it, how it is used, who it is shared with, and how it is protected. We are committed to being transparent about our data practices and to respecting your privacy rights.

“Pook Audio” (also referred to as “we,” “us,” or “our”) is a trading name of Ayal Yishay, sole proprietor, registered and operating under the laws of the State of Israel.

This Policy applies to all personal data collected through the Pook software (audio plugin and standalone application), the workspace and build tools, the backend and API, the website at pookaudio.com, and all related features and services (collectively, the “Service”).

For almost everything described here, Pook Audio is the data controller responsible for your personal data. There is one exception: where we handle the data of people who buy a plugin published by someone using Pook, the publisher is the controller and we act only as their processor. Section 3 explains that arrangement.

By creating an account, installing the Software, or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices as described herein, you should not use the Service.

This Policy should be read in conjunction with our Terms of Service, which govern your use of the Service.

We collect different categories of personal data depending on how you interact with the Service. Below is a detailed breakdown of the data we collect, organized by category.

2.1 Account Data (from sign-in)

When you create an account using a third-party identity provider (such as Google or Apple), we receive and store the following information from your identity provider:

• Email address
• Full name
• Profile picture (if available from the identity provider)
• Unique identifier from the identity provider

We do not receive or store your password from any identity provider. Authentication is handled entirely by the third-party provider.

2.2 Account Profile Data (you provide)

Your account carries a few fields you fill in yourself and can change or clear at any time:

• Display name
• Short description of yourself
• Website address
• Links to your social accounts
• An avatar image — taken from your identity provider unless you replace it

All of these are optional. Please do not put sensitive personal information in them; see Section 2.12.

2.3 Machine Data

When you activate the Software on a machine, we collect a set of machine identifiers so that the same machine can be recognized on later checks. These include the hardware addresses of the machine's network interfaces and identifiers derived from its storage and system configuration. They are used solely for activation and for enforcing the machine limits described in our Terms of Service. The Software may also send a name for the machine, so that you can tell your own activations apart when you manage them. We do not scan your machine, and we do not collect information about the files or other content on it. The one exception is the short, fixed list of coding assistants described in Section 2.8 — we record whether each of those is installed, and nothing else about the software on your machine.

2.4 Usage Data

When you use the Service, we collect information about which features of the Service you use and how frequently.

2.5 Technical Data

We automatically collect certain technical information when you use the Service, including:

• IP address
• Browser type and version (when using the website)
• Plugin version and format (VST3, AU, AAX)
• Operating system and version
• DAW (digital audio workstation) name and version
• Approximate geographic location (derived from IP address, city/country level only)

2.6 Publisher Account Data

If you publish plugins with Pook, we additionally store data about your publisher account:

• The publisher record — your publisher name and handle, support email address, description, website and social links, and the limits of your current plan.
• Team members — the Pook accounts that have access to your publisher account and the role each of them holds.
• Key metadata — the name, identifier and public half of each key issued to your account, along with when it was last used and whether it has been revoked. Secret API keys are stored only as hashes. The private half of a signing key is created inside a managed key service and never leaves it, so we never hold a copy of it.
• Administrative history — a log of administrative actions taken on your publisher account, recording which team member did what and when.

2.7 Plugin Submissions

When you submit a plugin to be released, we retain the plugin source file you submitted for that release, so that the release can be rebuilt and re-signed later. Compiled binaries produced from it are a build cache derived from that source; they are regenerated on demand and are not retained indefinitely.

2.8 Version Telemetry

When an activated machine checks in, it reports the version of each plugin it is running and the name of its operating system. We keep only the current reported version for each machine and plugin — it is overwritten on each check-in, not accumulated as a history — and it is used to serve update notices.

Pook also records which of the coding assistants it can open are installed on your machine, and which one you opened from Pook. This is a fixed list of the assistants Pook knows how to launch — Pook does not scan your machine for other software, and it records no version numbers or file locations for them. We keep the first answer and the current one per machine, and use it to decide which assistants to support and document.

Pook records one action alongside this: when you copy the setup message instead of opening an assistant, we record that you did and which screen you were on. We do not record the message, what you paste it into, or anything else you copy — only that the button was used, so we can tell an author who took the work elsewhere from one who got stuck.

2.9 Support Reports

When you send us a support report from the plugin or the website, we store the contents of that report — your message, the type of report, your name and email address, and any files you attach, such as screenshots, logs or a plugin file. A report sent from within the plugin also carries technical context about the session it came from: the Pook version, operating system, DAW, sample rate, plugin format, and the plugin the report is about. Attachments are stored in a private bucket that is not publicly accessible.

2.10 Mailing List

If you join our waitlist or subscribe to updates, we store your email address, which lists you asked to be on, and the times you confirmed the subscription and unsubscribed. We also store how you reached the site when you signed up — the campaign tags on the link you followed, the site that linked you, and the page you landed on — so we know which of our own posts and emails people find us through. We keep the record of an unsubscribe so that we do not email you again after you opt out. You can unsubscribe at any time using the link in any of those emails.

2.11 Abuse-Prevention Records

To stop mail-bombing, passcode guessing, and floods of automated requests, we count recent attempts within short, fixed time windows. Each counter is keyed on the thing being limited — a normalized email address, an IP address, or an account or key identifier — and holds nothing but that key, a count, and the window it belongs to. Counters are swept within a few days of their window closing.

2.12 Sensitive Personal Information

Pook Audio does not intentionally collect sensitive personal information, including but not limited to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sexual orientation. Please do not submit sensitive personal information through the Service, including in support reports, account fields, or plugin metadata. If you do submit such information, you consent to its processing in accordance with this Policy.

When you buy a plugin published by someone using Pook, that publisher decides why your data is collected and is the controller of it; Pook only processes it on their instructions, as their processor. This covers your email address; the machine identifiers described in Section 2.3, together with a name for each machine you activate on, the name of its operating system, and when it was last seen; the version of the publisher's plugin that each of your machines reports when it checks in, kept as one record per machine and plugin and overwritten on every check-in, so the publisher can see which version their customers are currently running; the one-time passcodes that confirm your email address at activation, and the sign-in session a redeemed passcode creates — when it expires and when it was last used, with the credential itself stored only as a hash; your license type and status; your activation records; and the abuse-prevention counters described in Section 2.11. It is used to issue, check, transfer and revoke your license, to show the publisher which version of their plugin your machines are running, and to send the emails those actions require — your activation passcode, and notices that a machine was activated or released or that a license was issued or disabled. The publisher's own privacy policy governs that relationship, and the plugin's activation screen links to it. Terms are in our Data Processing Addendum.

We use the personal data we collect for the following purposes:

• Provide and operate the Service — authenticate your identity, maintain your account, activate the Software on your machines, build and sign the plugins you submit for release, deliver updates, and respond to support reports you send us.
• Enforce terms and limits — manage machine activation, enforce the machine limits described in our Terms of Service, apply rate limits, and detect and prevent violations of those terms.
• Improve and develop the Service — analyze usage patterns and trends, conduct internal research, and develop new features. Where possible, we use anonymized or aggregated data that cannot reasonably be used to identify individual Users.
• Communicate with you — send service notifications, account-related alerts, security warnings, subscription and billing updates, and information about changes to our Terms or this Privacy Policy. With your consent, we may also send promotional communications about new features or offers.
• Security and fraud prevention — detect, investigate, and prevent unauthorized access, abuse, fraud, and other harmful or illegal activity. Protect the rights, property, and safety of Pook Audio, our Users, and the public.
• Legal compliance — comply with applicable laws, regulations, legal processes, or enforceable governmental requests. Establish, exercise, or defend legal claims.

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Israel, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR), UK GDPR, and the Israeli Privacy Protection Law 5741-1981, as applicable:

• Performance of a contract — processing necessary to provide the Service to you, including account creation and authentication, machine activation, building and signing the plugins you submit, issuing and checking licenses, and operating a publisher account. This is the primary legal basis for most of our data processing.
• Legitimate interests — processing necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes improving and developing the Service using aggregated analytics, detecting fraud and abuse, ensuring network and information security, and internal administrative purposes. We carefully balance our interests against your privacy in each case.
• Legal obligation — processing necessary to comply with legal or regulatory requirements to which Pook Audio is subject, including tax and accounting obligations, responding to lawful requests from public authorities, and data retention requirements.
• Consent — where required by applicable law, we rely on your consent for specific processing activities, including sending promotional or marketing communications, setting non-essential cookies, and sharing data with third parties for purposes not covered by the other legal bases. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

If we intend to use your personal data for a purpose not described in this Policy, we will notify you and, where required by law, obtain your consent before doing so.

We share your personal data with the following service providers, solely to the extent necessary for the purposes described below. We require all third-party providers to respect the security and confidentiality of your personal data and to process it only in accordance with our instructions and applicable data protection laws.

• Google — Cloud Run (application hosting), Cloud SQL (database), Cloud Storage (file storage), Cloud KMS (key management and signing), Firebase Authentication (sign-in), and Google Analytics (website analytics).
• Resend — transactional email, such as sign-in links, activation codes, and account notifications.
• Paddle — Paddle.com Market Limited is our merchant of record for purchases from Pook, and handles payment processing, billing, invoicing, tax calculation, and refunds. Pook Audio does not directly process, store, or have access to your payment card information, bank account details, or other financial data. Paddle's collection and use of your payment data is governed by Paddle's Privacy Policy.
• Vercel — hosting for the website at pookaudio.com.
• Cloudflare R2 — storage and delivery of plugin downloads.

We use Google Analytics to see how visitors use pookaudio.com. It loads from the root layout that wraps every page of the site, including sign-in and account pages, but it does not send anything to Google until you consent through our cookie banner — see Section 9 (Cookies & Tracking Technologies). Once you consent, if you are signed in, we also attach your account's internal ID to your analytics activity, so we can tell how signed-in Users use the Service.

Pook Audio does not sell your personal data to third parties. We do not share your personal data with third parties for their own direct marketing purposes.

We may also disclose your personal data if required to do so by law, regulation, legal process, or governmental request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, investigate fraud, or respond to a government request.

In the event of a merger, acquisition, reorganization, bankruptcy, or other similar event, your personal data may be transferred to a successor entity as part of that transaction. We will notify you of any such change and the choices you may have regarding your personal data.

Pook Audio is based in Israel. Your personal data is stored and processed on cloud infrastructure primarily located in the United States, and may also be accessed from Israel and other countries where our service providers operate. These countries may have different data protection laws than your country of residence.

Israel has been recognized by the European Commission as providing an adequate level of data protection. For transfers of personal data from the EEA or UK to countries that have not received an adequacy decision (such as the United States), we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission and/or the UK Information Commissioner's Office (ICO), or other legally recognized transfer mechanisms.

If you have questions about the safeguards we use for international data transfers, please contact us at support@pookaudio.com.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, as described in this Policy, or as required by applicable law. The specific retention periods depend on the nature of the data and the purpose of processing:

• Account data — retained for as long as your account is active. Upon account deletion, personal data is deleted or anonymized within 30 days, except where retention is required by law.
• Publisher account data — the publisher record, its team members, and key metadata are retained for as long as the publisher account exists. Records of administrative actions are retained afterwards where they are needed as an audit trail or to resolve a dispute.
• Plugin submissions — the source file submitted for a release is retained for as long as that release is available, so it can be rebuilt. Compiled binaries are a cache and are not retained indefinitely.
• Purchase and transaction records — retained for as long as required for accounting, tax, and legal compliance purposes (typically 7 years under Israeli tax law).
• Support reports — the report and its attachments are retained for as long as needed to resolve the issue and to investigate related reports, and are deleted or anonymized once that is no longer necessary.
• Mailing list — retained until you unsubscribe. After that we keep only the record that you unsubscribed, so that we do not email you again.
• Version telemetry — only the current reported version per machine and plugin is stored; each check-in overwrites the previous value, and the record is deleted with the machine it belongs to.
• Technical logs — IP addresses, access logs, and similar technical data are retained for up to 90 days for security and debugging purposes, after which they are deleted or anonymized.
• Abuse-prevention counters — kept only as long as the time window they belong to is relevant, and swept within a few days of that window closing.
• Machine identifiers — retained for as long as your account is active and deleted upon account deletion.
• Data we process for publishers — retained in accordance with the publisher's instructions for as long as their account is active, and returned or deleted once that processing ends, as described in Section 9 of our Data Processing Addendum. One record survives that: if a publisher's account closes, we keep the minimum needed to keep your existing license working — your email address, the product, and your license status — and from that point we hold it as an independent controller rather than as the publisher's processor, as described in the Addendum's Section 10.

When personal data is no longer needed for its original purpose and there is no legal requirement to retain it, we will securely delete or irreversibly anonymize it.

9.1 What Are Cookies

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work efficiently, provide reporting information, and assist with personalization. Cookies may be “session” cookies (deleted when you close your browser) or “persistent” cookies (remaining on your device for a set period or until you delete them).

9.2 Cookies We Use on pookaudio.com

The website uses the following categories of cookies:

• Essential cookies — required for the website to function correctly. These include cookies for authentication, session management, and security. You cannot opt out of essential cookies as they are strictly necessary for the website to operate.
• Analytics and performance cookies — we use Google Analytics to collect information about how visitors use the website, including which pages are visited most frequently, how long visitors spend on pages, and how they arrived at the site. Google Analytics loads from the root layout that wraps every page of pookaudio.com — including sign-in, activation, and account pages — but no analytics cookie is set and no data reaches Google until you provide consent through our cookie banner. If you are signed in when you consent, we attach your account's internal ID to your analytics activity, so it is tied to your account rather than fully anonymous; it is never tied to your email address, name, or other profile data.

9.3 The Pook Plugin

The Pook plugin communicates with our servers for authentication, activation and license checks, update notices, and support reports. These communications use standard HTTPS requests and authentication tokens — no tracking cookies, advertising pixels, or third-party tracking technologies are used within the plugin itself.

9.4 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified before a cookie is set. Please note that disabling essential cookies may affect the functionality of the website.

For more information about cookies and how to manage them, visit:

• www.allaboutcookies.org
• www.youronlinechoices.eu (for EU residents)

9.5 Do Not Track

Some browsers transmit “Do Not Track” (DNT) signals to the websites you visit. There is currently no universally accepted standard for how websites should respond to DNT signals. At this time, pookaudio.com does not respond to DNT signals, but we limit our use of tracking technologies as described in this section.

Depending on your location and applicable law, you may have the following rights with respect to your personal data:

• Right of access — you have the right to request a copy of the personal data we hold about you, together with information about how we process it.
• Right to rectification — you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure (“right to be forgotten”) — you have the right to request that we delete your personal data, subject to certain legal exceptions (for example, where we are required to retain data for legal or accounting purposes).
• Right to data portability — you have the right to request your personal data in a structured, commonly used, machine-readable format. This includes your account information, your publisher account details, and your purchase, license and activation records. The source of a plugin you author is held on your own machine and is already in your possession.
• Right to restrict processing — you have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.
• Right to object — you have the right to object to our processing of your personal data where we rely on legitimate interests as a legal basis, including objecting to the use of your data for Service improvement and analytics.
• Right to withdraw consent — where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
• Right to lodge a complaint — you have the right to lodge a complaint with your local data protection authority if you believe that our processing of your personal data violates applicable law.

How to Exercise Your Rights

To exercise any of these rights, please contact us at support@pookaudio.com. We will respond to your request within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request. If your request is complex or you have made multiple requests, we may extend the response period by an additional 60 days, in which case we will notify you of the extension and the reasons for it.

If your request concerns data we process on a publisher's behalf, as described in Section 3, please address it to that publisher. We will forward any such request we receive and assist the publisher in answering it.

These rights are provided under the General Data Protection Regulation (GDPR) for EU/EEA residents, the UK GDPR and UK Data Protection Act 2018 for UK residents, the Israeli Privacy Protection Law 5741-1981 for Israeli residents, and similar data protection regulations worldwide. Some rights may be limited where we have a legal obligation to retain data, a legitimate overriding interest, or where the exercise of rights would adversely affect the rights and freedoms of others.

You also have the right to delete your account at any time through the application settings or by contacting us. Upon account deletion, we will process the deletion of your personal data as described in Section 8 (Data Retention).

Pook Audio does not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do not profile you for advertising, and we do not build behavioral profiles of you.

Some checks are automated because they have to be: activation is checked against your machine limit, licenses are validated, rate limits are applied, and suspected fraud or abuse is flagged. If an automated check blocks something you believe it should not have blocked, contact us at support@pookaudio.com and a person will review it.

Pook Audio implements and maintains appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, destruction, or accidental loss. These measures include but are not limited to:

• Encrypted connections (HTTPS/TLS) for all data transmitted between your device and our servers.
• Encryption of personal data at rest on our cloud infrastructure.
• Access controls and authentication mechanisms to limit access to personal data to authorized personnel only.
• Secure credential storage — authentication tokens on your device are stored using the operating system's native credential storage (e.g., macOS Keychain, Windows Credential Manager).
• Regular security reviews and updates to our infrastructure and software.

Despite our efforts, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security of your personal data. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected Users and the relevant data protection authorities in accordance with applicable law, without undue delay.

The Service is not directed at, intended for, or designed to be used by individuals under the age of 18. Pook Audio does not knowingly collect, solicit, or process personal data from children under the age of 18.

If we become aware that we have collected personal data from a child under 18 without verifiable parental consent, we will take steps to delete such data promptly. If you believe that a child under 18 has provided personal data to us, please contact us immediately at support@pookaudio.com so that we can take appropriate action.

Pook Audio may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or operational needs. When we make changes, we will update the “Last updated” date at the top of this page and publish the revised Policy at pookaudio.com/legal/privacy.

For material changes that significantly affect how we collect, use, or share your personal data, we will provide additional notice via email (to the address associated with your account) or through a prominent in-app notification at least 30 days before the changes take effect.

Your continued use of the Service after any changes to this Policy constitutes your acceptance of the updated Policy. If you do not agree with the revised Policy, you should stop using the Service and delete your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information. This section supplements the rest of this Privacy Policy with information required under California law.

15.1 Categories of Personal Information

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers (name, email address, unique account ID, machine identifier, IP address)
• Internet or other electronic network activity information (browsing history on our website, interaction with the Service, feature usage)
• Geolocation data (approximate location derived from IP address)
• Commercial information (purchase and transaction history, license and activation records, plan status)
• Professional or employment-related information (only where you voluntarily provide it, such as details you add to your profile or publisher contact details)

The sources, purposes, and third-party disclosures for each category are described in Sections 2, 4, and 6 of this Privacy Policy.

15.2 Your California Rights

As a California resident, you have the right to:

• Right to know — request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share your personal information.
• Right to delete — request that we delete the personal information we have collected about you, subject to certain exceptions permitted by law (such as data retained for legal or accounting purposes).
• Right to correct — request that we correct inaccurate personal information we maintain about you.
• Right to opt-out of sale or sharing — Pook Audio does not sell your personal information and does not share your personal information for cross-context behavioral advertising purposes. Therefore, there is no need to opt out.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights. We will not deny you the Service, charge you different prices, provide a different quality of service, or retaliate against you for exercising your rights.

15.3 Exercising Your Rights

To exercise your California privacy rights, please contact us at support@pookaudio.com. We will verify your identity before processing your request by matching information you provide with information we have on file. We will respond to verifiable consumer requests within 45 days. If we need more time (up to an additional 45 days), we will notify you of the reason and the extension period in writing.

You may designate an authorized agent to submit requests on your behalf. If you use an authorized agent, we may require proof that you have authorized the agent to act on your behalf and may still require you to verify your identity directly with us.

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal data, or our data practices, please contact us at:

Email: support@pookaudio.com

Data Controller:
Pook Audio (a trading name of Ayal Yishay)
Israel

We are committed to resolving any complaints about your privacy and our collection or use of your personal data. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. For Israeli residents, this is the Israeli Privacy Protection Authority (PPA). For EU/EEA residents, you may contact the supervisory authority in your country of residence.