The short version

We keep what you put into Hollow Log, and your name and email address. That is all.
Nothing is sold, nothing is used for advertising, and nothing is used to train AI models.
Nobody else sees your tunes unless you invite them.
You can download your tunes or delete your account yourself, at any time.

The rest of this page says the same things carefully. Hollow Log is made by one person, Erik Pendleton, and run through ERKHLM LLC. "We" and "us" on this page mean ERKHLM LLC.

What we keep

Your name and email address, which come from Auth0 when you sign in
The tunes, sets and setlists you add, and what you write about them
Files you attach and recordings you make in Hollow Log. The microphone is used only while you are recording, after your browser asks your permission, and the recording is stored with your other files. Until it has uploaded, it is also kept in your browser's storage on the device you made it on, so that it is not lost without a connection; it is deleted from there once it has uploaded, or when you discard it
So that Hollow Log works without a connection, your saved pages, the files you choose to keep there, and plays you log while offline are kept in your browser's storage on that device. Logging out removes the pages and files; plays still waiting to be saved stay until you next sign in there
Who you have shared your tunes with, and who has shared theirs with you
If you turn on the weekly practice email, your time zone as your browser reports it (for example, America/New_York), so that it arrives on Monday morning where you are
Which plan you are on. Payment itself is handled by Stripe, and we never see or store your card details

What we use it for

To run Hollow Log for you
To take payment for a plan, if you choose one
To show your tunes to the people you choose to share them with
To send you messages about your account, such as a note on what your first 30 days include and a reminder before they end
To see how Hollow Log is being used, so we know what to fix or improve. Steps such as making an account, starting a plan, opening a set's link or starting the tuner, and which days you open Hollow Log, are recorded against your account's internal ID, never your name or email address, and we look at them only as totals. Nothing the tuner hears is recorded or sent

Who else sees it

We never sell your personal data or your tunes to anyone. They are shared only in these cases:

With the people you choose to share your tunes with. They see your tunes and what you have written about them, never your recordings, your attached files or your practice history. They can add a copy of any of your tunes to their own list, and that copy is theirs: it stays with them if you stop sharing or delete your account
With anyone who has a link to one of your sets, if you share a set by link. They see the tunes in that set, what you have written about them and their links (not the instruments and tunings you play them on), and only the recordings and files you chose to show on that link. They do not need an account. They see your name as the person who shared it, never your email address or practice history. Resetting the link or stopping sharing turns it off at once
With anyone who has the link to your whole list, if you share it by link. They see each of your tunes with its key, type, instruments and tunings, chord chart, intro, ending and lyrics, its links unless you turn them off, and your notes and who and where you learned it only if you turn those on. Never your recordings, your attached files or your practice history. They do not need an account, and they see your name, never your email address. If they have an account they can add a copy of a tune to their own list, and that copy is theirs. Resetting the link or stopping sharing turns it off at once
With the companies Hollow Log runs on: Auth0 for sign-in, Stripe for payments, Heroku for hosting the application and its database, Amazon Web Services for file storage (and for the copies of your recordings it makes, so they play on every device and loop without a gap), database backups and sending email, and Better Stack for server logs
If the law requires it, or to protect our rights and safety

How it is kept safe

Everything travels over an encrypted connection (HTTPS)
Sign-in is handled by Auth0, or by Google if you sign in that way, so we never see your password
Card details go straight to Stripe and never reach us
Your recordings and attached files are in private storage, and open only for you (and, for the ones you choose, for anyone with a set's link), through links that expire within the hour
Database backups are encrypted

What you can do

See what we hold: nearly all of it is what you see when you sign in, and you can ask us for the rest
Correct it: your name is editable on your Profile
Export your tunes as a spreadsheet (a CSV file), and download your recordings and files as one zip file, on every plan, from Preferences
Delete your account and everything in it, yourself, from your Profile
Stop reminder emails, from the link at the foot of any of them or from your Profile
Stop the weekly practice email, from the link at the foot of it or from the Practice page

For anything you cannot do in the app, write to support@hollowlog.app.

Deleting your account

When you delete your account, it happens straight away and cannot be undone:

Your tunes, sets, setlists, practice history, attached files, instruments, preferences, profile and sharing are deleted from our database and file storage
Your sign-in is deleted from Auth0, along with every way you signed in
Any subscription is cancelled. A lifetime plan ends with the account and is not refunded
You are signed out on every device

A few things are kept for a limited time, or because the law requires them:

Encrypted database backups, which may include your data, are deleted after 90 days
Stripe keeps its record of your past payments, as tax law requires
Copies of your tunes that people you shared with added to their own lists belong to them, and are not deleted
Server logs identify accounts only by an internal ID, never by name or email address, and expire on our logging provider's schedule
To sign out your other devices, we keep a one-way fingerprint of your account ID, which cannot be turned back into it, for 90 days

Cookies and tracking

We use the cookies that keep you signed in. We do not use third-party analytics, advertising cookies, or anything that follows you from one website to another.

One more cookie of our own remembers how you first found Hollow Log: the name of the website that linked to us (for example, a forum's address, never the page you were reading there), or a short tag on the link you followed. It lets us see which mentions of Hollow Log bring people here. It holds nothing else and is never shared. If you make an account, that one word is recorded with the fact that an account was created, and the cookie is deleted; otherwise it expires after 30 days. It is not set at all if your browser sends a Global Privacy Control or Do Not Track signal.

We also count visits to the home page while signed out, with the same one word for where each visit came from. No cookie is set for this, and nothing about you is recorded with the count: not your address, your browser or anything that could tell one visit of yours from another's. We look at it only as totals. With a Global Privacy Control or Do Not Track signal the visit is counted without the word.

If you follow a link with a discount code in it, a cookie of our own holds that code until you make an account or sign in, so the discount is there when you choose a plan. It holds the code and nothing else, is never shared, and expires after 30 days. Once you are signed in the code is kept with your account instead, and the cookie is deleted. It is set whatever your browser's tracking signals say, because it is a code you were given, not a record of where you have been.

A YouTube or Vimeo video plays on the page in that site's own player, under its own privacy policy. Nothing is sent to either until you press Play on a video. YouTube's is its privacy-enhanced player, which sets no cookies until the video plays, and Vimeo's is asked not to track you.

AI model training

We do not use your personal data, tune data, or usage data to train AI models. We do not share your data with third parties for AI training purposes.

Changes to this policy

If this policy changes, the new version is posted here with its date.

Contact us

The Terms cover payments, refunds and what you may upload. Questions about this policy or about what we keep: support@hollowlog.app.

Last updated: November 8, 2026

Privacy policy