Effective 12 September 2026 · v1.1

PRIVACY

midtoke.com is a music site. It does not want your data, and it takes almost none.

THE WHOLE THING IN ONE LINE No cookies. No analytics. No trackers. No accounts. The one thing the site ever keeps about a person is the purchase email a buyer chooses to type into the vault, and it is used for exactly one thing: getting them back in.

Who runs this

midtoke.com is the site of the music project midToke, run by one person. For the purposes of the UK and EU GDPR, that person is the data controller.

Because this domain has no mailbox attached, the reliable way to reach a human is a direct message on Instagram (@midtoke), TikTok (@midtoke) or SoundCloud. Say it is a privacy question and it will be answered.

What the site collects

Nothing, on the public pages. There is no analytics script, no advertising pixel, no tag manager, no heatmap, no session recorder, and no third-party embed that reports back. We do not know how many people visit, which is a choice rather than an oversight.

The vault is the one exception, and it is described in full below.

Cookies

This site sets no cookies at all. If you look in your browser, you will find none from midtoke.com. That is also why there is no cookie banner: consent is required to store or read things on your device, and we store nothing that needs it.

What is kept in your browser

A few small values are saved in your browser's localStorage, purely so the site behaves sensibly. They never leave your device and are not readable by us:

midtoke-lang - which language you picked, so it is still chosen next time.
midtoke.vault.v1 - remembers that you unlocked the vault, for 30 days on that device, so you are not asked for the code on every visit. "Forget this device" on the vault page removes it.
midtoke.vault.quality - the streaming weight you chose in the vault.
midtoke.reviver.introSeen.v1 and midtoke.reviver.installHintSeen.v1 - that you have seen the Reviver's opening sequence and its home-screen hint, so neither plays twice.

Two more live only in sessionStorage, which the browser wipes when the tab closes: a short-lived token for the signal player, and a flag that the Reviver or arcade was opened from the vault.

All are strictly necessary for features you asked for. Clear your site data and they are gone, with no other effect than being asked again.

Fonts and files

Every font, script, image and stylesheet is served from midtoke.com itself. Nothing is fetched from Google Fonts or any other outside company, so no third party is told that you visited. Audio and video stream from our own storage.

The vault

Every copy of the record carries a code, and the vault is where it is used. This is the only part of the site that stores anything about a person, so here it is in full.

A code on its own is checked against a checksum and looked up in a database. The record for a code holds which edition it is, when it was first opened, and how many different devices have opened it. None of that is a name.
A purchase email is the other way in. If you type the address you bought with, or a code that was issued to an address, that address is stored alongside the code. It is used for one purpose: so that you can get back in with it, and get your Filament key back, if you lose the code. It is not used to contact you and it is not shared with anyone for any other reason.
The buyer list behind that is built by hand from the sales export of the shop you bought from (Bandcamp), which already holds your order under its own privacy policy. It is imported so that typing your address just works, and it carries only the address and what was bought.
Your Filament licence is issued by Filament, a separate product run by the same person. To issue it, the vault passes your address to Filament's licence service, which keeps it with the licence as the record of who it belongs to. Filament's own privacy policy applies to it from there.

The database is hosted by Upstash. Downloads are served from Cloudflare storage through short-lived signed links, so Cloudflare sees the request for the file, as any host would. Neither is given anything beyond what it needs to store the record or serve the file.

Ask and the record for your code, including the address, will be deleted. Deleting it means the code no longer opens the vault.

Server logs

The site is hosted on Vercel, which keeps short-lived technical logs of requests, including IP addresses. These exist so the site stays up and abuse can be spotted. They are not used for analytics or marketing, we do not read them routinely, and they expire on their own.

Links out

Links to Instagram, SoundCloud, Facebook, Bandcamp and similar take you to companies with their own rules. Once you are there, their privacy policies apply and ours stops. We get nothing back from those platforms about you.

Legal basis, since we are asked

Keeping the site online and secure rests on legitimate interests under Article 6(1)(f) GDPR. Storing a purchase address with a code, and passing it to Filament for the licence, is done to deliver what you bought, Article 6(1)(b). There is no profiling, no automated decision-making and no advertising, so the impact on you is as close to nothing as it gets.

Your rights

Under the UK and EU GDPR you may ask for access to your data, its correction, its deletion, a restriction on its use, or a copy of it. Those rights apply here in full. Outside the vault there is nothing for them to reach, because we hold no record of you and everything the site remembers is on your own device. Inside the vault, the record for your code is the whole of it, and a message is enough to have it read out to you or deleted.

If you think something has been handled badly, message us first. You also have the right to complain to your national data protection authority.

Children

This is a music site and is not directed at children. No data is knowingly collected from anyone, of any age.

Changes

If any of this ever stops being true - if an analytics script or an advertising pixel is ever added - this page will be updated first and you will be asked for consent before anything is stored on your device.

v1.1, 12 September 2026. The vault section was rewritten. v1.0 said the code was checked in your browser and never linked to an email address; since the purchase-email way in was added, neither is true, and this page now says what actually happens. The languages and the streaming-weight setting were added to the list of things kept in your browser.

NOTE ON THE VAULT Entering a code does not create an account. What is kept is the code, which edition it is, and, only if you used one, the purchase address - so that you can get back in.