Privacy notice · October 13, 2026
A little care for
your information.
This notice describes the current Teddy Wonder website and the choices you have. Listening and browsing are open to everyone; sign-in options are available only after their provider connections are configured.
What the site keeps
- Sparks membership: Google and X sign-in are available when connected; unconfigured options stay disabled. After sign-in, the membership database stores the provider’s stable account identifier, your chosen public handle, profile creation time, and your private saved songs, images and videos. Profile details you choose to add—display name, bio, links and uploaded avatar—are stored and displayed on your public profile. Uploaded avatars are kept in site storage. A verified email supplied by Google at sign-in is retained privately for account administration. X may not supply an email. Provider passwords and access tokens are not stored. You can opt out of the member directory in account settings.
- Spark levels: Joining earns your membership badge. Levels reflect distinct qualified songs, active likes on other members’ approved notes, and your approved public notes; likes and notes each contribute at most five. Creating a website account joins the Sparks program; there is no separate fan-club enrollment. Qualifying listening counts automatically while you are signed in. Qualified song IDs and completion dates stay privately with your account; short verification sessions expire after 15 minutes. Your level and chosen accent are public. Signed-out listening does not count toward an account. These account features are separate from optional analytics and device-only recent listening.
- Optional account emails: the site saves your separate choices for account activity (replies and reactions) and Letters from Teddy (new music, site updates and promotions), with their version and save time. Both start unchecked and can be changed in account settings. These choices are private. A verified sign-in email is separate from these optional delivery choices. Account activity emails and Letters delivery are not connected; these choices record interest only and do not send email or enroll you in the separate newsletter list. In-app notices and essential sign-in and safety controls continue independently.
- Newsletter: your email, signup time, consent wording and version, and signup source. Email delivery is not connected, and no campaigns are sent from this site yet.
- Fan notes and community posts: display name or member handle, message, submission time, optional song or article context, reply reference, publishing-policy version, and moderation status. Member notes are associated with the member’s internal account identifier. Ordinary posts from members approved for instant publishing become public after automatic checks. Unreviewed accounts, flagged posts, and uploaded photos, GIFs or videos are held privately for staff review. Uploads are stored with their owner and post reference; public attachments are shown only with an available public post. Automatic checks validate text and file format, not the meaning of an image or video. Removal requests remain private. Likes, reposts and follow connections are associated with member accounts and may appear publicly when community features are enabled.
- Post bookmarks and impressions: saved posts stay private to your membership and can be removed from your bookmarks. Public impression totals count a post after at least half is visible for one second, once per member or browser session within 24 hours. The site stores short-lived hashed identifiers to prevent repeated counts; expired identifiers are cleared during subsequent counting. The total counts qualified views, not unique people. This functional community count is separate from optional advertising analytics.
- Sparks XP: Private account records store XP award identifiers, amounts, qualifying dates and acknowledged levels so repeat requests cannot create duplicate awards. Song and music-video identifiers are included in qualifying media receipts; playback verification sessions last up to 15 minutes. Game rewards use short-lived visit, area and elevator checks, including positions supplied with eligible actions; these verification records expire with the visit, within two hours. Durable game award receipts contain the activity identifier and points, not a continuous movement history. Visible muted or captioned video viewing can qualify; audio listening must be audible. Your numeric XP level is displayed on your public member star; your exact XP balance and reward history remain private. The XP ledger and earned badges persist when an underlying like, follow or post is removed. XP records are included in your account export and removed with your membership. These membership records are separate from optional analytics.
- Star finds: playful achievements are private collectibles, separate from Spark contribution levels. Short-lived activity records count overlapping sounds and revealed stars. Eligible star clicks are counted across visits, with distinct star identifiers preventing repeated plays from earning extra random chances. Those functional records stay with your account; a secure browser receipt preserves guest progress and earned finds for 30 days so they can be kept after joining or signing in. Saved finds retain their sound and stay with your account. These functional records are separate from optional analytics.
- Private messages and safety: when enabled, the site stores messages between members, their participants, time and read status. The application shows a conversation only to its participants. Reporting a message deliberately shares that specific message and your explanation with the owner for moderation. Blocks, reports, account status and moderation decisions are stored to enforce safety controls. Private messages are not end-to-end encrypted.
- In-app notifications: when community features are enabled, the site keeps follow, approved-reply, message and owner music-announcement notices, including their time and read status. These are website notifications; they do not send email, browser push notifications or messages through Google or X.
- Abuse controls: short-lived hashed request identifiers and attempt counts help limit spam. For signed-in accounts, the latest Cloudflare-reported IP and last activity time support abuse review. IPs expire from account display after 30 days and are removed during subsequent account activity after expiry. Email and IP details are restricted to administrators. Staff flags and notes remain private; warnings are visible to the affected member in account settings.
- Hosting and sign-in: OpenAI Sites, Cloudflare, and any sign-in provider you choose process requests under their own policies and may maintain operational or security logs. This notice does not control those providers’ retention. Owner administration is separate from fan membership.
Contact inquiries
When connected, the contact form sends your name, email, inquiry type, message and any optional project details privately to the project's inbox through its email delivery service. The website does not store a copy of the inquiry body. Email providers and the receiving inbox may retain the correspondence under their own settings. Your email is used as the reply address; submitting does not subscribe you to a newsletter. Form contents are not sent to Analytics. If delivery is unavailable, the form says so and does not claim your message was sent.
Sign-in and essential cookies
Google or X verifies your account, then the site asks you to choose a public handle. Provider profile information is used only to obtain a stable identity; a verified Google email may also be saved privately, while other returned profile fields and provider tokens are discarded. The site does not read your posts, send social messages, or publish to your accounts. Use the same sign-in option each visit; Google and X accounts are not automatically linked.
A short-lived security cookie binds a sign-in attempt to your browser for up to ten minutes. A successful fan sign-in creates an essential, protected session cookie lasting up to fourteen days. The database stores its hash, account identifier, creation time, and expiry. Signing out of the fan club deletes that session and clears its cookie. It does not sign you out of Google, X, or the owner’s hosting-platform account. Expired sign-in records are rejected and cleared during later sign-in activity.
Device storage and your choices
Your optional analytics choice is stored locally with its timestamp and version. Lighting preferences, device keepsakes, and recent listening and resume positions also stay in your browser. Recent listening expires after 30 days and can be cleared in the song queue; it is not exported to analytics. Profile keepsakes are stored in the database when you choose to save them to your account. Unsent community and message drafts may remain in this tab’s session storage so you can return to them. Instruments start with sound enabled and need your first click or tap before the browser can play sound; mute and volume choices are remembered on this device. The separate star-sound on/off choice also stays on this device and does not change music-player volume.
Use “Privacy choices” in the footer or your account menu to change optional analytics permission. Clearing browser storage removes local preferences and device keepsakes; it does not remove your member profile.
Personalized portraits
Names, song choices and celebrations entered for a signed portrait are processed in your browser and are not submitted to the site's database. They appear on the downloadable image. Sharing sends that image only through the destination you choose in your device's share sheet.
Optional analytics
With your optional analytics permission, the website records public song-play attempts, audible playback time and the parts of a song played. A play qualifies after 30 seconds of audible playback. Completion means at least 90% of the recording was played, using distinct played sections so seeking to the end or repeating one section does not count as finishing. These are browser-reported playback measurements, not proof of attention or royalty counts. Listening in private areas such as accounts, messages and the apartment is excluded.
A random browser identifier is created only after permission and expires after 90 days. For signed-in listening, a pseudonymous account identifier can group repeat listening across devices; guest listening is grouped by browser. Unique listeners therefore mean accounts or browsers, not unique people. This first-party feature works independently of Google Analytics. It does not import previous listening history or Spark rewards. The administrator report covers a 90-day window; older attempt records are removed during routine cleanup when analytics activity or report access resumes. Withdrawing permission immediately stops new measurement and clears the local analytics browser identifier; previously received records remain subject to that reporting window and cleanup process.
Google Analytics 4 is an optional service for understanding visits and how people use the public music pages. When enabled, its tag loads only after you allow optional analytics. Rejecting analytics prevents the tag from loading; withdrawing permission stops it and reloads the page. Advertising consent remains denied. The site does not send email addresses, member handles, comments, private messages, or form contents as analytics events.
With the same permission and enabled analytics configuration, public media measurements can report a recording starting, reaching 30 seconds of qualifying playback, or a selected film. These events contain the public song or film identifier and media type. Pauses, buffering, seeking and muted playback do not count toward the 30-second event. The site's media measurements exclude account and private-message routes, query strings and your local listening history; playback before permission is not sent later. These measurements describe playback, not proof that a person heard or enjoyed it.
How information is used
Membership supports your handle, saved songs and enabled community features. Newsletter consent records and optional account email choices support future requested emails. Guestbook records support moderation and displaying approved notes. The owner can review reports and suspend accounts; moderation audit records keep action metadata rather than copies of removed message bodies. The site includes no advertising trackers and does not sell collected information.
Removal, exports and retention
You can remove a newsletter signup using the form below. To request profile, community or fan-note removal, leave a moderation note beginning with “Removal request” in the guestbook. These requests are never shown publicly. When community features are enabled, signed-in members can export their own posts, connections, blocks, conversation messages and notifications from their account. Exports use public handles for other participants. The owner can remove contacts and messages and export moderation records for migration; the owner dashboard does not provide a general private-message inbox or export of everyone’s conversations. Operational retention periods and a dedicated privacy contact still need owner confirmation before public launch.
External links
Links to external sites take you to services with their own privacy policies. They are not embedded trackers on this site.
Fan sign-in connections require the owner’s provider setup before they can be used. Google Search Console verification is a separate future ownership setup and does not require analytics consent.