Your data

Privacy Policy

1. Who is responsible

Maksym Wieslaw, trading as Never Found Audio, Brookstraße 2a, 49685 Höltinghausen, Germany. info@neverfoundaudio.com. No data protection officer is appointed, as the thresholds requiring one are not met.

2. Hosting and server logs

This site runs on Cloudflare Pages (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA), which processes standard server logs when a page is requested: IP address, date and time, the file requested, amount of data transferred, browser type and version, operating system, and referring URL. They exist to run the site securely and are deleted automatically on Cloudflare’s retention schedule.

3. Fonts

The typefaces used on this site are served from our own server. No connection is made to Google Fonts or any other third party, and no data is transmitted to anyone in the process.

4. Cookies and local storage

This site sets no cookies and writes nothing to local or session storage. Switching colour themes on the EEQ-8 page only changes the screenshot shown and is not saved. No consent banner is needed, because nothing is stored on or read from your device.

The one exception is Kerf’s account site, account.neverfoundaudio.com: it sets cookies that are strictly necessary for signing in (section 15.2).

The Audio to MIDI tool reads the audio file you choose inside your browser. The file is not uploaded, stored or sent anywhere; closing the page discards it and the notes. The MG-Mini sign-up form on the same page is separate from the tool: it never sees the file, and it is described in section 8.

5. Analytics

We use Cloudflare Web Analytics to count page views. It collects aggregate figures only — page views, approximate visitor numbers, referring site, country and device type. It sets no cookies, stores nothing on your device, does no fingerprinting, and builds no cross-site or cross-device profile.

6. Videos (YouTube)

The videos on the EEQ-8 page and on the LF-Pro page are hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

They do not load automatically. Until you click play, no connection to YouTube or Google is made — the thumbnail you see is served from our own server.

When you click play, the player is loaded from youtube-nocookie.com. Your IP address and information about your browser and device are transmitted to Google in the process, possibly to the United States. Google may set cookies or use similar technologies at that point. If you are signed in to Google at the same time, Google can associate the view with your account.

The legal basis is your consent, given by clicking play. Without that click nothing is transmitted. You can withdraw it at any time by reloading the page and not starting the video again.

7. Email and the contact forms

If you write to us, your address and message are processed to answer you, and kept as long as that requires plus any statutory retention period.

The same applies to the two forms on this site — Contact and Earn with us. What you type there is not stored in any database, added to any list, or used for advertising. It is turned into an email and sent to us, and after that it exists only in our mailbox. Sending is handled by Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA), acting on our instructions. Your address is set as the reply-to address on that email, so that we can answer you directly.

If you open the contact form from a link in our newsletter, it also shows a box asking for a 15% discount code for EEQ-8. Only if you tick it, your email address is compared with our newsletter list at Resend. If it is on the list and not unsubscribed, the code is emailed to that address; otherwise nothing is sent. So that the code goes to each address only once, a one-way hash of your address — not the address itself — is kept in Cloudflare Workers KV for 60 days and then deletes itself. The legal basis is your request (Art. 6(1)(b) GDPR) and our legitimate interest in giving the code only to subscribers (Art. 6(1)(f) GDPR).

One short-lived technical record is written, purely to stop the forms being abused: your IP address is stored for five minutes to limit how many messages can be sent from one connection. It is held in Cloudflare Workers KV, deletes itself automatically, and is not used to identify you or to build any kind of profile.

Sending a form also writes a short technical log entry — that a message went out, or that sending failed. For the contact form this includes the reason you picked from the list and, if you ticked the discount box, whether the code was sent; it does not include your message. If a send fails, the error our email provider returned is recorded too, and that can contain your email address. These entries exist so that a message which did not arrive can be traced, and they are deleted automatically on Cloudflare’s retention schedule for Workers Logs.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract, and otherwise our legitimate interest in answering you and in contact forms that cannot be abused (Art. 6(1)(f) GDPR).

8. Newsletter, and the free download

Signing up uses confirmed opt-in: your address is stored only after you click the link in a confirmation email. Until then nothing is kept. Sending is handled by Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA). Every newsletter email has an unsubscribe link, and so does every other email that suggests one of our products. The confirmation link works for seven days. Resend processes the data as our processor under Art. 28 GDPR, in its Ireland region; the data processing agreement was signed on 19 August 2026.

The newsletter tells you now and then about VT-Pro, EEQ-8 and other NEVER FOUND releases, including the launch price of a new plug-in. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, with effect for the future, through the unsubscribe link in those emails or by writing to us. Your address is then marked as unsubscribed at Resend and gets no further newsletter. We keep that marker so the address is not mailed again by mistake and the withdrawal can be shown (Art. 6(1)(f) GDPR). If you want the address deleted entirely, write to us.

On this site, VT-Mini and MG-Mini are sent to people on that list, so joining it is how you get them here (VT-Mini is also available through MuseHub). Clicking the confirmation link does two things: it adds your address to the list, and it sends you a second email containing the download link for the plug-in you signed up for — MG-Mini if you signed up on the MG-Mini page or the Audio to MIDI page, otherwise VT-Mini. You may unsubscribe immediately afterwards and keep the plug-in — it needs no account, has no licence key, and never contacts us again.

The EEQ-8 trial is offered the same way. Signing up on the trial page uses the same confirmed opt-in and puts you on the same list. Clicking the confirmation link then sends you an EEQ-8 trial key and the download link instead of VT-Mini, and files your address in a separate group on that list, so we can tell that you came for the trial. You may unsubscribe at any time; the trial keeps running until it ends.

The only personal detail we keep for any of these purposes is your email address, and it is not passed to anyone but Resend, who send the mail on our behalf.

Three short-lived technical records are also written, purely to keep the form from being abused. Your IP address is stored for 60 seconds, to limit how many signups can come from one connection per minute. A shortened, one-way hash of your address is stored for one hour, so that submitting the form twice does not send you two confirmation emails; and a second such hash for 24 hours, so that a confirmation link opened more than once — by you, or by the link scanner your mail provider runs — does not send you the same download again; for a trial key the same protection lasts ten minutes. Both are held in Cloudflare Workers KV, both delete themselves automatically, and neither is used to identify you or to build any kind of profile. The legal basis is our legitimate interest in a signup form that works and cannot be abused (Art. 6(1)(f) GDPR).

Addresses at disposable-mail providers are refused, and obvious typos are pointed out rather than silently accepted. Three checks run: a fixed list of known throwaway domains held on our own server; a DNS lookup of the domain part of your address — never the part before the @ — through Cloudflare’s public resolver, to see which mail server that domain uses; and a comparison against the domains people most often mistype. A refused attempt is noted in our technical logs as the domain alone, not your full address.

Running the signup also writes short-lived technical log entries — that a confirmation was sent, that a send failed, that a duplicate was suppressed. These can contain your email address and the IP address the form was submitted from. They exist so that a signup which did not work can be traced and fixed, they are deleted automatically on Cloudflare’s retention schedule for Workers Logs, and they are never used to build a profile of you. The legal basis is our legitimate interest in a signup process we can repair when it breaks (Art. 6(1)(f) GDPR).

9. Licence check inside the software

EEQ-8 verifies its licence with Keygen (Keygen LLC, 1606 Headway Cir STE 9246, Austin, TX 78754, USA). The licence key and a machine fingerprint are transmitted, so the licence can be matched to the machine it is activated on. When you open the plug-in window while online, this happens at most once a day; without a connection EEQ-8 keeps working for up to 45 days. Audio, projects and file names are never transmitted.

Until 10 September 2026 the trial could also be started inside the plug-in. That sent a machine fingerprint — a one-way hash calculated on your computer — to our server, which asked Keygen for a trial licence; no name, email address or other contact detail was sent. Older versions of EEQ-8 still show that button, but our server no longer issues trials through it. Trial licences and their fingerprints stay stored with Keygen after the trial has ended, because they are what stops the same computer from starting a second trial. The legal basis is our legitimate interest in offering a trial that cannot be repeated endlessly on the same machine (Art. 6(1)(f) GDPR).

A trial requested through the newsletter (see section 8) is created only after you have confirmed your address. Keygen then receives a keyed one-way hash of your address with the trial licence — never the address itself — which stops the same address from receiving a second trial and cannot be turned back into the address. The trial key and the download link are sent through Resend. The log entries our code writes when issuing the key contain only the first twelve characters of that hash; the signup itself is logged as described in section 8. The legal basis is Art. 6(1)(b) GDPR for sending the trial you asked for, and our legitimate interest in one trial per computer and per email address (Art. 6(1)(f) GDPR).

A trial key that is never activated is deleted again after 24 hours, together with the hash of your address that was stored with it. Nothing of that request is then left with Keygen, and you can ask for a trial again. Once a trial has been activated, the licence and the machine fingerprint stay stored, because they are what stops the same computer from starting a second trial.

To stop one person from collecting trials with several addresses, two more checks run when you sign up on the trial page. Addresses are compared the way mail providers deliver them: anything after a plus sign in the part before the @ is ignored, and for Gmail the dots are too. And at most two different addresses per internet connection can request a trial within 30 days. For this, a keyed one-way hash of the IP address the form was sent from is stored for 30 days, together with shortened one-way hashes of up to two addresses; neither the IP address nor an address is stored in readable form. The legal basis is our legitimate interest in one trial per person (Art. 6(1)(f) GDPR).

This applies to EEQ-8 only. VT-Mini and MG-Mini are free and unlicensed: neither makes a network connection of any kind, at any time. MG-Mini's help can open neverfoundaudio.com in your own browser, but only when you click the link.

LF-Pro is different: it is sold through MuseHub, and its licence is checked by MuseHub’s own system on your computer. The plug-in itself makes no connection of any kind — it sends nothing to us, and we receive no data about your use of it. What MuseHub processes is described in their privacy policy.

10. Purchase

EEQ-8 is sold through Lemon Squeezy (Sold through Link, LLC, formerly Lemon Squeezy LLC, 222 South Main Street, Suite 500, Salt Lake City, UT 84101, USA), which acts as merchant of record and is the seller of your purchase. Payment and billing details are collected and processed on their systems, under Lemon Squeezy’s own privacy policy. Payment details never reach us.

After a purchase, Lemon Squeezy sends us your email address, your name and the order number. We use them to create your licence and email you the key. The order number and your email address are stored with the licence at Keygen, so that the purchase can be matched later, for a support request or a refund; your name is used only to greet you in that email. Keygen and Resend are described in sections 8 and 9. The legal basis is Art. 6(1)(b) GDPR.

11. Instagram messages (ManyChat)

If you comment a keyword on one of our Instagram posts or send us a direct message, the automatic reply with the link you asked for is sent through ManyChat (ManyChat, Inc., 8605 Santa Monica Blvd #64372, West Hollywood, CA 90069, USA), which processes the conversation on our behalf under its data processing agreement (Art. 28 GDPR). ManyChat receives your Instagram username and user ID, your public profile name and picture, and what you write in that conversation. We use this only to answer your request. We do not collect email addresses in Instagram messages: if you sign up for something, that happens on our website and section 8 applies.

ManyChat is certified under the EU–U.S. Data Privacy Framework, which covers the transfer to the USA (Art. 45 GDPR). Instagram itself is run by Meta Platforms Ireland Limited under its own privacy policy. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in replying to messages people send us. We delete the conversation data on request.

12. Your rights

Wherever you live, you may ask for a copy of the personal data we hold about you, ask for it to be corrected or deleted, or object to our use of it. Write to info@neverfoundaudio.com. In the EU or UK you may also complain to a supervisory authority.

13. If you live in California

NEVER FOUND is a very small business and does not meet the thresholds that make the CCPA/CPRA binding on it. The rights below are honoured regardless.

In the past twelve months we have collected identifiers (email address, IP address) and internet activity information, as described above, in order to deliver the product, answer messages and run the site.

We do not sell or share personal information, and never have. We do not use or disclose sensitive personal information for any purpose that would carry a right to limit. There is therefore no “Do Not Sell or Share My Personal Information” link to offer.

You may request to know, delete or correct your personal information at the address above. You will not be treated differently for exercising these rights.

14. Children

This site and EEQ-8 are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, write in and it will be deleted.

15. Kerf (video editor) and the Kerf account

This section covers the Kerf program and the Kerf account at account.neverfoundaudio.com. The controller is the same as in section 1. Unlike the rest of this site, the account pages set cookies that are strictly necessary for signing in (15.2).

15.1 Creating an account and signing in

For a Kerf account we process your name, your email address and your password. The password is stored only as a salted hash (scrypt), never in readable form. To confirm your address, to sign in with a code and to reset your password we email six-digit codes; they are valid for ten minutes and stored only as a hash. Addresses at throwaway-mail providers are refused.

If you sign in with Google or Apple (where offered), the account page sends you to that provider (Google Ireland Limited, address as in section 6; Apple Distribution International Ltd., Ireland). From there we receive your name, your email address, the ID of your account with that provider and, for Google, the link to your profile picture; the sign-in tokens the provider issues are stored with your account. The account page and the Kerf sign-in page load your profile picture straight from Google’s servers, which receive your IP address in the process. What the providers process themselves is set out in their own privacy policies.

The legal basis is Art. 6(1)(b) GDPR. Account data is kept until you delete your account.

15.2 Cookies on account.neverfoundaudio.com

The account page sets a session cookie (__Secure-better-auth.session_token, valid for 30 days) that keeps you signed in; during a sign-in with Google or Apple, a cookie for five minutes that secures that step (__Secure-better-auth.state); and, only while a sign-in that Kerf started is under way, a cookie for one hour (kerf_app, containing nothing but “1”) that notes the sign-in came from Kerf, so your welcome email leaves out the download you already have. All three are needed for the service you asked for (§ 25(2) no. 2 TDDDG), so no consent is required. There are no other cookies, no tracking and no advertising there.

15.3 Security

With every sign-in session we store the IP address and browser identification (user agent) you signed in from; you can see both in your data export. They are kept until you sign out, reset your password or delete your account, and are deleted at the latest 30 days after the session was last used. To limit requests, your IP address is stored for about a minute, and on the cancellation page a one-way hash of it for up to a day; to limit how many code emails go to one address, a one-way hash of your email address is stored for 24 hours; to limit checkouts and subscription-page links, your account ID is stored with each request for up to a day. If you wish, you can protect your account with a second factor (an authenticator app); its secret is stored encrypted and the backup codes only as hashes. Technical log entries can contain your account ID or email address and are deleted on Cloudflare’s retention schedule for Workers Logs. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in protecting your account and our service from abuse.

15.4 Kerf on your computer

When you first sign in inside Kerf, the computer is linked to your account. For this, Kerf sends the computer name as set in Windows or macOS (it often contains a first name), the operating system and a one-way hash of the computer’s system ID, which cannot be reversed. An account can be linked to up to two computers at a time; your account page lists them and lets you remove one, for example before you use Kerf on a third.

Kerf checks your subscription when it starts, every six hours and when its window becomes active again, sending that hash, the Kerf version and a device token. Without an internet connection Kerf keeps working for up to 7 days (3 days during a trial or after a failed payment). A computer that hasn’t checked in for 90 days is signed out. Resetting your password or turning on the second factor signs Kerf out on all your computers. We store when a computer last checked in and with which version, and for each account the days on which Kerf checked in; those days are deleted after 400 days. The legal basis is Art. 6(1)(b) GDPR for checking the subscription and Art. 6(1)(f) GDPR for the usage days (understanding how Kerf is used and spotting abuse).

15.5 Trial, subscription and payment

Subscriptions are taken out through Lemon Squeezy (address as in section 10), which acts as merchant of record, is your contracting party for the payment and processes payment details under its own privacy policy. When the checkout opens, we pass Lemon Squeezy your email address, your name and your account ID, signed by us so nobody else can set it. Lemon Squeezy reports back the subscription and customer IDs, email address, plan, status, renewal, end and trial dates, a link to its customer portal and, for each payment, the amount, the currency and whether it was refunded. We never receive card or address details.

The trial is available once per computer and once per email address. For this we store a one-way hash of the computer’s system ID and a one-way hash of your email address (anything after a plus sign, and the dots in Gmail addresses, are ignored). These hashes stay stored after you delete your account, because otherwise every deletion would open a new trial.

If you delete your account, we cancel a running subscription at Lemon Squeezy at the end of the paid period and then delete its subscription records; we keep only the Lemon Squeezy subscription ID, so that a late message about it isn’t stored again. Payment records (amount, currency, date, whether refunded) are kept without any link to you for our revenue figures and deleted after three years. As seller, Lemon Squeezy keeps the accounting records. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the trial hashes, the subscription IDs and the payment figures.

Cancelling without signing in. At account.neverfoundaudio.com/cancel you can cancel a subscription without signing in. We process the name, the email address, the type of cancellation, a reason (for an extraordinary cancellation) and the date you give, and first email a link to that address, so nobody can cancel someone else’s subscription; until the link is used we keep this as a pending request for at most 24 hours. When you click “Jetzt kündigen” on the link’s page, we look up the subscription by that email address, cancel it at Lemon Squeezy and email you a confirmation; a copy goes to our support inbox. We keep the cancellation record for three years as proof and then delete it. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 312k BGB, and Art. 6(1)(f) GDPR for keeping the proof.

15.6 Emails

For the account we send emails through Resend (see section 8; Ireland region, data processing agreement of 19 August 2026): codes, a welcome email with the download links, the download link again when you ask for it, replies to your reports and confirmations of cancellations. A Kerf account does not put you on our newsletter. The legal basis is Art. 6(1)(b) GDPR.

15.7 Help & feedback in Kerf

“Help & feedback” lets you write to us from inside Kerf. It sends the topic, your message and a contact address. With “Include diagnostics” switched on (the default; before sending you see exactly what goes), it adds the Kerf version, operating system, language, the end of Kerf’s log file (at most 64 KB; it can contain file paths with your Windows or macOS user name), the last crash and the context of an error.

Screenshot (F7): Only when you open a report with F7 or the “Report” button does Kerf take a picture of its own window – not of the rest of your screen. You see the picture before sending and can leave it out (“Include a screenshot of Kerf”). A report you open without F7 never contains a picture. The picture shows whatever was open in Kerf at that moment, such as frames from your video, file and project names, or your email address on the account screen.

Reports are stored with your account – the text in the database, the screenshot in file storage (Cloudflare R2) – until you delete your account, and are emailed to us through Resend with the log and the screenshot attached; we keep those emails as long as handling the report requires. The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR (answering you and fixing faults). Your data export links your own screenshots.

15.8 Updates and downloads

Kerf asks for a new version when it starts and every six hours. Updates and the installer are downloaded from account.neverfoundaudio.com and checked for authenticity before they are installed. Downloads are counted as daily totals only and no personal data is stored with them; technically, your IP address is transmitted (section 2).

15.9 AI models from Hugging Face

For captions and transcripts, meaning search, music detection and separating voice from music, Kerf downloads the model it needs from Hugging Face (Hugging Face, Inc., USA) the first time you use the feature. Your IP address and technical details about the program are transmitted, no content. From then on the models run only on your computer. The legal basis is Art. 6(1)(b) GDPR.

15.10 Fonts for text in your videos

Kerf loads a font for text in your videos from Google Fonts (Google Ireland Limited, address as in section 6) or Fontshare (Indian Type Foundry, India) when a project uses it, or when you open the font list; the fonts of Kerf’s own interface ship with Kerf. Your IP address, technical details about the program and the font names are transmitted, possibly to the USA or India. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in a wide choice of fonts for your videos.

15.11 Cut out

Cutting out people uses Google’s MediaPipe library, which runs on your computer. The library would send usage statistics to Google; Kerf blocks this, so nothing about your use of the feature leaves your computer.

15.12 Claude

Kerf can work with Claude, Anthropic’s AI assistant. Kerf itself sends nothing to Anthropic: it only offers Claude an interface on your own computer (Model Context Protocol, reachable at 127.0.0.1 only). When you use Claude with Kerf, your Claude app or Claude Code sends what Claude reads through Kerf – such as the project structure, file and project names with their location, transcripts, single frames from your video and the names of installed plug-ins – to Anthropic under your own account; Anthropic is responsible for that under its own privacy policy. So that Claude can find Kerf, Kerf adds itself to the settings of the Claude app and Claude Code; in Kerf’s Claude panel this can be switched off per app and altogether (“Allow Claude to edit”). Every Kerf feature works without Claude.

15.13 What stays on your computer

Speech recognition, music detection, separating voice from music, the face detection for automatic zooms and the Assist Bar run entirely on your computer. Kerf keeps your projects and copies of the media you import in its data folder on your computer. Log files leave the computer only with a report (15.7).

15.14 Usage figures on the account pages

On account.neverfoundaudio.com we count daily totals only: page views, the referring domain (at most 200 new domains a day; the rest are counted together), the country, checkouts started and downloads. No cookies are set for this and no IP addresses are stored. The legal basis is Art. 6(1)(f) GDPR.

15.15 Who sees account data

Only the operator has access to account data, through a protected admin area with a second factor, for example to answer requests, reconcile subscriptions or block abuse. A business partner who helps run Kerf has a separate area, also protected with a second factor: it shows totals (accounts, revenue, usage, visits) and, for problem reports, only the topic, Kerf version, operating system, date and a masked contact address (such as k•••@g•••.com); no account data, no report contents, no screenshots. Changes made in the admin area are logged with time and IP address; the log is deleted after 12 months, and for a deleted account it keeps only a masked address.

15.16 Where data is kept, recipients and your rights

The Kerf account runs on Cloudflare Workers, with a database (D1) and file storage (R2) at Cloudflare (see section 2). Further recipients are Resend (emails), Lemon Squeezy (payment, as an independent controller) and, when you use the respective feature, Google or Apple (sign-in), Hugging Face (models), Google and Indian Type Foundry (fonts).

On your account page you can download your data (“Download my data”: account, sign-ins, sessions, computers, trial, plan, subscriptions, payments, emails we sent, reports with their screenshots and our answers, the days Kerf was used, free access or a block, the second factor and admin actions on your account) and delete your account. After deletion, only these remain: the trial hashes, the Lemon Squeezy subscription IDs, payment records without any link to you for three years and cancellation records for three years (15.5), and admin log entries with a masked address for up to 12 months (15.15). We correct your name or email address on request by email. Section 12 applies otherwise.

Kerf is not directed to children under 16.

16. Changes

This policy is updated when the site or the product changes. The current version is the one that applies.