The rulebook.

Your audio never leaves your machine. It is decoded and analyzed in your browser, and it is never transmitted.

S3 is mandatory wherever this appears. Stating what does cross the boundary is what earns belief in the rest.

The measurements do travel: every completed report is handed to the page that embeds the tool, and for signed-in members the host stores it against their account. The audio is not part of that — the measurements and the file name, nothing more.

The file name is named deliberately. Master filenames routinely carry client, artist and version information, so an earlier wording — "only the numbers" — was imprecise in exactly the way a reviewer catches, and was corrected.

There is no fetch, XMLHttpRequest, WebSocket or sendBeacon anywhere in the build, and the page makes no external request of any kind. The only outbound path is a postMessage to the page that embeds it.

A structural fact rather than a policy promise, which is why it is the strongest sentence available — and why it is never softened into "we don't upload your files".

Saved clips are held in your browser's own storage (IndexedDB) — up to six clips within a 420 MB budget, oldest evicted first. Browser storage is not encrypted: anyone using that browser profile can replay them.

The second sentence never appears without the first, and the first never appears without the second.

The page never sends a member id. The host derives the member from the signed-in session on the server.

No account is required to analyze a master. Without one, appraisals are kept in that browser's own storage; signing in is what makes them follow you to another browser or another machine.

Appraisals you made before signing in are added to your account when you sign in. A row leaves this browser only once the account has confirmed it, so nothing is discarded — if the account cannot be reached, the appraisals stay where they are and the app says so.

An earlier version of this described a silent wipe, and it cost the site owner two appraisals before it was corrected. That is what the correction record below is for.

Clear removes the appraisal from the account permanently. It is not a local hide.

Appraisals belong to the account, not the person at the keyboard. If you sign in as a client and run evaluations, that client will see them. Clear them before you sign out.

The app acts on messages only from the site it is published on. A page that embeds it anywhere else cannot supply the member name it displays or the appraisal list it shows — it will show only the history held in that browser.

What this does not claim, stated because a security section that lists only reassurances is discounted on sight: it is not a defense against the site you are already on. A page that embeds the tool controls the frame around it and could draw anything it liked without involving the tool at all. The guarantee is narrower and exact.

The report is posted to whichever page embeds the tool. On museguitarist.com that is your own site. Any other site that embeds the tool would receive the reports run inside it — the audio, never.

This is the outbound mirror of S11, and it is a hardening item that has not been closed. The reason it is still open is a real observed failure rather than a shortcut: a mismatched target origin is dropped silently, so a wrong guess loses a reader's results with no error anywhere. It is never presented as resolved, and closing S11 did not close it.

The page loads its webfonts from a third party, which is a request on every page load. It carries no audio and no measurements — it is a static stylesheet URL — but it does disclose the visitor's IP address. Self-hosting the fonts would remove it.

Resolved by inlining the font faces into the build, so the assembled file contains no external address at all. It is kept here, struck, because pages published before that build carried it — and because a reviewer checking the old citation should find out from us that it has moved, not from the discrepancy.