Drumolo is a small, self-made project — and I built it so that respecting your privacy isn't a policy I ask you to trust, it's how the system is wired.
| Your email | To sign you in, verify your address, and send account emails (verify / password reset). Never sold or shared. |
|---|---|
| Your password | Only as an irreversible argon2id hash — never the password itself, never in plain text, never in logs. |
| Membership | Whether you're Free or on Drumolo Pro, so the app knows what to unlock. Everyone is Free at the moment — payments aren't switched on, so there's nothing to pay and no payment record to keep. |
| Feedback you send | Only if you use the feedback button — your message plus basic context (page, browser) so I can act on it. |
That's it. No card numbers, no location tracking, no advertising profile, no selling lists.
Every page and request is served over HTTPS/TLS (the padlock in your browser). Traffic rides through Cloudflare, which also shields the server and absorbs attacks.
Passwords are hashed with argon2id, the modern memory-hard standard. Sessions use signed, httpOnly, Secure cookies a browser script can't read.
Payments aren't switched on at the moment, so there's no checkout to go through and Drumolo holds no card details at all. When they are switched on, checkout will be handled by Lemon Squeezy as the Merchant of Record — a PCI-DSS-compliant processor — so your card details will go straight to them and never touch Drumolo's server.
Verification and password-reset links are single-use and expire quickly. Sign-in attempts are rate-limited, and reset never reveals whether an email is registered.
The account database is backed up nightly to two separate disks, so a hardware failure can't wipe your account — and backups hold the same hashed-only passwords.
If analytics are ever enabled, it's a cookieless, privacy-first counter (no cross-site tracking, no selling). I only want to know which features get used — never who you are.
You'll see sites plastered with “100% secure” seals. I'd rather show you the real thing than a sticker: the verifiable facts above — a valid TLS certificate (check the padlock) and argon2id hashing — are the genuine security guarantees. I won't display a third-party “audit” badge Drumolo hasn't actually earned.
Want a copy of your data, or want it gone for good? Email me and it's done — deleting your account removes your record and everything attached to it. Questions about any of this are welcome too.
👋 Coming soon — a short note about who builds Drumolo and why.