Eternal Crane has no ads. It counts its visits with Cloudflare Web Analytics, which sets no cookie and follows no one (below). If you make a free account to download sheet music, the site keeps your email, and one cookie keeps you signed in; it keeps nothing else about you. The only other thing it asks you for is what you choose to send joEy through his form, and that goes to him by email. When you buy something, you pay on Stripe’s own checkout page, not on the site.
Your browser
The site sets one cookie, and only when you sign in: it keeps you signed in on that browser for a year, or until you sign out, and holds your account’s number and when you signed in, nothing else. Otherwise the site saves nothing in your browser but one word, and only if you turn Autoplay off under a video: that it stays off. It never leaves your browser. Its few scripts play a video from the moment you pick and the next one when it ends, open a transcript, show when the next lesson is in your own time, send the forms, say whether you’re signed in, and show what you ordered and list its downloads. None of them collects anything about you. One more script, on every page, is Cloudflare’s Web Analytics: it tells Cloudflare which page you opened, the site that sent you there and how quickly the page loaded for you, from your browser’s own timings. It saves nothing in your browser.
Where the site runs
The site is served by Cloudflare. Like any web server, Cloudflare sees each request your browser makes: your IP address, the page asked for and what your browser says about itself. It handles that under its own privacy policy, and keeps its own counts of the site’s traffic. Its Web Analytics turns what its script sends into totals in Cloudflare’s dashboard: how many visits and page views, which pages, which sites sent them, which countries, browsers and kinds of device they came from, and how fast the pages loaded. A visit is counted when someone arrives from another site, so no one is followed to count one: Cloudflare says it sets no cookie, keeps nothing in your browser, doesn’t single you out by your IP address or browser, and leaves out the part of an address after its question mark. It keeps the full detail for a week, then only totals. The site keeps no log of visits of its own. If a page fails to load, your browser may send Cloudflare a short error report (Network Error Logging), a standard way of finding network problems.
Google Fonts and YouTube
Every page loads its two typefaces, Cinzel and Poppins, from Google Fonts, so your browser asks Google’s servers for them. The pictures of the videos come from YouTube, and the videos play in YouTube’s own player, embedded in its privacy-enhanced mode (youtube-nocookie.com). Where a page’s times play its video, the page also loads YouTube’s player script from youtube.com. Each of these requests reaches Google, which handles it under Google’s privacy policy. Once you play a video, you are using YouTube.
Your account
Sheet music on the lesson pages is free with a free account. To make one, you give your email where you are (a free download’s page, or the sign-in page), and the site emails you a six-digit code and a link to sign in, sent through Resend, an email service, under its privacy policy. Typing the code, or opening the link, makes your account the first time; until then nothing is kept. The site then keeps three things, on Cloudflare, which runs it: your email, when your account was made and when you last signed in; and, for each course you asked to hear about, which course and when you asked. That is all: no password, no name and nothing about what you download. Your email is used only to sign you in and, only if you tap a course’s “Tell me when it opens”, to tell you in one email the day that course opens (turn it off under Emails on the sign-in page, or with the link in the email itself): joEy never shares or sells it, and the site sends you nothing else.
So that the sign-in form can’t be used to flood anyone with email, the site counts the sign-in emails it sends. For a day it keeps a scrambled form (a keyed hash) of each one’s address and of the network address that asked for it, never the addresses themselves, then deletes them; and Cloudflare counts how often one network address asks (three times a minute at most). So that no one can guess a code, the site also counts the tries at each one, five at most, for the hour it works, by a keyed hash of it alone, never your address.
You can sign out, or delete your account, on the sign-in page whenever you like: deleting it removes your email from the site at once. Or ask joEy through the Contact form, and he’ll delete it. If you are under 13, please ask a parent or guardian before you make an account.
Writing to joEy
Apart from the email for an account, the form at the foot of the Book joEy page is the only place the site asks for anything. Your name and email are optional; with an email, joEy can write back to you. Everything you send (your name, email, message, links and up to three files, 10 MB together) goes to joEy as one email, sent through Resend, an email service, under its privacy policy. The email also says which country the message came from, as Cloudflare reads it from your connection. The site keeps no copy: it arrives as an email in joEy’s inbox. joEy never shares or sells what you send, and he’ll delete it if you ask.
If you are under 13, please write to joEy with a parent or guardian.
To keep out spam, the form also sends how long it was open, and Cloudflare counts how often it is sent from one network address (three times a minute at most). Neither is put in the email or kept by the site.
Buying from the Store
Buy takes you to Stripe’s checkout page. What you enter there (your email, your card and billing details, and for something that ships, your name and shipping address) goes to Stripe, a payment service, never to the site, and Stripe handles it under its privacy policy. Some digital items are sold through Link, by Stripe, as their seller, and Link handles those orders under its own privacy policy. For a subscription, Stripe keeps your card to charge each period until you cancel. Stripe, or Link, sends your receipt.
The checkout then sends you back to the site’s thank-you page, whose address carries your order’s number: each time that page opens, the site asks Stripe whether that order is paid and, if it is, shows what you ordered and lists any downloads.
Something that ships is made and sent by a print partner, Printful today. Once it’s paid, the site passes your name, shipping address and email from Stripe to Printful, so it can make your order, ship it and tell you where it is, and Printful handles them under its privacy policy. The site emails you through Resend that your order is being made, with the address it’s going to, and again with its tracking once it ships; and it emails joEy what was ordered, with your name and town, so he can see to it.
The site itself keeps no record of your order. Stripe, Link and Printful keep theirs, and joEy keeps the order emails and what his Stripe account shows as his business records, for as long as his taxes and the law need them. He never shares or sells them beyond what those services need to fill your order.
Keeping it safe
The site sends everything over an encrypted connection and keeps as little as it can. No site or service is perfectly secure, so joEy can’t promise nothing will ever go wrong; if something does that touches what you gave the site, he’ll tell you, as the law asks.
The course calendar
Add to calendar gives you the course’s calendar file: each lesson’s day, title and link, and nothing about you. If your calendar app subscribes to it, the app fetches it from the site now and then, like any other visit.
Other sites
The links to YouTube, TikTok and Discord, and the checkout, take you to those services, where their own privacy policies apply.
Changes and questions
If what the site does changes, this page changes with it, and the date at the top says when. For any question about it, write to joEy through the Contact form. The site’s terms of service are on their own page.