Privacy Policy

Updated 25 September 2026. This policy is currently available in English.

This page explains what FreeSoundLab (freesoundlab.com) collects when you browse the site or sign in, and how that information is used.

Browsing

You can browse, preview and download free sounds without an account.

Our own product analytics sends events to /api/v1/events, including page paths and query strings, searches, referrer URLs, campaign (utm_*) parameters, locale and details of the action (for example a preview or download). It keeps a random visitor number in a vid cookie (one-year lifetime) and in localStorage as fsl_vid; campaign information is kept in fsl_utm for up to 30 days. Tab-session bookkeeping uses fsl_sid, fsl_sid_at and fsl_ref_sent in sessionStorage, and the session number resets after 30 minutes of inactivity. If you sign in, these events may be linked to your account.

We also use Google Analytics 4, which receives usage information from your browser and may set its own cookies. Google's use of this data is covered by the Google Privacy Policy, and you can opt out with the Google Analytics opt-out browser add-on.

Downloads without an account

Free downloads do not require sign-in. They use the same first-party vid visitor number described above; first-party cookies must be enabled. For each anonymous full-file download, we record the visitor number, a salted cryptographic hash (HMAC) of the client IP address, the time, and the downloaded asset and its license information. The download records do not store the raw IP address. We use these records to apply download limits over the preceding 24 hours, enforce a short cooldown, prevent bulk abuse and maintain download counts. People sharing a network may share its IP-based limit.

Anonymous visitor numbers and IP hashes are removed from download records after 30 days by an hourly cleanup, also run when the backend starts. Cleanup may be delayed while the service is unavailable. The remaining records retain the asset, time and license information for aggregate counts and audit; these unlinked records do not currently have a fixed deletion schedule. This cleanup applies to download records, not the separate product analytics described above.

Signing in with Google

Sign-in uses Google OAuth and asks only for basic profile access (openid, email, profile). We receive and store your email address, name, Google account identifier and profile image URL. We do not get access to your Gmail, Drive or any other Google data.

A signed session cookie keeps you signed in for up to 30 days. Your account stores the features you use: favourites, download history and daily download quota usage.

Server logs and security

The site is delivered through Cloudflare, which processes requests (including IP addresses) to deliver pages and protect the site. Our server access logs record IP addresses, browser strings, requested URLs and times; they are used for security and abuse prevention, such as blocking automated scrapers, and are deleted after about 14 days. Pages also send a content-free /api/track/view request that appears only in these logs, to help tell readers from scrapers.

Sharing

We do not sell personal information. Information is shared only with the service providers named above (Google for sign-in and analytics, Cloudflare for delivery and security), or when required by law.

Retention

Server access logs are kept for about 14 days. Account information is kept while your account exists. Anonymous download visitor numbers and IP hashes have the 30-day cleanup described above; unlinked download audit records and product analytics events do not yet have an automatic deletion period.

Changes

If these practices change, we will update this page and the date at the top.