Privacy policy

Merry Bells, run by Brad and Kim Peterson.

• Your account. Email address, a password, the name you choose to display, and whether you want occasional news from us. Passwords are hashed by our authentication provider — we never see or store the password itself.
• Your orders. What you bought, what you paid, and a shipping address when the order contains something physical.
• Payment details — not by us. Card numbers go directly to Square and never touch our servers. We receive only the amount, the result, and the last four digits.
• Library activity. Which songs you own and play. Downloads are logged with the time and your browser, which is how we spot a purchased account being shared widely and how we help you when a download fails.
• How the site is used. Which pages are visited, where visitors came from, the kind of device and the country, a few button presses such as adding to the cart, and how long the free videos are watched. None of it uses cookies or says who you are. We also count who has the site open, and on which page, using a code made from your internet address and browser. The code changes every day and is deleted after about a week, and the address itself is never stored. If you are signed in, we also record on your account when you have the site open.
• An unfinished checkout. If you start a checkout and leave without buying, we keep your email with your cart and send you one reminder, with a link to stop it.

• We do not sell, rent or trade your information.
• We do not run advertising, and there are no advertising or cross-site tracking cookies on this site.
• We do not build a profile of you to target you elsewhere.
• Apart from one reminder about a checkout you left unfinished, we do not send you news unless you asked us to, and every one of those has an unsubscribe link.

We set only these, and none of them is for tracking:

• A sign-in cookie. Keeps you logged in. Without it the site cannot tell that your library is yours.
• A notice cookie. Set only if you close the note about our new website at the top of the page, so that it stays closed on your next visit.

Each one is strictly necessary for the site to work as you asked it to, which is why you are not greeted by a consent banner.

We use a small number of specialist companies to run the site. Each gets only what it needs to do its job, and none of them may use it for their own marketing.

• Supabase — accounts, database and the chart files. Holds your email, profile and order history.
• Square — payments. Handles your card details directly, online and in person.
• Mux — video streaming and downloads. Receives the request for each video, including the ones that play by themselves, and measures how well it plays, without cookies.
• Shippo — shipping labels. Receives the delivery address for physical orders only.
• Resend — email. Sends every email we send you.
• Vercel — hosting and visitor counts. Keeps standard server logs and counts visits without cookies.

We may also disclose information if the law requires it, or to protect our rights or someone’s safety.

Merry Bells is made for children to play, and we are glad when they do — but the account belongs to a grown-up. You must be 18 or older to create one and to buy anything.

We do not knowingly collect personal information from children under 13. If you believe a child has created an account or given us information, email playmerrybells@gmail.com and we will delete it.

Teachers and group leaders: the account should be yours or your organization’s, not a student’s.

You can ask us at any time to:

• Tell you what we hold about you.
• Correct anything that is wrong.
• Send you a copy of your data.
• Delete your account and personal information.

Email playmerrybells@gmail.com and we will action it within 30 days. There is no charge and we will not make it difficult.

If you live in California, the CCPA gives you the right to know what we collect, to have it deleted, and to opt out of its sale. We do not sell personal information to anyone, so there is nothing to opt out of, and exercising any of these rights will never get you worse service or a worse price.

One limit worth being straight about: deleting your account also removes your library. We cannot delete the account and keep your purchases accessible.

Account and library information stays until you ask us to delete it. Order records are kept for seven years because tax and accounting rules require it, even after an account is closed. Download logs are kept for two years.

Everything travels over an encrypted connection. Your library is protected at the database level, so one customer’s account cannot read another’s records even if the website itself had a bug. Card details are handled entirely by Square, which is certified to the payment industry’s security standard.

No system is perfect, and we will not pretend otherwise. If a breach ever affects your information, we will tell you.

If we change this policy we will update the date at the top. If the change is significant we will email account holders rather than hoping you notice.

Questions, requests, or something that looks wrong — email playmerrybells@gmail.com or write to us at the address in section 1. See also our terms of service.