privacy

plain version. last changed september 2026.

insomnia is a place to track learning guitar. it holds the least it needs to do that, keeps it private, and deletes it when you ask.

what we store

• your account: email address, display name, and a hash of your password. never the password itself.
• your progress: which stops you've started, the criteria you've ticked, notes and best tempos, and your practice log (dates, minutes, how it felt).
• your onboarding answers: how experienced you said you were, what you're chasing, and your weekly target.
• your recordings and notes on stops, if you add any.
• your sign-ins: for each device that's signed in, a label taken from its browser (like "chrome on windows") and when it was last used, so you can sign devices out.
• two cookies: one keeps you signed in, one remembers your timezone so a late-night session counts for the right day. nothing else, and no tracking cookies.

who can see it

only you. there are no public profiles. recordings are never at a public link: each one is handed to you only while you're signed in as its owner. the person who runs insomnia can technically reach the database, and won't look at your content.

where it lives

• the app runs on vercel.
• the database is neon postgres.
• recordings are in vercel blob, in private storage.
• to slow down guessing and abuse, sign-in, sign-up, reset and upload attempts are counted against your ip address (and the email, for sign-in) for a few minutes in upstash. they aren't kept beyond that.
• emails (verify your address, reset a password) go out through resend, which sees the address and the message.
• fonts are served from insomnia itself, so nobody else learns you visited.

there is no analytics and no advertising. links to lessons and tabs on other sites are ordinary links: those sites see you when you follow them.

your controls

• export: the "me" page downloads everything as json, or as a zip with your recordings too.
• delete a recording whenever you want, from the stop it's on.
• delete your account from the "me" page. it asks for your password, then removes your account, progress, practice log, and every recording straight away. there is no undo.

our database host keeps short-term restore history so it can recover from failures. deleted data ages out of that history on its own schedule. we keep no other backups.