Privacy Policy

Who this covers

This is the privacy policy for Rare Data LLC, a company based in Menifee, California. Rare Data makes two brands of music software: Compa and Quota.

This policy covers Compa: Groovebox Companion for iOS in full detail in the Compa section below.

Quota products have their own policy at getquota.app/privacy. That policy is the operative one for Quota apps. The company-wide commitments on this page apply to everything Rare Data makes.

In our apps: nothing

Our software collects nothing. Being specific, because “nothing” deserves to be spelled out:

• No personal information. No name, no email, no address, no phone number, no date of birth.
• No accounts. There is nothing to sign up for, nothing to log into, and no password to forget. You do not tell us who you are because we never ask.
• No analytics in the apps. No Firebase, no Mixpanel, no Amplitude, no Sentry, no Crashlytics, no Segment, no PostHog, no TelemetryDeck. None of it. We do not receive usage statistics, session counts, screen views or crash reports.
• No tracking. No advertising identifier, no IDFA, no App Tracking Transparency prompt, because there is nothing to ask you for. No advertising networks, no data brokers, no cross-app or cross-site profiling.
• We sell nothing about you.

This is not a matter of collecting your data and choosing not to look at it. We do not collect it because the software has no ability to send it. In Compa’s case we verified that at the binary level: there is no HTTP client compiled into the app at all. There is no Rare Data server anywhere in the picture.

On our websites: your email address, if you give it to us

raredata.net and getquota.app have forms that ask for your email: to send you a download link, or to put you on a list for product news. If you fill one in, here is exactly what happens.

• What we take: your email address. Not your name, not your address, not your phone number. We also record which page you signed up from, so we know whether you came for Compa, for Quota, for the radio or for press, and do not send you things you did not ask about.
• Why: to send you the download link or licence key you asked for, and to email you when there is something worth telling you about. That is the entire purpose.
• How to get off the list: every email we send has an unsubscribe link, and it works immediately. Or email support@getquota.app and we will remove you and confirm it.

We do not sell the list, rent it, trade it, or hand it to advertisers. It exists so we can send you a file and tell you when something ships.

The companies that touch your email

We are a small company and we do not build our own mail servers. When you give us your email address, these companies handle it on our behalf. They are named here because you deserve to know who they are, and each of them is bound to protect your data to the same standard this page describes.

• Brevo stores the email list itself.
• Resend delivers the individual emails that carry your download links.
• Backblaze B2 stores the actual files. The download links we mint are temporary and expire.
• Vercel hosts both websites, and like any web host keeps ordinary server logs.
• Paddle is the merchant of record for our desktop software. If you buy a Quota app, Paddle handles the payment and holds the billing details. Apple does the same for anything bought on the App Store. We never see your card, ever.

That is the complete list. No analytics companies, no advertising networks, no data brokers, no AI services, and no parent, subsidiary or affiliate, because there are none.

Website analytics, stated plainly

raredata.net runs no analytics at all. No Google Analytics, no tag manager, nothing.

getquota.app uses Vercel’s web analytics, which counts page views and referrers in aggregate so we can tell whether anyone found the page. It is not tied to your identity, we cannot use it to follow you around the internet, and we do not sell it.

Neither website shows you ads or lets an advertiser watch you.

Retention and deletion

If you never gave us your email address, we hold nothing about you at all, and there is nothing to retain or delete.

If you did, we keep it until you tell us to stop. Unsubscribe from any email and you are removed. Email support@getquota.app and we will delete you from the list and tell you we have done it. We do not keep a shadow copy of people who left.

Nothing your apps create is ever retained by us, because it never reaches us. Everything our apps make lives on your device, under your control:

• To delete it, delete the files from within the app, or from Apple’s Files app, or delete the app itself. Deleting the app removes its Documents folder, its Application Support folder and its preferences. One item is deliberately left behind: the trial start date. iOS keeps Keychain items after an app is deleted, and Compa relies on that so reinstalling does not hand out a fresh 30 days. It is a single date with nothing about you in it, it never identifies you, and it is described in full in the trial section below. Nothing survives on our side, because nothing was ever on our side.
• To revoke consent, turn off the feature or revoke the permission. Every permission Compa asks for can be switched off at any time in iOS Settings > Privacy & Security, or in iOS Settings > Compa. The app keeps working without them, minus the feature that needed them.
• To request that we delete your data, you are welcome to email us at support@getquota.app. Our honest answer will be that we have nothing to delete. We will say so in writing if you want it in writing.

One thing worth knowing, because it is true and rarely said: your device’s normal Apple backup, whether iCloud Backup or a local encrypted backup, includes app Documents folders. That is Apple’s standard backup behavior for every app on your phone, and it is why a restored phone still has your takes. Rare Data does not transmit anything to that backup and cannot read it. If you would rather Compa’s files were not backed up, you can turn Compa off in iOS Settings > your name > iCloud > Manage Storage > Backups.

The microphone permission is mostly not about your microphone

Compa asks for microphone permission because iOS requires it. On iOS, any app that takes an audio input has to ask for the microphone, even when the “microphone” is a sampler plugged into the USB port. There is no separate permission for “audio from a groovebox.” So Compa asks for the mic in order to hear your SP-404.

What that permission is used for:

• The oscilloscope and the L/R level meters.
• The recorder, when you press REC.
• A rolling recall buffer, so you can capture the thing you just played that you did not press record on. You choose how far back it reaches in Settings: 30 seconds, 1 minute, 2 minutes or 5 minutes. It holds one minute unless you change it.

Where that audio goes: into a WAV file in Compa’s own Documents folder on your device. That is the whole journey. There is no upload. There is no code in the app capable of uploading it.

The built-in microphone specifically is off by default. It only becomes live when both of these are true at the same time: no USB audio device is attached, and you have turned the BUILT-IN MIC toggle on yourself in Settings. The toggle defaults to off. If you have never touched it, the built-in mic has never been live. If your groovebox is plugged in, the built-in mic is not used regardless of the toggle.

The local network permission, and the two things that cross it

Compa supports Ableton Link, so it can lock tempo with Ableton Live and with other Link apps and hardware on your Wi-Fi. Link works by talking directly to the other machines on your network. That is what the local network permission is for.

Two things travel over your local network. Both stay on your local network. Neither one reaches the internet, and neither one reaches Rare Data.

1. Link sync, whenever Link is on

Compa broadcasts to the Ableton Link multicast group on your LAN:

• the peer name, which is the literal fixed word “Compa”. It is hardcoded. It is not your device name, not your name, and not an identifier.
• the tempo,
• the beat and phase position,
• transport start and stop, if you have start-stop sync switched on.

That is the complete list. No user content. No identifiers. It is the minimum required to keep a clock in agreement with your other gear.

2. Link audio sharing, which is off by default

If you turn on audio sharing in the Ableton Link settings panel, Compa streams its finished program mix to Link peers on the same network, as a channel named “Compa Out.” This is you deliberately sending your own music to your own copy of Ableton Live on your own network. It is a feature, and it works exactly as it says.

Being precise about what is in that mix, because you should know before you switch it on: it is Compa’s program output. That includes audio from your connected USB groovebox, audio from Compa’s own engine, and, only if you have separately enabled the built-in mic with no USB device attached, audio from the built-in mic.

That stream reaches the other machine on your Wi-Fi and stops there. It does not go to Rare Data, and it structurally cannot: the Link component contains no internet client of any kind.

The Bluetooth permission

Compa asks for Bluetooth so you can pair wireless MIDI keyboards and controllers. When you tap to pair, Compa presents Apple’s own system Bluetooth MIDI panel. Apple’s panel does the scanning and the pairing. Compa does not scan for Bluetooth devices itself, does not read Bluetooth data itself, and stores nothing about your Bluetooth surroundings. Once paired, your controller simply appears as an ordinary MIDI device.

Your MIDI gear

To match your hardware to the right control profile, Compa reads the names and IDs that your MIDI devices publish about themselves, the way any MIDI app does. Those names and IDs are stored in Compa’s own preferences on your device so it remembers your rig between sessions. They are not transmitted anywhere.

Recording audio from other apps

Compa can capture the audio your device is already playing, so you can sample from a video or another music app. This uses Apple’s system screen recording, and Apple, not Compa, shows you the confirmation dialog and the red recording indicator while it runs. When Compa uses it: the microphone is explicitly disabled for that capture, video is discarded and only the audio is kept, and the result is a WAV file in Compa’s folder on your device.

Apps that protect their audio deliver silence, by design. That is Apple’s behavior, not something we work around.

Video from your photo library

When you pick a video to sample audio from, Compa uses Apple’s system photo picker, which runs outside the app. Compa never gets access to your photo library. It receives only the single video you chose, pulls the audio out of it, and deletes the temporary copy. That is why Compa never asks for photo library permission: it does not have it and does not need it.

Your samples, kits, projects and takes

They live in Compa’s own folders on your device. Compa’s Documents folder is visible to you in Apple’s Files app, on purpose, so you can get your own audio in and out without asking anyone’s permission.

Compa has no iCloud container, does not use CloudKit, and does not sync anything to any cloud service. When you import a file, you pick it yourself through Apple’s system file picker. If you navigate that picker to iCloud Drive, that is your iCloud Drive and your file, handled by Apple’s picker, and Compa receives only what you selected.

Buying things: the trial and the unlocks

Compa is free to download and free to try for 30 days. After that there is a one-time unlock. There is also a separate one-time purchase that unlocks exporting kits to Ableton, MPC and Koala.

Everything about purchasing is handled by Apple. Compa uses Apple’s StoreKit. You pay Apple. Your payment details are entered in Apple’s interface, not ours. Rare Data never sees, receives, stores or forwards your name, your card, your Apple Account, your email or your receipt. Purchases are verified on your device by Apple’s own signature check. There is no Rare Data server to check with.

The 30-day trial clock is a single Unix timestamp stored in your device’s Keychain, so that deleting and reinstalling the app does not hand out a fresh 30 days. It is a date. It is not an identifier, it contains nothing about you, and it is not set to sync to iCloud Keychain. It is never transmitted to Rare Data. Like other Keychain items it can be carried in your own encrypted device backup, which is Apple’s standard behavior and something only you can restore.

Nothing is downloaded from Rare Data when you purchase, because the app has no way to make a request to us.

Your settings

Compa stores about 35 preferences on your device: your last BPM, your metronome state, your scope settings, your pad maps, your colors, your quantize setting and so on. Local preferences, on your device, gone when you delete the app.

The one third-party component in Compa

Ableton LinkKit, licensed from Ableton AG, is the only third-party code in Compa. It does tempo, beat and phase sync, and it carries the optional “Compa Out” audio channel described above.

LinkKit has no analytics and no telemetry. It contains no internet client at all: no HTTP, no HTTPS, no TLS. We verified this at the binary level, not by taking anyone’s word for it. Its only network activity is direct UDP to the Ableton Link group on your local network. It sends Ableton nothing. Ableton receives nothing about you from Compa.

There are no other third-party libraries, SDKs or dependencies in Compa. The app links Apple’s system frameworks and nothing else.

The device report, the one thing you can send us

Compa has a share button that builds a device report, to help us debug a problem you are having. It contains the Compa version, your iOS version, your device model, the names and IDs of your MIDI devices, and your audio route names. It contains no personal information and none of your audio.

Compa hands that report to the standard iOS share sheet. You choose where it goes: Messages, Mail, Notes, AirDrop, or nowhere. The app never picks a recipient and never sends it on its own. If you email it to us, we have it because you sent it, and we use it only to answer you.

This is the only place in Compa where anything describing your device can be transmitted, and it only happens by your own hand.

The links inside Compa

Compa contains a small number of links. Tapping one opens Safari or the App Store. The app does not fetch them, and it does not have the ability to. They are: raredata.net/compa, raredata.net/compa/manual, this privacy policy, the App Store page for QuotaFX, and ableton.com/link, which is a label inside Ableton’s own settings panel.

Your rights, wherever you live

Privacy laws such as the GDPR in Europe and the CCPA in California give you rights over personal information a company holds about you: the right to know what it has, to get a copy, to correct it, to have it deleted, and to tell it not to sell your information.

The only personal information Rare Data can hold about you is your email address, and only if you gave it to us. So exercising any of these rights is short work:

• To know what we have: email support@getquota.app and we will tell you whether your address is on a list, and which one.
• To get a copy: it is your email address. You already have it. We hold nothing else.
• To have it deleted: use the unsubscribe link in any email, or ask us at support@getquota.app. Either way you are gone.
• To opt out of sale or sharing: already done, permanently. We have never sold or shared personal information for advertising or any other purpose, and we have no mechanism to do so.

If you never signed up for anything, we hold nothing about you and there is nothing to exercise these rights against.

Your app data lives on your device, so you already have complete access to it and complete control over deleting it, without needing to ask us.

Changes to this policy

If Rare Data ever changes what its software does with your data, this page changes first, and the date at the top changes with it. We will not quietly add analytics and leave this page saying otherwise.

If a future version of any Rare Data app ever collects anything, we will say so here plainly, we will say what it is and why, and where the law requires your consent we will ask for it before collecting anything.