Privacy Policy

Effective date: October 21, 2026

This page explains what data this site does and does not collect. There are three kinds of measurement, and they are deliberately not the same kind of thing:

• Cloudflare Web Analytics runs on every page for every visitor. It sets no cookie and stores nothing on your device, which is why it is not gated behind a consent question.
• A count of return visits and finished course steps, kept by this site itself. It is not behind a consent question either: it sets no cookie, sends no identifier and keeps only totals. The one thing it stores on your device is the date of your last visit, which never leaves it. You can switch it off on the Privacy Preferences page, and it respects Global Privacy Control and Do Not Track.
• Google Analytics runs only if you explicitly allow it, and it does set cookies.

Each is described in its own section below.

No accounts

Harmony Gym does not ask you to create an account or sign in anywhere on the site. The only form on the site is the optional feedback form described below, and it never asks for anything beyond a message — the email field on it is optional too.

Local progress (localStorage)

Some lessons remember where you left off — for example, which exercises you have already completed. This progress is saved only in your browser’s local storage (localStorage) on your own device, and clearing your browser data will erase it. The progress itself — your scores, your streak, your history — is never sent to us or to any server. The one thing that does leave your browser is a single count when you finish a step of the guided course, described under “Return visits and course steps” below.

Advertising

This site does not serve advertising. There are no ad scripts on any page, no advertising cookies are set, and no information about your visit is sent to any advertising network.

The site may carry advertising in the future. If that happens, this policy will be updated to describe it — including which network is used and what it collects — before the first ad is served. Until you read that here, there are no ads.

Visitor measurement

Two counts run on this site without a consent question. Each is described below: what it records, what it never keeps, and how to stop it.

Cloudflare Web Analytics

This site uses Cloudflare Web Analytics on every page, for every visitor, and it is not covered by the consent banner. This section explains what it does and why it is not gated.

It exists to answer one question: which pages people actually read, and where they arrived from. That is what tells us which lessons and articles are worth writing more of.

It sets no cookie. Cloudflare Web Analytics uses no client-side state of any kind — no cookie, no localStorage, no identifier written to your browser. Nothing is stored on your device and nothing persists between your visits, so there is no profile accumulating against you and nothing on your side to switch off. That is the specific reason no consent is asked for it, and it is the only reason: if it stored an identifier, it would sit behind the banner like Google Analytics does.

For each page view it records the address of the page (host and path), the referring link or search engine you arrived from if there was one, your country, your browser, your operating system, your device type (desktop, mobile or tablet), how the page was loaded (a fresh visit, a reload, back or forward), and performance timings such as how long the page took to load.

On your IP address, plainly. Loading the beacon means your browser makes a request to Cloudflare, so your IP address is part of that request while it is in transit — this is true of every request to every website, including this one. Cloudflare uses it to derive your country and then removes it during processing rather than storing it against your page view. Cloudflare states that it does not use IP addresses, browser User-Agent strings or similar attributes to fingerprint visitors or to track them over time, and that it counts “visits” as page views arriving from a different site rather than by recognising people who come back. So no per-visitor identifier is created or kept.

This policy does not call that data anonymous, because that word would be doing more work than the facts support. What is accurate: nothing identifies you in what we can see, no identifier is stored in your browser or attached to your page view, and each field listed above is shared with very large numbers of other people. What is also accurate: the request carrying it necessarily contained your IP address, and what happens to it after that is Cloudflare’s handling under Cloudflare’s own privacy terms rather than something this site performs or can demonstrate to you.

This is separate from the infrastructure-level logs described under the feedback form below, which Cloudflare keeps as the operator of the network serving this site whether or not this beacon exists. If you browse with JavaScript disabled, or block the script, the beacon does not run and nothing is measured.

Return visits and course steps

Cloudflare Web Analytics cannot tell whether people come back, because it deliberately does not recognise anyone. To know whether the site is worth returning to — and whether the guided course is being finished — this site keeps two counts of its own:

• Return visits. At most once a day, your browser tells us whether you have been here before and, if so, roughly how long it has been since your last visit, in one of a few ranges: new, 1 day, 2 to 7 days, 8 to 30 days, or more than 30 days.
• Finished course steps. When you finish a step of the guided course, your browser tells us which step it was, the language of the page, and whether it was your first time finishing it or a repeat.

That is the whole message. Each one is added to a running total, and only totals are kept: how many visits this week came back after 2 to 7 days, how many times step three was finished for the first time. They are stored in Cloudflare’s Workers Analytics Engine, under this site’s account.

What is never kept. No cookie is set or read. No identifier is created, sent or stored, and nothing is done to recognise your browser — no fingerprinting. Your IP address, your browser’s user agent and the page you came from (the referrer) are not stored with the count; the request is sent without cookies and without a referrer in the first place. The user agent is looked at once, only to ignore search-engine crawlers that announce themselves, and is not kept. As with every request to every website, your IP address is part of the request while it is in transit, and Cloudflare, as the network that carries it, handles it under its own terms — the same as described for Cloudflare Web Analytics above.

The date stays on your device. To know how long it has been since your last visit, your browser keeps the date of that visit in its own localStorage, under the key mtg-visit-v1, and the date it first started counting, under mtg-visit-since-v1. Those dates never leave your device: only the range is sent, never a date. Clearing your browser data erases them, and your next visit then counts as a new one.

At most 13 months. The two dates are used for at most 13 months from the day counting started. Visiting does not extend that: on your first visit after the 13 months, both dates are erased, the visit counts as a new one, and the 13 months start again.

How not to take part. On the Privacy Preferences page, untick “Count my visits anonymously”. From then on neither count is sent from that browser, and both stored dates are erased at once; the choice is kept in your browser under mtg-count-pref-v1. Turning on Global Privacy Control or Do Not Track in your browser has the same effect, whatever that switch says. If you browse with JavaScript disabled, or your browser blocks local storage, nothing is sent either.

Why it does not ask first. This count relies on the exemption for anonymous audience measurement: it is used only to measure this site’s own audience, it produces only anonymous totals, it is not combined with any other data or shared, the dates it keeps on your device are limited to 13 months, and you can switch it off at any time. That exemption is the basis on which it runs without a consent question.

Analytics (Google Analytics 4)

This site can use Google Analytics 4 to see which lessons and pages people actually use, in aggregate. It is used to decide what to build or fix next; it is not used to identify you individually, and the data is not sold or shared.

Nothing loads until you say yes. On your first visit a banner asks whether analytics may be used. Until you answer, and permanently if you decline, no Google Analytics script is requested, no request is made to Google from this site, and no _ga cookie is set. This applies to every visitor, everywhere — there is no country detection and no different treatment by region.

If you allow it, the Google Analytics script is loaded and sets its own cookies (_ga and similar) in your browser to distinguish one visit from another. If you later decline, this site stops loading the script and clears those cookies where it is able to.

Your answer is stored in your own browser under the key mtg-consent-v1 in localStorage. It is never sent to a server, which means it is specific to that browser on that device: clearing your browsing data resets the question, and answering on one device does not answer for another. If your browser blocks local storage, nothing is remembered — and nothing is loaded.

Your choices

You can review or change your analytics choice at any time on the Privacy Preferences page, which shows the answer currently stored in your browser and lets you switch it. That page is linked from the footer of every page on this site.

Declining costs you nothing: every lesson, exercise and feature works identically either way, and no part of the site is withheld.

That choice covers Google Analytics, which is what the banner asks about. It does not switch off Cloudflare Web Analytics, which has no switch here because it stores nothing on your device — if you want to stop it as well, blocking the script or browsing with JavaScript disabled does that, and the site keeps working. The count of return visits and course steps has its own switch on the same page, “Count my visits anonymously”, and also follows your browser’s privacy signal: with Global Privacy Control or Do Not Track turned on, it is never sent.

Most browsers also let you block or delete cookies, and you can clear localStorage at any time in your browser settings — which will reset your analytics answer, any saved progress on this site, and the date of your last visit. If you browse with JavaScript disabled, no analytics is loaded at all.

Feedback form

If you use the feedback form, the message you type, the language of the page you were on, the path of that page, and the date and time you sent it are stored in a database (Cloudflare D1) that only the site’s operator can access.

The email field on that form is optional. If you leave it blank, your message is stored with no way for us to know who sent it or to reply — it is anonymous. If you fill it in, that address is stored alongside your message so we can write back.

This information is used only to decide what to build or fix next, and, when you leave an email, to reply to you. It is never used for advertising and never shared with anyone, including Google.

This section describes what this site’s own database stores. It does not cover Cloudflare’s operation of its network: Cloudflare serves every request to this site and, like any host, keeps its own infrastructure-level logs of that traffic, separate from and outside of what we store here.

To ask us to remove a message you sent, get in touch through the Contact page below and describe the message, or roughly when you sent it, so we can find it.

Microphone

One exercise on this site asks you to sing a note back, and that one needs to hear you. Your browser will ask for permission the first time; nothing opens until you allow it.

While that exercise is running, sound from your microphone is analysed in your browser to work out what pitch you are singing. It is never recorded, never written to storage, and never sent anywhere — not to this site’s operator, not to Cloudflare, not to anyone. What comes out of the analysis is a number: the frequency, which the exercise compares to the note it asked for. That number is not stored either.

The microphone is released the moment the exercise ends, and whenever you leave the page. Your browser’s recording indicator going out is the visible proof of that — and if you ever see it stay on after a drill has finished, that is a bug and we would like to hear about it.

Every other exercise on this site works with no microphone at all, and the singing one still explains itself and plays its notes if you decline.

Contact

If you have questions about this privacy policy, please get in touch through the Contact page.

Changes to this policy

This policy may be updated from time to time as the site or the services it relies on change. The date at the top of this page reflects the version currently in effect.