Privacy Policy
Last updated 1 November 2026
This page explains what TuningSQL.com collects about you, why, how long we keep it, and what you can ask us to do with it. We've tried to write it the way we'd want it explained to us: plainly.
The short version. We don't sell your information, and we don't use advertising trackers. We record what we need to run your account, to protect our course material from piracy, and to see which of our links and QR codes people actually use. Visitors from the EU and UK have their IP addresses shortened once we haven't seen them for 13 months.
| What | Why | How long |
|---|---|---|
| Your account (name, email, password, mailing address if you give one) | To run your account and deliver what you bought | While your account is open, and 5 years after it closes |
| What you do while logged in (log-ins, course activity) | Security, support, and running the courses | While your account is open, and 5 years after it closes |
| Coaching call recordings | So you and we can refer back to the call | While your account is open, and 5 years after it closes |
| Files you upload to our tools (such as trace files) | To analyse them for you, and for our own research | Kept permanently |
| Watermarked PDF downloads | To protect our material from piracy | Kept in full, permanently |
| QR-code scans and tracked links | To see which links and placements work, and to spot abuse | EU / UK: IP address shortened after 13 months unused. Elsewhere: kept |
| The visitor cookie (optional) | To recognise a repeat visitor | 13 months |
1Who we are
TuningSQL.com is run by TuningSQL.com, LLC, an Arkansas limited liability company. We decide what is collected and how it is used (in GDPR terms, we are the "controller").
TuningSQL.com, LLC
500 Westover Dr #11380
Sanford, NC 27330
United States
Questions or requests about your information: privacy@tuningsql.com
2What we collect, and when
When you have an account
Your name, email address and, if you give it, your mailing address. Your password is stored only as a one-way scrambled form (a "hash"); we can't read it. We also record when you log in, from which IP address, and your activity in the courses.
Coaching calls
Coaching calls are recorded, video and audio, so that you and we can refer back to them. The recordings are kept with your account.
Files you upload to our tools
When you upload a file to one of our tools, such as an Oracle trace file to the trace file analyzer, we keep it. Besides analysing it for you, we may study it in our own research into how databases perform. Trace files can contain SQL text, data values and the names of your database objects, so please don't upload anything you aren't allowed to share.
When you download a PDF
Our PDFs are watermarked: each copy is printed with details that identify who downloaded it, so a leaked copy can be traced. That can include your name, email, mailing address, IP address, the approximate location and network of that address, its hostname, and the time. We keep a record of each download with the same details.
Before a download, we check that your IP address's hostname is genuine (that the name and the address point to each other). If the hostname has been faked, the download is refused and the attempt is logged.
When you scan one of our QR codes or follow one of our tracked links
Our printed QR codes, slides and emails point to short links on our own site
(tuningsql.com/R/…). When you use one, we record:
- Which link you used, and when.
- Your IP address, and what it tells us: the approximate city and country, the network it belongs to, and whether it looks like a VPN, a hosting company, Tor or iCloud Private Relay. We work this out on our own server from a downloaded database; your address isn't sent to anyone to look it up.
- The address's hostname (its "reverse DNS" name, for example
host-81-2-69-160.example.net), looked up from our server. - What your browser tells every website: its name and version (the "user agent"), your preferred languages, and the page that sent you (the "referrer"). We never store cookie values or login details from these.
- Whether the visit looks like a program rather than a person (a search crawler, a link preview), so we can count people separately.
The visitor cookie
Some of our links offer a small cookie holding nothing but a random ID, so that if you use another of our links we can count you as the same visitor instead of a new one. It expires after 13 months.
- In the EU, UK, EEA or Switzerland (or if we can't tell where you are), we ask first. Either answer takes you to the same place. If you say no, we set a small "declined" cookie for 6 months so we don't keep asking.
- If you are logged in to your TuningSQL.com account on a browser that has this cookie, we connect the cookie to your account, so that link visits from that browser, before and after, count as yours. This happens once; a cookie is never moved to a different account.
When you comment on our blog
This policy covers our blog, blog.tuningsql.com, too. When you leave a
comment there, we keep the comment with the name, email address and website you give,
your IP address, and your browser's user agent. Your email address is never shown
publicly.
Cookies needed to log in
Logging in uses a session cookie, which lasts until your session ends. It's needed for the site to work, so we don't ask for it.
3Why we use it
- To provide what you signed up for: your account, your courses, your downloads.
- To protect our work: the watermarks and download records exist to trace and stop piracy of paid material.
- To understand what works: which talks, slides, cards and emails lead people to us.
- To keep the site secure: spotting abuse, failed-login attacks and automated traffic.
- For our research: files uploaded to our tools help us study how databases perform.
For visitors in the EU and UK: we rely on performing our contract with you for your account and purchases; on our legitimate interests for security, piracy protection and understanding our links; and on your consent for the visitor cookie, which you can refuse.
4How long we keep it
| Visitors in the EU, UK, EEA, Switzerland, or an unknown country | Once we haven't seen an IP address for 13 months, we shorten it
(81.2.69.160 becomes 81.2.69.0) and remove the matching
part of its hostname (host-81-2-69-<*>.example.net). The
approximate location (city, postal code, country) and network are kept. Every
time the address is seen again, the 13 months start over. |
| Anyone with an account | What you do while logged in is kept in full while your account is open, and for 5 years after it is closed. |
| Coaching call recordings | While your account is open, and for 5 years after it is closed. |
| Files you upload to our tools | Kept permanently, for our research. |
| Watermarked PDF downloads | Kept in full, permanently, because they are our evidence against piracy. |
| Visitors in the United States | IP addresses are not shortened. |
| Cookies | The visitor cookie expires after 13 months; a "declined" cookie after 6. |
5Who else sees it
We don't sell your information, and we don't share it with advertisers.
- Payment providers handle your payment details when you buy; we don't store full card numbers.
- Our hosting provider runs the server our site and database live on.
- A spam-checking service checks each blog comment before it appears, so it receives the comment, the name, email address and website given, the IP address and the browser's user agent.
- Gravatar and WordPress.org: on the blog, commenters' profile pictures come from Gravatar, which receives a scrambled (hashed) form of the commenter's email address, and blog pages load emoji support from WordPress.org. Your browser fetches these directly, so both services see your IP address.
- Booking a call: calls are booked through TidyCal. When you book one, TidyCal receives your name, email address and any answers you give, and passes them to us.
- Video services: our videos are hosted by Vimeo and YouTube, and some are sped up by Swarmify's SmartVideo service. When you watch one, your browser loads the video and player from them, so they see your IP address and basic details about your browser.
- Webinars, online meetings and video calls run on LiveWebinar. When you sign up for or join one, your browser connects to LiveWebinar, which receives the details you sign up with and your IP address.
- Email services send our newsletters and account emails (such as password-reset links), so they receive your email address and the messages.
- The law: we'll share information if the law requires it, or to act against someone pirating our material.
Our server is in the United States. If you're outside the US, your information is processed there.
6Your choices and rights
You can ask us to:
- show you what we hold about you;
- correct it;
- delete it, except what we must keep to comply with the law or to protect our material (download records, for example);
- stop using it for a purpose you object to.
Email privacy@tuningsql.com. We'll answer within a month. You can refuse or remove the visitor cookie at any time; the links still work without it. If you're in the EU or UK and unhappy with how we've handled your information, you can complain to your local data protection authority.
7Children
TuningSQL.com is for database professionals. It isn't meant for anyone under 18, and we don't knowingly collect information about anyone under 18.
8Changes
If we change how we handle your information, we'll update this page and the date at the top.
This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.