Legal
Privacy Policy
Last updated
In plain English
- We store what the product needs to work: your email address, your profile, your learning progress, what you post, what you buy, and any project you choose to save to the cloud.
- We do not track you. There is no advertising network, no analytics product, no third-party tracker, and no profiling. Authentication can contact Clerk; tutorial video players do not contact YouTube until you choose to load one.
- Direct messages are unavailable at minimum launch. The development preview does not yet use genuine end-to-end encryption, so its page and API are disabled.
- Audio you record and projects you work on stay on your device unless you explicitly save them to the cloud or attach them to a post.
- You can ask for a copy of your data or have your account deleted by emailing us. Being honest about it: there is no self-serve delete button yet, so we do it by hand.
1. Who we are
This policy explains what Soundflow does with personal data, for both the website and the desktop application. For UK and EU data-protection law we are the controller of the data described here.
- Service: Soundflow — a music learning academy, digital audio workstation, practice labs, community, and creator marketplace, delivered as a website and a desktop application.
- Operator: not yet published — see the notice at the top of this page
- Registered address: not yet published
- Contact: no contact mailbox is published yet. Until one is, there is no reliable way to reach us about the matters in this document — that gap is listed at the top of this page.
2. What we collect
The table below is the actual inventory — it mirrors what the database stores, table by table. If something is not listed here, we are not storing it.
| Category | What that actually is |
|---|---|
| Account | Your email address (required and unique), an optional display name, an optional public @handle, a short bio, and the roles you hold (student, parent, instructor — a single account can hold several). The schema retains a legacy avatar URL field, but the minimum-launch app neither accepts nor loads remote avatars and clears a legacy value when you next save your profile. If you sign in through our authentication provider we also store its identifier so we can match your login. |
| Learning | Course enrolments; per-lesson, per-section and per-block progress; quiz submissions including the answers you gave and the score; overall course progress; certificates issued to you and their verification serial; pathway enrolments; practice-lab mastery tiers and scores; your private lesson notes and bookmarks; poll votes; and an append-only activity log (event type, the id of the thing you acted on, and the timestamp) that drives streaks and “continue where you left off”. |
| Assignments | Work you submit against an instructor's assignment, and the grade and written feedback the instructor returns. |
| Community | Posts you publish (audio, image, video, poll or collaboration) with their captions and media references; likes; comments; who you follow and who follows you; course reviews and star ratings; lesson discussion posts; and the in-app notifications generated for you (including the display name of whoever triggered them). |
| Direct messages | Not collected at minimum launch. A database shape and a labelled non-encrypted development transport exist, but the Messages route is hidden and the API refuses message sends and conversation reads. We will not enable messaging until genuine authenticated end-to-end encryption and its key-management design are ready, and this policy has been updated. |
| Scheduling | One-to-one lesson bookings (instructor, student, start time, length, status, and optionally the course it relates to) and your attendance on live cohort sessions. |
| Realtime | Jam rooms and live sessions are disabled at minimum launch, so these surfaces do not accept new membership, session or chat data. The dormant database shapes are kept for a later reviewed release. |
| Cloud projects | When you choose to save a studio project to your account, we store the project document, its mixing side-tables, its size, and — if you generate one — a share token that lets anyone holding the link open it. |
| Marketplace | Paid checkout is disabled at initial launch. If the reviewed course-checkout gate is enabled, only eligible paid courses can reach it. We then store the course order (amount, currency, status and payment reference). For an instructor offering an eligible paid course, we store the connected payment-account identifier and whether that account is ready. Public asset/plugin listing and purchase flows remain disabled. |
| Technical | We do not write your IP address into our database. Like any website, the infrastructure that serves Soundflow processes your IP address and request details in order to answer the request, and may keep them briefly in operational logs for security and debugging. |
Payment card details never reach us. Checkout happens on our payment provider's own hosted page. We receive a reference for the payment and whether it succeeded — never your card number.
3. What stays on your device
A lot of Soundflow runs locally, and the data it produces there is not sent to us. Your browser holds:
- Preferences and device-local tools, in
localStorage: your theme, sidebar and studio layout, default role and display name, notification preferences, recent commands, tour voice setting, browser favourites, effect presets and chains, and the local-model usage meter when that feature is enabled. - Current-tab safeguards, in
sessionStorage: the signed-in identity mapping and an opaque checkout-attempt key that prevents duplicate orders or charges on retry. These values expire with the tab session and contain no card details. - Studio autosave, in an IndexedDB database called
soundflow-studio: a debounced snapshot of the session you are working on, so a refresh or a crash does not lose your work. It never leaves your browser unless you save the project to your account. - Downloaded AI models, in the browser's Cache Storage: the on-device model weights, cached so a feature you have used once works offline afterwards.
- Microphone and MIDI input. Recording and the practice labs ask your browser for microphone or MIDI access when you use them, and you can refuse. Audio you record is processed in the page and stays there — it only reaches us if you save the project to the cloud or attach it to a post.
Clearing your browser's site data for Soundflow erases all of the above, including any studio work you have not saved to your account. The Cookie Policy lists the exact keys.
4. Why we use it, and our legal basis
| What for | Legal basis |
|---|---|
| Running your account, courses, studio, and community | Performance of a contract — this is the service you signed up for. |
| Taking payment and issuing what you bought | Performance of a contract. |
| Keeping records of orders for tax and accounting | Legal obligation. |
| Keeping the platform secure, and moderating content | Legitimate interests — running a service that is safe for the people on it, balanced against your interest in not being over-monitored. |
| Microphone, MIDI, and other device access | Consent, given through your browser or operating system, and withdrawable there at any time. |
| Voice features that work on a specific person's voice | Consent — recorded as an attestation before the feature will run (see section 5). |
We do not send marketing email. Soundflow has no mailing-list system and no outbound email service wired up at all; notifications are shown inside the app only. If that changes, this policy changes with it and we will ask for your consent first.
5. AI features and your input
Provider-backed AI generation is disabled at minimum launch. Its routes and controls are not exposed, and no production generation credentials are configured.
- On-device features (audio-to-MIDI transcription, stem separation, audio search, groove humanisation, text-to-speech) download an open model into your browser and run it there. The audio and text you feed them do not leave your device. Downloading the model itself is a request to the host that publishes it — see section 7.
- Server-side generation is a later-release contract. If enabled, the prompt, lyrics and seed supplied to it would be recorded in the output's provenance record; it does not run in the minimum launch.
- Paid third-party AI services are switched off. The product contains inactive connection points for several commercial AI vendors. They hold no keys, make no network calls, and always report themselves as unavailable. Nothing you type is sent to them.
Disclosure and provenance
The dormant trained-model workflow records provenance and requires AI disclosure. Public asset selling and provider-backed generation are disabled at minimum launch, so no such material can be offered for sale through the public product.
Voice
Features that clone or convert a particular person's voice require a stored consent attestation — either that it is your own voice, or a signed release from the person whose voice it is — and are refused without one. Built-in synthetic voices carry no such person and need no attestation. We do not use voice recordings to identify anyone, so we do not process them as biometric data.
6. What other people can see
- Public by design: your display name, handle and bio; posts, comments and likes; who you follow; course reviews you write; and lesson discussion posts.
- Shared by your action: a studio project becomes reachable by anyone with the link once you generate a share token for it. Delete the project to revoke access.
- Certificate verification is deliberately anonymous. Anyone can check a certificate serial at /verify, and the result returns only the serial, the course title, and the issue date — never your name or email.
- Instructors see the submissions, grades and progress of learners enrolled on their courses.
7. Who else we share it with
We do not sell personal data and we do not share it for advertising. The only third parties involved are the ones needed to run the service:
| Who | What they get, and when |
|---|---|
| Clerk | Our authentication provider, when sign-in is enabled. Clerk handles your credentials and sign-in sessions, and holds the email address and any details you give it during sign-up. We store only its identifier for you plus your email and name. |
| Stripe | Our payment processor. If eligible paid-course checkout is enabled, you are handed to Stripe's own hosted page, where you give Stripe your payment details directly. Stripe also handles payment-account onboarding for eligible course instructors. |
| YouTube | On the hosted site, tutorial cards use YouTube thumbnails through Soundflow's same-origin image proxy; YouTube can receive the hosting service's proxy request, but the thumbnail does not make your browser connect directly to YouTube. The downloadable app uses bundled card artwork and makes no thumbnail request. A direct browser connection starts only after you press a lesson's load-video button. That loads YouTube's privacy-enhanced domain; Google then receives your IP address and browser request, and the player may use cookies or device storage and show non-personalised advertising under its own terms. |
| Hosting provider | The infrastructure that runs the website, the API and the database processes everything above on our instructions, and sees your IP address as part of serving requests. |
| Hugging Face | Only if you use the on-device text-to-speech feature. Your browser downloads the open voice model directly from Hugging Face, which means they see your IP address for that download. Nothing you typed is sent — the model runs locally afterwards. |
| Google Cloud Storage | Only if you use the groove-humanisation feature. Your browser downloads the open model checkpoint from Google's storage for the Magenta project, which means they see your IP address for that download. |
| User- or instructor-provided media hosts | A community post or authored lesson can contain an HTTPS image, audio, video, PDF or embed URL. It remains unloaded until you press its labelled load button. Loading it contacts that host, which receives your IP address and normal browser request details. Remote profile avatars are unavailable at minimum launch. |
We will also disclose data where the law requires it, or to establish or defend legal claims. If Soundflow is ever sold or merged, your data would transfer with the service and we would tell you before that happened.
Typefaces and site imagery are served from our own domain and Soundflow includes no advertising or analytics script. When configured, the site-wide authentication bootstrap can contact Clerk even before sign-in. The YouTube player remains completely unloaded until you press the load-video button; hosted catalogue thumbnails pass through our image proxy, while the downloadable app uses bundled card artwork.
8. International transfers
Our authentication and payment providers are United States companies, so data handled by them may be processed outside the UK and the European Economic Area. Where that happens, the transfer relies on the UK International Data Transfer Addendum (or the EU Standard Contractual Clauses) together with the provider's own certification under the UK Extension to the EU–US Data Privacy Framework, as applicable. You can ask us for details of the safeguards in place.
9. How long we keep it
Being straightforward about the current position:
- Account and content data is kept for as long as your account exists. Soundflow has no automated deletion or archiving job today — nothing expires on a schedule.
- When you delete your account, the records that hang off it — enrolments, progress, certificates, posts, projects and activity events — are deleted with it, because they are stored as dependents of your account record.
- Order records survive account deletion, because we are required to keep records of sales for tax purposes (generally six years in the UK). What is retained is the transaction, not your profile.
- Content you posted publicly may persist in other people's quotes or screenshots, which we cannot reach.
10. Your rights
Under UK and EU data-protection law you can ask us to:
- give you a copy of the personal data we hold about you (access);
- correct anything inaccurate (rectification);
- delete your data and your account (erasure);
- restrict or object to how we use it, including anything we do on the basis of legitimate interests;
- give you your data in a portable, machine-readable form; and
- withdraw any consent you have given, at any time, without affecting what came before.
How to exercise them, honestly: there is no self-serve “download my data” or “delete my account” button in Soundflow yet. Email our published contact address (not yet available — see the notice above) and we will do it by hand. We will respond within one month, as the law requires, and we will not charge you.
You can edit your own profile, delete your own posts, comments, reviews and cloud projects from inside the app at any time.
If you think we have got this wrong, please tell us first — but you can complain to the Information Commissioner's Office (the UK regulator) at ico.org.uk, or to your local supervisory authority if you are in the EEA, at any point.
11. Children and young people
Soundflow teaches music, and music is taught to children — but the platform as it stands is not built for them to use unsupervised, and we say so rather than pretending otherwise:
- We do not ask for your date of birth and we do not verify age. Accounts should be created and held by someone aged 16 or over (13 or over, with a parent or guardian's involvement).
- Guardian linking does not exist yet. The parent role exists, but there is no way to connect a child's account to a parent's and no parental controls. The Family Overview screen says this plainly instead of showing invented children.
- The product contains a safety gate that disables AI generation and voice features in an under-13 context, but it is not currently connected to any age signal, because we do not collect one.
If you believe a child has given us personal data, email our published contact address (not yet available — see the notice above) and we will delete it.
12. How we protect it
- Traffic is served over HTTPS in production.
- Every API endpoint that touches your data sits behind an authentication guard that verifies your session token against the identity provider before the request is allowed through.
- Direct-message pages and API endpoints are disabled until genuine authenticated end-to-end encryption is implemented.
- Every AI model file the app downloads is checked against a pinned SHA-256 hash before it is allowed to run, so a tampered or intercepted model is rejected.
- Payment card data never touches our servers.
No system is perfectly secure. If you find a vulnerability, please report it to our published contact address (not yet available — see the notice above) rather than disclosing it publicly, and we will work with you on it.
13. The desktop app
The desktop release candidate is not yet a signed public download. When you run an internal or later public build, it runs on your computer and can talk to the same API as the website, so everything above applies. In addition, on your machine only:
- it reads and writes the project and audio files you choose, through your operating system's file dialogs;
- third-party plugin scanning exists as a development capability but is disabled in the minimum-launch desktop release; and
- standalone Soundflow plugin licences and their token storage are not offered at minimum launch.
14. Changes to this policy
When we change this policy we will update the “last updated” date at the top. If a change materially affects your rights, we will make it obvious in the app rather than relying on you re-reading this page. Questions go to our published contact address (not yet available — see the notice above).