coproducer Privacy Policy
Short version: we collect the minimum needed to run a music studio in your browser, we never sell your data, and your music is not used to train AI. Analytics (and any advertising that may one day support the free plan) run only with your consent via the cookie banner. The detail follows.
What we collect
- Account: a username and a password (stored only as a salted scrypt hash we cannot read), or, if you sign in with Google, Discord, Facebook, X, Reddit, Spotify, Twitch or GitHub, the name, account id and (where the provider shares it) email address they give us. We never see your password for those services.
- Taste preferences: if you fill in the welcome wizard (genres, experience level, goals, reference artists) so the AI can make better musical choices for you. All optional.
- Usage counts: how many AI requests your account makes per day and month, to enforce plan limits.
- Product events: we record that actions happen — a sign-up, an AI prompt, an export, a plan change — with the event name and a few safe details (such as which genre or export format), so we can understand and improve the product and personalise it to what you make. We never log your music, your prompts, or their contents. These events are kept for up to 12 months, then deleted, and are removed when you close your account.
- How you arrived: if you reached us through a marketing link, we record the referring source (the campaign or site) at sign-up. It is used only in aggregate, to understand which channels work. No cross-site tracking, and it is never tied to you in anything we share.
- Billing: payments are processed by Stripe. We never see or store card numbers. We keep only your plan, a Stripe customer reference, and subscription status.
- Launch list: if you leave your email on the homepage, we store that address, and use it only to tell you about coproducer.
- Cookies: one essential cookie keeps you signed in. It always runs and needs no consent. Any non-essential cookies (analytics, and advertising if it ever arrives; see the next section) run only if you chose "Accept all" on the cookie banner. You can change your mind by clearing the site's data in your browser, which brings the banner back.
Analytics and advertising
We use, or may introduce, Google Analytics to understand how the site is used: page views, feature usage, rough geography. It runs only for visitors who accepted non-essential cookies, and we configure it without advertising features and with IP anonymisation where available.
We also use Microsoft Clarity on our public pages to see how people move through the site: heatmaps and anonymised session recordings of clicks, scrolling and navigation, so we can find what's confusing and fix it. It runs only after you accept non-essential cookies, and text you type and other sensitive content are masked by default. Neither tool ever sees your music, your prompts, or your projects.
The free Bedroom plan may in future be supported by advertising. If that happens we'll update this policy first, ads will be clearly marked, any advertising cookies will sit behind the same consent banner, and paid plans will stay ad-free.
Email from us
Account email (verifying your address, password resets, receipts and important notices) is part of running your account and goes to every user. Marketing and tips (product news, getting-started nudges, occasional offers) go only to people who opted in, and every one of those has a one-click unsubscribe link that takes effect immediately, no sign-in needed. Unsubscribing stops the marketing email; account email still reaches you.
So we can tell what's useful and stop sending what isn't, our marketing emails record whether you opened them and whether you clicked a link, tied to your account, in aggregate. To personalise them we may use the taste and usage signals described above (for example, leading with the genre you work in most). We run this ourselves; the content of these emails is never your music or your prompts, and if an address bounces we stop emailing it. You can opt out of marketing at any time from the unsubscribe link or by emailing us.
Your music and your audio
Your projects (songs, samples, the records you open) live in your browser and in project files saved to your device. When you ask coproducer to analyse or extract from an audio file, that audio is processed on our servers to do the job you asked for, and the results come back to your browser; we don't build a server-side library of your music and we don't use your audio or prompts to train AI models.
Who else touches data, and why
- AI model providers (Google Gemini and Groq, or a provider whose API key you supply): your instructions and the musical document they act on are sent to them to generate the response. These providers are located overseas (primarily the United States) and handle that data under their own terms.
- Railway hosts our servers and storage.
- Stripe processes payments.
- Resend delivers our emails (receipts, password resets).
- Google Analytics and Microsoft Clarity (consent-gated, as above) measure site usage and page interactions.
- Mixpanel records product events tied to your account — sign-up, email verification, prompts, exports and plan changes — so we can see where the product helps and where it gets stuck. It receives the event and your account identifier, never your music, your prompts, or their contents.
We share data with these processors only as needed to run the service, and with nobody else. We don't sell your data. We would disclose data if the law genuinely required it.
How it's protected
All traffic is encrypted in transit (HTTPS). Passwords are salted and hashed with scrypt. API keys you store with us are encrypted at rest with AES-256-GCM and are write-only: they can't be read back out through the interface, only replaced or removed. Access to server infrastructure is limited to the operator.
Your rights
You can see and change your preferences in the app, close your account in the app or by emailing us, which deletes your server-side account data, and ask us what we hold about you or ask for it to be corrected or deleted: hello@coproducer.pro. We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). If you're unhappy with how we've handled your data, contact us first and we'll do our best to fix it; you can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Data breach and changes
If a breach ever puts your data at risk we'll notify affected users and the OAIC as the Notifiable Data Breaches scheme requires. If this policy changes materially we'll note it here and flag it in the app.