Song Studio

Your songs. Your choice.

A plain-language summary of how Song Studio handles personal data.

Controller and contact

Katarzyna Ludwig, 2209 Skyler Dr, Mount Pleasant, SC 29466-9394, United States, is the controller and provider of Song Studio. For privacy or support requests, email support@songstudio.app.

What we process

  • Your Song Studio account identifier and Apple’s app-specific user identifier, plus authentication information used to sign in and secure your account. The app does not request your name or email through the Apple sign-in screen; authentication information supplied by Apple may still include an email or relay address, which Supabase may process and store.
  • An automatically created service identity is used during account setup. Linking with Apple keeps that identity and its credits. Existing guest accounts remain supported. If you publish a song, we also process the display name you choose.
  • Your unfinished song idea and genre, plus one previous draft for restoration, are stored only on this iPhone. They remain until replaced, restored, cleared after an exact submission, or the app is deleted, as applicable.
  • Your song idea and genre to create the requested song and individual cover.
  • Generated lyrics, audio, and cover art for temporary delivery and import into your library.
  • Job, download, and integrity information such as status, time, size, and checksum for delivery, troubleshooting, and abuse prevention.
  • Apple purchase and transaction information, such as product, transaction ID, and signed proof, to provide credits and prevent duplicate crediting.
  • If you enable a notification category, a random installation ID, APNs device token, selected notification categories, locale, app environment, and delivery status to send the update you requested.
  • Technical request information, which may include IP address and service logs, for operation, security, and abuse prevention.
  • Messages you send to support, to answer your request.
  • If you share or publish a song: its audio, cover, title, genre, duration, ownership and access records. Publication also uses your chosen display name; likes, reports, blocks, and moderation records support the community.

For public community songs, we process your likes and limited playback-session information (guest or linked account identifier, song, session, timing and playback progress) to provide aggregate counts and prevent duplicate or abusive requests. These playback-count requests contain no audio. A play qualifies after one second of actual playback. Pausing and resuming the same session does not add another play. Each linked account may give up to three likes per song; likes cannot be taken back individually. The displayed total counts likes, not distinct people. Only aggregate counts are public.

The one-time 18+ confirmation is stored on your device. Each creation request tells our backend that this confirmation was completed; we do not send a birth date or request identity documents. Please do not include confidential or particularly sensitive information in a song idea.

Your account and Apple sign-in

Starting with version 1.3, new installations require Sign in with Apple before entering the app. Existing guest accounts keep access to their local songs and credits and can link with Apple later. Linking preserves the account identifier. Switching to a different existing Apple-linked account requires separate confirmation and is allowed only when the current guest has no account data or credits that would be left behind. Accounts are not merged. Signing in does not upload your library or enable library sync.

When you confirm Apple sign-in, the app sends Apple’s one-time authorization code to our authenticated Supabase service. Supabase exchanges it directly with Apple and verifies that the returned identity belongs to the same Song Studio account. The code is not retained; its hash is kept to recognize retries. An Apple refresh token is encrypted before storage in a private, server-only table with the account identifier, Apple identifier, and minimal registration or retry state. The encryption key is held separately in server configuration. The token lets us revoke the Apple authorization when you delete your account. Raw codes and tokens are not included in application error logs.

The app also keeps an account-bound Apple user identifier in this device’s Keychain and a local registration status to check for revoked Apple authorization. Temporary connectivity errors do not remove your library or sign you out.

How AI creation works

Before the first creation, the app asks you to confirm AI processing. Each creation sends your song idea and genre through Supabase and OpenRouter to Google Lyria 3 Pro Preview. Short excerpts of the idea and generated lyrics go to Google Gemini 3.1 Flash Lite for the song title and to Google Gemini 3.1 Flash Image for the cover. No model-provider secret is included in the app.

OpenRouter input/output logging and its 1% data-use setting are disabled for this service. Requests use paid endpoints, and routing to paid endpoints that train on request data is disabled. OpenRouter still processes non-content request metadata. Google may retain prompts, contextual information, and outputs for up to 55 days for safety and abuse monitoring.

Apple handles payment. After age confirmation and account setup, you can create songs and buy credits. Existing guest accounts remain supported. Song Studio, Supabase, and Vercel process limited signed StoreKit transaction data to verify purchases, credit packs, refunds, and revocations.

One-time welcome song

Song Studio can provide one welcome song per App Store account and app. To check eligibility, Song Studio sends Apple’s signed AppTransaction through its authenticated Supabase service to a separately authenticated Vercel verifier. The signed proof and decoded AppTransaction ID are used only for verification and are not stored or logged.

After verification, Supabase stores a keyed HMAC-derived identifier and the minimum eligibility state, including the generation-job ID and a request hash needed to recognize an exact retry. This record contains no song idea, raw AppTransaction, or raw receipt. It remains while the one-time offer is enforced, including after account deletion, so reinstalling the app or creating a new guest identity cannot provide another welcome song for the same App Store account and app. The identifier is not used for advertising, cross-app tracking, or identifying a person. Verification rate-limit records are linked to the Song Studio account identity and are deleted with that identity.

Voluntary notifications and Apple offer codes

The optional notification invitation explains song-ready alerts, gifts and offers, and product news before you allow them. You can change each category separately in Settings. Existing consent for gifts and offers does not automatically enable product news. We process the random installation ID, APNs device token, selected categories, locale, app environment, and a limited delivery record to send the update you requested, avoid duplicate delivery, and handle invalid tokens. Turning a category off stops delivery for it; deleting your account removes its notification registration and delivery records.

If you choose to redeem an Apple offer code, the app sends the signed StoreKit transaction and signed AppTransaction to our verifier so Apple’s signature, product, offer type, app transaction, and credit claim can be checked. These signed proofs are transient and are not stored or logged. The minimum purchase and credit-ledger records remain under the retention terms below to prevent duplicate credits, support reversals, and provide the purchased credits. Receiving a notification or opening a redemption link does not add a credit.

Where data is processed

We use a Supabase project in Central EU (Frankfurt) for account, credit, job, temporary delivery, and deliberately shared song storage; OpenRouter and Google for AI creation; Vercel for this website, song-link previews, signed Apple purchase verification, and the APNs relay; Apple Push Notification service for enabled notifications; and Apple iCloud Mail for support email. Providers and their subprocessors may also process data outside the European Economic Area. Where GDPR transfer rules apply, we rely on the safeguards in the applicable processor or provider agreement, including an adequacy decision or EU Standard Contractual Clauses where applicable.

Retention and deletion

  • Library: songs, albums, song ideas, audio, lyrics, and covers stay on this iPhone until you delete them or the app. Sharing or publishing uploads only the selected song and its cover and display metadata, never your full library or original song idea. There is no live CloudKit sync. A device backup may include app data.
  • Shared songs: selected files and access records remain on the server so your links and publications can work beyond the temporary delivery period. Ending access prevents new playback links; already issued links can remain valid for up to two minutes. Account deletion blocks access and schedules hosted files for removal. Copies saved by recipients and previews cached by messaging services cannot be recalled.
  • Likes and playback counts: likes remain until the account or hosted song is deleted. Playback sessions expire after ten minutes and are scheduled for deletion 24 hours after expiry; short-term replay-prevention records are scheduled for deletion after 24 hours. Recurring cleanup may complete later. Account deletion removes your likes and playback-session records. Aggregate play totals contain no listener identifiers.
  • Server prompt: removed after successful song-and-cover generation. After a failure or safety block, it is scheduled for deletion after 24 hours; delayed cleanup may complete later.
  • Temporary delivery: generated lyrics and access to audio and cover files remain available for no more than 30 days. Physical file deletion may complete later through recurring cleanup.
  • Account identity, credits, and purchases: minimum records remain while your guest or Apple-linked Song Studio account exists. After deletion, pseudonymised StoreKit transaction and reversal records and a random purchase-account token may remain without a Supabase user ID to prevent duplicate credits and reconcile refunds. No fixed deletion period is currently configured for these technical records.
  • Support: messages received at support@songstudio.app are processed in Apple iCloud Mail and retained only as long as needed for support, security, refunds, legal claims, or legal obligations.
  • Website: Vercel and its service providers may process technical request information, including IP address and access logs, in the normal operation and security of the site. Share pages use no-store and no-referrer instructions and do not add analytics or advertising cookies. Service providers may process the requested URL; treat a private song link as access to that song.

Song links and publication

Sharing by link and publishing to the app community are separate choices. Anyone with a link, including someone it was forwarded to, can listen in Song Studio. A published song can be discovered in the app. You can end the link, remove the publication, or end both. Removing a publication does not end a separate link.

Message previews receive the song title and cover. They receive no audio, lyrics, original song idea, Apple email, purchase data, or internal account identifier. The website provides an App Store entry, not song playback. After installing Song Studio, tap the original link again. The receiving messaging service may cache a preview under its own terms.

Publication requires a safety review of the song, cover, title, genre, and display name. Likes, reports, and blocks are processed to operate the community and respond to misuse. To report content or request help, use the app’s controls or email support@songstudio.app.

Sharing and Photos

When you create a song video, it is rendered locally. With add-only Photos permission, Song Studio saves a copy to Photos and then opens the iOS share sheet. If Photos access is denied, sharing still works. Apple and any destination app you choose process the shared copy under their own terms.

Legal bases and your rights

For people in the EEA or UK, we process account, creation, delivery, and purchase data as necessary to provide the requested service (Art. 6(1)(b) GDPR); meet legal obligations (Art. 6(1)(c)); and protect the service from fraud and abuse (Art. 6(1)(f)). You can stop future AI requests in Settings → Datenschutz → KI-Verarbeitung.

You may request access, correction, deletion, restriction, portability, or object to processing. Email support@songstudio.app. You may also complain to your data-protection authority.

Delete your account

In the app, choose Settings → Account → Delete account. Once the request is accepted, your account is blocked from new backend actions and deletion is queued. Music already on this iPhone is not automatically deleted.

For accounts with a stored Apple token, we revoke the Apple authorization before completing account deletion. If Apple is temporarily unavailable, revocation is retried; the encrypted token and blocked account remain as needed to complete that process. The token is cleared when revocation succeeds, and related account records are removed with account deletion. Older Apple-linked accounts may have no stored revocation token. In that case, the app still accepts account deletion and shows how to remove Song Studio’s Apple authorization yourself. Provider safety-retention periods and the separate minimum transaction-record retention described above may still apply.

Services referenced

Apple Privacy Policy · Supabase Privacy Policy · OpenRouter Privacy Policy · Google Privacy Policy · Vercel Privacy Policy