Privacy notice

What we do with your data

Our listening stats measure link clicks and playback activity. They count plays, listening time and actions such as pausing, skipping and seeking. These reports contain no audio files, lyrics, artwork, passwords or source download links. Counting a play does not analyze the contents of your song.

No AI training. No sale of your music or personal information. No advertising profiles. Demotapes does not use your audio, artwork, lyrics or song metadata to train or fine-tune AI models, license it for AI training, or share it with advertising networks. Playing or sharing music never opts it into training. Optional analysis is performed only when you request it.

Stats are private to the uploader and the operator. The current player keeps playback reports in Demotapes' database; it does not send them to Dub. Dub handles clicks when you use our configured short links, without receiving your audio. Listening reports use a temporary random page-session ID, with no hardware fingerprint or persistent analytics identifier. Browser privacy signals disable playback reporting.

The public visitor counter is separate from listening stats. It estimates distinct browsers on each device opening a tape page, including visitors who never press play or unlock a private tape. A random ID is specific to that tape and saved in a signed first-party cookie and localStorage; reloads, other tabs and different links to the same tape reuse it. Recognition renews for 90 days after a counted visit. We retain only a tape-specific keyed hash and expiry, plus the tape's cumulative total; we do not join them to listening reports, accounts, IP addresses or audio, and do not collect a hardware, canvas, font or audio fingerprint. Privacy opt-outs and browsers blocking both cookies and localStorage are excluded. Clearing all site data, changing browsers or returning after 90 days of inactivity can count again. This is an estimate of browsers, not verified people or physical devices, and starts when the feature is enabled. We also count measured tape-page loads separately from plays. A fresh random ID held in page memory deduplicates the cookie handshake and retries; its tape-specific hash and timestamp expire after 90 days. It does not recognize a returning browser or link to accounts or listening sessions. Counts per minute retain page loads and newly recognized visitors without browser or page IDs. Page-load history begins when this feature is used; older loads are not reconstructed.

We store what is needed to make the player work. Direct uploads are stored privately for playback, with new B2 audio encrypted at rest. Linked Dropbox songs stream from Dropbox; we keep their source references and waveforms and temporarily fetch audio for validation or requested processing. Up to eight converted covers may remain in function memory until evicted or the instance is recycled; every artwork request still checks current access, and private artwork responses are not publicly cached. Hosting and storage providers handle the data needed to operate the service. The details below explain those limited uses, optional features and retention.

Your music, clearly explained

Demotapes does not use your audio, artwork, lyrics or song metadata to train or fine-tune AI models. We do not sell or license your content for AI training. Playing, storing or sharing a song does not opt it into training. Optional analysis runs only when requested; it is not model training.

• Files you upload: new hosted audio is stored in a private Backblaze B2 bucket, encrypted at rest using AES-256 and transferred over HTTPS. Existing media may remain in private Vercel Blob. Playback copies, artwork and project records are also stored to provide the service.
• Linked Dropbox songs: playback comes from Dropbox. Demotapes keeps an encrypted source reference and waveform data and temporarily fetches audio to validate or process it. New linked imports do not create a B2 audio backup. Earlier stored copies remain until deleted.
• Your stash: without sign-in, bookmarks and display metadata stay in this browser's localStorage. Clearing site data removes them. Dots is optional for saving bookmarks to your account across devices; neither option saves an offline audio copy or a tape password.
• Downloads off: our download buttons and download endpoints are disabled. Listening still delivers audio to the device, so recipients can capture or record it. This setting is not DRM and cannot disable downloads at the original source provider.

Expired comment-device credentials are removed when a comment identity is next used. Generated handles remain reserved to prevent reuse, including after their comments expire. Account-to-handle mappings remain while that account connection is retained; account deletion requests should include this mapping. Clearing browser storage can create a new handle unless sign-in restores it. Existing comments keep their original handle when a device later connects to an account with a different handle.

Encryption at rest and in transit does not mean end-to-end encryption. Our service and storage providers can process audio to deliver the features you request. We do not describe hosted uploads as “stored nowhere,” and we do not make a blanket no-storage or zero-logging claim.

1. Who and what this notice covers

This notice covers people uploading, importing, managing or listening to content, people whose information appears in that content, and people contacting Demotapes. An accountless session is pseudonymous, not a promise that its activity cannot be associated with a person.

The operator determines the purposes and means of its own session security, service administration and complaint handling. Uploaders may have separate responsibilities for personal information they submit or listener information they use. If a business customer requires Demotapes to process personal data solely on its instructions, the parties must determine their roles and put an appropriate data-processing agreement in place. These Terms are not that agreement.

This notice provides information. Agreeing to the Terms, entering a page password, or an uploader selecting analytics does not give consent on behalf of listeners to optional tracking.

2. Information in the current test build

• Content and results: uploaded or imported audio, filenames, file sizes and hashes, playback copies, selected processing options, generated stems, transcripts, detection results and error/status information. Requested vocal checks also save timestamped acoustic cues, usable coverage and an experimental processing index. Written evidence reports are generated in browser memory and can be downloaded with their raw data; this narrative is not saved on the server. Raw analysis and transcripts remain private in uploader history. Edited lyric drafts stay in page memory until explicitly submitted for a Pangram check. Separated stems are model estimates, not original session stems. Transcription can use a temporary vocal estimate or the received mix; only an explicit retained-stems request stores separated audio. Pitch-only vocal isolation is temporary unless you separately request retained stems; previously retained stems remain available. These checks run on the application host, do not send audio to an external analysis API, and are not used for training or an automated legal decision. Audio and lyrics may identify or describe people.
• Workspace access: random workspace and session identifiers, a hash of the session token, its expiry, and a salted password hash if you set an uploader password. We do not store the password as plaintext in the workspace database. My tapes associates authorized workspaces with a random owner library and a hashed browser token lasting up to 90 days. An optional recovery key is shown once and stored only as a hash; anyone holding it can recover editing access and private stats. Recovery ends previous browser sessions for that library. No hardware fingerprint is collected for this feature.
• Anonymous timestamped comments: when you submit a note, we store its text, song/version, playback timestamp, submission time and a generated pseudonymous handle. The form collects no name. A random first-party comment credential remembers the handle in this browser for 90 days after use, with cookie and localStorage fallback; we do not collect a hardware fingerprint or call an external name generator. If you sign in, a separate keyed hash of your verified account subject privately links your handle across devices. Your profile name and account subject are never included in listener comments. A recognizable handle can connect your comments across tapes; this is pseudonymity, not untraceability. Comment credentials and account mappings are not joined to visitor counts or listening reports. New notes are private to the uploader by default. The current form explains that the uploader can choose to publish them with the generated handle, or return them to private visibility. People with listening access can read published notes; password-protected tapes still require access. The uploader can read, moderate and remove notes. Older notes submitted with the private-only disclosure cannot be published through this control. Do not include identifying or sensitive information you do not want listeners to read.
• Browser stash and player preference: album/song references, display metadata and save time are stored locally when you choose to stash without signing in. Your chosen deck, CD or cassette case is also remembered locally. These values persist until removed or browser data is cleared; they are not analytics identifiers. Signing in does not automatically upload browser bookmarks. Use “save browser stash to account” to copy them to your account.
• Optional Dots sign-in: Dots verifies your identity through an authorization screen. We store the verified subject identifier, returned name/username, profile-sync time and project association. This allows you to reopen your Demotapes projects. If you choose to stash songs, we also store your saved tape/song references, selected player case, playback position and save time against your Dots subject. Your stash is private to that account and available on other devices after sign-in. It contains bookmarks, not audio copies or listening passwords; it does not grant uploader access or bypass a tape password. A separate hashed sign-in token lasts up to 90 days, is removed from this device on sign-out, and is not used to identify listening analytics sessions. You can remove each bookmark from your stash; signing out or clearing cookies does not delete saved bookmarks. We discard the access token after retrieving the basic profile; we do not copy your wallet, email, files or personal database. Writing Demotapes records into your Dots user database is not enabled. A short-lived cookie and server record bind the sign-in to your browser.
• Submission records: track/workspace identifiers, submission time, accepted Terms version and document digest, and your affirmative rights declaration. This is a record of an assertion, not verification of identity or ownership.
• Imports: the source URL and any embedded sharing token are used to fetch the material. For new Dropbox tracks with either download setting, the app retains an encrypted source-link reference and waveform data in its database for direct playback and removes them when the recording is deleted. Audio is fetched temporarily for validation and requested processing; no new B2 backup is made for these linked imports. It does not include that reference in song metadata or analysis reports. Source providers receive import requests and, for public linked playback, listeners’ direct media requests, including IP addresses and browser request information. Password-protected playback instead streams through Demotapes access checks without disclosing the upstream bearer URL. Other import URLs are not intentionally retained in the workspace database or reports. In the hosted test, Vercel Queues holds the import URL and any sharing token in a private job payload for up to 24 hours. Infrastructure logs and third-party retention require separate review.
• Browser and connection data: the essential session cookie, your chosen theme, and request data handled by the web server, such as connection address, route, timestamp, response status and browser-supplied headers. What infrastructure logs persist depends on its configuration. This is not a claim of zero logging.
• External lyrics analysis: if configured and separately approved by you, the selected text is sent to Pangram. Ordinary local playback does not make that request.

Password-protected listening pages and consented playback reports are active. Wallet and payment features are not implemented. Project/album titles, artist names, song display names and optional cover artwork are stored on the local host or, for the hosted test, in Turso with private B2 or Vercel Blob media copies. Artwork is converted to a static image with embedded metadata removed; the uploaded image’s size and hash and its rights acknowledgement are recorded. In hosted mode the source artwork is temporarily received in private Blob for validation, then deleted after normalization. B2 upload grants expire within ten minutes; Vercel grants expire within 15 minutes. Replayed B2 uploads cannot replace accepted recordings because reads are pinned to the accepted file version. Extra versions and cancelled or abandoned staging objects are cleaned on a subsequent upload request once a 20-minute grace period has passed. An idle test deployment can retain abandoned staging objects until that cleanup runs or the operator removes them.

3. Hosted storage and page access

The hosted service uses private B2 and Vercel Blob storage for recordings, playback derivatives and artwork, with database records for projects and permissions. The application authorizes media requests before issuing playback URLs. B2 playback URLs expire within five minutes; existing Vercel URLs can remain usable for up to 15 minutes after access is revoked; delivered audio cannot be recalled. A page password is an application access control; it is not the Blob credential and does not make the files end-to-end encrypted.

Authorized operator personnel and infrastructure providers may process content when necessary to operate, secure or support the service, or handle a lawful request. Access should be limited by role and purpose. “Private” does not mean inaccessible to the operator or its infrastructure providers.

Uploaders choose public access (anyone with the listening link) or a separate listener password. Public listening does not make the underlying Blob bucket public. The management password and link protect editing and owner analytics. Sharing a listener password does not establish who the listener is, and recipients may forward it. Changing access settings can restrict future requests; it cannot recall audio already delivered or recorded.

4. Clicks, plays and listener reports

Configured short links redirect through Dub, which can process the click and request information before the visitor reaches Demotapes. A direct listening link avoids that redirect. Dub's own processing is described in its privacy policy.

When the uploader enables reports, the current player automatically records playback in a temporary session. There is no analytics permission prompt, persistent analytics cookie, localStorage listener ID, or hardware fingerprint. A random session ID stays in page memory and is replaced after reload; the API accepts it for up to eight hours. The existing access cookie authorizes events but is not exposed to uploaders or used to recognize returning listeners. Global Privacy Control and Do Not Track disable these reports.

Reports contain random session/play IDs, track ID/title, event sequence, server time, playback position, cumulative listening seconds, starts, pauses, resumes, seeks, skips, endings, and speed/volume changes. Uploaders see per-track counts and the latest 25 session timelines, without a device identity. Session counts are not unique people or proof that a named person listened. Only the uploader's authorized editor and the operator can access them.

A qualified play requires 30 seconds of eligible playback, or 80% of a shorter recording. The browser excludes pauses, buffering, muted or zero-volume playback and seek distance; the server checks event order, deduplicates retries and caps reported time against elapsed server time. Reports are not suitable for billing or authoritative identity verification.

Automatic playback reports remain in Demotapes' SQLite/Turso database and are not sent to Dub. The player discards redirect click IDs. Earlier player versions may still submit separately consented Dub play attribution and persistent tape-scoped recognition through a compatibility endpoint; those older records remain subject to retention. No audio, lyrics, artwork, passwords, source links or signed media URLs are included in Dub events.

5. Purposes and legal bases

We process the data needed to provide requested storage, access, playback, imports and selected analysis; maintain security and reliability; enforce quotas and permissions; handle support and rights complaints; and comply with applicable legal obligations. Planned measurement helps uploaders understand listening activity.

Where EU or UK data-protection law applies, the final deployment must identify a valid basis for each purpose. Providing a requested service may rely on contractual necessity; proportionate security and abuse prevention may rely on legitimate interests after assessment; required disclosures may rely on legal obligations; optional processing may require consent. Contractual necessity does not automatically cover every analytics feature.

Where consent is required, it must be obtained before the relevant processing and can be withdrawn without affecting its prior lawfulness. Applicable storage/access rules may separately require consent or an available, properly assessed exception. Special-category information, children’s data and information about other people require additional assessment where relevant; an uploader warranty alone is not a legal basis for us to process it.

Demotapes does not sell personal information, run advertising trackers, or use submitted audio, artwork, lyrics or song metadata to train or fine-tune AI models. Any materially different use would require advance notice and a lawful basis, including separate permission where required. Detection is an estimate; the app does not use it to make an automated legal determination about a person.

6. Recipients, providers and transfers

Public tape and song previews include their names, artists and artwork and may be cached by messaging services. Password-protected previews are generic. Making a previously public tape private cannot recall previews already cached elsewhere.

Information may be available to recipients you authorize, service providers needed for the selected feature, personnel with an operational need, and recipients of a legally valid disclosure. A private sharing link can also reach people to whom a recipient forwards it. Copyright counter-notices may be forwarded to claimants as described in the complaints policy.

The provider notice identifies current and proposed data flows. Hosting, support and subprocessors may involve processing outside your country. Before hosting, we must identify actual regions and applicable transfer mechanisms, such as an adequacy decision or approved contractual safeguards where required, and explain how to obtain relevant information. Linking to a provider’s DPA does not mean it has been executed or every transfer is compliant.

7. Retention and deletion

Local media and results

No automatic expiry is implemented. Whole-tape deletion revokes listening access first and tracks cleanup until active workers, previously issued upload grants and provider deletions finish. It also removes the tape’s versions, artwork, notes and reporting data; failed cleanup stays revoked and retryable. It cannot recall already downloaded/buffered copies, external source files, third-party previews or provider backups. In the local build files remain on the host; hosted media remains in private B2 or Vercel Blob and metadata in Turso until deleted through the available controls or by the operator. Deleting a track removes its active files and database row, including its submission acknowledgement. In hosted mode deletion must also finish against private Blob; a provider failure is reported for retry. Temporary processing copies can remain on a function instance until it is recycled. Project metadata and artwork are separate: editing a song does not change its original audio file, and removing a track does not delete the album cover. Removing or replacing artwork removes its previous active image and acknowledgement; project details remain until changed or removed by the operator. Processing can temporarily prevent deletion. Independent copies or backups are not necessarily removed by that action.

Session and preference data

The session cookie expires after 30 days unless replaced or cleared sooner; authorization also checks expiry. Expired database records and an abandoned workspace do not necessarily disappear when a cookie expires. The theme preference remains until changed or browser site data is cleared.

Listening data

Individual listening sessions, events, per-play records and legacy attribution records are removed after 90 days on the next access-triggered cleanup. Before detail expires, we retain counts per minute of starts, qualified plays, listening seconds, sessions, skips, seeks and finishes by tape/song, with no session, browser, account or access-token IDs. These aggregate totals and page-load totals have no automatic expiry, supporting year and available-history reports. Requests for their deletion can be sent to the privacy contact. Temporary aggregation/deduplication IDs expire with the 90-day detail. History that had already expired before aggregation was added cannot be recovered. An idle deployment can retain expired rows until cleanup next runs. Listener access expires after 24 hours; reporting sessions expire after eight hours and are not restored after a reload. The current player clears any legacy tape-device cookie when starting its temporary session. A privacy signal stops new reports; existing reports and Dub events already sent are not automatically deleted. Contact the privacy address to request deletion.

Other hosted records

[SET AND PUBLISH: project inactivity/expiry policy, active media deletion time, backup expiry, Dub click/event retention, security logs, consent and acceptance evidence, and complaint records.] These periods have not been selected. They must reflect purpose, applicable law and actual provider capabilities.

Some information may need to be retained for a specific legal obligation or a proportionate dispute hold. Document the reason, restrict its use and delete it when the reason ends. Removing a short link does not by itself delete its destination, stored media or historical analytics; those require coordinated actions. Deletion cannot recall copies held by listeners or the original source provider.

8. Your choices and rights

You can delete eligible tracks, choose optional processing, and clear browser site data. Clearing a session cookie can also remove your ability to manage an anonymous workspace; save a recovery method first where one exists. Cookie clearing alone does not delete the uploaded files.

Depending on applicable law, you may request access, correction, deletion, restriction or portability of personal data, object to certain processing, withdraw consent, and complain to the relevant supervisory authority. Contact help@🗣.fm. We may request proportionate evidence that a request concerns your data or an authorized workspace, without collecting unnecessary identification. Where an accountless design means we cannot identify the relevant data, we will explain the limitation rather than promise an identification capability we do not have.

Where applicable U.S. state law provides these rights, you may also opt out of sale, targeted advertising or certain consequential profiling, and appeal a denied request by emailing help@🗣.fm with the original request reference and the reason for your appeal. We do not currently perform those sale, advertising or profiling activities. Exercising privacy rights must not result in unlawful discrimination. You may contact the Delaware Department of Justice about rights within its jurisdiction.

Requests are subject to applicable procedures, deadlines, exceptions and the rights of others. The privacy contact is help@🗣.fm. Inbox operation and a request-handling process have not been verified, and the prototype has no self-service export workflow. The operator must establish and test these processes before launch.

9. Security, age and updates

The current application uses session authorization and restrictive local file permissions; it does not encrypt local audio itself. The hosted application checks that the B2 bucket is private, requests AES-256 encryption on new B2 uploads, and verifies encryption before accepting them. B2 playback grants expire after five minutes and are bound to an accepted file version. Hosted pages use HTTPS and HSTS; passwords and session credentials are hashed. Source-link references are encrypted in the application database. This is not end-to-end encryption, and temporary local processing files are not encrypted by the application itself. No control makes audio already played impossible to capture.

The service is intended for adults 18 and over. Do not knowingly submit children’s personal information without the necessary authority and safeguards. If a child has provided information contrary to this policy, contact help@🗣.fm so the operator can assess and take appropriate action.

The hosted service must announce material changes in the player or workspace with a link to the revised notice and its effective date, and use any additional notice required by law. We will identify material changes and their effective date. A future notice does not retroactively supply consent for an earlier incompatible use. The current pages remain drafts until the deployment details and legal review are complete.