Providers & data flows
Draft version: 2026-10-12-draft-3 · updated October 12, 2026
Vercel · hosted test and private Blob
Purpose: host the application and privately store and deliver audio, derivatives and artwork. Application hosting may also process request information, configuration and operational logs. Vercel also runs the audio models and retains queued job payloads for up to 24 hours. A requested link import includes its source URL and sharing token in that private processing queue. Short-lived media URLs are issued after session authorization; they may be used by anyone holding them until expiry.
Access: private Blob reads need authentication. Demotapes must independently authorize the requesting user and the specific media, including range requests. Private storage is not an end-to-end encryption claim. Storage credentials belong on the server, never in a listener link.
Private Blob documentation · Privacy policy · DPA · Subprocessor information
Backblaze B2 · private media storage
New media uses a private B2 bucket in the eastern United States. The app checks owner or listener access before issuing a five-minute signed read URL for a fixed file version. Browsers upload directly through ten-minute grants limited to one object and an exact size. B2 receives media, object identifiers and direct upload/playback request information, including network addresses. Replayed and abandoned upload versions are collected on later upload activity after a 20-minute grace period; an idle deployment may retain these until cleanup runs. Existing Vercel objects retain their original provider. The bucket is not made public.
Upstash Blob · optional storage backend
When enabled, new private media objects are stored through Upstash Blob, backed by Cloudflare R2. Existing Vercel objects keep their recorded storage provider. The application authorizes each media request before issuing a signed read URL lasting up to five minutes. Direct upload grants name one object, pin its size and expire within ten minutes. Bucket credentials remain server-side. This backend is prepared but is not active until the operator configures and verifies a private bucket.
Dub · short links and attribution
Purpose: redirect listening links, provide click statistics and receive permitted qualified-play attribution events. Redirect requests can be processed before someone reaches the page-password screen or any destination consent control.
Current automatic player: no playback events or click IDs are sent to Dub. Link redirects still produce Dub click records. Older clients may use the separately consented attribution endpoint described below.
Legacy fields sent: the destination listening URL on link creation; the click identifier, pseudonymous play/customer identifier, tape ID, track ID and session ID for each consented qualified play. Detailed playback durations, skips, seeks and tape-scoped device hashes stay in SQLite/Turso. Request-derived analytics may include time, referrer, approximate location and device/browser information depending on configuration. No audio, lyrics, artwork, passwords, owner links, signed media URLs or wallet/identity details should be put in event metadata.
Roles: Dub’s DPA describes processor obligations for customer personal data within its scope. Its own account/service administration can have different roles. Demotapes must determine its responsibilities, execute appropriate terms and configure the actual data sent. Linking these documents does not outsource our privacy duties.
Pangram · optional, if configured
Purpose: analyze text separately selected and approved by the uploader. The current integration requires a configured key and explicit confirmation before submitting the selected lyrics/transcript. The local audio detector and stem processing do not send audio to Pangram.
Data: the selected text and necessary API request information; the returned text analysis is stored with the track. Review the specific provider agreement, retention, training use and transfer terms before enabling this for other users. This notice does not claim an executed DPA or zero retention.
Turso · hosted session and project database
Turso stores session-token hashes, optional salted password hashes, project and song/version metadata, file digests and private object references, processing results, artwork copies and submission acknowledgements. Database credentials stay on the server. Local development uses SQLite instead.
Dropbox, SoundCloud, Untitled and direct sources · import endpoints
When you request an import, the application contacts the source service and any permitted media endpoint to retrieve the content. That source can observe the request and the sharing token you supplied. These services are the source of the imported material, not automatically Demotapes subprocessors. Their independent practices and your authority to import still matter.
The app does not extract your browser cookies or login credentials. A signed or publicly playable URL supplies technical access, not copyright permission. A private import copy follows the same storage and access rules as uploaded audio. New Dropbox tracks stream directly from Dropbox regardless of download settings. Source-link references are encrypted in the application database until deletion, and Dropbox receives listeners’ playback requests. Files are fetched temporarily for validation, waveforms and requested analysis, without a new B2 audio backup. Other source imports still retain private media copies when required by their current adapters.
Dots · optional identity linking
With your authorization, Dots returns a verified subject identifier and basic display profile. Demotapes links that identity to your projects, stores the basic profile in Turso and discards the provider token after profile retrieval. The current integration does not read or write your Dots personal database or copy wallet information.
Local models and future services
The prototype runs available audio inference, separation and transcription on the host. Downloading model weights is separate from submitting audio to a hosted inference provider. The app does not use uploaded recordings to train general-purpose or music-generation models.
Jev, wallet providers, payment services and protocol attestations are not connected. They require confirmed integrations, data flows and any additional notices or transaction terms before release. This register will be revised when actual providers or purposes change.