Privacy Policy

This Privacy Policy explains how Songcase ("Songcase", "we", "us") collects and uses information when you use songcase.app: what we collect, why, and what we never collect. It also covers our Mac app, Lucid Lab, and its iPhone app, for the people using them (at the end).

Songcase

Songcase keeps what you put in it, private to your account: the songs and versions you add (their audio and stems), your notes, lyrics and split sheets, and the project backups you start on the website (or in our Mac app, Lucid Lab). These are stored on Cloudflare's storage for Songcase, sent there encrypted (HTTPS). A file you add twice is stored once. Nothing in Songcase is public unless you put it on your page. A song opens only for you and the people you share it with by email; a split sheet's signing link shows the sheet to the people you sent it to, not the audio. Rhymes for your lyrics are worked out in your browser or on your Mac; your lyrics are not sent anywhere for them. Files of an upload you stopped are deleted after a day. You can delete any song, version or backup in Songcase, and deleting your account deletes all of it.

To know your plan (free, a Songcase membership, Lucid Lab Pro), Songcase asks our licence server which subscriptions your account has and keeps the answer for up to ten minutes. When a membership ends, your 10 most recently changed songs stay and the other songs kept in Songcase are deleted 30 days later (see the terms).

We don't use your songs to train AI. We don't listen to them.

When you share a song, the people you invite get the role you choose (a viewer can play it but not download it), we email them an invitation, and the song keeps a record of who opened, played, downloaded or changed it, which only you can see; the record is kept 180 days. To keep your account safe we keep, for each device you're signed in on, the kind of browser or app and the country it signed in from, and we email you when a new one signs in. 2-step sign-in is optional; its secret is kept locked with a key only our server has. When you delete something, it is gone from Songcase at once and from our storage's own safety copies within 30 days.

If you sign in with Google or Apple, we get your name, your email address (with Apple, the private relay address if you choose to hide yours) and an account number from them, and use these only to sign you in and to write to you about your account. We don't get your password or anything else in your Google or Apple account.

If you link Dropbox or Google Drive in Songcase on the website, we keep the access they give, locked with a key only our server has, so the page can list and play your files; the audio is passed on to your browser and not kept. Unlinking deletes that access.

Your page

A Songcase Page (songcase.app/@yourname) is public once you turn it on: anyone can see the photo, name, bio, links, releases, social links and email you put on it, and play the songs you add to it from your Songcase, in the design you chose, and search engines can list it unless you say not to. It shows nothing else from your account. We count, per day, how many times the page was opened, each button tapped and each song played on it, which site or campaign tag sent the visit, and the visitor's country (from the network, not asked), and show those numbers only to you; they are counts, not people: we keep no IP address, set no cookie and record nothing about who looked. When you open your own page while signed in, your sign-in is used only to leave that visit out of the count. Counts are deleted after 120 days. We may email you about your page twice at most: once when it gets its first visitor, and once if nobody has opened it a few days after you made it. You can turn both off in your page's settings. Your photo is kept on Cloudflare's storage for us and replaced or deleted when you change or remove it. Turning your page off hides it at once; deleting your account deletes it, and its address can then be taken by someone else after 90 days.

• Work requests: when someone sends you a request from your page, we keep their name, email, message and link for 180 days, show it only to you, and email it to you so you can reply.
• Quotes: a quote you send keeps your client's name and email and what you offered, and we email it to them. When they agree, we keep the name they typed, when, a one-way tag of the network address it came from (not the address), and a fingerprint of exactly what they agreed to, and we email the record to you both. Payment goes through your own link; we never see or handle it, and we are not a party to the agreement.
• Fans by email: when someone signs up on your page, we keep their email address for you, with the country they signed up from (from the network, not asked), where the visit came from (for example Instagram, or a QR code you printed), which of your pages they were on, and when they joined and confirmed; we never ask or guess anything else, such as age. We send them one email to confirm; only after they confirm do we email them: once on the day of each release, and the letters you write to them (at most one a day and four in 30 days, with your postal address and a way to reply to you). Every such email has a one-tap way off, which deletes the address. The list is yours alone: you can see and download it, we never share or sell it, and we use it for nothing else.
• Credits and follows: a credit shows on both pages only after the person credited accepts it. When a Songcase account follows your page, you see how many follow it, never who.
• Private links and song links: a private link (songcase.app/p/…) is made for one person, and you name who. For it we keep how often it was opened (once per half hour), when first and last, the last opening's country and kind of device (for example iPhone), and for each song how often and how long it was played, how far, and which parts were heard again, as the page's player reports it. The person can also leave a ♥ on a song and notes at a moment in it, with a name they type; their browser remembers that name for next time, and nothing else. We email you when the link is first opened, when a song is first played that day, and when a ♥ or note arrives (one email per link in ten minutes); you can turn these emails off. If you put a password on a link, we keep only a one-way scramble of it, and the person's browser keeps a key for that link in a cookie after they enter it. All of this shows only to you and is deleted with the link. For a song shared with anyone who has its link, the song's record (above) notes each play without saying who. Neither keeps an IP address. If someone sent you a private link or a song link: this is kept so the person who sent it can see how their songs were heard, nothing on it is used to follow you elsewhere, and it is deleted with the link; to have it deleted sooner, ask them, or write to support@songcase.app.

What we keep

• Your account: the email address you sign in with, so you can sign in and so purchases reach you. Sign-in codes and sessions are stored only as one-way hashes.
• Your licence: a one-way hash of your licence key, the payment provider's ids for your subscription (Creem's or Paddle's), its status and end date, and a random id for each Mac you use it on (not your Mac's serial number). To notice a licence key shared too widely, we keep a one-way tag of the network address each Mac renews from, for 30 days, never the address. We keep no name, address or card details.
• Free use given to you (if we gave you some): your email and what was given.
• Where you came from, when you make an account on the website: the site that linked to us or the link's campaign tag (for example youtube.com). It travels in the page links while you browse; nothing is stored in your browser for it. An account made in the app is marked as made in the app.
• Sort with AI, only when you press it (Sort into songs, Tidy names): the file names and song titles involved, never audio or folder paths, are sent to Anthropic’s Claude to suggest songs, versions and names. Nothing changes until you confirm it. Anthropic does not train its models on them, and neither do we.
• Songcase AI, when you ask it something (or ask it for a release plan or a Spotify pitch): your question, the conversation so far, and what it needs to answer for you: your releases and their dates, your song titles with their key and tempo, the names of your lyrics and notes, the words of a lyric when you ask about it, your page's views and fan count, your social numbers, and, for your private links, the name you gave each one and whether it was opened, played or liked. These are sent to Anthropic’s Claude to write the answer. Never the audio, and never anyone’s email address. What it keeps about you (your answers to its questions, things you tell it about your music, past releases you import from MusicBrainz) is listed when you ask it “What do you remember about me?”; you can delete any line there, and all of it is deleted with your account. Anthropic does not train its models on any of it, and neither do we.
• The date Lucid Lab first exported stems for you. Only the date; not the project, its tracks or any file name.
• The days you use your account, and whether on the web, the Mac app or the iPhone app, for 180 days, so we know how Songcase and Lucid Lab are used. Not what you opened, played or wrote.
• Usage events, only if you turn them on in Lucid Lab: which task ran, whether it worked, how long it took. Never a track, file, path or project name.
• Feedback you choose to send us, with what you choose to include.
• The launch notice, if you ask for it on this website: your email and the page you asked from, used once to tell you Lucid Lab is out, then deleted.
• The demo check on songcase.app: the email you enter to use it, the link you came from, and whether you ticked the box for Songcase news. We only email you about Songcase if you ticked it, and every such email lets you unsubscribe. The song you check never leaves your device. To have your email deleted, write to us.

Payments

Creem (creem.io) is the merchant of record for Songcase memberships, and Paddle.com for Lucid Lab. When you buy, the merchant of record collects your name, email, billing details and payment information under its own privacy policy; we receive your email and the ids of your purchase so we can deliver it.

Services we use

Cloudflare hosts this website and our servers, including the relay between your Mac and iPhone (and so sees the usual request data, like IP addresses, for security and delivery). Creem and Paddle handle payments. Anthropic’s Claude writes Songcase AI’s answers and the Sort with AI suggestions. MusicBrainz is asked about the artist link you paste to import your past releases. Apple delivers notifications to your iPhone. Dropbox and Google Drive store what you keep in them. If you use Lucid Lab's assistant features, the questions they need (track names and the kind of sound) are sent to our AI provider to answer them; nothing else is sent.

Cookies

This website sets no tracking or advertising cookies; only the few it needs to work (signing in, a link's password, stopping repeat sign-ups). The full list is on the cookies page.

Your social numbers

If you link your accounts in Release › Social, we keep their follower numbers once a day, how many posts or videos they have, and whether your Songcase page is in their bio (yes or no, never the bio), for up to 400 days, so we can show your growth and suggest what to do next; unlinking deletes them. YouTube numbers are read with the YouTube API Services: by linking YouTube you agree to the YouTube Terms of Service, and Google's use of the data is covered by the Google Privacy Policy; numbers read that way are kept 30 days, and you can also remove our access in your Google security settings. Deezer numbers are the ones you type in. TikTok, Instagram and Spotify numbers are read by Songcase for Mac on your own Mac, from your public profile or, if you sign in to them there, your own account; your sign-in stays on your Mac and only the numbers reach us. Songcase's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Instagram creator and business accounts can also be read without your login: we look up the public follower and post counts of the @handle you link through Meta's Business Discovery, from Songcase's own Instagram account. If you choose to connect TikTok or Instagram with their own sign-in, we receive an access token for your account, keep it encrypted, and use it only to read your follower and post or video counts once a day. You can disconnect at any time in Social (we delete the token; TikTok's is also revoked), or remove Songcase in your TikTok or Instagram settings. Unlinking an account deletes its numbers and token, and deleting your Songcase account deletes everything.

Children

Songcase and Lucid Lab are not for children under 13, and we don't knowingly collect their personal data. If you believe a child under 13 has given us personal data, write to support@songcase.app and we will delete it.

Your rights

You can delete your account yourself on your account page or in the iPhone app (your initial at the top right, then Delete account): your account, every sign-in and everything the relay keeps for it are deleted at once. You can also ask to see, correct or delete your data by writing to support@songcase.app. We keep licence records as long as your subscription exists and as long as the law requires for purchases.

Lucid Lab, our Mac and iPhone apps

Lucid Lab isn't offered right now. If you use it, this applies too.

What never leaves your Mac

Your projects, audio, stems and sound library stay on your Mac. Lucid Lab reads and changes them locally. The exceptions are yours to make: what you open, play or send in your own Dropbox or Google Drive, and what you keep in Songcase (both below).

Lucid Lab on your iPhone

When you sign in on your Mac and your iPhone with the same account, your Mac sends our relay server what the phone shows, and the phone sends back what you ask your Mac to do. The relay keeps, for your account only:

• your Mac's name, whether it is online, and when it was last seen;
• your export schedules (their names, times and last result) and the export running, if any;
• the projects in Lucid Lab's library: their names, where they are on your Mac, the DAW, when each was saved and, when known, track count, tempo and key, so you can find one and export it;
• your last 20 deliveries: project, who it was for, the file names, format, loudness, peak and any warning — and a link to play a file only when you chose to open it to anyone — so you can see and send them from the phone;
• the last 20 things you asked your Mac to do from the phone, and its answers;
• your phone's push notification token, if you allow notifications, and the tokens Apple gives for showing an export on your lock screen (Live Activities), if you allow those.

No audio, stems or project files pass through the relay: the phone plays a delivery straight from your Dropbox or Google Drive. Deleting your account (below) deletes all of this.

Dropbox and Google Drive

If you connect Dropbox or Google Drive, you give Lucid Lab on your Mac full access to it: it can find your projects and audio anywhere in it, play and download them, and upload, share and organise your exports. You can take that access back at any time, in Lucid Lab (Settings › account & cloud › disconnect) or in your Dropbox or Google account.

That access belongs to the app on your Mac, not to us. Your files travel between your Mac and Dropbox or Google, encrypted in transit (HTTPS), and are never stored on Lucid Labs' servers. One case passes through us: when someone plays a Google Drive file from a share link you sent, our website fetches it from Google and streams it on to their browser, without keeping a copy. If you use the iPhone app, the relay keeps your last 20 deliveries (listed above), but a delivery carries a link to play a file only when you chose to open that file to anyone; otherwise your files stay private in your Dropbox or Google Drive. The sign-in is kept in your Mac's Keychain, which macOS encrypts; we never receive it, or your password. Dropbox and Google keep your files encrypted on their side.

A share link is short (lucidlabsaudio.com/d/…). What it opens (the folder's pages and the card you chose) is locked on your Mac before it is kept on our server, and the key to unlock it is in the link itself, after the #, which browsers never send. So we keep it but cannot read it. Your share links are deleted with your account.

Replies and receiving specs

When someone signs in to reply on a delivery, what they send (that they got it, a note, or a file sent back) is kept with the sender's account, together with the replier's email, and shown only to the sender and to the replier. Files sent back are deleted after 60 days. Receiving specs are public pages by design: anyone with the link can read one, so put nothing in it you wouldn't hand out.