Privacy
Last updated November 2026
songcode keeps as little as it can. There are no ads and no trackers, and nothing here is sold. This page lists what is collected, where it goes and how to have it removed.
The early access list
When you ask for an invite we keep your email address, the time you asked and which form you used. The list lives in our database and is copied to a Google Sheet we use to send invites. We use it to email you about your invite and about songcode opening up, and for nothing else.
When you open the app with an invite, a cookie named sc_invite remembers it for a year so you are not asked again.
Your API key and your prompts
When you bring your own key, it is stored in your browser's local storage and nowhere else. Each time you generate, your browser sends the key and your prompt to our server, which passes them to the provider you picked (Anthropic or OpenAI) to make that one request. We do not store the key and we do not log it. That request runs under your account with the provider, so their terms and privacy policy cover what they do with it.
We do not keep your prompts or the code that comes back unless you save the track. What you make is yours, with full commercial rights; the terms say so in full.
Saved tracks
Saving a track stores its title, prompt, genre, model name, settings and code. A saved track is public. Anyone with its link can open it, and recent tracks appear in the library. Leave personal details out of a prompt you plan to save.
A saved track stays yours. Publishing it lets us host and show it and lets other people play and remix it, as the terms set out. We do not sell saved tracks, license them to anyone or train models on them.
A saved track cannot be edited or deleted from the app. Email us its link and we will take it down.
Accounts
If you create an account we keep your email address and, if you set a password, a salted scrypt hash of it. We never keep the password itself. Signing in sets a session cookie; we store only a hash of its value. We email you to confirm your address, to send sign-in links and to reset your password.
Paid plans
Payments are handled by Stripe. Your card details go to Stripe and never reach our servers. We keep your Stripe customer ID, your plan, its status and billing period, and a record of each track made on the plan: when, which model tier, and how many tokens it used.
On a paid plan your prompt is sent to Anthropic under our account to write the track. As with your own key, we do not keep the prompt unless you save the track.
Feedback
A message sent from the feedback button is stored with the page you sent it from, the model tier you had selected and your browser's user agent. If you are signed in it carries your account email. Otherwise it carries an email address only if you leave one.
Rate limits and logs
We count requests by IP address to keep the service from being abused. Per-minute counts are held in memory at Cloudflare's edge. A daily counter is stored against your IP address and deleted after the day ends.
Our logs record that a request happened, which model it used, how long it took and whether it worked. They never contain your prompt, your code or your key. Cloudflare, which hosts songcode, also keeps standard request logs for a short time.
What stays in your browser
Local storage holds your API keys, the provider you chose and a few layout preferences. Clearing site data for app.songco.de removes all of it. The only cookies are the invite cookie and, once you have an account, the session cookie. Neither is used for advertising or to follow you across sites.
Who else is involved
- Cloudflare hosts the site, the app and the database, and sends our account email.
- Anthropic and OpenAI receive your prompt when you generate, as described above.
- Google holds the early access sheet. The pages also load their fonts from Google Fonts, so your browser makes a request to Google when a page opens.
- GitHub serves some of the instrument samples, so your browser requests those files from GitHub when a track uses them.
- Stripe processes payments for paid plans.
We do not sell personal data or share it with anyone for advertising.
How long we keep things
- Early access list: until you ask to be removed or the list is retired.
- Daily rate limit counters: one day.
- Saved tracks: until you ask us to take one down.
- Accounts and feedback: until you ask us to delete them.
- Billing records: as long as tax and accounting law requires.
Your choices
Email hello@songco.de to see what we hold about you, correct it, have it deleted or leave the early access list. We will answer within 30 days. Depending on where you live you may have further rights under laws such as the GDPR or the CCPA, including the right to complain to your data protection authority. We honour those requests wherever you live.
Children
songcode is not meant for children under 13, and we do not knowingly collect their data.
Changes
When this page changes, the date at the top changes with it. If a change affects data we already hold in a way that matters, we will email the people it affects first.