Privacy Policy

KeyTone (“KeyTone,” “we,” “us,” or “our”) is operated by an individual based in Calgary, Alberta, Canada. This Privacy Policy explains what information we collect when you use keytonestudio.com and the KeyTone Studio desktop companion app (together, the “Service”), how we use it, and the choices you have.

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

Account information

When you create an account, we collect your email address and a securely hashed password, or, if you sign in with Google, your name, email address, and profile picture as provided by Google. We never see or store your Google password.

Content you upload or generate

When you use a tool such as Audio to MIDI, Chord Improver, or Key & BPM Changer, we process the audio or MIDI file you provide and store the file and the resulting output (MIDI files, analysis data) in your private account storage. This content is access-controlled so that only your account can read it.

Payment information

If you upgrade to a paid plan, your payment is processed by Stripe. We do not collect or store your full card number, CVC, or other card details on our servers — Stripe handles that directly and is responsible for its own PCI-compliant handling of your payment data. We receive and store your subscription status and billing history metadata (for example, whether your subscription is active) from Stripe.

Usage and log data

We keep a record of the tools you've used, your project history, and your remaining credits, so the app can show you your history and enforce plan limits. Our infrastructure providers (see Section 3) may also automatically log standard technical data such as IP address, browser type, and request timestamps for security and reliability purposes.

2. Cookies

KeyTone does not use advertising or analytics cookies, and we do not currently run any third-party analytics or tracking scripts. The only cookies we set are strictly necessary session cookies used to keep you signed in, managed by our authentication provider, Supabase. These essential cookies are required for the Service to function and cannot be disabled without also disabling sign-in.

3. Third-Party Services

We rely on the following third-party providers to operate the Service. Each processes data on our behalf under their own privacy and security terms:

• Supabase — authentication, database, and encrypted file storage for your account, uploads, and generated files.
• Stripe — payment processing and subscription billing.
• Spotify Web API — used only when you search for a track in Similar Songs or Track Analyzer, to retrieve track metadata and preview audio. We do not access or require your personal Spotify account.
• Vercel and Railway — hosting for our website and backend API.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

4. Data Retention

We retain your account information and content for as long as your account is active. If you delete your account, your account record, uploaded files, and generated content are deleted from our active systems. Some information may persist briefly in backups or with our infrastructure providers before being fully purged, and billing records may be retained longer where required for tax or accounting purposes.

5. Your Rights and Choices

Wherever you're located, we offer the same core controls over your information:

• Access and correction — you can review and update your account details (name, profile picture) from your account menu at any time.
• Deletion — you can permanently delete your account and associated content directly from your account settings, or by emailing us using the contact details below.
• Portability — you can download the MIDI files and results generated from your projects directly from the app. For a copy of other account data, contact us below.

If you are located in the European Economic Area or United Kingdom, you have rights under the GDPR, including the right to object to or restrict certain processing. If you are a California resident, you have rights under the CCPA, including the right to know what personal information we hold about you. If you are in Canada, we handle your personal information in accordance with PIPEDA. To exercise any of these rights, contact us using the details in Section 9.

6. Data Security

We use industry-standard measures to protect your information, including encrypted storage, access-controlled file buckets so only your account can read your own uploads and generated files, and secure, hashed password storage. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Children's Privacy

The Service is not directed to children under the age of 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

9. Contact Us

If you have questions about this Privacy Policy or want to exercise any of your rights, contact us at rectrix21@gmail.com.