Privacy Policy

1. Information we collect

Account details. If you sign in with Apple or Google, we receive an account identifier and your email address (and, where the provider includes it, your name). We store the identifier and a masked email address for display in the app.

Creation content. The descriptions, lyrics, styles, moods and other options you enter, and the songs, artwork and titles generated from them.

Support messages. Whatever you send to songloom.build@gmail.com, including any attachments you choose to include.

Device and app data. Device model, iOS version, app version, interface language, an app-scoped device identifier used for abuse prevention and credit integrity, IP address and request timestamps.

Usage data. Songs created, playback and download events, favorites, shares, credit balance and generation status. Diagnostics: crash and error records needed to keep the service working and secure.

Purchase information. Purchases and subscriptions are processed by Apple. We receive transaction identifiers, product identifiers, subscription status and renewal events (directly from Apple and through RevenueCat, our subscription-management provider), and we keep a record of the credits and entitlements attached to your account. We never receive your full card number, billing address or Apple ID password.

2. Information we do not collect

We do not receive or store your Apple or Google password.

We do not access Gmail, Google Drive, Google Contacts, Google Calendar or Google Photos. Google Sign-In requests only the openid and email scopes.

We do not access your contacts, microphone, photo library, precise location, health data or advertising identifier by default. Text creation does not require any of these permissions. Avoid including unnecessary sensitive information in prompts, lyrics or support emails.

We do not sell personal information, and we do not run third-party advertising or cross-app tracking.

3. Third-party AI services and sharing

AI generation. When you create a song, your description, lyrics, style and mood selections are sent to our music generation provider, and lyric-assistance requests are sent to a text model provider. These requests contain only the content needed for that feature. They do not contain your Google account identifier, email address, sign-in tokens or payment details. These providers process the content under their own terms and privacy policies, may process it outside your country, and may keep it for their own retention periods. We do not promise zero retention by third parties. Generated results may be non-unique or similar to existing works.

Service providers. Cloudflare (hosting, database and object storage), Apple (App Store purchases and Sign in with Apple), RevenueCat (subscription state), and the AI providers described above. Each provider receives only what it needs to perform its function.

Legal and safety. We may disclose information when required by law, legal process or a binding order, or when necessary to protect the rights, safety or property of our users, the public or us.

Business transfer. If the service or its assets are transferred, merged or reorganized, information may be transferred as part of that transaction, and this policy continues to apply until you are told otherwise.

We never sell personal information, and we do not share it with advertising networks or data brokers.

4. How we use information

We use the information described above only to:

• create, store, play, share and (for Pro) download the songs you ask for;
• verify your identity, link or restore your account, and keep your account, credits and creations secure;
• process purchases, credits, subscriptions and refunds;
• send the notifications you enable and answer your support requests;
• detect abuse, fraud, payment manipulation and prohibited content, and enforce our Terms of Use;
• debug failures, measure reliability and improve existing features;
• comply with legal obligations and respond to lawful requests.

5. Security, retention and deletion

Security. We use encrypted transport, access controls, scoped credentials and private storage for audio objects. No system is perfectly secure, so protect your device and your sign-in accounts, and tell us promptly if you suspect unauthorized access.

Where data is stored. Data is stored on Cloudflare's global network, which may process it outside your country of residence. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

Retention. Free-tier songs remain accessible for 90 days from creation unless you extend access through Pro or the in-app restore option; expired songs are removed from ordinary access and their stored audio is queued for deletion. Account data is kept while your account exists. Operational logs are kept for up to 30 days. Purchase, refund, fraud-prevention and account-deletion records may be kept for as long as accounting, tax, chargeback and legal obligations require. Backup copies rotate out on a fixed schedule.

Deleting your account. In the app, open My Library → Settings → Delete account. This deletes the linked Apple or Google identifier and masked email, invalidates access to the account, deletes your creation records and queues the stored audio for removal. Cleanup can be delayed by network failures and is retried automatically. You can also write to songloom.build@gmail.com to request access, correction, export or deletion; we may need to verify your identity first. Deleting a Songloom account does not cancel an Apple subscription, and does not imply that every backup copy is erased immediately.

6. Your rights, children and international transfers

Your rights. Depending on where you live, you may have the right to access, correct, delete, export or restrict the processing of your personal information, to object to processing, to withdraw consent, and to appeal a decision we make about your account. We respond to verified requests within 30 days.

Region-specific rights. If you are in the EEA, the UK or Switzerland, we rely on contract performance, legitimate interests and consent as our legal bases, and you may complain to your local supervisory authority. If you are a California resident, you have the rights described in the CCPA/CPRA; we do not sell or share personal information for cross-context behavioral advertising. If you are in mainland China, the Personal Information Protection Law applies, and you may contact us to exercise the corresponding rights.

Notifications. We send service and security notices when needed. Product notifications are opt-in and can be turned off in iOS Settings or in the app.

Children. Songloom is not directed to children under 13 (or under 16 in the EEA and the UK). We do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.

7. Changes and contact

We may update this policy when the service, our providers or the law change. We publish the update date at the top of this page, and we notify you in the app before a material change takes effect. Continuing to use Songloom after an update means you accept the revised policy.

Songloom is developed and operated by Wang Dong, an independent developer. For any question about this policy, or to exercise your rights, write to songloom.build@gmail.com. Do not send passwords, verification codes, session tokens or complete payment information by email.

8. Google sign-in, data use and your controls

What we request. Google Sign-In requests only openid and email. We validate the Google ID token on our servers, then store the Google account identifier, a masked email address and the time the account was linked.

Why we use it. To verify your identity, link or restore your Songloom account together with its songs, credits and subscription, display a masked account address, and protect the account from unauthorized access. Google passwords are never provided to Songloom.

What we never do with Google user data. We do not sell it. We do not share it with advertisers, data brokers or information resellers. We do not use it for advertising, ad personalization or retargeting. We do not use it to train, fine-tune, evaluate or otherwise improve any AI or machine-learning model, and we do not send it to our music or text generation providers. We do not use it to create, alter or distribute intimate imagery or any other non-consensual synthetic likeness of a person. We do not allow humans to read it except (a) with your explicit permission for support, (b) where necessary for security or abuse investigation, or (c) where required by law.

Limited Use. Songloom's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the user-facing features described in this policy.

Your controls. You can remove Songloom's access at any time in your Google Account's third-party connections page (myaccount.google.com/connections). Revoking access does not by itself delete your Songloom account, creations or purchases.