SoundScribe — Privacy Policy

1. About This Policy

This policy applies to the SoundScribe mobile application for iOS and Android (version 2.0 and later), published by Appfide Private Limited ("Appfide," "we," "us," or "our"), a company incorporated under the laws of India with its registered office at XXI/152 Panadans, Cochin University Post, Ernakulam – 682022, Kerala, India. Appfide is the controller (and, under India's Digital Personal Data Protection Act, the data fiduciary) for the personal data described here.

It sits alongside our company-wide Privacy Policy, which continues to govern our website and our other apps. Where the two differ, this app-specific policy prevails for SoundScribe. Sections of the company policy that describe user accounts, sign-in, profile data, advertising, analytics and web payment processing do not apply to SoundScribe.

2. In Short

• No sign-up, no password, no name, no email, no phone number. Your account is an anonymous, random identifier tied to your installation of the app.
• What you describe — your prompt, lyrics, section plan and any video you pick — is sent to our AI music provider, a third-party AI audio service, only to create the track you asked for.
• Uploaded videos are deleted as soon as your track is made. Your track is deleted from our servers as soon as your device has saved it, and anything never saved is deleted after 30 days.
• No advertising, no analytics, no crash-reporting SDKs, no advertising identifier, no tracking across other companies' apps or websites, and we never sell your data.
• You can delete your account and everything linked to it from the app, at any time.

SoundScribe collects no personal data beyond what this policy lists.

3. No Name, No Email, No Sign-In

SoundScribe has no sign-up and no login. We never ask for, and never receive, your name, email address, phone number, contacts or social profile, and we do not collect your location.

To stop abuse and to keep your purchased credits safe, the app identifies your installation instead of you. When the app starts, it opens a session with our server using:

• A random installation identifier (a UUID) created on your device and kept in its secure storage (the Keychain on iPhone and iPad, an Android Keystore-encrypted store on Android). Our server links it to a random user identifier of its own. Neither is derived from your name, email, phone number, Apple ID, Google account or device serial number.
• A device attestation token. On iPhone and iPad this uses Apple's App Attest service, and on Android Google Play Integrity, both through Firebase App Check. It lets our server confirm that a request comes from a genuine copy of SoundScribe on a real device.
• Basic technical details: your device's platform (iOS or Android), the app version and your device language, so the app can be shown in your language and we can support older versions.

The server answers with a short-lived session token that expires after 15 minutes of inactivity. With each session we record the IP address and user-agent string your device connected from, to detect and block abuse; session records are deleted about a day after the session expires.

4. Your Prompts, Lyrics and Videos

SoundScribe exists to turn what you describe into music, so this is the part of the app that handles your content. Here is exactly what happens when you create a track:

1. You agree first. The app's welcome screens explain how tracks are made and ask you to agree to this policy and the Terms of Use before you can create anything.
2. You choose what to send. Depending on what you make, that is your description (prompt), the genres and moods you pick, whether it is instrumental, lyrics you write, a section plan, an instruction for editing or extending a track, or — for a video soundtrack — a video you pick from your library together with an optional description and tags. The app only reads the video you select; it does not scan or upload your photo library.
3. It is sent over an encrypted connection to our server. Videos are held there only while your soundtrack is being composed. If you ask to split a track into stems after our copy of it has already been deleted, the app uploads the track from your device for that job.
4. It is processed by our AI music provider, a third-party AI audio service, only to create your track. The provider receives the content described above — your prompt with its genre and mood labels, your lyrics and section plan, your edit instruction, your video with its description and tags, or the track to split into stems — but never your identifiers, your purchases or anything else about you. To let you edit and extend a track later, the provider keeps a copy of the generated track, with nothing that identifies you. The provider may apply its own content filters and may decline a request; if it does, your credits are refunded.
5. Uploaded videos and audio are deleted as soon as the job finishes — whether it succeeds or fails. Anything a failed upload leaves behind is removed within 48 hours.
6. Your track is deleted from our servers as soon as it is saved on your device (when your device confirms it has a complete copy). The app saves tracks automatically whenever it is open. We keep a track only until then, so that a dropped connection or a closed app never costs you a track you paid for.
7. Anything never saved is deleted automatically 30 days after it was created, so please open the app to save your tracks before then. The app tells you how long each unsaved track has left.

Tracks are stored in private cloud storage (Cloudflare R2) that is not publicly accessible; your device downloads them through short-lived signed links. We do not use your prompts, lyrics, videos or tracks to train AI models, we do not sell them, and we do not look at them except where you ask us to investigate a specific problem with a specific track.

Your library lives on your device. Saved tracks stay inside the app. On iPhone and iPad they are included in your device's iCloud or computer backup like other app data; on Android they are excluded from cloud backup. Exporting or sharing a track is up to you.

Content Credentials. Tracks are generated with C2PA Content Credentials, an industry standard that marks them as made with AI. The credentials describe the track, not you.

Demos. The free demo tracks in the app are shared examples that we made once for everyone. Trying a demo sends nothing about you to our AI music provider.

5. Records We Keep About Your Tracks and Credits

So that you can see, edit, extend and re-download your work, and so that we can answer a question about a purchase or a track that went wrong, we keep a record of each track and each creation job. It contains what you asked for — the prompt, genres, moods, lyrics, section plan, edit instruction, and for videos the description, tags, file name, type and size — together with the track's title, length, status, the number of credits charged or refunded, any failure reason, and when each step happened (requested, finished, saved to your device, deleted). It does not contain the audio or the video, which are deleted as described in section 4.

These records are kept while your account exists. Deleting a track in the app deletes its audio from our servers straight away and hides the track; its record is removed when you delete your account.

We also keep a credit ledger — purchases, subscription grants and roll-overs, credits used, failed-job refunds, expired subscription credits and store refunds — so we can show your balance, answer support questions and handle refunds correctly.

6. Notifications

SoundScribe uses Firebase Cloud Messaging (which delivers through Apple's push service on iPhone and iPad) to tell you when a track is ready or has failed. To do this the app registers a push token for your device with our server when it starts; we store it against your user identifier. Notifications are shown only if you allow them, and you can turn them off at any time in your device settings. A notification contains the track's title, which is generated from your prompt. Deleting your account deletes the token.

7. No Ads, No Analytics, No Tracking

• SoundScribe shows no ads and contains no advertising, analytics or crash-reporting SDKs.
• It does not collect the advertising identifier (IDFA on iOS, the Advertising ID on Android). We do not track you across other companies' apps or websites, so the app never asks for tracking permission.
• The only Google services in the app are Firebase App Check (section 3) and Firebase Cloud Messaging (section 6).

Server logs and IP addresses. Like any internet service, our servers and Cloudflare see your device's IP address when the app connects. Besides the session record in section 3, we use it only to deliver the service and to limit abusive request rates. Our request logs record the time, the request path, the result, a request identifier and your random user identifier — never request contents, headers or your IP address — and are kept only as long as we need them to run and troubleshoot the service.

8. Purchases and Subscriptions

Credit packs and SoundScribe subscriptions are sold through the Apple App Store and Google Play. The store processes the payment; we never receive your card details, your store login or the name on your store account. Subscriptions renew automatically until cancelled, and you manage or cancel them in your store account settings. Deleting the app or your SoundScribe account does not cancel a subscription.

When you buy, the app passes your random user identifier to Apple or Google with the purchase (Apple's app account token, Google's obfuscated account ID) so that the purchase is credited to the right account and "Restore" can move your subscription, with its remaining plan credits, to a new device. Our server verifies every purchase directly with Apple or Google and keeps the store, the store's transaction identifier, the product, the price, currency and store country, the dates, the store's signed transaction record, the number of credits granted and how many of them have been used. If a store refunds a purchase, we record the refund and take back the credits it granted, which can leave a negative balance (see the Terms of Use). Accounts with repeated refunds are flagged for review.

If you ask Apple for a refund, Apple may ask us about the purchase. We tell Apple that it was delivered, what share of a credit pack's credits has been used, that the app offers free demos before purchase, and, where credits have been used, that we recommend declining the refund. Apple makes the decision. We never share your prompts, lyrics, videos or tracks for this. Google Play tells us when a purchase is refunded or voided; we do not send Google information about refund requests.

9. Why We Use Your Data (Legal Bases)

• To provide the app you asked for (performance of our contract with you): creating, editing and extending the tracks you request, running your credit balance, subscriptions and purchase restores, delivering tracks to your device, and answering support requests.
• Your consent: sending your content to our AI music partner (agreed to on the welcome screens) and showing push notifications (asked for by your device). You can withdraw consent at any time by deleting your account or not creating anything further; this does not affect processing that happened before.
• Our legitimate interests, balanced against yours: keeping the service secure (device attestation, session records, rate limiting, preventing credit and refund fraud) and keeping it working well. You can object at any time.
• Legal obligations: keeping financial records of purchases and refunds as tax and accounting laws require.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. AI is used only to create the music you asked for.

10. Who Receives Your Data

We share data only with the service providers needed to run the app, each acting on our behalf and only for the purposes above:

• Cloud hosting and storage — DigitalOcean (our servers and database) and Cloudflare (track storage in R2, and network delivery).
• AI music generation — a third-party AI audio service, which receives the content you choose to send (section 4), never your identity or purchase details.
• Payment and subscription processing — Apple (App Store) and Google (Google Play).
• Device attestation — Apple (App Attest) and Google (Play Integrity), through Google Firebase App Check.
• Push messaging — Google Firebase Cloud Messaging, which delivers notifications through Apple's push service on iPhone and iPad.

We may also disclose data where the law requires it, or to protect the rights and safety of our users and others. If Appfide or SoundScribe is ever sold or reorganised, this policy would continue to protect your data.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

11. International Transfers

Appfide is based in India, and our servers and database run in the United States. Our service providers, including our AI music provider, may process data in the United States, the European Union and other countries where they operate. Where the law of your country requires it, we protect these transfers with appropriate safeguards — such as the European Commission's standard contractual clauses (with the UK Addendum for UK data), the standard contractual clauses approved by Brazil's ANPD, and our providers' data processing agreements. Contact us for more information about these safeguards.

12. Data Retention

• Uploaded videos and audio: deleted as soon as the job finishes, whether it succeeds or fails; leftovers from a failed upload within 48 hours.
• Tracks and stems on our servers: deleted as soon as your device confirms it has saved them, or when you delete them; anything not yet deleted is removed 30 days after it was created.
• Copies at our AI music provider: kept by the provider so that tracks can be edited and extended, with nothing that identifies you.
• Track and job records, and the credit ledger: kept while your account exists, and deleted when you delete your account.
• Purchase and refund records: kept after account deletion without any link to an account, for as long as needed to answer refund requests and to meet tax and accounting laws.
• Session records (including IP address and user agent): deleted about a day after the session expires.
• Push tokens and installation records: kept while your account exists; deleted with it.
• Backups: our managed database is backed up by our hosting provider, and backups are kept for a short period (currently up to 7 days), so deleted records leave our backups within about that time.

13. Deleting Your Account

You can delete your SoundScribe account at any time from the app (Settings → Delete account). This permanently deletes every track, stem and upload of yours still in our storage, then removes your user identifier, installation and session records, push tokens, credit balance, credit history, subscription link, and track and job records from our servers, and clears the library saved inside the app on that device.

Deletion is irreversible: unused credits are lost and cannot be restored afterwards. Purchase records held by Apple and Google are kept by them under their own policies. We also keep our own record of each purchase and refund (the store's transaction record, the product, the credits it granted and how many were used). It is not linked to any account and is used only to answer refund requests, prevent refund fraud and meet accounting laws. Remember to cancel any active subscription in your store account.

14. Security

Data is encrypted in transit. Our server checks device attestation when a session opens, sessions are short-lived, tracks are stored in private storage reachable only through short-lived signed links, and access to our systems is restricted to the people who need it. No system is perfectly secure, but we design SoundScribe to hold as little about you as possible, for as short a time as possible. If a breach affecting your data occurs, we will notify the authorities and, where we can reach them, the people affected, as the law requires.

15. Your Rights

Wherever you live, you can delete everything yourself in the app and turn notifications off in your device settings. For anything else, email soundscribe@appfide.com. Because we hold no name or email to look you up by, please include the order or transaction ID from your App Store or Google Play receipt, or describe a track you made and when, so we can find your records. We will not ask for more information than we need to verify your request. We respond within 30 days, or sooner where the law requires it, and we will not treat you differently for exercising your rights.

European Economic Area, United Kingdom and Switzerland

Under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection you have the right to access your personal data, to correct it, to have it erased, to restrict its processing, to data portability, to object to processing based on our legitimate interests, and to withdraw consent at any time. You may also complain to your local data protection authority — in the UK, the Information Commissioner's Office.

California (CCPA/CPRA) and other US states

In the last 12 months we have collected these categories of personal information, for the business purposes described above: identifiers (random user and installation identifiers, push token, IP address); commercial information (purchase and refund records); audio and visual information (videos you choose to score and tracks made for you, deleted as described in section 4); and user-generated content (prompts, lyrics and plans you write). We disclose them only to the service providers in section 10. We do not sell or share personal information, and we do not use or disclose sensitive personal information for any purpose that would give you a right to limit it. You have the right to know what we collect, to access, correct and delete it, and not to be discriminated against for using these rights. You may use an authorised agent; we may ask the agent for proof of authority.

India (Digital Personal Data Protection Act, 2023)

You have the right to a summary of your personal data and of how it is processed and with whom it is shared, to correct, complete, update and erase it, to withdraw consent as easily as you gave it, to nominate someone to exercise your rights in the event of your death or incapacity, and to grievance redressal. Please raise any grievance with us first at soundscribe@appfide.com; if you are not satisfied with our response, you may complain to the Data Protection Board of India.

Brazil (LGPD)

You have the right to confirmation that we process your data, to access it, to correct incomplete, inaccurate or outdated data, to anonymisation, blocking or deletion of unnecessary or excessive data, to portability, to deletion of data processed with your consent, to information about the entities we share it with and about the possibility of refusing consent and its consequences, and to revoke consent. You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

16. Children

SoundScribe is not directed to children. It is not meant for anyone under 13, and we do not knowingly collect personal data from children under 13. If you are under 18, or under the age at which you can consent to data processing where you live, please use SoundScribe only with the consent of a parent or guardian. If you believe a child has used the app without that consent, contact soundscribe@appfide.com and we will delete their data promptly.

17. Changes

We may update this policy from time to time. Material changes will be posted here with a revised "last updated" date and, where appropriate, noted in the app. If a change affects how your content is processed, the app will ask for your agreement again.

18. Contact

Privacy enquiries, grievances and app support: soundscribe@appfide.com
Appfide Private Limited, XXI/152 Panadans, Cochin University Post, Ernakulam – 682022, Kerala, India.

See also the SoundScribe app page and our Terms of Use.