What we keep, and why.

Your email address and name, and your account and billing status — your plan, your credits and whether a payment went through.

The songs you make, including your prompts, lyrics, tags and the audio itself, so you can play, download and share them.

If analytics are switched on, a handful of basic usage events — pages visited, songs made or played, checkouts started — so we can see what works and fix what doesn't. When you're signed in, these are linked to your account ID. We skip them entirely if your browser sends Do Not Track. No ads, no ad trackers, and we never sell your data.

A few trusted services do part of the work. Each one only gets what it needs for its job:

• Stripe handles payments. Your card details go straight to Stripe — we never see or store your card number.
• Supabase stores your account, our database and your songs' audio.
• Resend sends transactional emails, like “your song is ready.”
• Cloudflare Turnstile checks that sign-ins come from a person, not a bot.
• PostHog counts basic usage, if analytics are switched on.
• Our AI music engine, run by a third-party provider, receives your prompts, lyrics and tags to generate your songs. It doesn't receive your email or payment details.

A session cookie keeps you signed in. If you arrive through an invite link, a zm_ref cookie remembers who invited you for 30 days, so they get their bonus when you join. If analytics are on, a random ID is kept in your browser's local storage so visits can be told apart.

No advertising cookies, ever.

Your songs are private until you share one. A share link is public: anyone who has it can listen and see the song's title, style tags and lyrics, and it may be passed on. It stays live until you turn sharing off for that song.

We keep your account and songs for as long as you have an account. You can delete any song at any time, and it's removed from our storage (the engine's provider may keep its own copy for a limited time under its own retention rules).

To delete your whole account, email hello@zimplemusic.com from the address you signed up with. We'll erase your profile and songs. Deleted data can linger in backups for a short while before it's overwritten. Billing records are kept for as long as tax and accounting law requires.

You can ask to see the data we hold about you, correct it, delete it, or get a copy to take elsewhere. Email hello@zimplemusic.com and we'll answer within 30 days. Depending on where you live you may have further rights, including complaining to your local data protection authority.

ZimpleMusic isn't for children under 13, and we don't knowingly collect their data. If you think a child has signed up, tell us and we'll delete the account.

If we change this policy in a way that matters, we'll tell you before it applies.

Questions or requests about your data: hello@zimplemusic.com. To report a song that uses your voice, name or work, see takedown & likeness.