Privacy

If you only listen

You need no account to listen, and we keep no profile of you. When a track plays we count the play, and to stop the same person from counting a hundred times we keep a short-lived, one-way hash of your connection for that count. It cannot be turned back into you, and it is gone within an hour.

There are no ads on the site. The service runs behind Cloudflare, which sees your connection the way any network does in order to deliver the pages and protect the site from abuse. Its bot check leaves a cookie called cf_clearance, which records that your browser passed the check. We do measure our own adverts, with a script from Meta: the next section says what it keeps and sends.

Measuring our adverts

We advertise Musical Links with Meta, the company behind Facebook and Instagram. To see which adverts bring people here, every page loads Meta's pixel, a small script from Meta, except the page a feedback link opens. It runs whether you have an account or not.

The pixel keeps a random identifier in a cookie called _fbp, so Meta can recognise your browser when you come back. It lasts 90 days from your latest visit. If you arrived by clicking one of our adverts, the pixel also keeps that click's code, in a cookie called _fbc and in your browser's local storage. It also notes in local storage where you last arrived from.

On each page, the pixel tells Meta the page's address, title and description, your screen size and time zone, and that identifier. Like any request to another company's server, this also gives Meta your IP address and details about your browser. When you press a button, it tells Meta which one. On the Share your music page it also reports the steps of signing up, and the page you see after creating an account or uploading your first track reports that too.

If you type your email address or your name into a form here, such as the sign-in form or the contact form, the pixel turns them into a one-way hash in your browser and sends Meta the hash when you press the button. Meta uses it to match your visit to a Facebook or Instagram account, if you have one. What Google sends us when you use Continue with Google is not put into any form here, so the pixel does not see it.

Meta uses what the pixel sends to measure our adverts, and under its own privacy policy it may use it for its own purposes too. If your browser sends Global Privacy Control, the site stops reporting the sign-up steps, but the pixel still loads and does everything else described here. Blocking Meta's cookies or scripts in your browser, or with a content blocker, stops all of it, and listening and signing up work the same without it.

If you have an account

We keep your email address, the artist name you chose, the music and artwork you upload, the details you type in about them, and the play counts of your tracks. Your email address is for signing you in, for the few messages an account needs, such as a sign-in link or a note that a sign-in method was added, and for tips and reminders about using Musical Links, which you can turn off at any time with the link at the bottom of each one. If you ask someone for feedback on a song, we also send you an email when someone answers a feedback link, which you can turn off on your account page. We do not send newsletters, and we do not sell your address. We share it with Brevo, the email service in France that delivers our messages, and Brevo uses it only to deliver them. If you type it into a form here, Meta's pixel also sends Meta a one-way hash of it, as Measuring our adverts explains.

A sign-in leaves a session cookie in your browser so you stay signed in; the cookie does nothing else. The stop link at the bottom of a tips email leaves a cookie for 15 minutes, so the page it opens can turn tips off without keeping the link's code in its address. That cookie does nothing else either. If you set a password, we keep only a hash of it, which is the standard way and means we cannot read it back. We also note when you last signed in and which way you used (email link, Google, passkey or password), so we can help if you have trouble getting in. We keep only the most recent one. In your studio we also note whether you hid the Get started card, and when you first copied or shared your artist link from it, so the card knows which steps you have done.

Making a cover with AI. If you press "Make a cover with AI" on one of your songs, its title, genres, mood, About text, lyrics and your hint are sent to Anthropic, whose Claude model writes a short description of a picture. Anthropic's terms say it doesn't train its models on this by default, and deletes it within 30 days unless it is flagged under its usage policy. That description, not your lyrics, is then sent to Kie.ai, which runs the image model that paints the picture. Kie.ai says it keeps the generated file for 14 days and its request logs for two months; its terms don't say whether it uses descriptions for training. Nothing is sent unless you press the button. We keep the picture, its description, your hint and the style you chose on our server. A picture you don't use is deleted after 14 days. A picture appears on your song only if you choose "Use this", and its Artwork credit is then filled in as "Made with AI", which you can change. If you put words on the picture, we keep the words and a copy of the picture without them, so you can change or remove them.

Polish and genre analysis. Both run on our own server, and neither sends your audio anywhere. Polish makes a cleaned, levelled copy of a song when you ask for it and keeps your original so you can go back. When you upload a song without choosing its genres — and when you ask the studio to suggest them — a classifier listens to the file and stores its genre scores, its key, tempo and loudness, and a small acoustic fingerprint of the sound. The fingerprint is what “Sounds like this” uses to find close matches, and the key and tempo become the mood word the AI cover tool is given. All of it is deleted with the song.

Your public profile shows your artist name and the music you have marked public. Unlisted and private tracks are shown only to the people you give the link to, or to you alone.

If a musician asks you for feedback

A musician can send you a private link to one of their recordings and ask what you think. You need no account. When you send your feedback we keep your name, the email address you choose to give, what you wrote, the notes you pinned to moments in the recording, and when you sent it. All of it is tied to that one link and shown to only the musician who made the link. It stays until they delete it, or delete the song.

Opening the link leaves a cookie for up to seven days, so the page can recognise the link while you listen and write without keeping its code in the address. The cookie, called musical_feedback_link, does nothing else. While you write, your draft is kept in your own browser, not on our server, until you send it or clear it.

Your feedback is not shown on the song's public page, in search, or anywhere else. If you gave an email address, the musician can use it to reply to you; we do not use it for anything of our own. Listening through a feedback link is not counted as a play.

Signing in with Google

If you choose Continue with Google, Google sends us basic information from your Google account: your name, your email address, an identifier for your Google account, and sometimes your profile picture and language. We keep only your email address and the account identifier. Everything else is discarded as soon as you are signed in.

We use this Google user data to sign you in and keep your account yours, and the email address is also how we reach you about your account, including tips and reminders you can turn off. We never sell it, never share it except with the email service that delivers our messages, never use it for advertising, and never use it to train AI. We cannot see your Google password, mail, contacts, files or anything else in your Google account.

The identifier stays with your account until you remove the connection on your account page, or until your account is deleted. Either removes it from our records. Google keeps its own list of sites you have signed in to, in your Google account's security settings.

Getting your things back, and deleting them

Your account page has a one-click export of everything you uploaded, with its details, in open formats. It is yours whenever you want it.

Ask us to delete your account and we will, along with everything you uploaded and the record of your email address. Backups that still hold a copy are overwritten within thirty days. Use the contact page; there is no self-service button for it yet.

Questions

Anything about your data, from a question to a request to delete it, goes through the contact page. A person reads it. If this page changes in a way that matters, the date at the top changes with it.