Privacy policy

1. Who is responsible

52commerce, Kronenburgsingel 525, unit 3.05, 6831 GM Arnhem, the Netherlands, registered under Chamber of Commerce (KvK) number 83007229, is responsible for the personal data described here. You can reach us at [email protected].

This policy covers the Tunaki apps, this website, and the song, artist and playlist pages on it.

2. The short version

• We collect what we need to run Tunaki: your account, what you make, what you listen to and what you buy.
• Your song descriptions and lyrics go to Google, our AI supplier, to generate the music. We ask your permission first.
• We do not sell your data, and we do not share it with anyone for advertising.
• This website has no advertising trackers and no analytics from other companies.
• You can download your data and delete your account in the app.

3. What we collect

Account. Your email address, or the identifier and email address that Apple or Google gives us when you sign in with them. Also your language and country setting, and the moment you accepted the terms.

Age. We ask for your date of birth when you create an account. We use it once, to check that you are 18 or older, and we keep only the fact that you passed the check and when. We do not store your date of birth. If the check fails, we keep a marker for 30 days, linked to a scrambled device code, so that the question cannot simply be answered again. That marker contains no name and no date of birth.

Profile. Your artist name, username, bio and profile picture. These are public.

What you make. Your song descriptions, your lyrics, titles, the choices you make (genre, mood, type of vocal, language), the songs and covers that result, and whether a song is private, shared by link or public. For each song we keep a technical record: which model made it, when, and whether it succeeded.

Proof of Creation. For each finished song we keep a signed record with a digital fingerprint of the audio file, your artist name, the AI supplier and model, and the time of generation. The record has a verification page that anyone with its link can open.

This certificate documents a recorded AI music generation event. It does not establish copyright ownership or guarantee exclusive intellectual property rights.

What you do. The songs you play and for how long, your likes, follows, playlists, shares, blocks and reports. We also record basic events in the app, such as starting a song or opening the screen where you make one, to understand how Tunaki is used. We store these ourselves. They do not go to an analytics company.

Device. A device code that the app creates, which we store only in scrambled form (as a hash), the platform you use (iOS, Android or web), and a notification token if you allow notifications.

IP address. Our servers see your IP address when you connect. We store it only as a hash, a scrambled form that we cannot turn back into the address. We use it to count plays fairly and to detect abuse.

Purchases. Which pack or plan you bought, when, the price and currency, and the status of your subscription. The payment itself is handled by the Apple App Store or Google Play. We never see your card or bank details.

Messages. What you send us when you contact support or file a report or a rights complaint, including your name and email address if you give them.

Listening without an account. If you play a song on a song, artist or playlist page without an account, the player keeps a random code in the storage of your browser. Together with the scrambled IP address we use it to count plays and to stop one play from being counted many times. If you arrived through a shared link, we record that the link was opened and whether the song was played.

Ad measurement. If you installed the iOS app after tapping an ad in the App Store, the app can pass us a token from Apple that tells us which campaign the install came from. It does not tell us who you are.

4. Why we use it

The law asks us to name a legal basis for each use. These are ours:

• To provide Tunaki (our contract with you): your account, making and storing songs, playing music, your library, credits and purchases, support, and service messages such as sign-in codes.
• To publish what you choose to publish (our contract with you): your profile and your public songs are visible to everyone, including people without an account and search engines.
• To send your description and lyrics to the AI supplier (your consent): we ask in the app before your first song. You can withdraw your consent in the settings. After that you can still listen, but you can no longer make songs.
• To recommend music and build charts (our legitimate interest in a useful service): we use plays, likes, follows and the genres you pick. You can clear your listening history in the app.
• To keep Tunaki safe and fair (our legitimate interest, and our legal duties as an online platform): filters, reports, moderation records, detecting fraud and abuse, counting plays fairly, and the age check.
• To understand and improve the service (our legitimate interest): our own usage statistics.
• To measure our own App Store ads (our legitimate interest): the campaign token described above.
• To send notifications (your consent): you switch these on or off in your device settings.
• To meet legal duties (legal obligation): bookkeeping and tax records, and answering lawful requests from authorities.

We do not build advertising profiles. Our filters can block a request automatically, and several reports can hide a song automatically until a person has looked at it. The Terms of use explain how you can object to such a decision.

5. Who receives data

We share personal data only with the parties below, and only for the purpose stated.

• Google, our AI supplier. Receives the description and the lyrics of each song you ask for, together with your musical choices, to generate the music. We do not send your name, your email address or your account identifier along. So do not put personal details in a description or in lyrics unless you want them there. Google processes this on our behalf under a data processing agreement, does not use it to improve its own products, and keeps logs for a limited time to detect abuse (55 days at the time of writing). In some cases the request reaches the model through a technical provider that works on our instructions.
• Apple and Google, as app stores, and RevenueCat. Purchases are paid through the Apple App Store or Google Play. RevenueCat is a service that tells us that a purchase or renewal took place. It receives an account identifier and the purchase details.
• Apple and Google, for signing in. If you sign in with Apple or Google, that company confirms your identity to us.
• Hosting and delivery providers. Our servers, our database, our file storage and our content delivery network are run by providers that process data on our instructions. Audio files, covers and this website are delivered through Cloudflare.
• Our email provider. Sends sign-in codes and service messages to your email address.
• Notification services. If you allow notifications, they are delivered through the notification services of Apple and Google.
• The other side of a complaint. If someone files a rights complaint about your song, we pass the content of the complaint on to you, and your response to them, so that each side can react. See the Copyright and complaints policy.
• Authorities. We share data when the law requires it, and we report suspected serious crimes that threaten someone's life or safety.
• A successor. If Tunaki is taken over by another company, your data moves with the service, under this policy.

Other users and the public see what you publish: your artist name and profile, your public songs with their titles and lyrics, your public playlists, and the verification page of a Proof of Creation. They never see your email address.

6. Transfers outside Europe

Some of these parties are based in the United States, or process data there and in other countries. This applies to Google, Apple, RevenueCat and Cloudflare. Where personal data leaves the European Economic Area, we rely on a decision of the European Commission that the destination offers adequate protection, such as the EU-US Data Privacy Framework for companies certified under it, or on the standard contractual clauses approved by the Commission. You can ask us for a copy of the safeguards that apply.

7. How long we keep it

• Account and profile: until you delete your account.
• Songs, descriptions and lyrics: until you delete the song or your account. When you delete your account, your descriptions and lyrics are erased straight away.
• Files of deleted songs: audio and covers are removed from storage 7 days after deletion. This short period lets support undo a mistake.
• A deleted account: the empty record that remains is removed after 30 days.
• Listening history: after 365 days a play is disconnected from your account, your device code and your scrambled IP address. After that it only counts as a number.
• Usage statistics from the app: 400 days.
• Records of opened share links: 180 days.
• Sign-in codes: 2 days.
• The marker of a failed age check: 30 days.
• Purchases and credit history: these are bookkeeping records and are kept longer. They stay after you delete your account, without your name or email address, for as long as tax and accounting law requires. In the Netherlands that is seven years.
• Reports, complaints and moderation decisions: for as long as we need them to handle the case, to apply our policy on repeat infringers and to be able to show how we acted.
• Messages to support: for as long as we need them to answer you and to follow up on your question.
• Proof of Creation records: for as long as the song exists on Tunaki. When you delete the song or your account, the record no longer shows your artist name.

8. Your rights

• See and download your data. In the app, open Settings and choose Download my data. You get a file with your account, profile, songs, descriptions, lyrics, playlists, likes, follows, credit history, purchases and listening history.
• Delete your data. You can delete a song, clear your listening history, or delete your whole account in the app. The page Delete your account explains how, also without the app.
• Correct your data. You can change your profile in the app. For anything else, write to us.
• Object or restrict. You can object to uses that rest on our legitimate interest, and you can ask us to limit what we do with your data while a question is being sorted out.
• Withdraw consent. You can withdraw your consent for the AI supplier in the app settings and for notifications in your device settings.

Write to [email protected] to use any of these rights. We answer within one month, and it costs nothing. To protect your account we may ask you to confirm the request with a code that we send to the email address of the account.

You also have the right to complain to the data protection authority of the country where you live. In the Netherlands that is the Autoriteit Persoonsgegevens.

9. Cookies, trackers and fonts

This website does not set cookies. It has no advertising trackers and no analytics scripts from other companies.

The player on the home page fetches one song from our own servers and plays it. It stores nothing in your browser. The players on song, artist and playlist pages keep the random code described in section 3.

The website loads its fonts from Google Fonts. Your browser connects to Google to fetch them, and Google sees your IP address when it does.

10. Age

Tunaki is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If you believe that someone under 18 has an account, tell us. We will close the account and delete the data.

11. Security

We use encrypted connections, we store device codes and IP addresses only in scrambled form, and we limit who on our team can see personal data. No system is perfectly secure. If a data breach puts you at risk, we tell you and the authority as the law requires.

12. Changes

When we change this policy we change the date at the top. We announce important changes in the app or by email before they apply.

13. Contact

52commerce
Kronenburgsingel 525, unit 3.05, 6831 GM Arnhem, the Netherlands
Chamber of Commerce (KvK) number 83007229
Email: [email protected]