Privacy Policy

Streamood, operated by Streamood Technologies L.L.C S.O.C, is an AI music generation service for businesses. We provide background music streams for cafés, gyms, retail spaces, and similar venues. This policy explains what data we collect and how we use it.

When you register and use Streamood, we store:

• Account info — email, name, company, industry, interface language, password (hashed with bcrypt, never stored in plain text), whether two-factor authentication is on, an avatar image if you upload one, and the country you signed up and last signed in from (see below)
• Generation activity — the prompts you enter and the audio tracks generated from them, the part of the day at your venue when each was requested (worked out from your device’s time zone), plus per-track flags like “saved to library” and “liked”
• Listening totals and playback history — for each account, how many tracks it played and for how long, per day, and a log of which track played and when. We keep the playback history for 3 years so that we can provide a playback statement on request, for example for a music collecting society. Play and skip counts per track are also kept without any link to who played it
• Subscription state — plan, billing period, trial and renewal dates, the amount charged and the channel you paid through, together with the seller’s record of the subscription. For purchases on streamood.app that record can include the name, email and billing details you entered at checkout
• No payment details. Card numbers and payment credentials never reach our servers. Every purchase is processed by the seller for that channel — Apple for the App Store, Google for Google Play, and our payment provider, Polar, for purchases on streamood.app. Each of them is the merchant of record for its own channel and handles applicable taxes. We never receive the card or other instrument you paid with
• Where you came from — the page of our website you first landed on, the domain of the site that referred you and when you first visited; if you came through an ad or a tagged link, also its campaign tags (utm parameters, Google click ID). In the Android app, the same tags passed on by Google Play at install. On the website this is kept in your browser’s local storage and sent to us when you sign up. We use it only to see which campaigns bring customers. Clicks on our app link (streamood.app/get) are counted by platform, campaign tags and referring domain only — no IP address, device identifier or click ID is stored for them
• Venues — the email addresses (and names, if you give them) of the venues you invite. A venue in Streamood is a separate account with its own sign-in; we do not keep venue records such as street addresses
• Devices — if you allow notifications in the iOS or Android app, a push token for that device, used only to deliver our notifications
• Feedback — when you send feedback or a rating from the app, the rating and text, your email, platform, app version, language and plan at that moment
• Security codes — one-time codes for email verification, two-factor sign-in and password reset, kept until they are used or expire

We use IP addresses for security only: to rate-limit sign-in and other requests and, on the website, to decide when to show a Cloudflare Turnstile check after repeated failed sign-ins or sign-ups. These counters are held in server memory for up to an hour and are not written to our database. The only IP addresses we hold are those stored with entries to our former early-access waitlist, together with the browser’s user-agent; that form is no longer available, and no new entries are collected. When you sign up or sign in, we record the country your connection comes from, as determined by our network provider (Cloudflare); the IP address itself is not stored. We use it only to understand where our customers are. We do not use IPs for behavioural profiling or advertising, and we don’t sell your data to anyone.

Note that the audio tracks generated through the service stay in Streamood’s catalogue, and the prompts that produced them are used under the licence you give us in Terms §7 (see also Terms §5). Both remain on our servers after you delete your account, in anonymised form — see “How long we keep data” below.

On the website we use a small number of essential cookies and local-storage entries in your browser:

• Keeping you signed in — so you don’t have to log in every time you open the app or close the tab.
• Remembering your choices — your cookie-banner choice, theme and interface language, and which notices you have already seen.
• Where you came from — the landing page, referring domain and campaign tags described above.

These are required for the service to work, so they’re always on. We do not use them to track you across other websites.

Advertising and analytics on the website. We load Google Ads conversion tracking, to measure how our marketing performs, and Google Analytics, to see how the site and web app are used. Both load on every visit but start in a “denied” consent state: in that state they store nothing on your device and set no identifiers. They store cookies only if you choose “Accept all” in the cookie banner. Choosing “Essential only” (or never deciding) keeps them in the denied state. If you choose “Accept all”, our servers also report subscription milestones — trial started, first payment, renewal, cancellation, refund — to Google Analytics under the same anonymous browser identifier. No name, email or account ID is sent.

In the iOS and Android apps there are no cookies. Sign-in tokens are held in the platform’s secure storage — Keychain on iOS, encrypted preferences on Android — and your library is cached on the device so it opens without waiting. Both are cleared when you sign out or remove the app.

The apps include Google Firebase components: Analytics (which screens are opened and which actions are taken, with the app version and basic device information), Crashlytics (crash reports), Performance Monitoring (start-up, screen and network timings) and Cloud Messaging (delivery of push notifications). This data is collected in the released apps without your name, email or Streamood account ID, and without the device’s advertising identifier: on iOS the analytics component is built without access to it, and on Android its collection is switched off and the permission removed. The apps show no ads and contain no advertising SDKs. For subscriptions bought in the apps, our servers report the same subscription milestones to Google Analytics under a pseudonymous key, without your name, email or account ID.

Streamood relies on the following providers. Each receives only what its task requires and is bound by its own data processing terms and security standards:

• Railway — application servers and the main database
• Cloudflare — website delivery and network protection, Turnstile checks, and storage of audio files and database backups
• Resend — sending email: sign-in codes, invitations and account notices
• Hugging Face and RunPod — running the AI models that read and expand prompts, title tracks and generate music. They receive the text of a prompt, not your name, email or account
• Google — Firebase in the apps (analytics, crash reports, performance, push notifications), and Google Ads and Google Analytics on the website, subject to your cookie choice
• Apple, Google and Polar (Polar Software, Inc.) — sellers of record for purchases in the App Store, on Google Play and on streamood.app respectively. They process your payment under their own privacy policies

Some providers may process data on servers located outside the European Economic Area, including the United States. Where applicable, such transfers are covered by Standard Contractual Clauses (SCCs) under Article 46 GDPR and by each provider’s own data processing terms.

Our lawful bases under Article 6 GDPR are:

• Contract (Art. 6(1)(b)) — account, music generation, library, subscription state, venues, push notifications about your account and plan. We can’t deliver the service without this data.
• Legitimate interest (Art. 6(1)(f)) — security (IP-based rate limits and sign-in checks), the sign-up and sign-in country, operational logs, crash reports, performance measurements and usage statistics in the apps, subscription milestones reported from our servers for app subscriptions, playback history kept to provide playback statements, campaign tags, the source of entries to our former waitlist, feedback, and retaining generated tracks and prompts in anonymised form after account deletion (see Terms §5 and §7).
• Consent (Art. 6(1)(a)) — advertising conversion tracking and Google Analytics on the website, including subscription milestones reported from our servers for website subscriptions, via the cookie banner. You can withdraw at any time from the controls below.
• Legal obligation (Art. 6(1)(c)) — responding to lawful requests and keeping records the law requires of us. Tax records for purchases are kept by the seller of record for each channel.

• Account data (email, name, company, avatar, subscription state, venues, listening totals, campaign tags, push tokens) is kept while your account is active. Playback history is kept for 3 years and then deleted automatically.
• When you delete your account, the personal record above is removed immediately, together with sessions, one-time codes, likes, subscription records, push tokens, listening totals, playback history, campaign tags and the venue links you owned or were part of. Venues you added keep their own accounts, but without your plan. Audio tracks generated through the service, the prompts that produced them, and per-track flags like “saved to library” are retained on our servers for ongoing service operation, similarity search and model improvement (Terms §5 and §7) — but with all personal identifiers stripped, so they are no longer linked to you.
• Feedback you sent stays after account deletion, together with the email it was sent from, so that we can still reply to it; it is no longer linked to your account.
• Routine database backups are kept for up to 30 days and then overwritten, so a deleted account may persist in backup snapshots for that period before rolling off naturally.
• Security counters based on IP addresses are held in memory for up to an hour. Error and operational logs are kept for up to 90 days for incident investigation.
• Analytics, crash and performance data held by Google Firebase, and website data held by Google Ads and Google Analytics, are kept under the retention settings of those Google services.
• Entries to our former waitlist are kept until you ask us to remove them, or until the early-access period you signed up for ends.

You can at any time:

• Request a copy of the data we hold about you
• Update your account details from the Profile page
• Delete your account from Profile → Privacy & Data — this removes your account record and personal flags immediately. Generated audio tracks and the prompts you submitted remain on our servers (see Terms §5 and §7), but are anonymised — no longer linked to you. Backups are overwritten within 30 days. Deleting your account stops renewal of a subscription bought on streamood.app; a subscription bought in the App Store or Google Play keeps renewing until you cancel it in your Apple or Google account
• Object to processing based on legitimate interest, or withdraw cookie consent (use the controls below)

For data requests or account deletion, contact hello@streamood.app. We aim to respond within 30 days.

If you live in the European Economic Area or the UK, you also have the right to lodge a complaint with your national data protection authority (for example, the ICO in the UK, the CNIL in France, or the relevant supervisory authority in your country).

This Privacy Policy is written in English, and the English version is the only authoritative one. The interface, in-app help and our blog are available in several languages for convenience; any translation of this policy is provided for information only, and in the event of any discrepancy the English version prevails.

You can change or withdraw your cookie choice at any time: open the Privacy Policy from the footer of streamood.app — it opens with these controls — or clear this site’s stored data in your browser, and the cookie banner will ask again.

If we change how we handle data, we’ll update this page and bump the “Last updated” date at the top. If a change materially affects how your personal data is used, we’ll tell you in advance by email or in the app; where a change relies on your consent, we’ll ask for it before it takes effect.

The data controller is Streamood Technologies L.L.C S.O.C, licence no. 1632361, registered in Dubai, United Arab Emirates. Questions or concerns? Email hello@streamood.app.