Privacy Policy
1. Data we collect
When you create an account with email and password, we collect your email address and a salted hash of your password — we never store plaintext passwords. If you sign in with Google, we receive your email address, name and profile picture from Google Sign-In; we never see your Google password. If you enable two-factor authentication, we store the secret required to verify your 6-digit codes. We collect usage data (number of exports, stem jobs, credits, login timestamps) to enforce plan limits and improve the service.
Exports on the free plan carry a watermark that includes a unique export code. We keep that code in your account’s export record, so that a file found elsewhere can be matched to the export that produced it. The record is deleted together with your account (section 7).
2. Audio processing
Mastering in Quantara Studio runs entirely in your browser, using Quantara Music’s own engine. Your audio files are not transmitted to our servers for mastering — the file is decoded and processed on your own device, and the export is written locally. We do not receive, store or have access to the audio you master.
3. Stem separation
Stem separation is not currently available. If we enable it, it will require server-side processing: the audio file would be temporarily uploaded, processed, and the result made available for download. We will update this policy before that happens, and the feature will be clearly marked in the interface.
4. Cookies and local storage
We use a single strictly necessary session cookie (qm_session, httpOnly, Secure, expires after 7 days) to keep you signed in. It cannot be read by JavaScript and is not used for tracking, which is why no cookie consent banner is required for it. Browser localStorage stores non-sensitive preferences and a cached copy of your profile for display. We do not use third-party tracking or advertising cookies. Our pages load no third-party resources — fonts are self-hosted on our own domain, so visiting our pages sends no request to Google or any other third party.
5. Security processing
To protect accounts we log authentication events (login attempts, password changes, 2FA changes) together with the IP address they came from, apply rate limiting, and receive browser security (CSP) violation reports. We process this data on the basis of our legitimate interest in keeping the service secure, and retain it only as long as needed for that purpose.
Where an IP address is new to us, we may send it to a third-party network-reputation service to find out its country and whether it belongs to a data centre, a VPN or a residential connection. We store the answer — country, network type, network operator and a proxy flag — against that IP address so we do not have to ask again. Only the IP address is sent; no account details, no email address, nothing about what you were doing. This is a transfer to a processor that may be located outside the EEA.
These signals help us spot automated sign-up abuse. Nothing is blocked automatically on the basis of them. They are shown to an administrator alongside other information, and any decision about an account is taken by a person. We keep this record only while an account that used that IP address exists, and delete it when the last such account is deleted (at the latest within a day).
If you want to know what we hold about a particular IP address, or object to this processing, write to us at the address in section 8.
6. Data sharing
We do not sell your personal data. Payments are processed by Stripe: when you check out, we share only what is needed to complete the purchase (your email and the selected plan). Card numbers are entered directly on Stripe's payment page — we never see or store them. See Stripe's privacy policy for how they handle payment data.
7. Deleting your account
You can delete your account at any time from Account settings in the studio. If you have a subscription, cancel it first from Account → Manage subscription; the account can be deleted once the subscription has ended.
Deletion takes effect immediately. We delete your profile (email address, name, password hash, profile picture, two-factor secret), your saved files, your API keys, your credits — including purchased credits you have not used — your usage and credit history, the record of newsletters sent to you, your activity log, and the record of people who joined through your referral link.
What we keep: product feedback you sent, without your email address or any link to your account; referral records, if you joined through a referral link, without your IP address; and payment records (date, amount, product and the Stripe customer reference) for as long as accounting and tax law requires. Stripe keeps its own records under its privacy policy. Entries an administrator made about your account stay in the administration log with your email address removed.
Backup copies of the database made before you deleted your account may still contain your data until those copies are themselves deleted; we use backups only to restore the service after a failure.
8. Contact
For privacy inquiries: support@quantaramusic.com