Privacy Policy

1. Data we collect

When you create an account with email and password, we collect your email address and a salted hash of your password — we never store plaintext passwords. If you sign in with Google, we receive your email address, name and profile picture from Google Sign-In; we never see your Google password. If you enable two-factor authentication, we store the secret required to verify your 6-digit codes. We collect usage data (number of exports, stem jobs, credits, login timestamps) to enforce plan limits and improve the service.

2. Audio processing

Mastering in Quantara Studio runs entirely in your browser using the Web Audio API. Your audio files are not transmitted to our servers during mastering. Audio is only uploaded to our servers if you explicitly save a track to your Cloud Library.

3. Stem separation

Stem separation (Demucs) requires server-side processing. When you submit a stem job, the audio file is temporarily uploaded to our servers, processed, and the result is made available for download. Files are stored for the duration of your subscription and deleted upon account deletion.

4. Cookies and local storage

We use a single strictly necessary session cookie (qm_session, httpOnly, Secure, expires after 7 days) to keep you signed in. It cannot be read by JavaScript and is not used for tracking, which is why no cookie consent banner is required for it. Browser localStorage stores non-sensitive preferences and a cached copy of your profile for display. We do not use third-party tracking or advertising cookies. Our pages load no third-party resources — fonts are self-hosted on our own domain, so visiting our pages sends no request to Google or any other third party.

5. Security processing

To protect accounts we log authentication events (login attempts, password changes, 2FA changes) together with the IP address they came from, apply rate limiting, and receive browser security (CSP) violation reports. We process this data on the basis of our legitimate interest in keeping the service secure, and retain it only as long as needed for that purpose.

6. Data sharing

We do not sell your personal data. Payments are processed by Stripe: when you check out, we share only what is needed to complete the purchase (your email and the selected plan). Card numbers are entered directly on Stripe's payment page — we never see or store them. See Stripe's privacy policy for how they handle payment data.

7. Data deletion

You can delete your account at any time from Account settings. Account deletion permanently removes all your data from our servers within 30 days.

8. Contact

For privacy inquiries: support@quantaramusic.com