Privacy Policy
1. Data we collect
When you create an account with email and password, we collect your email address and a salted hash of your password — we never store plaintext passwords. If you sign in with Google, we receive your email address, name and profile picture from Google Sign-In; we never see your Google password. If you enable two-factor authentication, we store the secret required to verify your 6-digit codes. We collect usage data (number of exports, stem jobs, credits, login timestamps) to enforce plan limits and improve the service.
2. Audio processing
Mastering in Quantara Studio runs entirely in your browser using the Web Audio API. Your audio files are not transmitted to our servers for mastering — the file is decoded and processed on your own device, and the export is written locally. We do not receive, store or have access to the audio you master.
3. Stem separation
Stem separation is not currently available. If we enable it, it will require server-side processing: the audio file would be temporarily uploaded, processed, and the result made available for download. We will update this policy before that happens, and the feature will be clearly marked in the interface.
4. Cookies and local storage
We use a single strictly necessary session cookie (qm_session, httpOnly, Secure, expires after 7 days) to keep you signed in. It cannot be read by JavaScript and is not used for tracking, which is why no cookie consent banner is required for it. Browser localStorage stores non-sensitive preferences and a cached copy of your profile for display. We do not use third-party tracking or advertising cookies. Our pages load no third-party resources — fonts are self-hosted on our own domain, so visiting our pages sends no request to Google or any other third party.
5. Security processing
To protect accounts we log authentication events (login attempts, password changes, 2FA changes) together with the IP address they came from, apply rate limiting, and receive browser security (CSP) violation reports. We process this data on the basis of our legitimate interest in keeping the service secure, and retain it only as long as needed for that purpose.
Where an IP address is new to us, we may send it to a third-party network-reputation service to find out its country and whether it belongs to a data centre, a VPN or a residential connection. We store the answer — country, network type, network operator and a proxy flag — against that IP address so we do not have to ask again. Only the IP address is sent; no account details, no email address, nothing about what you were doing. This is a transfer to a processor that may be located outside the EEA.
These signals help us spot automated sign-up abuse. Nothing is blocked automatically on the basis of them. They are shown to an administrator alongside other information, and any decision about an account is taken by a person. We keep this record for as long as the account it relates to exists, and delete it when the account is deleted.
If you want to know what we hold about a particular IP address, or object to this processing, write to us at the address in section 11.
6. Data sharing
We do not sell your personal data. Payments are processed by Stripe: when you check out, we share only what is needed to complete the purchase (your email and the selected plan). Card numbers are entered directly on Stripe's payment page — we never see or store them. See Stripe's privacy policy for how they handle payment data.
7. Data deletion
You can delete your account at any time from Account settings. Account deletion permanently removes all your data from our servers within 30 days.
8. Contact
For privacy inquiries: support@quantaramusic.com