Privacy Policy

• Account data from your identity provider when you sign in (Google or Apple): email address, name and profile picture.
• Content you create: the prompts you submit and the MIDI clips Compoxer generates from them.
• Operational logs: IP address, request paths and error codes, kept for security and debugging.

We do not collect microphone audio, location, contacts or any sensitive personal information.

Strictly to operate the service: authenticate you, generate and store your compositions, prevent abuse, and reply to support requests. We do not run advertising, do not profile you, and do not use your prompts or MIDI to train external AI models without your explicit consent.

Our legal basis under GDPR/UK GDPR is the performance of the contract you enter into by using Compoxer, and our legitimate interest in keeping the service secure.

We do not sell, rent or trade your personal information. We disclose data only when strictly required to operate the service or to comply with a binding legal request.

Compoxer is hosted on servers located in the United States. By using the service from another country, including the European Economic Area, the United Kingdom or Canada, you consent to the transfer of your data to the United States. Where applicable we rely on Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office, or on the EU-US Data Privacy Framework (and its UK Extension) where the relevant provider is certified under it. Canadian users: your data may be processed outside Canada and remains protected by contractual safeguards consistent with PIPEDA.

Sign-in is handled by Google and Apple, who process your authentication request on their own infrastructure under their respective privacy policies.

We use strictly necessary technical storage: a session cookie that keeps you signed in, a CSRF token that protects forms, and a small amount of local storage that remembers UI preferences such as your cookie-banner choice. You can clear any of these from your browser at any time.

Analytics (Google Analytics 4). When you accept cookies, we use Google Analytics 4 to understand how visitors interact with Compoxer. GA4 collects anonymized IP addresses, page views, session duration and device type. We retain this data for 14 months. No advertising cookies, no tracking pixels, no data sales. You can revoke consent at any time by clearing cookies in your browser; analytics will stop immediately.

Wherever you live, you can ask us to access, correct, export or delete the personal data linked to your Compoxer account. You can also object to or restrict specific uses of your data.

If you are in the European Economic Area or the United Kingdom, you have the right under the GDPR / UK GDPR to lodge a complaint with your local data-protection authority.

If you are a California resident, you have the right under the CCPA / CPRA to know what personal information we collect, to request its deletion, to opt out of any sale or sharing (we do not sell or share), and not to be discriminated against for exercising these rights.

If you are in Canada, you have the right under PIPEDA (and Quebec's Law 25, where applicable) to access and correct your personal information, to withdraw consent to its processing, and to file a complaint with the Office of the Privacy Commissioner of Canada or your provincial authority.

To exercise any right, email [email protected] from the address linked to your account. We reply within 30 days.

We keep your account data while your account is active. When you delete your account, we erase your profile, stored compositions and related metadata within 30 days, except items we must retain for security audits (up to 12 months).

All traffic travels over HTTPS / TLS. Authentication tokens are stored on your device in the operating-system keychain (macOS Keychain in the desktop app, httpOnly secure cookies in the browser). We never store passwords because we rely exclusively on third-party identity providers.

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated in the app or by email when appropriate. Continuing to use Compoxer after the change means you accept the updated policy.

Compoxer is operated by an individual creator. For any privacy-related question, write to [email protected].