Privacy Policy
We collect what we need to run your account, take payment and process your audio. We do not sell your data, and we do not use your audio to train AI models. You can ask us to delete your account at any time.
1.Who we are and what this policy covers
Secret Weaponz is operated by Patrick Giles, a sole trader in Australia (ABN 80 946 142 841), trading as Secret Weaponz ("we", "us"). Our contact details are in section 12. This policy explains what personal data we collect when you use the Secret Weaponz website and the web app at app.secretweaponz.app (the "Service"), what we do with it, and what choices you have.
For people in the EU and UK, we are the "controller" of your personal data. This policy forms part of our Terms of Service. Words with capital letters that are not defined here, such as Track A and Track B, have the meaning given in the Terms.
2.What we collect, why, and how long we keep it
We collect only the data below. We do not ask for your card details, and we do not collect special-category data on purpose.
| Data | What it includes | Why we use it | How long we keep it |
|---|---|---|---|
| Account | Email address, name if you give one, sign-in method (email or Google), account ID | Sign-in and account security | Until you delete your account. Our sign-in provider may keep security logs for a short period |
| Billing records | Pack bought, amount, currency, country, tax details, payment status, Stripe reference numbers. Not your card number | Take payment, tax and accounting, refunds and disputes | As tax and accounting law requires, typically 5 to 10 years |
| Tokens and usage | Token balance, free grant, spends, refunds, job IDs, the Terms version you accepted and when | Run the token system, prevent abuse, settle disputes | Until your account is deleted. Records we need for accounting stay with billing records |
| Temporary audio | Working copies of Track A, and of audio you send for stem or drum splitting, on cloud storage | Analyse and generate, split stems | Deleted automatically, normally within 24 hours and in any case within 7 days |
| Derived data | Tempo, key, beat positions, a style estimate, a file fingerprint (a short code that identifies the file, not the audio itself), and a compact numerical encoding used to guide generation | Guide generation and reopen your projects | Until you delete the library entry or your account |
| Output | Generated Track B, stems and drum-split results (working copies on cloud storage), and your library and session entries | Let you reopen, arrange and export your work | Cloud copies of audio are deleted automatically within 2 days. Your saved copy stays in your browser, on your device. Library and session entries stay until you delete them or your account is closed |
| Text you enter | Style notes and similar text | Guide generation | With the related project or job record |
| Technical logs | IP address, timestamps, requests, errors, job timings, browser and device type | Security, abuse prevention, fixing faults | Short periods, typically up to 90 days |
| Messages | Emails you send us and our replies | Support and record keeping | As long as needed to deal with the matter, up to 3 years afterwards |
3.How your audio is handled
Track A. When you load Track A, your browser holds it in memory only while the session is open and does not save it. To analyse it and guide generation, a working copy is sent over HTTPS to temporary cloud storage and processed on cloud GPU servers. We do not keep a permanent copy of the audio. The temporary copies are deleted automatically, normally within 24 hours and in any case within 7 days. We keep only the derived data listed in section 2.
Track B, stems and drum splits. When you save a project, your generated Track B audio is kept on your device, in your browser's storage, so you can reopen it. While you work, a working copy of Track B also sits on cloud storage, and it is deleted automatically within 2 days. When you split a track into stems or split drums, a working copy goes to cloud GPU servers for processing, and the results stay on cloud storage for the same 2 days. If you clear your browser data you can lose your saved copy, so export anything you want to keep.
Loops, samples and instruments. Loops and samples you drop on the LIVE pads, and sounds you load into the instruments, are analysed and tempo-matched in your browser. They stay on your device unless a feature you choose, such as a split, needs to send them to our servers, in which case the rules above apply.
What we do not do. We do not listen to your audio or review it by hand. We do not use your audio to train AI models. We do not sell it or share it with anyone except the providers named in section 5, and only to process it for you. The numerical encoding we keep is used to guide generation, and we do not treat it as playable audio.
4.How we use data and our legal bases
We use your data to provide the Service, take payment, keep it secure, fix faults, and meet our legal duties. For people in the EU and UK, our legal bases are:
- Contract. To create your account, run the Service you asked for, and handle tokens and payments.
- Legitimate interests. To keep the Service secure, prevent abuse and fraud, understand which features work, and defend legal claims. We weigh these against your rights and interests.
- Legal obligation. To keep tax and accounting records and respond to lawful requests.
- Consent. Only where we ask for it, for example for optional emails. You can withdraw consent at any time.
Analysis and generation are automated, but we make no decisions about you that have legal or similarly significant effects. We do not use your data for advertising or profiling.
5.Who we share data with
We do not sell your personal data. We share it only with the providers that help us run the Service, who act on our instructions, and in the other cases listed below.
| Provider | What they do | Data involved |
|---|---|---|
| Clerk | Sign-in and account management | Account data, sign-in and device details |
| Stripe | Payments | Billing details you give at checkout, purchase records |
| RunPod | Cloud GPU processing | Temporary audio copies and text you enter, for analysis, generation and splitting |
| Cloudflare | Website and app hosting, file storage, network security | Temporary audio copies (deleted automatically within 2 days), traffic and security data |
| Railway | Servers and database | Account references, token records, library and session entries, derived analysis data, technical logs |
We may also share data where the law requires it or a court or authority validly asks for it, to protect our rights, safety or property or those of others, with professional advisers who are bound to keep it confidential, and with a successor if the business is sold or transferred, in which case this policy continues to apply to your data. We may change providers, and we will update this list when we do.
6.International transfers
We operate from Australia, and our providers process data in other countries, including the United States and, depending on the provider, other regions. Your data may therefore leave the country where you live, including the EU, the UK and Australia. Where we transfer personal data out of the EU or UK, we rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum, or on a provider's certification under the EU-US Data Privacy Framework. You can ask us for details of the safeguards at the contact address in section 12.
7.Cookies and local storage
We use only what the Service needs to work. Our sign-in provider sets session cookies that keep you signed in. Your browser's local storage and IndexedDB hold your saved projects and the audio in them (but never Track A), and your settings, on your device. Stripe sets its own cookies on its checkout pages. We do not use advertising cookies or cross-site tracking, and we do not currently use third-party analytics. Our hosting provider may process basic traffic and security data to keep the Service running and protected. If we add analytics, we will update this policy first.
You can clear cookies and browser storage at any time in your browser settings. Clearing storage deletes the audio copies kept on your device, and the Service may stop working until you sign in again.
8.Your rights and how to use them
Everyone. You can ask us for a copy of the personal data we hold about you, ask us to correct it, and ask us to delete your account and data. To delete your account, email us from the address on your account. We act within 30 days, and we will tell you if we need longer. We delete what we hold apart from records we must keep by law, such as billing records, and our providers may keep their own records under their own policies.
EU and UK. You also have the right to restrict or object to our processing, to receive your data in a portable format, to withdraw consent at any time, and to complain to your data protection authority. In Portugal this is the CNPD, and in the UK it is the ICO.
Australia. You can ask to access and correct your personal information, and you can complain to us. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner. We handle personal information in line with the Australian Privacy Principles, whether or not the Privacy Act strictly requires it of a business our size.
California. We do not sell or share personal information for advertising, and we do not use or disclose sensitive personal information beyond what is needed to provide the Service. California residents can ask to know, correct and delete their personal information, and we will not treat you differently for doing so.
We may need to confirm who you are before we act on a request. We will say so if we cannot act on one, and why.
9.Security and data breaches
We protect your data with measures suited to a small service: encrypted HTTPS connections, access limited to the person who runs the Service, and providers that apply their own security controls. No system is completely secure, and we cannot guarantee that your data will never be accessed or lost. If a breach is likely to put you at risk of serious harm, we will tell you and the relevant authorities within the time the law sets.
10.Children
The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.
11.Changes to this policy
We may update this policy. We will post the new version here with a new date, and for material changes we will give notice by email or in the app before they take effect.
12.Contact and complaints
Patrick Giles, trading as Secret WeaponzABN 80 946 142 841
49 Caledonia Loop, North Coogee, Western Australia 6163, Australia
Email: hello@secretweaponz.app
For a privacy request or complaint, email us with "Privacy" in the subject line. We will reply within 30 days. You are also free to complain to your data protection authority at any time, though we would like the chance to put things right first.