Privacy Policy
Last updated: October 27, 2026
At TuneCraft, accessible from https://tunecraft.ai, the privacy of our visitors is one of our main priorities. This Privacy Policy explains what information TuneCraft collects, how we use it, and the choices you have. The controller of your personal data is ZHU SHENSHEN (Singapore), who operates TuneCraft.
This Privacy Policy applies only to our online activities on tunecraft.ai, in the TuneCraft app in ChatGPT, and in the TuneCraft plugin for Grok Bot and Cursor. It does not apply to information collected offline or through other channels.
Consent
By using our website, you consent to this Privacy Policy. Where the law requires a specific legal basis, we explain it in "How we use your information" below.
Information we collect
Account information. When you sign in with Google, we receive your name, email address and profile picture from Google. We never receive your Google password.
What you create. The descriptions you write, the styles and moods you choose, and the songs created for you: audio, cover art, titles and lyrics.
How you found us. When you first visit, we record the page you came from (the referrer), any campaign parameters in the link (such as utm_source), and your browser language, time zone and screen size. When you create an account, we store this with your account.
Device and log information. Your IP address, approximate country (provided by our network provider), browser type, operating system, device type, and the date and time of your requests.
Waitlist. If you join our waitlist, your email address.
Messages. If you email us, your email address and the content of your message and any attachments.
We do not collect payment information. We do not use third-party analytics or advertising trackers.
How we use your information
We use the information we collect to:
- provide and operate TuneCraft, including creating your songs and keeping your library;
- send you emails about your songs, such as when a song is ready;
- contact you about early access if you joined the waitlist;
- decide who can create songs during early access, and enforce usage limits such as one account per person and the daily allowance;
- find and prevent fraud and abuse, and keep TuneCraft secure;
- understand which channels bring people to TuneCraft, using aggregated data from our own records;
- respond to your requests and meet our legal obligations.
We do not sell your personal information, and we do not use it for advertising.
If you are in the European Economic Area or the United Kingdom, our legal bases are: performing our contract with you (providing the Service), our legitimate interests (security, abuse prevention and understanding how people find TuneCraft), your consent (waitlist emails), and compliance with legal obligations.
Service providers
We share information only with the providers that help us run TuneCraft:
| Provider | What they do for us | Information involved |
|---|---|---|
| Sign-in | The profile information you allow Google to share | |
| Vercel | Website hosting | Requests, IP address, server logs |
| Supabase | Database | Account, attribution and song records |
| Cloudflare | Network and file storage (R2) | Request data, song audio and cover art |
| AI model providers | Prompt safety review and AI generation of music, lyrics and cover art | Your description and chosen styles |
| ZeptoMail (Zoho) | Sending emails | Your email address and the email content |
Some of these providers process information outside your country, including in the United States. Where the law requires it, we rely on appropriate safeguards such as Standard Contractual Clauses.
Share pages
Every song has a share page that anyone with the link can open while the song is available. It shows the song's title, your description, the lyrics, the cover art, your display name and the date it was created. Share pages are marked so that search engines do not index them.
Using TuneCraft in ChatGPT
You can also use TuneCraft as an app in ChatGPT. When you connect TuneCraft in ChatGPT, you sign in to your TuneCraft account and allow ChatGPT to create and play songs on that account when you ask it to.
When you use TuneCraft in ChatGPT, we receive from OpenAI:
- your TuneCraft account identity, through the OAuth connection you approve;
- the song description and styles that you ask ChatGPT to send to TuneCraft;
- your approximate language and region.
We do not receive your full ChatGPT conversation, and we do not collect your precise location. OpenAI's own privacy policy covers how OpenAI handles your conversations.
Songs you create in ChatGPT are saved to your TuneCraft library and kept for the same periods as songs created on our website (see "How long we keep information" below).
You can disconnect TuneCraft at any time in the connected apps section of your ChatGPT settings. Disconnecting stops ChatGPT from using your TuneCraft account, but it does not delete your account or your songs. To delete your account, email [email protected] from the email address linked to your account.
Using TuneCraft in Grok Bot and Cursor
You can also use TuneCraft as a plugin in Grok Bot and Cursor. Grok Bot is provided by xAI. In both Grok Bot and Cursor, the connection to TuneCraft is made for you by the connector service of Cursor (Anysphere, Inc.). When you add TuneCraft, you sign in to your TuneCraft account in your browser and allow the connection to create and show songs on that account when you ask it to. The sign-in tokens for this connection are stored by Cursor.
When you use TuneCraft in Grok Bot or Cursor, we receive:
- your TuneCraft account identity, through the OAuth connection you approve;
- the song description and styles that are sent to TuneCraft when you ask for a song.
We do not receive your full conversation. xAI's and Cursor's own privacy policies cover how they handle your conversations.
Your description and styles are processed by a third-party music generation service to create your song. Neither we nor that service use this information to train AI models.
Songs you create in Grok Bot or Cursor are saved to your TuneCraft library and kept for the same periods as songs created on our website (see "How long we keep information" below).
You can disconnect TuneCraft at any time by removing it from your connected apps in Grok Bot or Cursor. Disconnecting stops Grok Bot and Cursor from using your TuneCraft account, but it does not delete your account or your songs. To delete your account, email [email protected] from the email address linked to your account.
How long we keep information
- Song audio and cover art: deleted from TuneCraft 3 days after the song is created.
- Song titles, descriptions and lyrics: kept in your library until you delete your account.
- Account and attribution information: kept until you delete your account.
- Technical records from our AI provider about each generation: kept for up to 14 days.
- Waitlist emails: kept until you ask us to remove yours or we open access to you.
- Server logs: kept by our hosting provider under its own retention rules.
Our AI provider may keep its own copies of generated files for a limited time (currently up to 14 days) under its own terms.
Cookies and local storage
We only use cookies that are needed to run TuneCraft. We do not use advertising or analytics cookies.
| Name | Purpose | Duration |
|---|---|---|
| Sign-in session cookies | Keep you signed in | 30 days |
NEXT_LOCALE | Remember your language | 1 year |
tc_attribution | Remember how you first found TuneCraft | 90 days |
tc_cg | Remember whether your visit came through an early-access channel | 90 days |
We also keep a draft of your song description in your browser's local storage, so that it is still there after you sign in. You can block or delete cookies in your browser settings. If you block the sign-in cookies, you will not be able to sign in.
Third-party privacy policies
This Privacy Policy does not apply to other websites or services. We recommend reading the privacy policies of Google and of the providers listed above.
CCPA privacy rights (do not sell my personal information)
Under the CCPA, among other rights, California consumers have the right to:
- request that a business that collects a consumer's personal data disclose the categories and specific pieces of personal data that it has collected about the consumer;
- request that a business delete any personal data about the consumer that it has collected;
- request that a business that sells a consumer's personal data not sell it.
We do not sell personal data. If you make a request, we have one month to respond to you.
GDPR and PDPA data protection rights
We would like to make sure you are fully aware of all of your data protection rights under the General Data Protection Regulation (GDPR) and Singapore's Personal Data Protection Act 2012 (PDPA). Every user is entitled to the following:
- The right to access: you can request copies of your personal data.
- The right to rectification: you can request that we correct information you believe is inaccurate, or complete information you believe is incomplete.
- The right to erasure: you can request that we erase your personal data, under certain conditions.
- The right to restrict processing: you can request that we restrict the processing of your personal data, under certain conditions.
- The right to object to processing: you can object to our processing of your personal data, under certain conditions.
- The right to data portability: you can request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
- The right to withdraw consent at any time, where we rely on your consent.
- The right to complain to your local data protection authority.
Our data protection contact is [email protected]. To exercise any of these rights, or to delete your account, email us from the email address linked to your account. If you make a request, we have one month to respond to you. Deleting your account deletes your account information, your library records and any song files that have not yet been deleted.
Children's information
Another part of our priority is protecting children while they use the internet. We encourage parents and guardians to observe, participate in, and monitor and guide their children's online activity.
TuneCraft is not intended for children under 13, or under the minimum age of digital consent in their country. We do not knowingly collect personal information from them. If you think your child has given us this kind of information, please contact us immediately and we will do our best to promptly remove it from our records.
Security
We protect your information with encryption in transit (HTTPS), access controls and reputable infrastructure providers. No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time, so we advise you to review this page periodically. We will post the new version on this page and update the date at the top. Changes take effect as soon as they are posted.
Contact us
If you have any questions or suggestions about this Privacy Policy, contact us at [email protected].