Draft for legal review. This document describes how TRAX works today and is being reviewed by a lawyer before TRAX launches publicly. Values in [brackets] are still to be filled in.
LEGAL

Privacy Policy

Last updated: October 2, 2026 · Draft

🔒 Prefer plain English? Read our data promise — your work stays yours →

TRAX is operated by Bianca Ruehlig, sole proprietor ("TRAX", "we", "us"), [registered address]. This policy explains what we collect when you use TRAX, why, how long we keep it, who else handles it, and your choices. The plain-English version is our Trust page.

1. What we collect

  • Account details: your name, username, email address and password (scrambled one way with scrypt, so nobody at TRAX can read it).
  • What you make: ideas, captures and recordings, projects, lyrics, mixes, splits, agreements and signatures, messages and files.
  • Billing: your plan, its dates and payment status, and Stripe's customer and subscription ids. Stripe collects your card on its own page; we never see or store card numbers.
  • Usage and security: while you're signed in, which pages and tools you use (TRAX's public pages too), for how long, and the kind of action (a view, a button, a form sent, an upload), never what's inside your work or anything you type; sign-ins with the device type and browser. For these, your IP address is scrambled one way before it's stored, and location is region-level at most.
  • Forms you send us (the contact form and our waitlists): your name, email and what you write, plus your IP address, browser, and the campaign tags of the link you came from, to stop abuse and see what brought you.
  • If someone shares a packet or a delivery link with you: when you open it, we record the visit with your IP address and browser, and what you do there (for example time on the page, how far you read, previews and downloads), so the sender can see it was opened.
  • Optional: a location tag you add to a capture; microphone and camera only while you record.

2. How we use it

  • To run TRAX for you and the people you collaborate with.
  • To keep accounts secure and prevent abuse.
  • To send the emails about your account: confirming your email, tips and reminders during a trial, notices after a trial ends (up to seven over 97 days), receipts, plan and subscription changes, payment problems, and password resets and changes; replies when you join a waitlist; and, once, a "TRAX is live" email if you joined our waitlist.
  • To support you, and to understand which features help so we can improve them.

3. What we never do

  • We don't sell or rent personal data.
  • We don't train AI models on your content.
  • We don't show ads or use advertising trackers.

4. Who else handles it

Collaborators you invite see what their project role allows. These outside services are involved, each only as described:

Supabase
Database and encrypted file storage (United States).
Vercel
Hosting — serves the app and runs its server code. On TRAX's public pages (never inside your account) it also counts anonymous visits — the page, country, device type and where the visit came from — with no cookies and nothing about you or your work.
Stripe
Payments — when you subscribe, Stripe collects your card on its own secure checkout page and runs your subscription, invoices and receipts. TRAX never sees or stores card numbers; it keeps your plan, its dates, your payment status and Stripe's customer and subscription ids.
Resend
Email delivery — the emails about your account (confirming your email, tips and reminders during a trial, notices after a trial ends, receipts, plan and subscription changes, payment problems, password resets and changes), the reply when you join a waitlist, and — once, if you joined our waitlist — a "TRAX is live" email are sent through Resend. It receives your email address and that email; TRAX sends no other marketing email.
OpenStreetMap
Map tiles on the calendar map. Your browser loads the tiles; no account data is sent.
YouTube (privacy-enhanced mode) and Vimeo
Play the how-to videos in Help — only when you press play.
Your browser's speech recognition
Transcribes voice memos when your browser offers it (in Chrome, Google processes that audio).
ASCAP, BMI, SESAC, PRS for Music / MCPS, GEMA, SACEM, SOCAN, JASRAC, SoundExchange and The MLC
Registration packets on Royalties are files you download and submit yourself on their sites. TRAX never sends them anything; the links open their sites in your browser.
Anthropic (Claude)
AI Business Coach — only when you ask it a question or a written review is made: a summary of your business figures (revenue, clients, deals, invoices, goals) is sent so it can answer. Rights contribution analysis — only when someone runs it: each person's role and counts of sessions, captures and approvals on that song, under anonymous labels (no names). Fair-split coaching — only when you ask it: the roles, shares and activity counts on that song you can see yourself, under anonymous labels, plus your own split patterns. Lyric Helper — only when you ask the co-writer something: your question, the song's title, language, genre, mood and what it's about, your last few questions and its answers, and the last 6,000 characters of your saved draft, so it can respond to what you've written (it never writes lyrics for you). None of these send your audio, files or messages, and only Lyric Helper ever sends lyrics — your own draft, when you ask. Anthropic's commercial terms don't allow training on it.

5. How long we keep it

Active accounts
Kept for as long as your account is open.
Deleted accounts
Preserved privately for 30 days (so you can change your mind), then permanently deleted. Backups roll off within 90 days.
Sign-in records
Kept for 90 days.
Trials
When a 30-day trial you started yourself ends without a subscription, your workspace is paused and kept just as it is for 90 days. On day 97 it's archived — still not deleted: kept for at least a year, and you can bring it back by subscribing or by asking us.
Ended subscriptions
If your subscription ends, your account is locked but your work stays saved: export it any time, subscribe again to pick up where you left off, or delete your account.
Unconfirmed sign-ups
A sign-up whose email is never confirmed is deleted after 30 days, with its confirmation emails.
Billing records
Your plan, its dates and payment status are kept while your account is open and removed when it's deleted. Stripe keeps invoices as tax and accounting law requires.
Project change log
Permanent — append-only and tamper-evident, so every split, approval and upload keeps a legal-grade record.
Data exports
Download links work for 30 days, then the export files are removed.

6. Your rights and choices

  • See every kind of record we keep about you: Settings → What we store.
  • Take a copy: Settings → Download all my data.
  • Correct it: your profile and account settings, or ask us.
  • Delete your account: Settings → Delete my account (with a 30-day grace period, or straight away; cancel an active subscription first).
  • Ask us anything about your data, or object to how we use it: [privacy email]. Depending on where you live, you may also have the right to complain to your data protection authority.

7. Security

Your work is in private storage, encrypted in transit and at rest, with role-based access and audit logs. A project's change log is append-only and tamper-evident. The tech specs page has the details.

8. Children

TRAX is for people aged 18 and over and isn't directed to children.

9. Cookies

TRAX sets only its own cookies: to sign you in, to remember the project you were last in, and to let it record your usage while you're signed in. No advertising or third-party tracking cookies. Visits from people who aren't signed in are counted without cookies. The Cookie Policy lists them.

10. Changes

We'll post changes here with the date, and tell you before a material change takes effect.