Privacy policy

What we hold

Four sets of records. This is all of them.

1. Your account, your projects and your purchases

You can drop stems, categorise them, mix and listen without an account and without telling us anything. An account is created when you press Download, and not before.

• Account. You sign in with Google. We ask Google for your email address, your name and your profile picture, and nothing else. We never see your Google password. We store your email address and an internal id.
• Projects. The name you gave the project and its dates. For each stem: the filename, the file size, the sample rate, the channel count, the length, and a checksum of the file. Not the audio.
• Mixes. The settings you chose — categories, gains, pans, and every control on the Mix page — for each version you save. Alongside them, the waveform outline the app draws on screen and the analysis numbers behind the mix. Neither can be turned back into your recording.
• Purchases. Your orders and subscriptions, your credit balance and every movement in and out of it, your desktop licences, and which machines each licence is activated on.

Payment is taken by Lemon Squeezy, who are the seller of record. Your card details go to them and never reach us. We hold the order, not the card.

2. Journey events — how the site gets used

We record what people do on the way through the product, so we can see where it loses them. It is deliberately thin.

• No cookie, and nothing written to your device. A session id is issued by our server and held in a variable in the page's memory. It survives moving between pages and is gone the moment you reload or close the tab. There is no durable identifier of you anywhere in this system.
• Per session we store the page you landed on, the site that referred you, your country, and — if you arrived from an advert — the click identifier in the link. We never store your IP address or your browser's user-agent string. There is no column for either.
• To count visitors we make a one-way hash of your IP address, your user agent and a salt that changes every day. Old salts are thrown away, so yesterday's hash cannot be recomputed and the count cannot be joined up across days.
• The events. Arriving; dropping stems, with how many, their total length and sample rate; analysis finishing; setting a stem's category; reaching the mix page; starting playback; your first real move of a parameter; attempting an export; seeing the paywall and the reason for it; opening checkout; completing it; downloading; a project forking; saving a version; creating an account. That is the list.
• No session recording, under any vendor, at any tier. We do not record your screen, your mouse or your keystrokes.

These events post to our own domain. No third-party analytics service receives them.

When you create an account, the events from that visit are attached to it, so we can see one complete path from arriving to paying. That is a one-off update over that session's rows and it is the only time these records are ever changed.

3. Categorisation samples — the training set

Finalist has to know which stem is the kick and which is the lead vocal. Today you tell it. We are building something that guesses, and this is the record that makes that possible.

• When you set or confirm a stem's category we keep the numbers our analysis produced for that stem, the category you ended up with, and whether you set it by hand, accepted a suggestion, or overrode one.
• The audio features are one-way. Nothing we keep can be turned back into a recognisable rendering of your recording. That is a design constraint, not a hope.
• Filenames stay on your machine. Stem filenames carry artist names, song titles and client names, and they are the single strongest clue to what a stem is. So the match happens in your browser, against a fixed list of words shipped inside the app, and only the matched word is sent — or nothing, if it did not match. The filename itself, and the part of it that did not match, never leave your device. We do not send the length of it, the number of words in it, or anything else about its shape.

Your stem filenames are stored as part of your own project, so the app can help you find your files again on another machine. They are yours, visible to you, and they are never added to the training set above.

4. The link we email you

Finalist needs a desktop machine. If you open the site on a phone we offer to email you the link, and if you ask for it we keep the address you typed, the time, and whether the message actually sent. We keep it so that we can write to you about Finalist later. Nobody but us can read it, and you can ask us to delete it — the last section says how.

Who else touches any of this

• Supabase — the database and the sign-in service. Hosted in Ireland.
• Cloudflare — hosting, and object storage for waveforms and analysis. Western Europe.
• Google — sign-in only, because you chose to sign in with Google.
• Lemon Squeezy — payment, as seller of record.
• Resend — the service that sends our email: support replies, and the link we send you if you ask for it from a phone.
• Meta and Google Ads — advertising measurement. The next section is entirely about what goes to them.

Your audio, and the rights we do not claim

We claim no rights whatsoever over your audio. Not ownership. Not a licence to use it. Not a right to play it, publish it, show it to anyone, or train anything on it. Putting a stem into Finalist changes nothing about who owns it. It is yours before, during and after.

That is an easy promise to make because of how the app is built: your audio never reaches us. Finalist mixes and masters in your browser, on your own machine. Your stems stay on your device. The finished mix is rendered on your device. We hold no copy of either and have no way to obtain one.

What does leave your machine, once you have an account, is the list in the section above: filenames and file properties, the settings you chose, the waveform outline drawn on screen, and the analysis numbers. None of it can be turned back into your recording.

Which means your mixes live only on your machine

This is the part people are surprised by, so it is here in plain words rather than buried in the terms.

• Nothing you make is stored on our servers. Not the stems, not the rendered mix.
• A mix you have paid for is re-downloadable for as long as you still have the stems it was made from. What we record is the purchase, against the set of files it was made against — so if you clear your browser storage or move to another machine, drop the same files again and your paid download comes back.
• If you lose the stems, the mix is gone. Your entitlement survives; the audio does not, because we never had it.
• We do not back your mixes up and we cannot recover them. There is no copy anywhere but your machine. Nobody here can restore one.

Keep your original files.

Every ad platform we transmit to

Two. Naming a category instead of a platform would be a way of not answering, so here they are:

• Meta — Facebook and Instagram — through the Meta Conversions API.
• Google — through Google Ads Enhanced Conversions.

There is no advertising tag in your browser. No Meta Pixel, no Google Tag, no TikTok pixel, nothing equivalent. No third-party script runs on this site at all. When you buy something, our server tells those two platforms that a purchase happened. Your browser tells them nothing.

What we send them, and it is the whole list:

• a one-way hash of your email address, normalised and lower-cased — never the address itself;
• the click identifier from the advert you arrived on, if there was one;
• the order id, which is there so one sale is not counted twice;
• your IP address and browser user agent where the platform requires them, hashed wherever the platform permits it.

We also send two earlier signals from the same server, about the moment a visitor becomes a user: that stems were dropped, and that an export was attempted. Both carry the same match keys and nothing more.

Click identifiers. If you arrive from an advert, the link carries an identifier — fbclid from Meta, gclid from Google, ttclid from TikTok. We read it out of the address and store it against your session. Reading a parameter out of a URL does not touch your device, which is why this needs no banner. We record TikTok's identifier but we do not currently transmit anything to TikTok. If that changes, this page changes first.

Joint control with Meta. For the conversion data we send to Meta, we and Meta each decide part of what happens to it, so in law we are joint controllers and Meta's controller terms apply to that part. For everything else on this page we act alone.

The lawful basis

Under UK and EU data protection law, everything above needs a reason in law. There are three here.

• Your account, projects, orders, credits and licences — performance of a contract. We cannot sell you a mix, let you download it again, or run your subscription without them.
• Journey events and categorisation samples — legitimate interest. Ours is in running the product, seeing where it fails people, and building the categorisation that makes it work. We have weighed that against your interests and written the assessment down.
• Advertising measurement — legitimate interest, and it is the weakest of the three. Hashed, server-side conversion measurement on this basis is mainstream and, we think, defensible. It is not risk-free: some regulators take the view that advertising measurement needs consent whatever the mechanism. We would rather say that than imply the question is settled.

Why there is no cookie banner

The rule that produces cookie banners is not really about cookies. It is about storing information on your device, or reading information already stored there — which covers local storage, IndexedDB and everything else a browser offers, not just cookies.

Finalist writes a great deal to your device: your stems and your projects live there, because that is where the mixing happens. All of that is storage you asked for by using the app, which is the exemption the rule provides for. That exemption is tied to its purpose and cannot be lent to anything else — so we did the only other thing available. The analytics writes nothing to your device at all. No cookie, no local storage, no session storage, no IndexedDB entry. There is nothing to ask your permission for, so we do not ask.

This is not a claim about intent. An automated check drives the whole anonymous journey through the product on every build and fails it if a cookie appears, if the analytics writes anything to the device, or if any request leaves our own domain. A second check runs the same test with a deliberate fault injected, to prove the first one can still catch it.

If a consent banner is ever added it will be to add something on top of this, not to unlock it, and rejecting will take exactly as few clicks as accepting.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, and object to anything above that runs on legitimate interest — including the advertising measurement. Where we rely on legitimate interest we will stop unless we have a compelling reason not to, and we will tell you which it is. The section below carries the address to write to.

Who we are, how long we keep this, and how to complain

TEXT NOT YET WRITTEN.

Not draftable from this repository, because it is facts rather than prose. Needed: the controller's registered legal name, company number and registered address; an address for data requests and for objections under the section above; the countries the data is stored in and the transfer basis for the advertising data that goes to Meta and Google; and the ICO complaint route. Everything above this section is a first draft by a non-lawyer and needs review before any of it is relied on.

The retention period is DECIDED and is not yet ENFORCED — Tim, 17 Sep 2026, and docs/METRICS-PANEL.md §5. It was the one item on the list above that this repository could answer, so it is answered here and the rest of the list stands.

Analytics without an account — kept indefinitely. The visitor hash is salted with a secret that is deleted the next day, so after twenty-four hours it cannot be linked to an address, a device or any later visit. Analytics attached to an account — the behavioural record is kept indefinitely and the link to the account is removed after 24 months, which is the same thing that happens immediately if an account is deleted.

⚠ NOT YET ENFORCED. The mechanism exists (deattribute_old()) and nothing calls it on a schedule: this project has no cron, the two Edge Functions are webhook receivers, and the admin console is a page somebody opens. Until a schedule exists, the two paragraphs above describe a decision and not a thing that happens — and a privacy notice that asserts a retention period nobody can prove ran is worse than one that says this.