Privacy Policy

Last updated: 17 July 2026 · Effective immediately

1. Who we are

Pitch Your Music (“Pitch”, “we”, “our”, “us”) is the data controller for the personal data described in this policy. We operate the website at pitchmusic.io and the associated services (collectively, “the Service”).

To contact us about your data: support@pitchmusic.io

2. What data we collect and why

DataWhy we collect itLegal basis (UK/EU GDPR)

Email addressProcessing your analysis, sending results and purchase receiptsContract performance + Legitimate interest

Uploaded audio fileRunning the engine analysis pipeline on the audioContract performance

Audio fingerprint (hash)Deduplication and copyright screening - not the audio itselfLegitimate interest

Analysis resultsDisplaying the decode and generating the paid packages you buyContract performance

Payment metadataRazorpay/Stripe order & payment IDs, package type, amount - no card dataContract performance + Legal obligation

IP addressRate limiting and fraud preventionLegitimate interest

Session cookieKeeping you signed in across page loadsLegitimate interest

Usage analyticsUnderstanding how the product is used to improve it (PostHog, opt-out available)Legitimate interest

Error logsDiagnosing and fixing technical issues (Sentry)Legitimate interest

We do not collect: location data, browser history, advertising identifiers, or data from third-party tracking networks. We do not sell any personal data to any third party.

3. Audio file handling

The audio file you upload is sent directly to Cloudflare R2 via a presigned URL. It is used solely to run the engine analysis pipeline and is deleted immediately after the analysis completes (and in any case within 24 hours). We do not listen to the audio, share it with any third party beyond the processors listed below, or use it to train any model.

Pitch claims no ownership of any track uploaded to the Service and takes no position on who holds rights in it (see Terms §3.1). This policy describes only how the file and the data derived from it are handled.

Two kinds of non-audio data derived from the uploaded file are retained (see Terms §3.2): the SHA-256 file fingerprint (copyright screening and deduplication) and acoustic measurements - numbers describing the sound, such as tempo, key, loudness, mood profiles, and mathematical audio fingerprints - used to deliver your reports and power anonymous, aggregate features such as sonic-similarity matching. Neither can be used to reconstruct, play back, or recreate the audio, and neither is published in a form identifying you or an unreleased track you uploaded without your separate, explicit consent.

4. Third-party data processors

We share your data only with the following sub-processors, each under a Data Processing Agreement:

ProcessorPurposeLocation

SupabaseDatabase and authenticationAsia-Pacific (Tokyo)

Cloudflare R2Audio file storage (deleted after analysis; 24h max)Cloudflare global network

Amazon Web ServicesAudio feature analysis server (EC2)USA (SCCs apply)

AudDAudio fingerprinting for copyright screeningUSA (SCCs apply)

AnthropicEngine analysis of measurements from the track (audio features only - audio not sent)USA (SCCs apply)

RazorpayPayment processing (India - INR)India

StripePayment processing (international cards - USD)USA / EU (SCCs apply)

ResendTransactional email delivery (paid packages only)USA (SCCs apply)

PostHogProduct analytics (anonymised, opt-out available)EU (Germany)

SentryError monitoringUSA (SCCs apply)

SpotifyArtist/genre data enrichment (no personal data sent)USA

SCCs = Standard Contractual Clauses (EU Commission approved mechanism for international transfers).

5. How long we keep your data

Data typeRetention period

Audio file24 hours - then auto-deleted from Cloudflare R2

Audio fingerprintIndefinitely (copyright screening)

Acoustic measurementsIndefinitely (report delivery + anonymous similarity features - numbers only, never audio)

Email addressUntil account deletion or unsubscribe request

Analysis resultsUntil account deletion

Payment records7 years (legal / tax obligation)

Session tokensRolling 7-day expiry

Error logs (Sentry)30 days

Usage analytics1 year rolling window

6. Your rights

Under UK GDPR and EU GDPR you have the right to:

AccessRequest a copy of all personal data we hold about you.
RectificationAsk us to correct inaccurate or incomplete data.
ErasureRequest deletion of your data (“right to be forgotten”). You can do this instantly from your Account Settings, or by emailing us.
PortabilityReceive your analysis data in a machine-readable format.
RestrictionAsk us to stop processing your data while a complaint is resolved.
ObjectionObject to processing based on legitimate interest.
Withdraw consentWhere processing is based on consent (analytics only), withdraw it at any time via Account Settings.

To exercise any right, email support@pitchmusic.io. We will respond within 30 days. If you are unsatisfied, you have the right to lodge a complaint with the ICO (UK) or your local supervisory authority (EU).

7. Cookies and tracking

CookiePurposeCategoryDuration

sb-auth-tokenAuthentication session - keeps you signed inStrictly necessary7 days

ph_*PostHog analytics - usage patterns (no PII)Analytics (opt-out)1 year

sentry-*Error session replay (disabled by default)FunctionalSession

You can opt out of analytics cookies at any time in Account Settings → Privacy or by clearing your browser cookies. We do not use advertising cookies.

8. Children

The Service is not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us immediately and we will delete it.

9. Changes to this policy

We will notify registered users by email at least 14 days before any material change to this policy. The “Last updated” date at the top of this page reflects the most recent revision.