Privacy Policy

Who We Are

Song Cage is a songwriting web application operated by Digital Candy LLC. The application is available at app.songcage.com, and our marketing site is at songcage.com.

This policy explains what data we collect, how we use it, and what rights you have over it.

Data We Collect

We collect only the data necessary to provide and improve Song Cage. This includes:

• Account information: your email address and, if you sign in with Google OAuth, your name, email, and profile picture as provided by Google
• Song data: chords, lyrics, sections, and any other content you create within the app
• Audio recordings: voice memos and audio you record directly in the app, and, if you own the Song Cage licence, recordings you import into your Ideas Inbox (without the licence, imported recordings stay on the device you imported them on)
• Payment information: processed securely by Stripe, or by PayPal if you choose it at checkout. We do not store your credit card numbers, and we never have access to your full card details. A licence bought in the iPad app is paid through Apple's in-app purchase: Apple handles the payment, and we receive only Apple's signed record of the purchase (the product, the date, the country's currency and price, and a transaction number), linked to your Song Cage account
• How you found us: when you create an account, we record how the visit that led to it began: the page that linked to us, the page you arrived on, and any campaign tags in the link (or that you came from a Google ad). We use this only to see which sources bring people who sign up

How We Use Your Data

Your data is used to:

• Provide, maintain, and improve the Song Cage application
• Authenticate your account and keep your sessions secure
• Sync your song data across devices
• Process payments for paid plans
• Respond to support requests

We do not sell your personal data to third parties. We do not use your song content for training AI models or for any purpose other than providing the service to you.

Third-Party Services

We use the following third-party services to operate Song Cage:

• Supabase: authentication and database hosting
• Stripe: payment processing
• PayPal: payment processing, when you choose PayPal at checkout
• Google: OAuth sign-in
• PowerSync: offline-first data synchronization
• Datamuse API: word tools including rhymes and synonyms
• Cloudflare: site hosting and CDN
• Sentry: anonymous crash and error diagnostics (never includes your song content)
• PostHog: usage statistics from the desktop app, the plugin, and Melody Rack, only if you choose to share them (never includes your song content)

Each of these services has its own privacy policy. We encourage you to review them. We only share the minimum data required for each service to function.

Song Cage Mobile (iOS and Android)

The Song Cage mobile app is a free idea-capture app for iPhone and Android, distributed through the Apple App Store and Google Play. It is a capture tool (record voice memos, sketch lyrics, and build chord ideas), not the full editor, and it can be used without an account. On an iPad the same app opens the full editor, which is covered by the rest of this policy like the web app. Its data handling differs from the web app in a few specific ways:

• Use it without an account: you can record, write, and sketch as a guest. Everything you capture is stored locally on your device, and nothing is uploaded to our servers until you sign in.
• Microphone access for voice memos: the Record tab uses your device's microphone to record voice memos. The app asks for microphone permission the first time you record, and uses the microphone only to capture the recordings you start. You can deny or revoke this permission in your device settings, and the rest of the app still works without it.
• Where recordings and ideas go: a voice memo is saved on your device the moment you record it. If you are signed in, that audio and your idea content (lyrics and chords) are uploaded to our servers (Supabase database and storage) so they sync to your other devices and appear in your Ideas Inbox on the web and desktop. If you are not signed in, they stay on the device and are never uploaded.
• No purchases on iPhone or Android: the capture app is free. It contains no in-app purchases and collects no payment information. The iPad app offers the Song Cage licence and its free trial as Apple in-app purchases, described under Payment information above.
• Account deletion in the app: if you create an account, you can delete it and all of its data directly from the app (the menu in the top-right corner, then "Delete account"). You can also request deletion on the web at songcage.com/account/delete. Deleting your account removes your account record and all associated data, including any voice-memo audio, from our systems.
• Diagnostic telemetry (Sentry): to surface crashes and errors quickly, the mobile app may send anonymous diagnostics to Sentry: error stack traces, your operating system and version, the app version, locale, and a tag identifying the platform as ios or android. Song content is never sent: no lyrics, chord progressions, or audio leave your device through telemetry.
• Update check: to tell you when a newer version is out, the app asks the App Store (on iPhone and iPad) or Google Play (on Android) which version is current, and each time it opens it asks downloads.songcage.com/mobile/latest.json whether your version is still supported. That request carries only your platform (ios or android) and the app version you have installed: no account, no song, no identifier of any kind. We count these requests to learn which versions are still in use, against a salted, truncated hash of your IP address, the same way plugin update checks are counted. It records nothing about what you do in the app.

Song Cage Desktop (macOS and Windows)

The Song Cage desktop app is a native installer for macOS and Windows. It runs the same songwriting canvas as the web app, but installed locally and able to operate fully offline. Its data handling differs from the web app in a few specific ways:

• Songs save locally first: songs you create in the desktop app are stored in a local database on your machine. Nothing is uploaded to our servers unless you sign in.
• Optional sign-in for sync: signing in connects your desktop app to your Song Cage cloud library. While signed in on an account that includes cloud sync, edits sync bidirectionally with the web app, mobile app, and AU/VST3 plugin through PowerSync. A one-time sign-in starts the 14-day trial or unlocks a purchased license; after that the desktop app functions fully offline, and sign-in is never required for writing.
• Sign-in happens in your system browser: the desktop app opens songcage.com/desktop-auth in your default browser, you complete sign-in there, and the browser hands the session back to the app over a one-time loopback connection to 127.0.0.1. No password is ever typed into the desktop app itself.
• Word tools run offline: rhymes, synonyms, similar-meaning, and association data ship inside the desktop app. No network call is made to look up a rhyme.
• Diagnostic telemetry (Sentry): to surface crashes and errors quickly, the desktop app sends the following anonymous data to Sentry: error stack traces, your operating system and version, the app version, locale, and a tag identifying the platform as desktop-tauri. Song content is never sent: no lyrics, chord progressions, or audio leave your machine through telemetry.
• License entitlement cache: when you sign in with a paid license, the desktop app caches a short-lived signed entitlement file locally so it can continue working offline for up to 30 days between server check-ins.
• Auto-update check: the app checks downloads.songcage.com/desktop/latest.json on launch to see if a new version is available. The check sends only your current app version and target OS/arch. You can disable auto-update from the View menu.
• Usage statistics (PostHog), only if you say yes: the desktop app asks once whether to share usage statistics, and sends nothing unless you choose Share. Until you answer, events stay in memory on your machine, and they are discarded if you choose No thanks. If you share, the app sends a small number of events so we can see whether it is working for people: the app was opened; the first time in a session a chord, lyric, or melody note was written (only which kind, never what it was); melody detection on a recording finished (which detector ran, and whether it had to fall back to another) or failed; a note was sung in with hold-to-sing (whether a note was heard); voice memos were imported (how many files, and whether they came from a folder, files you picked, or your phone); Auto Chords suggestions were accepted (how many chords they wrote); a PDF or MIDI file was exported (which kind); a take was recorded (its length in seconds); the licence screen was shown (and whether the trial had ended); and a purchase was started (Stripe or PayPal, whether it continued after you signed in, and what happened, for example checkout opened, already purchased, or an error). Each event carries the app version, your operating system, your licence state (trial, licensed, or ended), whether your licence includes cloud sync, and whether you are signed in. PostHog also sees the IP address each request comes from, which it uses to estimate your country and city. Song content is never sent: no lyrics, chord names, melodies, or audio leave your machine through usage statistics. Events are tied to a random identifier stored by the app, or to your Song Cage account ID (never your email) once you sign in. We do not use session replay.
• Opting out: to change your answer about usage statistics, open the song menu and switch Share usage stats off (or on). Turning it off also deletes the app's random identifier. To disable diagnostic telemetry, email support@songcage.com from the address tied to your account and we will mark it opt-out at the source.

Song Cage Plugin and Melody Rack (AU / VST3)

The Song Cage plugin and Melody Rack run inside your DAW (Logic, Ableton, FL Studio, Cubase, Reaper, Studio One, GarageBand) on macOS and Windows. Melody Rack is a separate product on its own licence, but it is built on the same plugin shell, so everything below applies to both:

• Songs save inside the DAW project: by default, songs created in the plugin live only in the DAW project file on your machine. Nothing is uploaded to our servers unless you explicitly sign in and use "Save as new cloud song" or "Update cloud copy."
• Optional sign-in: when you sign in, the plugin pulls your existing Song Cage cloud library so you can import songs into the DAW. A one-time sign-in starts the 14-day trial or unlocks a purchased license; after that the plugin functions fully offline, and sign-in is never required for writing.
• Word tools run offline: rhymes, synonyms, similar-meaning, and association data ship with the plugin. No network call is made to look up a rhyme.
• Diagnostic telemetry (Sentry): to surface crashes and errors quickly, the plugin sends the following anonymous data to Sentry: error stack traces, the DAW host name and version, your operating system, the plugin format (AU/VST3/Standalone), and the Song Cage plugin version. Song content is never sent: no lyrics, chord progressions, or audio leave your machine through telemetry.
• License entitlement: when you sign in with a paid license, the plugin caches a short-lived signed entitlement file locally so it can continue working offline for up to 30 days between server check-ins.
• Update check: each time you open the plugin window, it asks downloads.songcage.com/plugin/latest.json (Melody Rack asks /melody-rack/latest.json) whether a newer version exists, so it can show the update dot. The request carries nothing about you or your session: no account, no song, no license, no identifier of any kind. We count these requests to learn how many people who download an installer actually get the plugin running in a DAW, which is otherwise invisible to us. The count is kept against a salted, truncated hash of your IP address, the same way installer downloads are counted, and is used only to tell one machine from another. The update check is not usage tracking: it records nothing about which controls you touch, which presets you load, what you sing, or how long you work. Usage statistics are a separate choice, described below.
• Usage statistics (PostHog), only if you say yes: the Song Cage plugin and Melody Rack each ask once whether to share usage statistics, and send nothing unless you choose Share. Until you answer, events stay in memory on your machine, and they are discarded if you choose No thanks. If you share, the Song Cage plugin sends the same events as the desktop app (above), plus MIDI being dragged into your DAW, and each of its events carries the plugin version, the DAW name, your operating system, your licence state, and whether you are signed in. Melody Rack sends: the window was opened, a take was recorded or imported (how it was captured, how many notes were detected, how many seconds long it was, which detector ran, whether it succeeded), a take was deleted, MIDI was dragged out, a take was sent to Song Cage, a purchase was started, and an update was announced; each of its events carries the plugin version, the DAW name, the plugin format (AU/VST3), your operating system, and your licence state (trial or licensed). Melody Rack 0.5.11 (released September 12, 2026) sends these events without asking; every later version asks first. PostHog also sees the IP address each request comes from, which it uses to estimate your country and city. Song content is never sent: no pitches, no chords, no lyrics, and no audio leave your machine through usage statistics, only counts and durations. Events are tied to a random identifier stored by the plugin, or to your Song Cage account ID (never your email) once you sign in. We do not use session replay in the plugin.
• Opting out: to change your answer about usage statistics, open the song menu in the Song Cage plugin and switch Share usage stats off (or on), or click the Melody Rack name at the top left of Melody Rack. Turning it off also deletes the plugin's random identifier. To disable diagnostic telemetry, email support@songcage.com from the address tied to your account and we will mark it opt-out at the source. To stop the update check, block downloads.songcage.com in your firewall; the plugin treats an unreachable feed as "no update" and works normally offline.

Cookies

We use minimal cookies: only what is required to keep your authentication session active. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

Data Retention

Your data is retained for as long as your account is active. You can delete your account and data at any time, either from inside the app or by requesting deletion on that page. We will remove your personal data and song content from our systems. Some data may be retained in encrypted backups for a limited period before being permanently purged.

Dormant accounts that have not bought a licence

Storing audio costs us money every month, including for accounts that have gone quiet. If an account has not bought a licence and is not in a trial, and has not created or changed anything for twelve months, we may remove the recordings and the captured ideas held in its cloud library.

• Your songs are never touched by this. The policy covers cloud-stored audio recordings and items in the ideas inbox only. Songs, lyrics, chords, and melodies stay.
• You get warned first. We email the address on the account at least 30 days before anything is removed. Signing in and doing any work resets the clock, and nothing is removed after that.
• Anything stored only on your own machine is out of reach of this entirely. The desktop app keeps your songs locally, and without a licence, audio you import stays on the device you imported it on.

Your Rights

Regardless of where you live, we believe you should have control over your data. Under the GDPR, CCPA, and similar regulations, you have the right to:

• Access: request a copy of the personal data we hold about you
• Delete: delete your account and associated data, in-app or by request
• Export: receive your data in a portable format
• Correct: request correction of inaccurate personal data
• Opt out: California residents may opt out of the sale of personal information (though we do not sell personal data)

To exercise any of these rights, contact us at support@songcage.com.

Children

Song Cage is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.

Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will notify users through the app or by email. The "last updated" date at the top of this page reflects when the policy was most recently revised.

Contact

If you have questions about this privacy policy or how your data is handled, reach out to us at support@songcage.com.