Privacy Policy

The short version

You can listen without an account, on the site and in the iPhone app. We keep only what the station needs to run: your account if you make one, what you choose to make or post, and a few counters. No ads, no tracking, and we never sell your data.

Who we are

Crimson Station decides how your data is used and is responsible for it. Reach us, and the person who looks after privacy here, at hello@crimsonstation.com.

When you listen

• Your browser keeps a random listener key, your volume and where you stopped the last song, in its own storage.
• The listener key is sent with what is playing so we can count listeners and plays. It is not linked to your name or your account.
• Our host keeps short-lived request logs, including IP addresses, to deliver the site and keep it secure.
• Our host also counts page views, the page or site that brought each visit, and the rough country and kind of device, without cookies and without identifying you.

Your account

Signing in, with Google or with a one-time code sent to your email, gives us your email address and, with Google, the name on your Google account. We use them to keep you signed in, to show your name on the notes you post, and to answer you when you write to us.

A cookie keeps you signed in. It is the only cookie we set.

In the iPhone app

The app works without an account. Your kept songs, tapes and downloads stay on your phone.

When you first buy a plan or restore one, the app makes an account for your phone without asking you anything: a random key kept in your phone's Keychain, of which we store only a scrambled copy, and a made-up display name you can change. It holds your plan and the songs you make.

Signing in with Apple is optional. It attaches to that same account so you can reach your songs and plan from another iPhone. Apple gives us an identifier for you that only works with our app, and the name you choose to share; we never ask for your email. Sessions are stored only as a scrambled copy, and on your phone they live in the Keychain and never leave the device.

The studio

With a subscription, you can ask the studio for a song: a title, a description or your own words, and the style, mood and voice you pick. To make it, we send that request to a third-party AI music service, which uses it only to make your song. Nothing else goes with it: not your name, not your Apple ID, not what you listen to. The app asks for your permission before the first request.

The songs you make are stored privately in your account. The app plays them through links that expire within the hour.

Subscriptions are bought and billed by Apple. A subscription service tells us which plan your account has and when it renews, so we can count your songs for the month. We never see your payment details.

Songs you publish, and reports

If you publish a song, its page is public to anyone with the link: the song, its title and your display name. Unpublish it at any time.

Anyone can report a published song. A report keeps the reason, any note written with it, and a code made from the reporter's IP address that changes every day, so each person counts once per song; the address itself is not stored.

What you post and save

Notes you leave on songs are public and show your name. The songs you keep and the playlists you make are linked to your account, and your playlists are visible only to you.

Security

Everything travels encrypted, sessions and keys are stored only as scrambled copies, and only the station can reach the data. Requests that probe the station for weaknesses, such as addresses no listener would open or bait fields only bots fill in, are logged with the IP address, the address requested and the browser description. They can lock that IP address out of sign-in for 24 hours.

Who helps us run it

• Our hosting provider runs the site and keeps its request logs and page-view counts.
• Our database and storage provider keeps accounts, songs and files, and sends the emails that carry sign-in codes.
• Google handles sign-in on the site when you choose to continue with Google.
• Apple handles sign-in in the iPhone app and every App Store purchase.
• A subscription service tells us which plan your account has.
• A third-party AI music service makes the songs you ask the studio for, from your request alone.

They process data only on our instructions, to provide these services to us. Beyond them, we disclose data only when the law requires it, or to whoever takes over the station if it ever changes hands, under this same policy. We never share personal data for advertising.

YouTube and TikTok

We publish lyric videos on our YouTube and TikTok accounts. Our upload tools use YouTube API Services and TikTok's developer tools only to post the station's own videos to its own accounts. They never ask for, read or store your Google, YouTube or TikTok data. Watching on TikTok is covered by TikTok's Privacy Policy.

Watching our videos on YouTube is covered by the YouTube Terms of Service and the Google Privacy Policy. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Any access you give us through Google can be revoked at any time on your Google account permissions page.

How long we keep it

• Your account, kept songs and playlists: until you delete them or ask us to close your account.
• Notes: until you ask us to remove them, or we hide them.
• Your app account and the songs you made: until you delete them. Deleting a song removes its files at once; a short record that it was made (its title and date) stays with your account so the month's song count stays right, and goes when the account does.
• Reports: as long as they help us keep the station safe.
• Plays and listener counts: kept as anonymous counts.
• Security log entries: kept as long as they help protect the station.

Deleting your account

In the iPhone app, Settings has Delete account: it deletes your account, your songs and their files right away, and ends the app's access to your Apple ID if you signed in with it. A subscription is billed by Apple, so cancel it in your Apple ID settings as well.

To close your account on the site, write to hello@crimsonstation.com. Clearing your browser's storage for this site resets your listener key, volume and resume point.

Why we're allowed to use it

• To give you what you asked for: your account, sign-in, your plan, the songs you make, keep and publish, your playlists and notes.
• Our legitimate interest in running a safe station: counting plays and visits, security logs, reports and moderation. You can object, and we will weigh it.
• Your permission: the app asks before it sends your first studio request out to be made into a song. Saying no only means the studio can't make songs.
• The law: keeping records it requires and answering lawful requests from authorities.

Cookies and what stays on your device

On the site, the only cookie keeps you signed in. Your browser's own storage holds your listener key, volume and resume point, used only by us. Page views are counted without cookies; decline in the notice, or under Privacy choices at the foot of any page, and your visits are not counted. A Global Privacy Control signal does the same. There are no advertising or third-party cookies.

In the app, the account key and session stay in your phone's Keychain, and downloads stay on your phone. The app never asks to track you and never reads your advertising identifier.

Where your data goes

The station and the services that help run it work mainly from the United States. If you are in the EU, the UK, Brazil or anywhere else, your data is transferred there under the safeguards the law requires, such as standard contractual clauses.

Your rights

Wherever you live, you can ask us to confirm what we hold about you, to see it, to receive a copy you can take elsewhere, to correct it, to delete it or make it anonymous, to stop or limit a use of it, to know who it was shared with, and to withdraw a permission you gave. Using a right never changes the price or the service you get.

The app's Settings deletes your app account at once. For everything else, write to hello@crimsonstation.com. We may ask you to confirm the request from the email or account it is about, and someone you authorize may ask for you. We answer within 15 days.

If we turn a request down, reply to our answer to appeal, and we decide within 45 days. You can also complain to your data protection authority: in the EU, your country's; in the UK, the ICO; in Brazil, the ANPD; in the US, your state's attorney general.

For California and other US states

In the past 12 months we collected identifiers (an email address, a name, account identifiers, IP addresses), commercial information (your plan and when it renews), internet activity (pages visited, songs played) and what you create (studio requests and songs, notes, playlists), from you, your device and the sign-in and subscription services you use, for the purposes above.

We do not sell or share personal information for targeted advertising, and have not in the past 12 months. We collect no sensitive personal information and draw no profiles from what you do. Global Privacy Control signals are honored.

Decisions made by machines

Nothing about you with a legal or similarly significant effect is decided by automated means alone. A song reported by several people comes down on its own, and a person reviews it within a day.

Children

The station is not meant for children under 13, or under the age your country sets for agreeing to online services on your own (up to 16 in parts of Europe), and we do not knowingly collect their data. If you believe a child has made an account, write to us and we will delete it.

Changes and contact

When this policy changes, the date at the top changes with it. The Terms of Service cover the rest of how the station works. Questions go to hello@crimsonstation.com.