At Odyon, we engineer audio tools for the future. We believe data privacy deserves the same precision as our generative algorithms — so this policy describes, plainly and accurately, what we collect, where it goes, and what your choices are.
1. Who We Are & Scope
This Privacy Policy describes how Odyon Audio ("Odyon", "we") collects, uses, and shares personal data when you use the Odyon web platform, the Odyon Copilot, and the Odyon desktop plugin. For privacy questions or to exercise any of your rights described below, contact us at privacy@odyon.ai.
2. Data We Collect
Account data — when you sign up via our authentication provider (Clerk), we receive your email address, name, and a unique account ID, plus technical data such as IP address collected by Clerk for security. Creations & inputs — the sounds, MIDI sequences, projects, and presets you generate; the text prompts and lyrics you enter; audio files you upload for features such as MIDI extraction, stem separation, and Voice Swap. Copilot data — your assistant conversations, attachments you share with the assistant, and long-term preferences the assistant remembers (such as favorite genres or skill level). Transactional data — your plan, Gem balance and credit transaction history, and subscription status. Payments are processed by Lemon Squeezy as Merchant of Record; Odyon never receives or stores card numbers or other sensitive payment details. Feedback & usage data — feedback you submit in-app, including a copy of the prompt the feedback is about, and (only with your consent) product analytics as described in Section 5. Operational records — for each AI job we run for you we record which provider and model was used and what it cost, against your account and plan, so we can meter and price the service. Waitlist — if you join the waitlist before an account exists, our authentication provider collects the email address you give us, so we can tell you when access opens.
3. How Your Audio Is Processed
We want to be precise about what happens to your audio: — Live hum-to-MIDI pitch tracking runs locally in your browser. While you hum into the microphone, pitch detection happens on your device and the live audio stream is not sent to our servers. — Extract MIDI / stem separation: when you submit a recording or upload a file for extraction, that audio file (up to 20 MB) is uploaded to our audio-processing backend to be analyzed, and the resulting MIDI or stems are stored in your library. — Voice Swap & Vocal Studio: vocals you upload for voice conversion are sent to our voice-processing backend. The source vocal and the converted output are stored in your library (the source is retained for provenance and abuse-prevention purposes). Microphone access is only requested when you actively use a recording feature, and you can revoke it in your browser settings at any time.
4. Third-Party Processors
We use a small set of specialized providers to run Odyon. Each receives only the data needed for its role: — Clerk — authentication and account security (email, name, IP, session data). — Convex — our realtime database (your account record, library metadata, projects, Copilot chats and memory, credit transactions). — Cloudflare R2 — file storage (generated audio, MIDI files, presets, uploaded audio, Copilot attachments). — Replicate — AI audio generation; receives your prompts and, for some features, audio to process. — OpenAI — text-to-speech voice generation; receives the text you submit for vocal features. — Google (Gemini) — prompt enhancement and the Odyon Copilot; receives your messages, recent conversation history, studio context, and attachments you share with the assistant. — PostHog (EU) — product analytics and error monitoring, hosted in the EU, active only after you consent (see Section 5). — Lemon Squeezy — payment processing as Merchant of Record. — Vercel — web hosting and delivery. — Render — hosting for our audio- and voice-processing backends. — Slack / Discord — when you send in-app feedback, a notification carrying your alias or email, your plan, and your message is posted to our internal team channel so we can act on it. We do not sell your personal data. We do not currently use your uploads, creations or prompts to train our own generative models. If that changes, these limits will apply, and we will post the change here and show a notice in the app before it takes effect: — Studio plan: your creations and prompts are contractually excluded from model training. — Hobby and Pro plans: included by default, with an opt-out you will be able to use at any time, free of charge, from Account Settings. Opting out will cost you nothing and will limit no feature. — Vocals you upload for Voice Swap are never used to train any model, on any plan — the voice in a recording belongs to whoever sang it, and that is often someone who is not our user. — Your Copilot conversations are never used to train our models. — Audio from our sound-effect engine is never used to train any model, on any plan — the engine's own licence forbids it. The AI providers listed above process your prompts and audio under their own terms in order to return a result to you. We select providers and settings intended to keep that data out of their own model training, but we do not control their systems and cannot guarantee it for every provider.
6. Legal Bases (GDPR)
Where the GDPR applies, we process your data on the following bases: performance of our contract with you (operating your account, storing your creations, processing generations and payments); your consent (analytics cookies); and our legitimate interests (securing the platform, preventing abuse and fraud, defending legal claims, and improving and developing our products, models and features). Publishing creations to the public Explore gallery is part of the service as described in our Terms of Service, Section 7 — you can unpublish any creation from its own page, on any plan. Where we rely on legitimate interests you have the right to object at any time. Write to privacy@odyon.ai and we will action it. If we ever begin training our models on your content, the free opt-out described in Section 4 will be the way to exercise that right without writing to us.
7. Data Retention & Deletion
Your creations and account data are retained while your account is active. Temporary generations that you do not save are automatically deleted by our cleanup routines. You can delete your account yourself from Settings → Security → Privacy & Data. This immediately erases your creations, projects, stored audio and files, Copilot conversations and assistant memory, feedback, and credit history from our primary systems, and removes your login. A minimal billing record is retained where payment law requires it: it holds no name or account id — only the payment processor's order reference, which our payment processor can still resolve to you. In some cases it also holds a one-way hash of the purchase email. Product-analytics events held by our analytics provider (Section 5) are not covered by in-app deletion — email privacy@odyon.ai to have those erased. Copies may briefly persist in our infrastructure providers' encrypted backups before those rotate out. You can also email privacy@odyon.ai to have any personal data deleted.
8. Your Rights (GDPR / CCPA)
Depending on where you live, you have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time (without affecting prior processing). California residents additionally have the right to know what personal information we collect and to opt out of its sale — we do not sell personal information. You can download a copy of the data we hold in our own database (as a JSON file with links to every stored audio, MIDI and preset file) and delete your account directly from Settings → Security → Privacy & Data. That export covers your account, creations, projects, Copilot history, feedback and credit history. It does not include the product-analytics events described in Section 5, which are held by our analytics provider; email privacy@odyon.ai to receive or erase those. For any other request, or if you cannot access your account, email privacy@odyon.ai. We will respond within the timelines required by applicable law, and you also have the right to lodge a complaint with your local data-protection authority.
9. Data Location & International Transfers
Our analytics data is hosted in the European Union (PostHog EU Cloud). Other providers listed in Section 4 may process data in the United States or other countries. Where personal data is transferred outside the EEA, we rely on safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework certifications of our providers.
10. Security
All data is encrypted in transit using TLS, and our storage providers encrypt data at rest. Access to production systems is restricted and payment credentials never touch our servers. No online service can guarantee absolute security, so we also ask you to keep your account credentials confidential and to contact us immediately at privacy@odyon.ai if you suspect unauthorized access.
11. Children
Odyon is not directed at children under 13 (or under 16 in the European Economic Area without parental consent), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact privacy@odyon.ai and we will delete it.
12. Changes to This Policy & Contact
We may update this Privacy Policy as the platform evolves. When we make a significant change we will post the updated Policy here with a new date, and show a notice in the app on your next visit. Continued use of the platform after changes take effect constitutes acknowledgment of the updated policy. Contact: privacy@odyon.ai.