At Odyon, we engineer audio tools for the future. We believe data privacy deserves the same precision as our generative algorithms — so this policy describes, plainly and accurately, what we collect, where it goes, and what your choices are.
1. Who We Are & Scope
This Privacy Policy describes how Odyon Audio ("Odyon", "we") collects, uses, and shares personal data when you use the Odyon web platform, the Odyon Copilot, and the Odyon desktop plugin. For privacy questions or to exercise any of your rights described below, contact us at privacy@odyon.ai.
2. Data We Collect
Account data — when you sign up via our authentication provider (Clerk), we receive your email address, name, and a unique account ID, plus technical data such as IP address collected by Clerk for security. Creations & inputs — the sounds, MIDI sequences, projects, and presets you generate; the text prompts and lyrics you enter; audio files you upload for features such as MIDI extraction, stem separation, and Voice Swap. Copilot data — your assistant conversations, attachments you share with the assistant, and long-term preferences the assistant remembers (such as favorite genres or skill level). Transactional data — your plan, Gem balance and credit transaction history, and subscription status. Payments are processed by Lemon Squeezy as Merchant of Record; Odyon never receives or stores card numbers or other sensitive payment details. Feedback & usage data — feedback you submit in-app, and (only with your consent) product analytics as described in Section 5.
3. How Your Audio Is Processed
We want to be precise about what happens to your audio: — Live hum-to-MIDI pitch tracking runs locally in your browser. While you hum into the microphone, pitch detection happens on your device and the live audio stream is not sent to our servers. — Extract MIDI / stem separation: when you submit a recording or upload a file for extraction, that audio file (up to 20 MB) is uploaded to our audio-processing backend to be analyzed, and the resulting MIDI or stems are stored in your library. — Voice Swap & Vocal Studio: vocals you upload for voice conversion are sent to our voice-processing backend. The source vocal and the converted output are stored in your library (the source is retained for provenance and abuse-prevention purposes). Microphone access is only requested when you actively use a recording feature, and you can revoke it in your browser settings at any time.
4. Third-Party Processors
We use a small set of specialized providers to run Odyon. Each receives only the data needed for its role: — Clerk — authentication and account security (email, name, IP, session data). — Convex — our realtime database (your account record, library metadata, projects, Copilot chats and memory, credit transactions). — Cloudflare R2 — file storage (generated audio, MIDI files, presets, uploaded audio, Copilot attachments). — Replicate — AI audio generation; receives your prompts and, for some features, audio to process. — OpenAI — text-to-speech voice generation; receives the text you submit for vocal features. — Google (Gemini) — prompt enhancement and the Odyon Copilot; receives your messages, recent conversation history, studio context, and attachments you share with the assistant. — PostHog (EU) — product analytics and error monitoring, hosted in the EU, active only after you consent (see Section 5). — Lemon Squeezy — payment processing as Merchant of Record. — Vercel — web hosting and delivery. — Render — hosting for our audio- and voice-processing backends. We do not sell your personal data, and your uploads and creations are not used to train our base generative models.
6. Legal Bases (GDPR)
Where the GDPR applies, we process your data on the following bases: performance of our contract with you (operating your account, storing your creations, processing generations and payments); your consent (analytics cookies, publishing creations to the public gallery); and our legitimate interests (securing the platform, preventing abuse and fraud, and defending legal claims).
7. Data Retention & Deletion
Your creations and account data are retained while your account is active. Temporary generations that you do not save are automatically deleted by our cleanup routines. Copilot conversations and assistant memory currently do not have an in-app deletion control — to have them (or any other personal data) deleted, email privacy@odyon.ai and we will process the request. When you delete your account, we delete your personal data and stored files from our primary systems within 30 days; encrypted backups may persist for up to 90 days for disaster recovery before being purged.
8. Your Rights (GDPR / CCPA)
Depending on where you live, you have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time (without affecting prior processing). California residents additionally have the right to know what personal information we collect and to opt out of its sale — we do not sell personal information. To exercise any of these rights, email privacy@odyon.ai. We will respond within the timelines required by applicable law, and you also have the right to lodge a complaint with your local data-protection authority.
9. Data Location & International Transfers
Our analytics data is hosted in the European Union (PostHog EU Cloud). Other providers listed in Section 4 may process data in the United States or other countries. Where personal data is transferred outside the EEA, we rely on safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework certifications of our providers.
10. Security
All data is encrypted in transit using TLS, and our storage providers encrypt data at rest. Access to production systems is restricted and payment credentials never touch our servers. No online service can guarantee absolute security, so we also ask you to keep your account credentials confidential and to contact us immediately at privacy@odyon.ai if you suspect unauthorized access.
11. Children
Odyon is not directed at children under 13 (or under 16 in the European Economic Area without parental consent), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact privacy@odyon.ai and we will delete it.
12. Changes to This Policy & Contact
We may update this Privacy Policy as the platform evolves. We will notify you of significant changes via the email address associated with your account or through an in-app notice. Continued use of the platform after changes take effect constitutes acknowledgment of the updated policy. Contact: privacy@odyon.ai.