Privacy Policy

This explains what StemX collects, why, how long we keep it, and who else touches it. It covers stemx.app and the API.

The data controller is Shruti Jadhav, an individual trading as StemX, of 1st A Cross Rd, Nagavarapalya, C V Raman Nagar, Bengaluru, Karnataka 560093, India. For anything in this policy, including a request to access or delete your data, write to support@stemx.app.

What we collect

Your account. Your email address and whether it has been verified. If you signed up with a password, we store an argon2 hash of it — never the password itself. If you signed in with Google, we store the identifier Google gives us, not your Google password.

The audio you upload, the filename you uploaded it under, and the separated tracks we produce from it.

Job and usage records: when a separation ran, how long the audio was, whether it succeeded, and how many minutes it consumed against your allowance. We need these to enforce plan limits and to bill correctly.

IP addresses, as a keyed hash. So that a single source cannot exhaust the free tier or brute force a password, we record where a sign-up, a sign-in attempt and a preview came from — not as the address itself, but as a keyed hash of it that cannot be turned back into the address. We do not use it to profile you or to build an advertising audience, and we do not sell it.

API requests. If you use the API, we log each request: when it came, which key and route it used, the result, how long the audio was and how long it took. There is no IP address in it. We use it to show you your usage and to investigate problems.

How you found us. When you create an account, we store the campaign tags in the address of the first page you opened in that browser session (the utm_ parameters, if there were any), the name of the site that linked you here, and that first page's address. Until you sign up they stay in your browser's session storage, not in a cookie, and disappear when you close the tab. We use them only to learn which channels bring people to StemX; they are not shared, and deleting your account removes them.

Usage statistics. We count how people use the site with Umami, open-source analytics that we host ourselves on Google Cloud; no analytics company receives it. For each page view it records the page, the site that linked you here, your browser, operating system, device type, screen size and language, and the country, region and city looked up from your IP address. It stores neither the IP address nor a cookie. To tell one visit from the next it keeps a one-way hash of your IP address and browser details, mixed with a value that changes every month, so visits cannot be connected across months or traced back to you. It is not linked to your account. Page addresses are recorded without their query string, except campaign tags (utm_ parameters), and the addresses of preview results are removed in your browser before anything is sent. We also count a few named actions — choosing a file, opening the mixer, downloading a stem, opening checkout — with category values only, never your email, file names or job links.

A session cookie when you are signed in. It is strictly necessary to keep you signed in, which is why there is no cookie banner: we run no advertising, analytics or tracking cookies at all.

If you subscribe, a Paddle subscription identifier. We never see or store your card details — those go to Paddle directly.

Email we send

We only email you about your own account, its usage and its files.

• Always sent: verification and password reset links; a notice when a payment for your subscription fails; a notice when this month's plan minutes are used up or a split was refused for lack of minutes (at most once a month); and a list of full splits whose files are about to be deleted (at most once a day).
• Optional, on until you turn them off: a welcome email with tips once you verify your address; a reminder about a preview you made while signed in and haven't split, while it still exists (at most once a week); and a warning when you pass 80% of the month's plan minutes (at most once a month).

Turn the optional ones off in your account settings, or with the unsubscribe link at the end of each of those emails. To make sure none is sent twice, we keep a record of which of these emails we sent you and when; it is deleted with your account.

No marketing email without your consent. We send no newsletters or promotions. If that ever changes, we will ask first, with a separate opt-in that is off by default.

How long we keep things

Audio is deleted automatically by a scheduled sweep, not by request:

• Previews from anonymous visitors: 1 hour.
• Previews once you are signed in: 24 hours.
• Completed full separations: 3 days on Free, 7 days on Starter and Pro, 30 days on Scale, from when the job finished.

Account records and usage history are kept while your account exists, and billing records for as long as tax law requires after that. Abuse control records are short-lived and pruned on a rolling window.

Sign-up and sign-in throttle records (the keyed hashes above) are deleted after one day, expired jobs' records 7 days after they expire, and API request log entries after 30 days.

Usage statistics are kept while they help us understand how the site is used. They hold no IP address, cookie or account identifier.

Who else sees your data

We use these services, and no others touch your data:

• Google Cloud Platform — hosting, and the object storage your audio sits in while it exists.
• Paddle — payments. Paddle is our Merchant of Record and handles your payment details; we never receive them.
• Resend — delivers the email we send you: the verification and password links and the account notices described under “Email we send”.
• Google — only if you choose to sign in with Google.

We do not sell your data, and we do not share it with anyone for their own purposes. We would disclose it if the law compelled us to, and we would tell you unless legally prevented.

What we do not do

We do not train models on your audio. The separation models are third-party pretrained weights; nothing you upload is added to them or used to improve them. Your audio is processed to produce your result and then deleted on the schedule above.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account and everything attached to it. Write to support@stemx.app and we will act within 30 days.

Deleting your account removes your identity records, your job history, how you found us, the record of emails we sent you, your API keys and request log, and any audio still inside its retention window. Billing records we are required to keep are retained for that period and nothing more.

Depending on where you live you may also have the right to object to processing, to data portability, or to complain to your local data protection authority.

Security

Traffic is encrypted in transit. Passwords are stored as argon2 hashes. Download links are time-limited signed URLs rather than public addresses. Access to production data is limited to the people who operate the service.

No system is perfect. If we ever discover a breach affecting your data, we will tell you and the relevant authority as the law requires.

Changes

If this policy changes materially we will update the effective date above and email account holders before it takes effect. Questions: support@stemx.app.