// legal

Privacy Policy

Last updated: September 17, 2026

1. Introduction

This Privacy Policy explains how Music Shorts AI (the "Service") collects, uses, stores, discloses, and protects information when you use the website, accounts, the credit system, song and video generation workflows, public song pages, and related tools. Our Terms of Service also apply.

If you do not agree with this policy, do not use the Service.

2. Information We Collect

Depending on the features you use, we may collect or process:

  • Account information: email address, name, sign-in method (password, magic link, or social provider), session data, and authentication metadata
  • Billing and credits: plan, purchases, refunds, Stripe customer references, and credit balance and usage
  • Creation data: prompts, lyrics, uploaded files, reference images, generation settings, generated songs and videos, task IDs, provider responses, and related metadata
  • Usage and device data: pages and features used, timestamps, IP address, approximate location derived from IP, browser and device information, logs, rate-limit data, and fraud-prevention signals
  • Support and communication: support messages, feedback, contact-form submissions, and newsletter subscriptions

Anonymous Guest Experience

When anonymous generation is enabled, we issue a signed random Guest session and use purpose-specific cryptographic hashes derived from limited network, browser, and device signals to enforce free-use limits, prevent automated abuse, and protect the shared daily credits budget. Cloudflare Turnstile may process challenge and network information under its own terms.

Guest funnel analytics is limited to product, stage, stable result or error code, credits, mode, watermark status, and sign-in conversion state. We do not intentionally send Guest IDs, raw IP addresses, device or fingerprint hashes, session or Turnstile tokens, prompts, or upload URLs to analytics providers.

Unless a longer period is required for security, legal, or abuse investigations, guest source files are scheduled for deletion after 24 hours, watermarked guest results after 7 days, and inactive unblocked risk-signal hashes after 90 days. Scheduled deletion may complete later because of processing queues, outages, or backups. Signing in does not automatically attach prior anonymous files or results to the account.

3. How We Use Information

We use information to:

  • Provide, secure, and improve the Service
  • Process AI generation requests, uploads, downloads, accounts, credits, payments, refunds, and support requests
  • Prevent abuse, enforce limits, troubleshoot failures, and monitor service quality
  • Communicate operational notices, product updates, and support responses
  • Comply with legal, tax, accounting, security, and platform obligations
  • Establish, exercise, or defend legal claims

4. AI Processing and Moderation

To complete a generation request, prompts, uploaded files, settings, and related technical information may be transmitted to one or more AI model or infrastructure providers (for music generation, video generation, or both). The providers involved may depend on model selection, availability, region, performance, safety, or other operational factors.

We and our providers may run automated content moderation before or after generation. Where reasonably necessary — for example, to investigate reports, provide support, prevent abuse, or comply with the law — authorized personnel may review limited content or metadata.

Do not upload content about other people unless you have their authorization and all necessary permissions. Avoid submitting confidential, regulated, or highly sensitive information unless the workflow explicitly supports it.

5. How We Share Information

We may share information, to the extent reasonably necessary, with:

  • AI model, inference, storage, and content-delivery providers
  • Payment processing and fraud-prevention providers (Stripe)
  • Authentication, email, customer-support, analytics, and security providers
  • Professional advisers, auditors, or counterparties where appropriate
  • Law enforcement, regulators, courts, or other competent authorities where required or permitted by law
  • Successors or transaction parties in a merger, acquisition, financing, reorganization, or asset sale, subject to appropriate safeguards

Third-party websites and services linked from the Service have their own privacy practices. Review their policies before providing information to them.

6. Uploads, Outputs, and Public Sharing

Uploaded content and generated outputs may be stored temporarily or persistently depending on product configuration, your plan, public/private visibility choices, moderation needs, provider requirements, and operational logs.

If you publish a song or video to a public song page, that content — including its title, lyrics, audio, and video — becomes accessible to anyone with the link until you change its visibility or delete it.

7. Retention

We retain information only as long as reasonably needed for the purposes described in this policy, including service delivery, account management, credit and billing records, dispute resolution, safety, abuse prevention, legal compliance, and backups. Retention periods vary by data type, plan, provider requirements, and legal obligations. When information is no longer needed, we may delete, de-identify, or aggregate it. Residual copies may persist temporarily in backups or security records.

8. Security

We use reasonable technical and organizational measures to protect information. No system is perfectly secure, and AI and cloud providers may introduce operational risks outside our direct control. Keep your credentials confidential and report suspected unauthorized access promptly.

9. Your Choices and Rights

Depending on your location, you may have the right to request access, correction, deletion, export, or restriction of certain personal information, or to object to certain processing. These rights may be limited by identity verification, technical necessity, security, fraud prevention, billing records, legal obligations, or the rights of others.

To submit a privacy request, email [email protected] with the subject line "Privacy Request". We may ask for information reasonably necessary to verify your identity and locate the relevant account or data.

10. Cross-Border Processing

Our providers and operations may process information in countries other than your country of residence, where data protection laws may differ. Where required, we rely on appropriate contractual or legal mechanisms for cross-border transfers.

11. Children's Privacy

The Service is not intended for children under 13, or below the minimum age required in your jurisdiction, whichever is higher. Accounts and paid features additionally require the age of legal majority (see our Terms of Service). We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

12. Changes to This Policy

We may update this Privacy Policy as the Service, providers, practices, or laws change. We will post the updated version on this page with a new effective date and provide additional notice where required.

13. Contact

For questions or privacy requests, contact us at [email protected].