Privacy Policy

Last updated: August 19, 2026 · Effective August 19, 2026

Music Tracker (musictracker.io) is an AI-powered analytics platform for electronic music producers and DJs (the "Services"). It is created, owned, and operated by Stefan Pavlović (the "Platform Owner", "Owner", "we", "us", or "our"), acting as an individual under the laws of the Republic of Serbia. The Platform Owner is the data controller for the personal information described below.

This Privacy Notice describes how and why we collect, store, use, and share your personal information when you use the Services. We process personal data in accordance with the Serbian Law on Personal Data Protection, which is harmonized with the EU General Data Protection Regulation (GDPR).

Reading this notice will help you understand your privacy rights and choices. If you have any questions, contact us at privacy@musictracker.io.

1. Information We Collect

As data controller, the Platform Owner determines the purposes and means of processing. We process your personal information solely to provide you with the Services, an analytics platform that helps you improve your artistic work as a producer or DJ, and for no unrelated purpose.

Information you provide

When you register or use the Services, we collect: your email address and display name; a password if you sign up with email/password (stored only as a salted bcrypt hash — never in plaintext); contact preferences; and content you create such as search history, monitored tracks, gigs, setlists, and demo analysis results.

Your shareable artist profile

You can build a visit card on your own page to introduce yourself to labels, promoters, or collaborators. It shows only what you choose to put there: your nickname, display name, avatar, bio, genres, social links, and a featured mix or track. It contains no account or billing data, and your technical rider is never part of this page (it is included only in the PDF version of the visit card, if you add it).

We do not share this profile information with anyone. The page opens only through a link we generate for you, which carries a key that cannot be guessed from your artist name. You alone, at your own initiative, may pass that link to a third party so they can view your profile. By sharing it, you are responsible for that sharing and for the accuracy and truthfulness of the information you place on your profile. Anyone who then has that link can open the page, so treat what you put there as information you are publishing yourself. We ask search engines not to index these pages, and you can change or empty your profile, or stop sharing it, at any time from your profile settings.

Demo audio you submit

Audio you submit to Demo Analyzer is processed to extract technical characteristics (BPM, key, energy, waveform shape). The audio file itself is deleted automatically once the analysis completes; we keep only the resulting analysis and a waveform visualisation, and never the recording. Stem separation and remix tools are currently in limited beta and are not available on general accounts. Where they are enabled, the audio is sent transiently to Replicate (running the Demucs model) to produce stems, is used for no other purpose, and is not retained by us.

Information collected automatically

When you visit the Services we automatically collect technical data such as IP address, browser and device characteristics, operating system, language preferences, referring URLs, and information about how you use the Services. This is collected via log files and similar technologies and is used mainly to operate and secure the Services.

Payment data

If you subscribe, payment is handled and stored entirely by Lemon Squeezy as merchant of record. We never see or store your full card details. See Lemon Squeezy's privacy notice.

Google API

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services

Some features use YouTube API Services to fetch public video and comment data (such as view counts, related videos, and top comments) for in-app analytics. Your use of these features is subject to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy. We use this data only to display results in the app; we do not download, re-host, or sell YouTube content.

We do not knowingly collect sensitive personal information (e.g. racial or ethnic origin, health, or biometric identifiers).

2. How We Use Your Information

Create and manage your account and authenticate you
Provide, maintain, and improve the Services
Respond to your inquiries and offer support
Send administrative information (security alerts, billing, policy changes)
Send track-monitoring notifications when milestones are reached
With your consent, send marketing communications (you can opt out at any time)
Prevent fraud and abuse, and keep the Services secure
Analyse usage trends to improve the platform

We never:

Sell your personal data
Share your personal data with advertisers
Use your audio for any purpose other than producing your requested result
Send marketing emails without your consent

3. Legal Bases for Processing

The Serbian Law on Personal Data Protection (harmonized with the GDPR), and the GDPR itself for users in the EEA or UK, require a valid legal basis for processing. Depending on the data, we rely on:

Performance of a contract — your account details (email, name, password) and the content you create (search history, demo analyses, saved profiles, gigs, setlists), which we need to provide the Services. Kept while your account is active.
Consent — optional analytics cookies and marketing emails. You can withdraw at any time, and we delete the related data on request, even while your account is active.
Legal obligations — billing and payment records, retained as long as tax and accounting law requires.
Legitimate interests — keeping the Services secure and preventing fraud or abuse, and improving them through aggregate analysis (balanced against your rights). You may object to this processing.

4. When & With Whom We Share

We share personal data only with vendors who process it on our behalf under a contract (and, where applicable, a Data Processing Agreement):

Authentication

Google Sign-In and email/password via NextAuth.js

Hosting

Vercel

Database

Supabase (PostgreSQL, EU — Frankfurt)

Infrastructure & Backup

Cloudflare (DNS, email routing, Turnstile, R2 backup storage)

Transactional Email

Resend

Payments & Invoicing

Lemon Squeezy (merchant of record)

Analytics (opt-in)

Microsoft Clarity — loaded only with your consent

AI & Audio Processing

Groq, Voyage AI, Replicate, ACRCloud (EU region)

Music Metadata & Search

Discogs, Last.fm, YouTube Data API, MixesDB, Google Custom Search. These lookups use track/artist names — we do not send your personal account data to them.

Audio processing (Replicate, ACRCloud). We send only your audio to these providers — never your account details or other personal data — and the audio is not passed on to any third party. They are bound by confidentiality (NDA) terms that protect your demo recordings from unauthorized sharing, copying, or use, and process the audio solely to produce the result you requested.

We may also share data in connection with a business transfer (merger, acquisition, or sale of assets). Our processors are contractually bound to protect your data and use it only as we instruct.

5. Cookies & Tracking

We use essential cookies (login session, CSRF token, Cloudflare Turnstile, and your cookie choice) that are required for the Services to work.

Optional analytics(Microsoft Clarity) load only if you click "Accept all" in our cookie banner. If you choose "Essential only", they are never loaded.

We do not use advertising or retargeting cookies. Full details are in our Cookie Policy.

6. AI-Based Features

Some features use AI/ML provided by third-party processors (Groq, Voyage AI, Replicate, ACRCloud). When you use them, the relevant input (e.g. extracted audio features, a DJ name, or audio for stem separation) is processed by these providers to generate your result.

AI-generated output (demo feedback, label recommendations, DJ DNA, set suggestions) is advisory only. We do not use it to make decisions that produce legal or similarly significant effects about you. You can avoid AI features by simply not using them.

7. Google Sign-In

You may register or log in using your Google account. When you do, we receive basic profile information (your name, email address, and profile picture) from Google to create and identify your account. We use this only as described in this notice. We recommend reviewing Google's privacy policy to understand how they handle your data.

8. International Data Transfers

Our database is hosted in the EU (Germany). Some processors operate in the United States or globally, so some data may be processed outside your country:

Personal data (e.g. your email and name, IP address and usage data) is transferred to hosting, email and analytics providers — Vercel, Cloudflare, Resend, and (with your consent) Microsoft Clarity.
AI processors (Groq, Voyage AI, Replicate, ACRCloud) receive only the content needed to produce your result — such as extracted audio features or track/artist names — not your account identity.

Where we transfer personal data out of the EEA or UK to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) and equivalent UK safeguards with those processors. Copies can be provided on request.

9. Data Retention

We keep your personal data only until the purpose for which it was collected is fulfilled, in accordance with the retention periods set out below (and any longer period required by law):

Account & content data: kept while your account is active
Inactive free accounts: deleted after 6 months of inactivity
Search history: last 50 searches, auto-pruned
Demo audio: deleted automatically once the analysis completes; only the analysis results are kept
Contact form messages: retained for 90 days
Cached API data: expires after 24 hours
Billing records: retained as required by tax/accounting law

When you delete your account, your associated data is removed from our active database immediately, and from our encrypted backups within 30 days (except records we must keep by law). You can export all your data at any time from your profile.

10. Data Security

All data is transmitted over HTTPS (TLS)
Database encrypted at rest and in transit (Supabase, EU region)
Passwords stored as salted bcrypt hashes; Google OAuth also supported
Payment processing via Lemon Squeezy (PCI-DSS compliant)
Demo audio is deleted automatically once the analysis completes; only extracted results are saved
Daily encrypted database backups; regular security reviews

No method of transmission or storage is 100% secure, so we cannot guarantee absolute security, but we work hard to protect your information.

11. Children's Privacy

The Services are not directed to children. In line with our Terms and Conditions, you must be at least 16 years old to create an account. We do not knowingly collect data from anyone below that age. If you believe a minor has provided us data, contact privacy@musictracker.io and we will delete it.

12. Your Privacy Rights

Depending on where you live (EEA, UK, Switzerland, and others), you may have the right to:

Access — request a copy of the data we hold about you
Rectification — correct inaccurate data
Erasure — request deletion of your account and data
Portability — export your data in a machine-readable format
Restriction / objection — limit or object to certain processing
Withdraw consent — at any time, where processing is based on consent

Exercise these rights from your profile (export and delete are built in) or by emailing privacy@musictracker.io. We respond in line with applicable law.

If you have any concern about how we handle your personal data, please contact us first at privacy@musictracker.io so we can address it. If you remain unsatisfied, you may address the Commissioner for Information of Public Importance and Protection of Personal Data (Poverenik, poverenik.rs); users in the EEA or UK may contact their local data protection authority.

13. Do-Not-Track & Global Privacy Control

Because there is no finalised industry standard for Do-Not-Track (DNT) browser signals, we do not currently respond to them.

We do honour Global Privacy Control (GPC)signals where applicable. If your browser sends a GPC signal, we treat it as a valid opt-out of any "sale" or "sharing" of personal information under applicable US state laws.

14. US State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Virginia, or another US state with a privacy law, you may have the right to know, access, correct, delete, and obtain a copy of your personal data, and to opt out of its "sale"/"sharing" for targeted advertising — which we do not do. You also have a right to non-discrimination for exercising these rights.

Categories of personal information we may collect include: identifiers (name, email, IP), commercial information (purchase history), internet activity (search history, usage), geolocation (approximate), audio/electronic information (uploaded for analysis — not retained), professional information, and inferences. We do not collect biometric or sensitive personal information.

To exercise your rights, email privacy@musictracker.io. We will verify your identity before responding and you may appeal a declined request.

15. Updates to This Notice

We may update this notice from time to time. The "Last updated" date at the top reflects the latest version. For material changes (such as a new category of data, a new processor, or a change to retention periods or legal bases), we will notify you by email and/or an in-app notice at least 30 days before they take effect.

16. Contact

Questions or requests about this notice or your data can be directed to us:

Stefan Pavlović, Platform Owner and data controller (Serbia)
Email: privacy@musictracker.io
Contact form: musictracker.io/contact

You can review, update, or delete your data at any time from your profile.