Privacy Policy

1. Who is responsible

The operator of demucs.net is responsible for the personal data processed through this website. You can reach us about anything in this policy at support@demucs.net.

2. What we collect

• Account details. If you sign up with an email address: your name, email address and password, which we store only as a one-way hash. If you sign in with Google: the name, email address and profile picture Google shares with us, and your Google account identifier.
• Audio you upload and the stems we produce. The file itself, its name, length and size, and the separated stems.
• Job records. For each separation: the model and settings you chose, its status, the credits it used, and when it ran.
• Billing records. If you buy credits or a plan: your payment provider customer ID, what you bought, when, and your subscription status. Card details go directly to our payment provider and never reach us.
• Security signals. The IP address and browser user agent of each signed-in session, and standard server logs (the page or API requested, the time, and the IP address).
• Usage data. Cloudflare Web Analytics counts page views, where visitors came from and how fast pages load, without cookies and without identifying you.
• Messages you send us. Emails to our support address, including anything you attach.

3. How we use it

• To provide the service — creating your account, separating your audio, letting you play and download the stems, and keeping track of your credits. We rely on our contract with you.
• To bill you and keep the records the law requires for purchases. We rely on our contract with you and on legal obligations.
• To protect the service and its users. Free credits cost us real GPU time, so before granting them we check that an account signed in with Google or confirmed its email address, that it was created from an ordinary browser, and how many accounts recently came from the same network. We also use these signals to detect abuse and attacks. We rely on our legitimate interest in keeping the service available and affordable.
• To understand how the site is used — which pages people read, where they come from and how quickly pages load — so we can improve it. We rely on our legitimate interest in running a useful website.
• To send you service emails — address verification, password resets and messages about your account or purchases. We do not send marketing newsletters.
• To comply with the law and to respond to lawful requests from authorities.

We do not sell your personal data, we do not use it for advertising, and we do not use your audio to train any model.

4. Your audio and the GPU provider

Demucs runs on graphics processors we rent from Replicate, Inc. When you start a separation, your file is stored in our cloud storage and Replicate receives a signed link to it that expires after one hour. Replicate runs the Demucs model and returns the stems, which we copy into our own storage for you. Replicate states that for requests made through its API, inputs, outputs, files and logs are deleted automatically after an hour.

Your audio is used only to produce your stems. Nobody at Demucs.net listens to it, and it is not used to train Demucs or any other model.

5. Who we share data with

We share personal data only with the service providers that run this site for us, and only what each one needs:

• Hosting, storage, email, security and analytics — Cloudflare, which runs the website, stores uploads and stems, sends our service emails, forwards mail sent to our support address and measures visits and page speed without cookies.
• Database — Neon, which hosts the database holding accounts, job records and credit balances.
• Audio processing — Replicate, as described in section 4.
• Sign-in — Google, if you choose to sign in with a Google account.
• Payments — Stripe, which processes purchases and subscriptions.

We may also disclose data when the law requires it, to protect our rights or the safety of others, or to a successor if the service is transferred — in which case this policy continues to apply.

6. Cookies and browser storage

These are set on demucs.net:

• Session cookie (session_token, with a site prefix) — keeps you signed in. Expires after 7 days, or when you sign out.
• Session cache cookie (session_data) — a short-lived copy of your session so pages load faster. Expires after one hour.
• Sign-in safety cookies — set briefly while you sign in with Google, to protect that exchange from forgery.
• Preference cookies — your language (NEXT_LOCALE) and whether the dashboard sidebar is open (sidebar_state, 7 days).
• Local storage — the ID of the separation you are working on (demucs:active-job), so a reload does not lose it. Cleared when you start another song.
• IndexedDB — if you choose a file and press Start before signing in, the file is kept in your browser for up to 30 minutes so the separation can continue after sign-in. It never leaves your device unless the separation starts.

Cloudflare Web Analytics uses no cookies or browser storage. We do not use analytics, advertising or retargeting cookies. When you sign in with Google or pay through Stripe, you do so on their pages, and they set cookies there under their own policies. Our sign-up, sign-in and password-reset forms use Cloudflare Turnstile to tell people from bots; it runs from Cloudflare’s own domain and processes browser signals under Cloudflare’s privacy policy.

7. How long we keep it

• Uploaded audio: deleted as soon as its separation finishes, whether it succeeded or failed. Uploads that are rejected or never used are deleted within one day.
• Stems: 24 hours on the free plan and 7 days on paid plans, then deleted. You can delete them sooner from your dashboard at any time.
• Job and credit records: while your account exists, so you can see your history and we can answer billing questions.
• Account data: until you delete your account.
• Server logs: kept by our hosting provider for up to 7 days.
• Analytics: Cloudflare Web Analytics stores no personal data.
• Support emails: as long as needed to handle your request.

Deleting your account (Settings → Security) removes your separations and their audio from our storage straight away, followed by your account, sessions, job records and credit balance. Our payment provider keeps its own records of past purchases as the law requires.

8. International transfers

Our providers operate in the United States and other countries, so your data may be processed outside the country you live in. Where the law requires it, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses offered by those providers.

9. Security

Connections to the site are encrypted, passwords are stored only as hashes, and files in storage are reachable only through signed links that expire within an hour at most. No system is perfectly secure, but we limit what we keep and how long we keep it, which limits what could be exposed.

10. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy of it, object to or restrict how we use it, and withdraw consent where we rely on consent. You can delete your account yourself in Settings → Security; for anything else, email support@demucs.net. We answer within 30 days. You also have the right to complain to your local data protection authority.

11. Children

Demucs.net is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

When this policy changes, we update the date at the top. If a change materially affects how we use your data, we will tell you by email or on the site before it takes effect.

13. Contact

Questions or requests about your data: support@demucs.net.