Privacy Policy

1. Who is responsible

The operator of demucs.net is responsible for the personal data processed through this website. You can reach us about anything in this policy at support@demucs.net.

2. What we collect

• Account details. If you sign up with an email address: your name, email address and password, which we store only as a one-way hash. If you sign in with Google: the name, email address and profile picture Google shares with us, and your Google account identifier.
• Audio you upload and the stems we produce. The file itself, its name, length and size, and the separated stems.
• Job records. For each separation: the model and settings you chose, its status, the credits it used, and when it ran. We record rejected separation attempts with the required and available credits, model and plan so we can diagnose credit limits.
• Billing records. If you buy credits or a plan: your payment provider customer ID, what you bought, when, and your subscription status. We also record checkout creation and confirmed payment amounts and currencies to reconcile purchases. Card details go directly to our payment provider and never reach us.
• Security signals. The IP address and browser user agent of each signed-in session, and standard server logs (the page or API requested, the time, and the IP address).
• Usage data. Cloudflare Web Analytics counts page views, where visitors came from and how fast pages load, without cookies and without identifying you. If you visit from outside the EEA, the United Kingdom and Switzerland, Google Analytics also records the pages you view and how you interact with them (such as scrolling, file downloads and clicks on links to other sites), your approximate location, your device and browser type and how you found us, and recognises your browser on later visits through a cookie.
• Visit sources. Where regional and browser privacy settings allow it, we record your first visit source and the source of the visit during which you register or begin checkout: a campaign label, referring domain, landing page name, approximate country and time. We link these records to your account and purchase to understand which sources lead to registrations and completed purchases. We do not store full referring URLs, search queries or advertising click IDs.
• Messages you send us. Emails to our support address, including anything you attach.

3. How we use it

• To provide the service — creating your account, separating your audio, letting you play and download the stems, and keeping track of your credits. We rely on our contract with you.
• To bill you and keep the records the law requires for purchases. We rely on our contract with you and on legal obligations.
• To protect the service and its users. Free credits cost us real GPU time, so before granting them we check that an account signed in with Google or confirmed its email address, that it was created from an ordinary browser, and how many accounts recently came from the same network. We also use these signals to detect abuse and attacks. We rely on our legitimate interest in keeping the service available and affordable.
• To understand how the site is used — which pages people read, where they come from and how quickly pages load — so we can improve it. We rely on our legitimate interest in running a useful website.
• To send you service emails — address verification, password resets and messages about your account or purchases. We do not send marketing newsletters.
• To comply with the law and to respond to lawful requests from authorities.

We do not sell your personal data, we do not use it for advertising, and we do not use your audio to train any model.

4. Your audio and the GPU provider

Demucs runs on graphics processors we rent from Replicate, Inc. When you start a separation, your file is stored in our cloud storage and Replicate receives a signed link to it that expires after one hour. Replicate runs the Demucs model and returns the stems, which we copy into our own storage for you. Replicate states that for requests made through its API, inputs, outputs, files and logs are deleted automatically after an hour.

Your audio is used only to produce your stems. Nobody at Demucs.net listens to it, and it is not used to train Demucs or any other model.

5. Who we share data with

We share personal data only with the service providers that run this site for us, and only what each one needs:

• Hosting, storage, email, security and analytics — Cloudflare, which runs the website, stores uploads and stems, sends our service emails, forwards mail sent to our support address and measures visits and page speed without cookies.
• Database — Neon, which hosts the database holding accounts, job records and credit balances.
• Audio processing — Replicate, as described in section 4.
• Sign-in — Google, if you choose to sign in with a Google account.
• Payments — Stripe or Dodo Payments, depending on your choice at checkout, process purchases and subscriptions. We pass account and order identifiers to the chosen provider. With Stripe, we also pass the visit-source snapshot described above when collection is allowed.
• Analytics — Google Analytics, only for visitors outside the EEA, the United Kingdom and Switzerland. Google signals and ad personalisation are turned off, so the data is not used to show you ads.

We may also disclose data when the law requires it, to protect our rights or the safety of others, or to a successor if the service is transferred — in which case this policy continues to apply.

6. Cookies and browser storage

These are set on demucs.net:

• Session cookie (session_token, with a site prefix) — keeps you signed in. Expires after 7 days, or when you sign out.
• Session cache cookie (session_data) — a short-lived copy of your session so pages load faster. Expires after one hour.
• Sign-in safety cookies — set briefly while you sign in with Google, to protect that exchange from forgery.
• Preference cookies — your language (NEXT_LOCALE) and whether the dashboard sidebar is open (sidebar_state, 7 days).
• Local storage — the ID of the separation you are working on (demucs:active-job), so a reload does not lose it. Cleared when you start another song.
• IndexedDB — if you choose a file and press Start before signing in, the file is kept in your browser for up to 30 minutes so the separation can continue after sign-in. It never leaves your device unless the separation starts.
• Visit-source cookie (demucs_acquisition) — remembers your first visit and the current visit source for up to 90 days from the first capture. It is not set in the EEA, the United Kingdom or Switzerland, when the country is unknown, or when your browser sends Global Privacy Control. Existing visit-source cookies are cleared when these restrictions apply. It contains no account ID.
• Analytics cookies — only if you visit from outside the EEA, the United Kingdom and Switzerland: Google Analytics sets _ga and _ga_<ID> to count visits. They last up to 13 months, and are not set at all if your browser sends a Global Privacy Control signal.

Cloudflare Web Analytics uses no cookies or browser storage. We do not use advertising or retargeting cookies. When you sign in with Google or pay through Stripe or Dodo Payments, you do so on their pages, and they set cookies there under their own policies. Our sign-up, sign-in and password-reset forms use Cloudflare Turnstile to tell people from bots; it runs from Cloudflare’s own domain and processes browser signals under Cloudflare’s privacy policy.

7. How long we keep it

• Uploaded audio: deleted as soon as its separation finishes, whether it succeeded or failed. Uploads that are rejected or never used are deleted within one day.
• Stems: 24 hours on the free plan, 7 days on Pro or with a credit pack, and 30 days on Studio, then deleted. You can delete them sooner from your dashboard at any time.
• Job and credit records: while your account exists, so you can see your history and we can answer billing questions.
• Account data, including visit-source snapshots: until you delete your account.
• Operational and payment totals: retained without the account link or visit-source snapshots after account deletion. These records contain no names, email addresses, audio filenames or full URLs.
• Server logs: kept by our hosting provider for up to 7 days.
• Analytics: Cloudflare Web Analytics stores no personal data. Google Analytics keeps event-level and user-level data for 2 months; after that only aggregate reports remain.
• Support emails: as long as needed to handle your request.

Deleting your account (Settings → Security) removes your separations and their audio from our storage straight away, followed by your account, sessions, job records and credit balance. Our payment provider keeps its own records of past purchases as the law requires.

8. International transfers

Our providers operate in the United States and other countries, so your data may be processed outside the country you live in. Where the law requires it, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses offered by those providers.

9. Security

Connections to the site are encrypted, passwords are stored only as hashes, and files in storage are reachable only through signed links that expire within an hour at most. No system is perfectly secure, but we limit what we keep and how long we keep it, which limits what could be exposed.

10. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy of it, object to or restrict how we use it, and withdraw consent where we rely on consent. You can delete your account yourself in Settings → Security; for anything else, email support@demucs.net. We answer within 30 days. You also have the right to complain to your local data protection authority.

11. Children

Demucs.net is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

When this policy changes, we update the date at the top. If a change materially affects how we use your data, we will tell you by email or on the site before it takes effect.

13. Contact

Questions or requests about your data: support@demucs.net.