Soundfish privacy disclosure

Composition data

Soundfish stores the complete canonical composition after the# in its URL. Browsers do not send that fragment in an ordinary HTTP request. The editor can also retain compositions in IndexedDB on your device. Clearing Soundfish site data removes that local browser library.

Anyone who receives a complete Soundfish URL can read the composition. If you paste the URL into ChatGPT, Claude, or another hosted agent, that provider receives the fragment and CLI output under its own data policy. Provider-opening links contain neither the prompt nor the fragment; you choose whether to paste it.

Published audio

When you publish an album, its title, slug, description, details, track titles, revision numbers and dates, cover, and audio become public on the album page, your artist page, the embed, and their Markdown twins, together with your Hraness handle and, when your profile is published, its name and avatar. Drafts are visible only to you. Soundfish never shows revision notes or revision details to listeners.

Uploaded audio and cover images are stored in a private Cloudflare R2 bucket. Pages and embeds reach them only through short-lived signed addresses; there is no public bucket listing. Each upload is inspected after it arrives (duration, sample rate, channels, and a waveform for audio; dimensions for images), and metadata is stripped from cover images. Uploads that never complete expire after an hour. Unpublishing removes the public pages. Deleting a track or an album removes its pages and releases its storage; a scheduled maintenance run deletes the objects afterwards.

Listening, hearts, and comments

Listening needs no account. To count a play once and to limit abuse, album pages set a first-party cookie named __Host-soundfish-listener: a random identifier, Secure, HttpOnly, SameSite=Lax, valid for 30 minutes from the play that sets it; later plays do not extend it. The player also keeps that identifier in memory until you leave the page, and the next play that carries neither sets a new random identifier. Inside an embed, which cannot hold the cookie, only the in-memory identifier is used. It is not used for advertising or cross-site tracking and is never sent to a third party. Play records store the listener identifier, the track, and how much was heard; transient play and rate-limit records are pruned by an hourly job.

Hearts and comments need a Hraness sign-in. A heart stores your account identifier. A comment stores your account identifier, your handle, the text, the moment in the track if you chose one, and the revision that was current when you wrote it; it is shown publicly with your handle. You can delete your own comments from the album page.

Accounts, sync, and API tokens

Local editing does not require an account. If you sign in, Hraness Suite Accounts handles authentication and Soundfish associates cloud checkpoints with the resulting account identifier. Convex stores the canonical composition checkpoints needed for the synchronized library. Deleting a composition from My loops removes its account ownership and deletes canonical content after its final stored reference is gone.

Publishing needs a Hraness account with a username. Album pages show the name and avatar from your published Hraness profile, fetched from account.hraness.com and cached for ten minutes; an unpublished profile shows your handle alone. API tokens you create at /settings/tokens are shown once and stored as a SHA-256 hash with a label, creation time, and last-use time; the CLI keeps the token in a file only your user can read. Revoking a token stops it immediately.

Soundfish does not publish an automatic expiration period for cloud library checkpoints. Provider backups and security records can follow the hosting providers' own retention schedules.

Anonymous page analytics

The production site sends cookieless, memory-only page analytics to PostHog's US ingestion service: a pageview, a page leave, page speed measurements, a missing-page event, and a limited number of error reports. Each event contains the page address, the address of the site that linked to the page reduced to its domain, such as https://google.com, campaign and ad-click parameters such as utm_source when the link carried them, the browser, operating system, and screen size, and no stored identifier: PostHog groups a visit's events by a daily hash of the request address and browser. It creates no person profile, sets no cookie, and includes no other URL parameter, fragment, email address, composition content, account identity, automatic interaction event, or replay. Manage and settings pages send only a generic route with no parameters, and embeds on other sites send nothing.

Local development and preview deployments do not send these events. The application respects the browser's Do Not Track setting. Analytics waits for your acceptance where the regional policy requires it, or when the region is unknown. Elsewhere it can run without cookies before you respond. Declining stops analytics.

Soundfish mailing list

If you use the footer subscription form, your email address, the Soundfish list choice, the form source, and a short-lived Cloudflare Turnstile proof are sent to Hraness Accounts at account.hraness.com. Cloudflare verifies the anti-abuse proof. Hraness Accounts records dated consent, and Resend sends confirmation and subscribed messages from news.hraness.com. You are not subscribed until you confirm.

After confirmation, each newsletter message includes a Soundfish-specific unsubscribe link. Using it removes you from only the Soundfish list, without changing another product subscription or a separate general Hraness subscription.

Hosting and private-alpha processing

Vercel serves the website and can process ordinary request metadata needed to deliver and protect it. The optional synchronized library, the audio catalogue, plays, hearts, comments, and API token hashes use Hraness Suite Accounts and Convex as described above; published media is stored in Cloudflare R2.

The separate audio-to-MIDI API remains a private alpha and is not the public composition editor. Authorized callers must acknowledge rights and third-party processing before uploading audio. Soundfish sends the audio to Klangio for transcription. The checked service caps input retention at 24 hours and MIDI artifact retention at 30 days; its capability document records Klangio's result-retention period as 14 days.

Control and contact

• Remove local compositions by deleting Soundfish browser data.
• Remove a synchronized composition from My loops.
• Unpublish or delete an album or a track from its manage page.
• Delete your own comments from the album page.
• Revoke API tokens at /settings/tokens.
• Keep a fragment out of hosted agents when the composition is sensitive.

For a privacy question or account-data request, use the support path. Start with a public mention that asks for a private channel. Do not include a composition URL, account identifier, or other sensitive data in the public message.