Privacy Policy

Who is responsible

The controller of your personal data is the operator of Utabox, an individual developer based in Japan. We disclose the operator's name and postal address on request — just email support@utabox.app.

For any privacy question or request, email support@utabox.app.

What we collect

• Account data: your email address. If you sign in with Google, the name, profile picture and account ID Google shares with us. The display name and handle you choose.
• Your content: prompts, lyrics, stories, photos, style choices, messages to the song assistant, and the lyrics, songs, covers and videos we make for you.
• Activity: your credit balance and history, the songs you make, edit and share, plays of your public songs, and reports you send.
• Technical data: IP address, browser and device details, and server logs (time, request, errors), used to run, secure and fix the service.
• Messages: emails you send us, and the sign-in codes we email you.

We don't ask for sensitive information. Please don't put it — for example health details, or other people's private information — in prompts, lyrics or photos.

How we use it, and why

• To run Utabox: create your account, sign you in, make, store and edit your songs, run the assistant, and show the songs you share. (Legal basis: performing our contract with you.)
• To keep it safe: prevent abuse and fraud, check content against our policies, and handle reports and takedown requests. (Our legitimate interests and legal obligations.)
• To talk to you: sign-in codes, important notices about the service, and replies to your messages. (Contract and legitimate interests.)
• To improve it: find errors and see how features perform, using logs and aggregated data. (Legitimate interests.)
• To meet legal obligations, such as answering lawful requests from authorities.

We don't sell your personal data, and we don't share it for targeted advertising. We don't train our own AI models on your content. Automated checks may flag content for review, but we don't make decisions with legal or similarly significant effects about you based only on automated processing.

AI processing

To make your songs, we send what each task needs — prompts, lyrics, style descriptions, assistant messages and, for edits, your song's audio — to third-party AI providers, which process it and send back the result. Your prompts and lyrics go to the provider of the music model you choose:

• Google's Lyria music model, accessed through OpenRouter
• MiniMax and ElevenLabs music models, accessed through Cloudflare
• aimusicapi, which runs the editable (Suno-based) model for songs you can change part by part
• DeepSeek and MiniMax, for writing lyrics, for the chat assistant, and for safety checks: prompts, lyrics, comments and display names are checked against our rules before they're used or shown

These providers may process data outside your country, including in the United States and in Asia (for example China). Their own terms and privacy policies govern how long they keep inputs and whether they use them to improve their services. We send only what a task needs, and never your password (Utabox doesn't have one) or payment details.

Service providers

• Railway: our application servers, database (MySQL) and cache (Redis), in the United States.
• Cloudflare: website hosting and delivery, storage of audio, covers and uploads (R2), and sending email.
• Google: sign-in with Google.

We also share data when the law requires it, to protect people's rights and safety, or if Utabox is sold or merged — in which case we'll tell you. Songs you make public can be seen by anyone.

International transfers

We and our providers process data in the United States and other countries whose data-protection laws may differ from yours. Where EU or UK law applies, we rely on recognised safeguards such as adequacy decisions (including the EU–US Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses.

For users in Japan, we handle transfers in line with the Act on the Protection of Personal Information. You can ask us which countries data goes to and how it's protected.

How long we keep it

• Your account and songs: for as long as your account exists.
• Deleting a song takes it off every page and deletes its audio, cover, WAV and video files right away. Its remaining records (lyrics, prompts, assistant messages, edit history) are permanently deleted 30 days later.
• Deleting your account (Settings → Delete account) does the same for all your songs, deletes your profile picture and background, removes your email, display name and bio, removes your likes and follows, signs you out everywhere and stops songs still being made. Comments you left on other people's songs stay, without your name.
• Reports: we keep the reporter's IP address for 90 days, to deal with abuse of reporting.
• Backups: we don't currently keep database backups beyond our hosting provider's (Railway's) short-term recovery window.
• Logs: our hosting providers (Railway, Cloudflare) keep server logs for their standard periods. Sign-in codes expire within minutes.

We may keep some data longer where the law requires it or to deal with a legal claim.

Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, or send it to you in a portable format, and you can object to or ask us to restrict some uses. Where we rely on your consent, you can withdraw it at any time.

You can delete your account yourself in Settings. For a copy of your data, email support@utabox.app from your account address and we'll send it within 30 days. For other requests, email us the same way; we'll reply within one month, or sooner if the law requires.

In the EU or UK, you can also complain to your local data-protection authority. In Japan, you can contact the Personal Information Protection Commission.

California residents have the right to know, delete and correct their personal information and not to be treated differently for using these rights. We don't sell or share personal information as the CCPA defines those terms.

Cookies and local storage

We only store what Utabox needs to work:

• your sign-in tokens, in your browser's local storage;
• your theme choice, in local storage;
• your language choice, in a cookie (utabox-locale).

We don't use analytics or advertising cookies or trackers. If that changes, we'll update this policy and ask for your consent where required.

Children

Utabox isn't for children under 13 (or under 16 where the law requires). We don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.

Security

We use encrypted connections (HTTPS), access controls and established infrastructure providers. No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.

Changes to this policy

We may update this policy. If a change matters, we'll tell you in the app or by email before it takes effect.

Contact

Utabox (operated by an individual developer based in Japan)

Email: support@utabox.app