Privacy

What runs where

Every tool on this site does its work in your browser. Audio is synthesized on your device from a seed and your settings. Your generated audio and imported music projects are not uploaded to us; there is no music upload endpoint.

Downloads are produced locally too, and the provenance certificate available with an unedited, licensed Studio export records only the inputs that made the audio: engine version, seed, and settings. It contains no account or payment details.

What is stored on your device

This site keeps the following in your browser's localStorage and IndexedDB:

• Your work: saved presets, playlists, A/B slots, shuffle settings, and editor projects.
• Your preferences: theme, volume, mute, and continuous play.
• Your license: the unlock code you entered and the signed license the server issued for it.

Clearing your browser's site data deletes the local copies. Export files you want to keep first. This does not delete files you exported or copies in cloud storage that you connected.

Your own cloud storage

A Studio license lets you connect Google Drive where this build is configured for it. Connection is optional; your work remains on this device when you do not connect. Once connected, presets, playlists, and saved editor projects can sync directly with a Sonodrift folder in your own Drive. This library data includes the settings and notes needed to recreate your tracks. It does not pass through Sonodrift's servers.

Google sign-in and storage are handled by Google. The browser holds the access token in memory, and access is limited to files created by this app or explicitly made available to it. Disconnecting stops this connection; it does not delete the files in your Drive. Manage those files and app access in your Google account.

What we collect

Product analytics is switched off in the current build. No analytics identifier is created and nothing is sent. If we turn it on, it is PostHog, and this is the complete list of what one event carries: the event name (for example hit_paywall), a random identifier stored in your browser and tied to no name, email, or account; which app you were in; the page URL and referrer, with any checkout credential stripped out; a timestamp; and the event's own properties. If you submit your email for a launch discount, that email is one of those properties.

We set no cookies at all, including for analytics or sessions.

When you buy a license

Payment is handled by Stripe on Stripe's own pages. Your card details never touch our servers or this site; we cannot see them.

Stripe holds the purchase record, and we write a small amount of information onto it so the purchase can be honored later: which product you bought, your email address as you gave it at checkout, a one-way handle derived from your unlock code, and timestamps for when the code was activated, refunded, or disputed. We keep no customer database of our own. Our license server stores no purchase records, so there is no user table here to breach, export, or lose.

Your unlock code is not stored anywhere either. It is derived from the payment each time it is needed, which is why we can re-send it to you and why an export of our records could never leak a working one.

Email

We send transactional email through Resend: your purchase email with the unlock code, a re-send if you ask for one, and a refund confirmation. We send no marketing, no newsletters, and no reminders.

A re-send always goes to the address on the Stripe record, never to an address typed into the form. That is deliberate: it means a request made by someone else can only ever deliver your code to your own inbox.

The feedback form

The current feedback page provides an email link. If a feedback form is enabled, it is delivered by Web3Forms straight to our mailbox. Alongside your message it carries the page you came from and the site's build number, so a bug report says which version it is about. Your name and email address are included only if you type them. Nothing else is attached: not your user agent, not anything held in your browser's storage.

There is no form on this site that sends us anything you did not type into it.

Our server, and what its logs hold

The site and its four license endpoints run on one host, Render, fronted by Cloudflare. Serving a request necessarily involves your IP address, and standard request logs are kept for a short period by those providers as part of running the service and defending it from abuse. Our own application log records one line per API call with the method, path, status, and duration, and no IP address.

To stop one visitor from flooding the license or recovery endpoints, the server keeps a counter in memory against a key derived from your network address. It is never written to disk, never associated with a purchase, and disappears when the process restarts.

What we never do

• No advertising, ad networks, or third-party trackers
• No cookies
• No selling or sharing of personal information, ever, to anyone
• Nothing is uploaded to Sonodrift's servers: what you create stays on your device, or in cloud storage of your own if you connect it
• No accounts and no passwords, so there is nothing of that kind to breach
• No profiling and no automated decisions about you

How long things are kept

• On your device: until you clear your browser's site data.
• Purchase records in Stripe: kept as long as tax, accounting, and consumer-protection law require us to keep them, which outlives any request to delete them.
• Email: Resend holds delivery records for a short operational window; we keep the messages we have exchanged with you for as long as needed to support you.
• Rate-limit counters: minutes to an hour, in memory only.

Your data, your call

Depending on where you live you may have the right to see what we hold about you, correct it, have it deleted, take a copy elsewhere, or object to how it is used. There is no account panel to do this from because there are no Sonodrift accounts. Write to us and we will do it by hand. We answer within 7 days, and we will not charge you or make you jump through hoops for asking.

The practical shape of it: almost everything about you that exists at all lives in Stripe as a purchase record. We can tell you exactly what that is, and delete anything the law does not require us to keep.

Children

Sonodrift is not directed at children, and we do not knowingly collect personal information from anyone under 13. The free tools need no information at all to use.

International

We are in the United States, and our processors (Stripe, Resend, Render, Cloudflare, Web3Forms, PostHog) operate internationally. If you use the site from outside the US, the limited information described above is handled in the US.

Changes

If this policy changes materially we will update the date below and say what changed. We will not make a quiet change that widens what we collect.

Last updated October 7, 2026. Clarified optional cloud storage and local library storage.