Your songs, only for the people you choose

Only the people you invite get in

Your notes, audio and projects are visible to your account and to the people you invite to a project or to your band. Our server checks this on every request, not just the app.

If you remove someone, they lose access straight away, and if they were editing a note with you, they’re out of it within seconds. Invite codes have an attempt limit, so they can’t be guessed by trial and error.

Encrypted on the way to our servers

Everything that travels between the app or the web and our servers is encrypted with TLS (HTTPS): on your phone, on your computer and while you edit together with someone.

Encrypted while it’s stored, too

The disks behind our database, its backups and our audio storage are encrypted with AES-256 by our providers (Supabase and Google Cloud).

And your lyrics will get their own key. We’re adding encryption of its own to the title and text of your notes, and today it only works in part: we keep a copy of every note encrypted with AES-256, using a different key for each account, and those keys are protected by a master key in a vault (Supabase Vault), separate from the notes. But the working copy of the note is still stored without that extra encryption (the disk itself is encrypted). We’re completing it in phases.

Private audio and links that expire

Your demos and files live in private storage with public access blocked. They can only be downloaded through a personal link that expires after 15 minutes, once we’ve checked you have access. File names in storage are random.

Your music trains no AI

Auralis, our assistant, only works if you turn it on. It receives text, never your audio, and runs on Google Vertex AI in the European Union. Google does not use what you send to train its models, and neither does Zoundroom.

We’ve turned off Google’s cache, so it doesn’t keep your requests to answer faster. It may log one if it detects possible abuse.

Where your data is stored

The database is in Ireland and audio and files are in Belgium, both in the EU. The Auralis AI model runs in the EU as well.

Real-time co-editing goes through Cloudflare, in a data centre close to whoever opens the note, which may be outside the EU, and a copy of the note is stored there. Our providers are listed in our privacy policy .

Delete means delete

What you delete in the app is kept for 30 days at most (notes sit in the trash in case you change your mind) and is then deleted. If you delete your account, your content is deleted right away. In both cases, backups are gone within 7 days at most.

PIN lock

You can require a 4-digit PIN to open the app. Our server checks it, with an attempt limit, and stores it as a hash, never as-is. It protects the app on your phone; it doesn’t change how your data is stored.

Your phone, too

On Android, app data is left out of phone backups, and on iPhone the app’s folder isn’t visible in Files.

When you log out, switch accounts or delete your account, the app deletes the audio and files you downloaded from your phone. When you log out or switch accounts, only recordings that haven’t been uploaded yet stay, so you don’t lose them.