COSMIC
Privacy Policy
Your audio. We use your audio only to analyse it. We delete it when the analysis ends, we never use it for model training or subsequent testing, and we do not sell, share or publish it. Only the cloud providers that run the service for us handle it, as described in Section 5. What we do keep is a hash and an acoustic fingerprint of the recording, and its result, described in Section 2 and Section 6.
1. Who we are and what this Policy covers
This Privacy Policy describes how Angelware, the company behind COSMIC ("COSMIC", "we", "us" or "our") collects, uses, discloses and retains personal data in connection with the website at cosmic.audio, the COSMIC analysis service and the COSMIC API (together, the "Service"), and the rights available to you. For the purposes of the EU and UK General Data Protection Regulations, Angelware, the company behind COSMIC, is the controller of the personal data described here. Capitalised terms not defined here have the meaning given in our Terms of Service.
2. Information we collect
2.1 Audio you submit. When you upload a file, or submit a link from which we retrieve audio on your behalf, we receive the audio file, its file name, its technical properties (such as format, duration, sample rate and channel count) and certain embedded metadata tags relevant to the analysis. An uploaded file is sent from your browser straight to a private cloud storage bucket, through a link that works only for that upload and expires. We do not keep a link as you pasted it. From it we rebuild the track's address: for a listed service, that service's standard address for the track (including the private part of a private SoundCloud link); for a direct file link, the file's address without the part after "#", and a file name taken from it. That address, and for a listed service the track's title and artist name as the service gives them, are kept with that analysis's result so the result can name the track and link back to it, and are deleted when the result expires.
2.2 Identifiers derived from audio. To recognise a recording that has been submitted before, we compute and store a cryptographic hash of the submitted file, a cryptographic hash of the decoded audio, and an acoustic fingerprint (Chromaprint). These identifiers cannot be played back or converted back into audio. However, they can be used to determine whether a particular recording was submitted to the Service by anyone holding a copy of that recording, and we therefore treat them as personal data where they are linked to you, and handle them with the same care as the results they point to.
2.3 Results. The analysis result for each submission, including scores, verdicts and supporting evidence, and a cached copy of the result associated with the derived identifiers so that identical audio need not be analysed again. The provenance and watermark check results for a file are also kept with that file's hash, with no account or address, so that the same file sent again need not be checked again. If you use "Copy link" on a result from the website, we create a separate random share identifier for it. Anyone who has the link can open that result until the result expires (24 hours). The shared view shows the result, and for a pasted link the track's title, artist and address, but not the file name, file hash or metadata tags, and it cannot be used to delete or change the analysis. Results from API keys cannot be shared this way.
2.4 Visitors without an account. We do not store your IP address in our application databases. Our network security provider, which sits in front of the Service, receives it (see 2.7). Where needed to prevent abuse or to meet legal compliance obligations, we may keep the raw address in security and abuse records for up to 30 days, then delete it. Our hosting platform's request logs may also record the address of the connecting client for up to 30 days (see 2.7). We compute a keyed cryptographic hash of your IP address (for IPv6, of its /64 network prefix), which does not store the address in readable form. We use this value to apply the free allowance and rate limits, and we store it together with records of which recordings (by derived identifier) it has been used to analyse and when. Because this value links requests made from the same network address, we treat it as personal data.
2.5 Account information. If you create an account: your email address, account creation and verification times, your plan, your credit balance and its history, your Square customer identifier and the identifiers of your checkouts, and the API keys you create (stored only as one-way hashes). Sign-in links and session identifiers are stored only as one-way hashes, except that a sign-in email awaiting delivery is held briefly with its link. If you turn on two-factor sign-in, we also store the secret for your authenticator app while two-factor is on, and your recovery codes as one-way hashes; turning two-factor off or deleting your account removes them. If we suspend an account (see section 16 of our Terms), we record when and an internal note of why, and we keep its email address while the suspension lasts so that the address cannot be used to register again. We also store a keyed cryptographic hash of your email address, computed so that spellings that reach the same inbox (such as dots and +tags at Gmail, or +tags at Outlook, Proton and Fastmail) give the same value; accounts sharing it share one free allowance. We store a keyed hash of the network (IPv4 /24 or IPv6 /48) an account was created from, to detect many accounts created from one network. Neither hash stores the address in readable form. To prevent abuse, we also keep the IP address an account was created from and the IP address of its most recent sign-in, each for 30 days from when it was recorded, then delete it; deleting your account deletes them sooner. If you delete your account, both hashes are kept for 30 days so that deleting and signing up again does not reset the free allowance, then deleted. We record which version of our Terms was in force when you created your account and when you started each checkout. Once you have bought a plan or credits, we also record the time of each sign-in (not the IP address), to show in a payment dispute that the Service was used. If you signed up through a link we shared, we record which link. If you claim gift credits through such a link, we record the claim, with the keyed hash of your email address described above, so that each person claims once. When you request a sign-in link, we look up the public mail records of your email domain, through Cloudflare's DNS resolver, to check that it can receive email; the lookup sends the domain only, not your address.
2.6 Payment information. Payments are processed by Square. We give Square your email address to pre-fill checkout. We do not receive or store full card numbers. We receive from Square information about your subscription status and transactions, including any inquiry or chargeback your card issuer opens about a payment, and we record usage of the API for billing. For a disputed payment we keep the Square dispute identifier, its status, the account it concerns and Square's identifier for the card used (not the card number), and we email you about any change it makes to your account. If a payment was charged back, we use that card identifier to recognise later payments with the same card. To respond to a dispute, we may give Square and your card issuer records of your purchases and of your account's use of the Service.
2.7 Technical and security data. For account protection, we keep account identifiers, internal API-key identifiers (never the key itself), operation identifiers and times, rejection counts and reasons, temporary restriction times, alert-delivery status and operator review actions. Incident evidence and review actions are deleted after 30 days. Rate counters are kept while needed to enforce their windows; operation identifiers are retained for at least one hour and up to the result-retention period to support safe retries. Security alerts contain these limited identifiers and counts, without your email, audio, filenames, credentials or raw IP address. Our hosting, network and security providers process your IP address, browser and device information, network characteristics and request details to deliver and protect the Service. The bot check processes signals such as your IP address, user-agent and connection characteristics to distinguish people from automated traffic (Cloudflare Turnstile; see the Turnstile Privacy Addendum). Its provider also processes these signals to improve bot detection under its own privacy notice. Our application logs contain job identifiers, outcomes, timings and error classes, without IP addresses, visitor identifiers, file names, tags or audio. Hosting request logs and any abuse or compliance records may contain raw IP addresses for up to 30 days. This period concerns those records, rather than every record independently processed by a provider. Crash reports contain the error and its stack trace, without request bodies, cookies, IP addresses, file names or audio.
2.8 Communications and general feedback. If you email us, we receive your email address, the content of your message and any attachments. If you use our website or API feedback form, we receive your message and any name or reply email you choose to provide. These fields are optional; you can send a message without them. The form does not accept attachments. We do not store an account or network identifier with the message; a keyed identifier is used briefly to limit submissions.
2.9 Update emails. If you ask for COSMIC updates on the website, we first email you a confirmation link. Only when you open it is your email address added to our subscriber list, which is held by our email subscription provider, the service we use to send those emails. Until you confirm, the address is held briefly by us for that purpose only and is deleted after 24 hours. Subscribing is separate from having an account.
2.10 Accuracy answers. When a result says AI-generated audio was or was not detected, we may ask whether it was accurate. If you answer, we store your yes or no together with the verdict, score, detection route and model release recorded for that analysis, and with the identifiers derived from the recording (Section 2.2). You may also provide optional notes, a song title, artist and public source link to help us understand a reported error. We do not fetch or retain audio from feedback links. Your answer is linked to that recording's identifiers, not directly to your account or name; optional details may nevertheless identify you or someone else. Because those identifiers can show whether a recording was submitted, we treat the linked answer as personal data.
The Service is not intended for the processing of special categories of personal data, and we ask that you do not submit such data. COSMIC does not intentionally infer, classify, or use special-category information contained in submitted audio.
3. Cookies and similar technologies
We use one authentication cookie set by our application, cosmic_session, which is set only when you sign in. It is strictly necessary to keep you signed in, is marked HttpOnly and Secure, and expires after 30 days or when you sign out. Our network security provider and its bot check (Cloudflare Turnstile) may set cookies or use similar technologies that are necessary to protect the Service and distinguish people from automated traffic. We do not use advertising cookies, third-party marketing analytics or third-party advertising, and we do not use your activity for cross-site advertising. Fonts and other site assets are served from our own domain. If you use the Reduce motion or High contrast button in the footer, your choice is saved in your browser's local storage on your device; it is never sent to us. If you open a link we shared (an address containing ?ref=), its code is kept in your browser's local storage until you sign in, so that a sign-up through it, or a claim of its gift credits, is recorded for that link.
4. How we use information and our legal bases
| Purpose | Information | Legal basis (EU/UK GDPR) |
|---|---|---|
| Providing analyses and returning results | Audio, derived identifiers, results, job records | Performance of a contract; our legitimate interest in operating the Service for visitors without an account |
| Recognising repeat submissions so identical audio is not analysed twice, and keeping your history | Derived identifiers, cached results, history | Legitimate interests in efficient operation and in providing history; performance of a contract for account holders |
| Applying free allowances, plan limits and rate limits, and preventing abuse | Keyed IP hash, account sign-up and sign-in IP addresses, allowance records, derived identifiers, Turnstile signals | Legitimate interests in preventing abuse and protecting the Service |
| Accounts, sign-in and API keys | Email address, hashed tokens, sessions and keys | Performance of a contract |
| Billing, accounting and tax | Plan, credit balance and history, gift-credit claims, Square customer, checkout and dispute identifiers, usage records, Terms versions, sign-in times after a purchase | Performance of a contract; compliance with legal obligations |
| Counting visits and sign-ups through links we share | A count of visits, kept once per network a day using a keyed network hash; the link an account signed up through | Legitimate interests in knowing which shared links are used |
| Security, troubleshooting and maintaining the Service | Service logs, technical data | Legitimate interests in securing and maintaining the Service |
| Sending COSMIC update emails | Email address, confirmation records | Consent |
| Reviewing reported errors and improving accuracy | Your answer, optional report details, the result shown, derived identifiers | Legitimate interests in investigating reported errors and improving the accuracy of the Service |
| Reviewing general feedback and responding to enquiries and legal requests; enforcing our Terms | Messages, optional contact details and any relevant records | Legitimate interests in maintaining the Service and responding to enquiries; compliance with legal obligations |
We use audio you submit or ask us to retrieve only for your requested analysis. We do not use it for model training or subsequent testing. Feedback is reviewed to investigate reported errors and improve the Service; sending feedback does not change how we handle your audio. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing; the results of the Service concern recordings, not people, and are provided for your own evaluation.
5. How we share information
We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We disclose personal data only to:
- Service providers and payment partners: We use third-party providers for cloud infrastructure, hosting, data storage, content delivery, network security, bot prevention, error monitoring, email delivery, payment processing, subscription management, and business communications. These providers may process personal data as necessary to perform their respective services, subject to applicable contractual, security, and privacy protections. Certain providers may also process information as independent controllers where applicable, under their own privacy notices.
- Platforms you ask us to retrieve audio from: when you submit a link, our servers request the audio from that platform, which receives our server's request but not your IP address or account details.
- Legal and safety: where we believe in good faith that disclosure is required by law, regulation or legal process, or is necessary to protect the rights, property or safety of COSMIC, our users or others, or to enforce our Terms.
- Business transfers: in connection with a merger, acquisition, financing, reorganisation or sale of all or part of our business, subject to this Policy or protections at least as protective.
A cached result produced by an earlier submission of identical audio may be returned to a later submitter. Nothing about the earlier submitter, including whether one existed, is disclosed with it.
6. How long we keep information
| Information | Retention |
|---|---|
| Submitted and retrieved audio | Deleted when the analysis ends, whether it succeeds or fails. Any audio left behind by an interrupted job is deleted within one hour. |
| Job record (result, file name, metadata tags, file hash) | 24 hours, then deleted automatically. |
| Provenance and watermark check results kept with a file's hash | 7 days, then deleted automatically. |
| Share identifier and shared result link | Works for as long as the job record, up to 24 hours, then stops working and is deleted with it. |
| Analysis history (which recordings you or your network address submitted, and when) | 30 days after that recording was last submitted by you, then deleted. |
| Derived identifiers and cached results | While any history entry refers to them; deleted within approximately 24 hours after the last such reference is removed. |
| Allowance records for visitors without an account (keyed IP hash, recording identifier, time) | Deleted 30 days after the analysis. The free allowance renews on a rolling 30-day basis, so these records are needed for no longer than that. |
| Raw IP addresses in hosting-platform request logs, in abuse and compliance records, and an account's sign-up and most recent sign-in addresses (Sections 2.4, 2.5 and 2.7), where kept | Up to 30 days, then deleted. |
| Usage records for accounts and API keys | For as long as necessary for billing, accounting, tax and legal purposes. If you delete your account, the recording identifier is removed from these records. |
| Account information | Until you delete your account. |
| Terms versions, sign-in times after a purchase, gift-credit claims and the link an account signed up through | For as long as necessary for billing, accounting, tax and legal purposes, like usage records. |
| Keyed network hash used to count a visit through a shared link once a day | 24 hours, then deleted automatically. Only the visit count is kept. |
| Keyed hashes of your email address and sign-up network (Section 2.5) | Until you delete your account, then 30 more days, then deleted. |
| Suspension record (time and internal reason) | While the suspension lasts. Deleted when it is lifted. A suspended account's information, including its email address, is kept until the suspension ends, unless you ask us to delete it, in which case we delete it subject to the billing and legal retention above. |
| Two-factor secret and recovery codes | While two-factor is on. Deleted when you turn it off or delete your account. |
| Payment-event log (Square event identifier, type and time; no name, email or card data) | For as long as necessary for billing, accounting, tax and legal purposes. |
| Sign-in links, emails awaiting delivery, expired and revoked sessions | Deleted within one day of expiry, use or revocation. Sessions expire after 30 days. |
| Account-protection incident evidence, review actions and alert-delivery records | Up to 30 days. Current rate state is removed after a day of inactivity once its active windows and restrictions have ended; operation identifiers expire after at least one hour and the configured result-retention period. |
| Application logs | For a limited period for security and operations. |
| Update-email subscription (held by our email subscription provider) | Until you unsubscribe or ask us to remove you. Unconfirmed addresses are deleted after 24 hours. |
| Accuracy feedback and optional report details | Unanswered questions are deleted after two days. Individual answers, related result details, recording links and optional context are deleted after 12 months from submission during scheduled cleanup. Only aggregate yes/no counts by verdict and model release remain. Account deletion clears recording links and optional context from related answers. |
| Website and API general feedback | Messages, names and reply emails are deleted after 12 months from submission during scheduled cleanup, or earlier on request. Submission-rate counters expire after one hour. |
| Correspondence | For as long as needed to deal with your enquiry and any follow-up, and as required by law. |
| Backups | Encrypted, stored separately from the Service, and kept for up to 7 days. Data deleted from the Service can remain in a backup until that backup expires. |
We may retain information for longer where required by law or where reasonably necessary to establish, exercise or defend legal claims.
7. Deleting your data
You can delete your account at any time from the account page. Deletion revokes your sessions and API keys, releases your email address, removes your analysis history, deletes every derived identifier and cached result that no other user's history still refers to, and cancels any subscription at Square. Usage records are kept for billing and accounting purposes with the recording identifier removed. A recording that someone else has also submitted remains in their history; what remains contains nothing about you.
To request removal of a feedback report, contact us with the analysis or feedback identifier if you have it, or enough information to locate the message. General feedback is not automatically linked to an account, so deleting an account does not automatically delete those messages.
You can delete an individual analysis job through the Service, which deletes its job record and any audio still present. Visitors without an account may contact us to request deletion; because our application records hold network addresses only as keyed hashes (raw addresses, where kept at all, only in request logs and abuse records for up to 30 days), we may need you to make the request from the same network address so that we can locate the related records, and we may be unable to identify records in some cases. Allowance records for visitors are not linked to an account and are deleted automatically 30 days after the analysis.
8. Your rights
Depending on where you live, you may have the right to: access the personal data we hold about you and receive a copy; correct inaccurate data; delete your data; restrict or object to our processing, including processing based on legitimate interests; receive your data in a portable format; and withdraw consent where processing is based on consent. Residents of the EEA and UK may lodge a complaint with their local data protection authority.
Residents of California and other US states with comprehensive privacy laws may have the right to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it; to delete and correct it; and not to be discriminated against for exercising these rights. In the preceding twelve months we collected the categories described in Section 2 (identifiers, commercial information, internet or other network activity information, and audio information), from you and your device, for the purposes described in Section 4, and disclosed them to the service providers described in Section 5 for business purposes. We do not sell or share personal information as those terms are defined under California law, and we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit.
To exercise any right, email [email protected]. We will verify your request using information associated with your account or submission, and respond within the period required by applicable law. You may use an authorised agent where the law permits, subject to verification. If we decline a request, we will explain why and, where applicable, how you may appeal.
9. Security
We use administrative, technical and organisational measures designed to protect personal data, including encryption in transit, storage of credentials and tokens as one-way hashes, keyed hashing of network addresses, separation of the analysis service from the public network, least-privilege access, and encrypted backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. International transfers
We and our service providers process data in the United States and other countries where those providers operate, which may have data protection laws different from those of your country. Where we transfer personal data from the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and their UK equivalents, or an adequacy decision or recognised certification framework.
11. Children
The Service is not directed to children under 13 (or any higher age of digital consent that applies in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this Policy
We may update this Policy from time to time. If a change is material, we will provide reasonable notice, for example by posting the updated Policy with a new effective date or by email to account holders, before it takes effect.
13. Contact
Angelware, the company behind COSMIC. Email:[email protected].
For processing protection, we keep submission identifiers, account or keyed network identifiers, input-binding hashes, admission day and processing state. Settled processing-protection records are deleted after seven days through scheduled cleanup. They contain no audio, readable file name, source URL or upload credential. Refund entitlement and reservation adjustments are retained as billing records. A temporary recovery record holds payment-provider dispute pages while reconciliation is in progress, then clears them when enumeration finishes.