Privacy Policy

Overview

StemStash (operated by Dave Nunes) helps producers upload exported audio stems and get them automatically classified, analyzed, and reorganized for download. This policy explains what personal data we collect when you use StemStash, why we collect it, and the choices and rights you have over it.

Information we collect

• Account information: the email address you sign up with, used to authenticate you and manage your account.
• Uploaded audio files: the stems you upload to a project for processing.
• Derived metadata: the output of analyzing your audio: instrument or group classification, BPM, musical key, confidence scores, and silence flags.
• Billing and usage records: your plan or subscription status, credit balance and history, and the payment records needed to operate subscriptions and credit purchases.

How we process your audio

Classification, BPM detection, key detection, and silence detection all run as deterministic local audio analysis on our own servers. This is not a call to a third-party generative AI service, and not a per-file model call: the same file analyzed twice produces the same result. Your uploaded audio is never used to train any AI model, by us or by anyone else, and it is never inspected, downloaded, or listened to by a person as part of normal operation.

Every value StemStash detects is shown with a confidence score and can be reviewed, corrected, or overridden before you export, since automated detection is not guaranteed to be perfect.

Security: why your stems stay private

Your uploaded stems and exports sit in a private storage area with no public or authenticated access policy of any kind attached to it: nothing about the storage layer itself lets any account, including ours, browse or open another user’s files. The only way a file is ever retrieved is through a short-lived, single-use signed link that our server generates on demand, and it only generates one after checking, on every request, that the project belongs to the account asking for it. That link expires within a minute, so a link that leaked or was shared would already be dead by the time anyone else opened it.

The credential capable of reaching every file in storage exists only on our backend server and is never sent to a browser, embedded in a page, or exposed through any API response, so it can’t be extracted from the app itself. Everyday access, both yours and the automated analysis pipeline’s, goes through the same ownership-checked path described above rather than that credential directly.

Files are removed automatically no later than 2 hours after your export completes, and you can delete them yourself immediately at any time from the export screen. Less time in storage means less to protect.

Cookies and sessions

StemStash uses a single session cookie, set by our authentication provider, to keep you signed in. We do not use analytics, advertising, or third-party tracking cookies. If that changes, this policy will be updated first.

Sub-processors

We share data with two service providers, each used for a specific purpose:

• Supabase: database hosting, authentication, and file storage. Your account data, project metadata, and uploaded and exported audio files are stored in Supabase, inside the private storage area described above, scoped to your account only. The specific data region is disclosed in the app or available on request.
• Stripe: payment processing for subscriptions and credit purchases. Stripe is PCI-DSS compliant, and StemStash never sees or stores your full card number, since Stripe handles that directly.

We do not sell your personal data, and do not share it with anyone beyond these two processors except where required by law.

Data retention and deletion

Uploaded stems and generated export files are stored only for as long as needed to let you review and download them, and are automatically deleted no later than 2 hours after your export completes. You can also delete your uploaded files and any export immediately at any time from the export screen, without waiting for the automatic window.

Files are stored in a private, per-account area that is not publicly accessible and cannot be reached via a guessable link. Downloads are served through a short-lived signed link, issued only after we confirm you own the project.

Account and billing records are kept for as long as your account is active, and for a reasonable period afterward as needed for accounting, fraud prevention, and legal obligations.

Your rights

Subject to applicable law, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to fix inaccurate account information.
• Deletion: delete your account and associated data. Uploaded audio is already deleted automatically per the schedule above, and can be deleted on demand at any time.
• Portability: receive your data in a portable format.
• Objection and restriction: object to, or ask us to restrict, certain processing of your data.

To exercise any of these rights, contact us at support@davenunes.com. We will respond within a reasonable time.

International data transfers

Our sub-processors may process data in regions outside your own, including outside the European Economic Area. Where that happens, we rely on the safeguards those providers offer for cross-border transfers, such as the EU Standard Contractual Clauses.

Children’s privacy

StemStash is not directed at children under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as StemStash evolves. Material changes will be reflected in the date above and, where appropriate, communicated to you directly. Continued use of StemStash after a change means you accept the updated policy.

Contact

Questions about this policy or your data can be sent to support@davenunes.com.