Privacy Policy

Last updated 2026-10-11 (rev 14).

This policy covers TYPE-02, the music discovery app made by Type Studio, on iOS, Android, and macOS, and the typeaistudio.com website. TYPE-02 shares its account system with the Type Studio app, so the account, credit, run, and Liked data described here is the same data that app uses.

What TYPE-02 collects

TYPE-02 only sees what a user gives it while using the app.

Account. A user signs in with an email address and password through Supabase Auth. Supabase stores the account (a user id, the email, and the password in hashed form) along with the version of the terms and this policy the user last accepted and when they accepted it.

Listening. When a user taps the big button on the home screen, or the TYPE-02 button in Control Center or on the Lock Screen (iOS 18 and later), the app turns on the microphone for up to 15 seconds to name the song playing nearby. The Control Center button does this without opening the app: the Lock Screen and the Dynamic Island show that it's listening, then the song it named, which stays on the Lock Screen until the user taps or dismisses it. The app asks for microphone permission the first time the user listens inside it, and the user can turn that permission off at any time in their device settings; search still works without it. The microphone stops as soon as the song is named, when the user stops listening, or after 15 seconds. Apple's ShazamKit turns the sound into a compact audio signature on the device. A signature can't be turned back into sound. Only the signature goes to Apple's Shazam service, which sends back the song's title, artist, and catalog details. TYPE-02 never records or saves the audio, and never sends audio to Type Studio's servers or to the AI. On Android, the backend gives the app a short-lived access token for each listen; the token identifies Type Studio, not the user. Listening doesn't add anything to the user's own Shazam library.

Runs. A run is one analysis of one song. A user starts one by picking a song from search or by letting the app hear one. The backend then stores a run record keyed to their user id: what they searched for or the song that was heard, the song that was analyzed, the run's status, and when it ran. That record is what lets their run history follow them across devices. Runs made with the earlier Mini analysis stay in the user's history the same way.

Results. A finished run's analysis and recommendations are stored per song, not per user, so a later run of the same song by anyone can reuse or update that stored result. The stored result describes the song and contains nothing that identifies a user.

Liked songs. When a user hearts a song, its title and artist, its cover art and preview links, the reason TYPE-02 gave for recommending it, and when they liked it are stored with their user id, so the Liked list follows them to any device they sign in on. The app also keeps a copy on the device so the list opens offline.

Credits and subscription. The user's credit balance, their credit transactions, and whether Type Pro is active are stored with their user id.

Logs and error reports. Google Cloud keeps standard request logs for the backend (IP address, user agent, time, and response status), and Supabase keeps standard sign-in logs. Type Studio reads them only to debug and protect the service. When the app or the backend hits an error, an error report goes to Sentry with the error, the app version, and device and operating-system details. Error reports are configured to leave out personal details such as the user's email.

On the device. The app keeps the user's sign-in session in the platform's secure storage (the Keychain on iOS and macOS, the Keystore on Android) so they stay signed in. It also stores the copy of the Liked list, a note of which terms the user accepted, and the ids of runs still in progress, so a run survives closing the app.

Ad measurement (iPhone and iPad). TYPE-02 shows no ads, but Type Studio advertises TYPE-02 on TikTok. To see which of those ads bring people to the app, the iPhone and iPad app includes TikTok's measurement SDK. It does nothing until the user answers Apple's App Tracking Transparency prompt, which the app shows the first time it opens. If the user taps Allow, the SDK sends TikTok the device's advertising identifier; device and app details such as the model, operating system, language, and app version; and events such as opening the app, signing in, and subscribing to Type Pro (with the product and price). When the user signs in, it also sends their account id and email address, which the SDK scrambles with a one-way hash before they leave the device. TikTok matches this to its own users to report which ads worked. If the user taps Ask App Not to Track, the SDK never starts and nothing goes to TikTok. The user can change their answer at any time in Settings, Privacy & Security, Tracking. The Android and macOS apps include no tracking SDK, and TYPE-02 sets no cookies.

The website. typeaistudio.com sets no cookies and loads no analytics, advertising, or third-party scripts. Cloudflare, which hosts the site, processes visitors' IP addresses to deliver pages and block abuse.

Who TYPE-02 shares data with

Google Cloud. Vertex AI (Gemini) writes the analysis and recommendations. For each run, the backend sends Gemini text: the song being analyzed, and candidate songs and tags gathered from music services. TYPE-02 sends Gemini no audio and doesn't send it the user's name or email. Google Cloud also hosts the backend (Cloud Run), the run, credit, and Liked records (Firestore), and the stored results (Cloud Storage).

Apple's Shazam service. Receives the audio signature described under Listening, directly from the device, and returns the matching song. Apple handles that request under its own privacy policy.

Music services. To search the catalog, gather candidate songs, and fill in song details, the backend sends song and artist names to Apple Music, Last.fm, Deezer, iTunes Search, and Spotify. Last.fm and Spotify are reached only with Type Studio's own app credentials; the app never signs a user in to any music service. These requests carry nothing that identifies the user.

Some requests go straight from the device to these services instead of through the backend. Playing a 30-second preview streams it from Apple's or Deezer's servers, and cover art loads from those services. When the backend has no preview for a song, the app asks iTunes Search for one. Those requests show the service the device's IP address and the song being looked up. Opening a song on Spotify, Apple Music, or Deezer leaves TYPE-02 for that service, and its own privacy policy applies.

TikTok. On iPhone and iPad, and only if the user allows tracking, TikTok receives the ad-measurement data described above and handles it under its own privacy policy.

Sign-in, payments, and error reporting. Supabase handles sign-in and stores the account. RevenueCat confirms whether Type Pro is active using the user's account id and the purchase token the store issues. The Apple App Store or Google Play processes payment. Sentry receives the error reports described above.

Type Studio never sends any of these providers a user's password.

What TYPE-02 doesn't do

Type Studio doesn't sell a user's data or show ads in the app. The only data it shares for advertising is the TikTok ad measurement described above, which needs the user's permission, and it doesn't transfer data to anyone outside the providers named above. It doesn't train any model on a user's data. Google Vertex AI operates under its own retention policy for API traffic, which a user should review on Google's site if that matters to them. As of this date, Google Cloud's terms state that customer data sent through Vertex AI is not used to train Google's foundation models.

Where a user's data is processed

TYPE-02's backend, run, credit, and Liked records, and stored results are on Google Cloud in the United States. Supabase, RevenueCat, Sentry, TikTok, Cloudflare, Apple, and the music services process requests on their own infrastructure, which may be in the United States or elsewhere. If a user opens the app from the European Economic Area, the United Kingdom, or another region with cross-border transfer rules, their data is transferred to and processed in the United States. Type Studio relies on each provider's standard contractual clauses (or an equivalent transfer mechanism) for that transfer, and each provider's own privacy terms govern the data it receives.

Payments

Type Pro is sold and processed by the Apple App Store or Google Play, depending on the platform. Type Studio never sees or stores a user's card or payment details, because the store handles the entire transaction. RevenueCat sits between the store and Type Studio's backend to confirm whether a subscription is active; it receives a store-issued purchase token and the user's account id, not the payment method. Apple, Google, and RevenueCat each handle that data under their own privacy policies.

Retention

Listening audio is never stored. The signature lasts only as long as Apple's Shazam service takes to answer the request.

Run records stay until the user deletes the run or their account. Deleting a run removes the user's record of it, and also removes the song's stored result if no other user has a run of that song. A run that stops responding is marked as failed after a few minutes and stays in the user's history until they delete it.

A liked song stays until the user un-hearts it or deletes their account. Credit and subscription records stay as long as the account exists.

Delete Account (under Settings, Manage Account) removes the user's run records, Liked list, credit and subscription records, and profile, and deletes the sign-in account from Supabase, for TYPE-02 and the Type Studio app alike. Stored per-song results that other users' runs also rely on are kept, since they contain nothing that identifies the user. Backend logs, sign-in logs, and error reports expire on Google Cloud's, Supabase's, and Sentry's standard retention schedules. TikTok keeps ad-measurement data under its own retention policy.

On-device data stays on the device until the user removes it or deletes the app.

A user's rights

A user in Canada has the right under PIPEDA to ask what personal data Type Studio holds about them, to correct it, and to have it deleted. A user in the EU or UK has the same rights under the GDPR, plus data portability and the right to object to processing. A user in California has the right under the CCPA to know, to delete, and to opt out of sale or sharing. Type Studio doesn't sell data, and the only sharing for advertising is the TikTok ad measurement, which the user can turn off in Settings, Privacy & Security, Tracking.

To exercise any of these, a user emails [email protected] from the address they signed in with. Type Studio responds within a reasonable time, which usually means within the same week.

Children

TYPE-02 is not directed at children. It doesn't knowingly collect data from anyone under 13, or under 16 in the European Economic Area. If someone believes a child has signed up, they contact Type Studio and it deletes the account.

Changes to this policy

When this policy changes, the "Last updated" date at the top of this page changes, and for a material change the app asks the user to review and accept the updated policy before they continue.

Contact

Email [email protected] with any privacy question, a data-export request, a deletion request, or anything else covered here. See also the terms of use.