Privacy Policy

Last updated: 11 October 2026

Musical Focus is a workflow app that helps music creators finish more music. This policy explains what personal data we collect, why, what we do with it, and the rights you have over it. We've tried to write it the way we write everything else: plainly.

1. Who we are

The data controller — the party responsible for your personal data — is Musical Focus Ltd, a company registered in England and Wales (company no. 17322522), whose registered office is at 128 City Road, London, United Kingdom, EC1V 2NX.

For anything about your data, contact us at privacy@musicalfocus.com. We aim to respond to all requests within one month.

2. Who this service is for

Musical Focus is for adults and young people aged 16 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If we learn that an account belongs to someone under 16, we will delete the account and its personal data. If you believe a child has created an account, contact us at privacy@musicalfocus.com.

3. What we collect and why

Account and profile data

When you sign up we collect your email address and your creator role (e.g. songwriter, producer, mixing engineer). If you sign in with Google, our authentication provider also stores the basic profile Google sends with the sign-in — your name and profile picture alongside your email. The app itself does not read or display them. You can optionally add profile details: experience level, commitment level, weekly hours, main goal, genre focus, hardware and software you use, and a personal “North Star” mission. Profiles are private by default.

Why: to provide the service, sign you in, and tailor the app to how you work. Lawful basis: performance of our contract with you; the optional profile fields rest on our legitimate interest in making the product work better for you.

Your projects and workflow data

The substance of the app: your projects, tasks, ideas, notes, progress, goal dates, session recaps, statuses, and the reasons you record when you park or retire a project. Free-text content you write (titles, notes, reasons, ideas, lyrics) is treated as personal content: it is never included in aggregated insights, never appears in analytics events, and is erased when your account is deleted (copies in our database backups are deleted on the schedule in section 6).

Why: this is the service. Lawful basis: performance of our contract with you.

When you were last active, and inactive accounts

For each account we keep the date and time it was last seen active. We work it out once a day from your sign-ins, from your session being refreshed (which happens regularly while you use the app signed in) and from your activity in the app. If we ever send you an inactivity notice, we also keep the date we sent it and the activity date it was based on. This record is included in your data export, kept while your account exists, and erased with it. It is never included in the anonymised workflow records and never sent to our analytics or error-monitoring services, and your last-seen date is never sent to our email service — though the deletion date in an inactivity notice is worked out from it, so that date shows our email service when you were last active, to within about a day.

We use it for one thing: our rule for inactive accounts. If your account has had no activity for 24 months, we email you to say it will be deleted. If it still has none at 27 months — and at least 3 months after that email — we delete it, in the same way as if you had deleted it yourself (see section 6). The rule never applies to an account with a paid plan that hasn't been cancelled, or with access we have granted. The email is an account notice, sent through our email service (Loops): it carries only your email address and the deletion date, and neither unsubscribing nor the Emails switch in your Profile stops it, because it is about your account, not marketing.

Why: to apply our published retention periods, so that accounts nobody uses are not kept forever, and to tell you before that happens. Lawful basis: legitimate interest in applying our published retention schedule (the record and the deletion); legitimate interest in sending you a service message about your account before it is deleted (the notice email).

Breathe

If you use the breathing exercise, we keep a log of each session with your account: the pattern, the planned length, how long you actually breathed, whether sound was on, where you started it from, and when. It is shown back to you as your own stats. It is never included in the anonymised workflow records, never sent to our email service, and is erased with your account. Our product analytics records that a session was started or completed — with the pattern, the planned length, where you started it from and whether sound was on, and, for a completed session, how long you breathed — under the same random identifier as everything else.

Why: to run the feature and show your progress. Lawful basis: performance of our contract with you (the feature); legitimate interest (the two analytics events).

The insight programme (you're included unless you object)

Musical Focus builds an anonymised, aggregate picture of how music gets finished — which stages stall, what gets skipped, how long things really take — so we can learn where songs die and make the app better at getting you past those points.

What goes in: your workflow patterns — templates used, stage durations, where projects slow down, completion rates — only ever in anonymised, aggregated form. What's never included: your music, your name, your email, anything you write in your own words (titles, notes, reasons, ideas, lyrics), and your Breathe sessions.

Today this happens at one point: when an account is deleted, we keep anonymised records of its projects (described in section 6), unless the account holder objected. We may also build these aggregates from accounts that are still active. While your account exists, the data they are built from is held under your account's random identifier and is protected as personal data throughout.

Your identifiable data is never sold. Anonymous statistics about how music gets finished may be published or licensed — but only from records that meet our anonymisation standard, and never before the anonymised dataset is large enough that no individual could be picked out of it. Until then, the records are used only inside Musical Focus and are treated as personal data.

You can object at any time with the Insight sharing switch in your Profile. Objecting excludes you from both uses above and changes nothing about what you get. If you declined when this programme was opt-in, we treat that as an objection, and it stays that way unless you change it yourself. Once an account is deleted, we keep no key that links its anonymised records back to it, so they can no longer be objected to or removed; while the dataset is small, we still treat them as personal data.

Why: to learn, across everyone, where songs stall and what helps them finish; to improve the product; and to publish or license anonymous statistics about how music gets finished. Lawful basis: legitimate interest, with your right to object at any time.

The Unfinished Song Audit (the public quiz)

You can take the audit without an account. It asks how many songs you started and finished in the last 12 months, your active projects, where you get stuck, your DAW, and your release goals. We also record whether you arrived by a link or a QR code. Answers given without an email are stored with no email address, no account identifier and no IP address. We keep the day you took the audit, not the time; while few people take it, even the day could narrow a set of answers down to a handful of people. Answers are kept indefinitely; apart from setting up your account if you sign up (below), they are used only in aggregate.

Lawful basis (your answers, for as long as they can be linked to you, in the ways explained here and below): legitimate interest in understanding how creators work.

Your email is optional. If you give it, we don't store the address itself in our database: we keep only a keyed fingerprint of it (a scrambled code made with a secret key), so that if you later sign up with the same email we can use your answers to set up your account for you. When that happens, your answers are copied into your new profile and the fingerprint is erased; no account identifier is ever written to the audit record. Your profile's copy is cleared when you finish setting up your account, and the audit record keeps only the month it was used — though while few people sign up each month, even that could point to your account. If you never sign up, the fingerprint is erased after 24 months. Until it is erased, your answers are linked to that fingerprint and are treated as personal data. Audit records written by the earlier version of the audit may hold the email address itself, because that version stored it: that address is deleted 6 months after you took the audit, or when you sign up, if sooner.

Lawful basis (the fingerprint): legitimate interest in setting up your account the way you asked, if you sign up.

Launch and tips emails (only if you tick the box). The audit has one optional box, never ticked for you: “Email me when I can start using Musical Focus, and send me launch news and tips for finishing music. Unsubscribe anytime.” If you tick it, your email address goes to our email service (Loops) with the time you ticked it (your consent record) and a marker that you came from the audit — nothing else. The day you ticked it (recorded as the end of that UTC day) is also kept with your audit answers as a record of your consent. Our email service holds the exact time, so the two no longer match exactly — but while few people take the audit each day, the day could still match your answers to your entry there, so your answers are treated as personal data for as long as our email service holds it. You can unsubscribe at any time via the link in any email, and you can ask us to remove you entirely at privacy@musicalfocus.com. When you're given access, this entry is removed; once you have an account, your account's email settings apply instead.

Lawful basis (the emails): your consent, which you can withdraw at any time.

Audit submissions are rate-limited by a keyed hash of your IP address, kept for 24 hours.

The launch list (while Musical Focus is in private beta)

While access is limited you can leave your email address to be told when you can get in. We store the email, the time you joined (your consent record), and which page you joined from — nothing else — in our email service (Loops). We use it solely to email you about your access — letting you know the moment you can get in — and news when we launch. You can unsubscribe at any time via the link in any email, and you can ask us to remove you from the list entirely at privacy@musicalfocus.com. When you're given access, your entry is removed. Submissions are rate-limited by a keyed hash of your IP address, kept for 24 hours.

Lawful basis: your consent, which you can withdraw at any time.

Payments

Purchases are processed by Paddle, our merchant of record — Paddle is the seller for payment purposes and handles your payment details under its own privacy policy (see paddle.com/legal). We never see or store your card details. We receive from Paddle the subscription status information needed to run your account (plan, status, renewal dates).

Lawful basis: performance of our contract with you; for our own copies of the payment records, legitimate interest in running and defending billing (Paddle, as merchant of record, keeps the financial records the law requires).

Product analytics and error reporting

We use privacy-first product analytics to understand how the app is used (events like “project created” or “task completed”) and error monitoring to fix crashes. This is configured deliberately: EU hosting, no session recording, and no names, email addresses or anything you write in any event — events are keyed to a random internal identifier, not your email. Our analytics provider is set to discard IP addresses, and its location lookup is switched off, so our analytics works out no location from your IP address. This operational analytics runs for all users and is separate from the insight programme above. You can object to it by emailing privacy@musicalfocus.com.

Lawful basis: legitimate interest in operating, securing, and improving the service.

Feedback and support

If you send feedback or contact support, we keep the message and basic context (which screen, your role, your DAW) to act on it. Feedback sent from the app is erased with your account.

Lawful basis: legitimate interest in acting on feedback and supporting you.

If you cancel: the one-question survey

After a subscription is cancelled, the app may show you one optional question asking why, with an optional note. We store the reason you pick (from a fixed list) and the note. If you dismiss the question, we record only that you preferred not to say, so we never ask twice. When you delete your account the note is erased and your name is detached from the answer; the anonymous reason — with no link to you — is kept indefinitely as part of a simple tally of why people leave.

Why: to understand why people cancel and improve the product. Lawful basis: legitimate interest in improving the service.

Emails we send

Service emails are always sent, because they are how the service works: sign-in codes, receipts (sent by Paddle when you pay), and account notices, such as the notice before an inactive account is deleted. Unsubscribing and the Emails switch in your Profile do not affect them.

Getting-started emails — a welcome and a few short nudges to help you get going — relate to your use of the product. You can turn them off at any time with the Emails switch in your Profile, or with the unsubscribe link in any of them.

Lawful basis: legitimate interest in running your account and helping you get started (service and getting-started emails to account holders); your consent for emails to people who don't have an account (the launch list and the audit's launch and tips emails, above).

4. What we never do

• Your identifiable data is never sold.
• We never share your individual data with advertisers.
• We never train AI on your workflow data without asking you separately first.
• We never host your audio — links you save point to services you control.
• We never include your free-text content (notes, lyrics, ideas, reasons) in any aggregated dataset.

5. Who we share data with (sub-processors)

We use a small number of service providers to run Musical Focus. Each receives only what its function requires:

Where a provider processes data outside the UK, the transfer is protected as follows. PostHog (EU Cloud, with processing outside the UK and EEA, including the US, allowed): the UK Addendum to the EU Standard Contractual Clauses, and PostHog's certification under the Data Privacy Framework including its UK Extension. Sentry (EU storage, some account-level data in the US): the Data Privacy Framework including its UK Extension, with the Standard Contractual Clauses and the UK Addendum as a fallback. Loops (US): the Data Privacy Framework including its UK Extension, and the Standard Contractual Clauses. Resend (US): the UK Addendum to the Standard Contractual Clauses, and the Data Privacy Framework including its UK Extension. Vercel (mainly US): the UK Addendum to the Standard Contractual Clauses, and the Data Privacy Framework including its UK Extension. Microsoft 365 (mailbox stored in the UK): for any access from outside the UK, the Standard Contractual Clauses and the Data Privacy Framework including its UK Extension. Anthropic (US): the Standard Contractual Clauses with the UK Addendum. Supabase stores our database in the UK; its data processing agreement (the UK Addendum to the Standard Contractual Clauses) covers any access from outside the UK. Paddle is its own controller for checkout and payment data; for data we send it, its data processing agreement applies, with the Standard Contractual Clauses and the UK Addendum. Google acts as an independent controller for Sign in with Google, so no transfer mechanism of ours applies.

Planned addition. Tolt (affiliate tracking) will join this list when the affiliate programme launches, and this policy will be updated when it does.

6. How long we keep things

The periods for audit records, rate-limit counters and the records kept after an account is deleted are applied by a daily clean-up, so each record is deleted at the first daily run after its period ends.

When you delete your account — or it is deleted under the inactivity rule — your identifiable data is erased: your profile, projects, tasks, notes, ideas, recaps, feedback, your “last seen” record, sign-in and billing records all go. A daily clean-up job then removes you from our email service (Loops) and deletes your analytics profile (PostHog); PostHog clears the events behind that profile later, in its own background process, which is not immediate. A small set of records is kept afterwards, and this is exactly what it is:

• Your consent and objection history — the record of what you were shown, what you agreed to or objected to, and when (the insight programme and your email preference), kept for 6 years as evidence. It carries the random account identifier from your old account, and no email or name. If an account is ever deleted in an emergency without a deletion record, we also keep a note of the day our clean-up first found this history without an account; it is deleted with the history.
• The deletion record — one entry noting that an account with that identifier was deleted, when, whether the deletion was made by you, by us, or under the inactivity rule, and whether a paid subscription was live and cancelled at the time. Nothing else: no counts, no payment identifiers. Kept for 6 years.
• A clean-up note — your old account's random identifier, the day it was deleted and how far the clean-up has got, kept only until the daily job has removed you from our email and analytics services (if it cannot, we finish the job by hand and then delete the note).
• The payment-provider ledger — the signed notifications Paddle sent us about your subscription, kept for 6 years from receipt to run and defend billing. They carry Paddle's identifiers and our account identifier, not your email.
• The anonymous cancellation tally — if you answered the one-question survey, the reason with your name detached and the note erased.
• Anonymised per-project workflow records, unless you objected to the insight programme — including your coarse creator segment (role, experience level, commitment level, a weekly-hours band and main genre) and each project's genre, DAW and the 1–10 ratings you gave it, but no identity and no free text. Project timings are kept at month resolution and the deletion itself only at quarter resolution, and we keep no key that links these records to the deletion record — but while the dataset is small, someone with access to our database could still narrow them down, so until it is large enough we treat them as personal data. These records are held to a strict anonymisation standard and are never published or licensed until they are large enough that no individual could be picked out of them.
• Backups — copies of our database taken before your account was deleted still hold your data until each copy is deleted, on the schedule in the table above.

7. Your rights

Under UK GDPR you can:

• Access your data — the app includes a “download your data” export, which includes your “last seen” record;
• Correct anything inaccurate;
• Restrict how we use your data while a question about it is resolved;
• Delete your account and data — self-serve, in your settings;
• Port your data (the export is machine-readable);
• Object to processing based on legitimate interests — for the insight programme, with the Insight sharing switch in your Profile; for getting-started emails, with the Emails switch or any unsubscribe link; for anything else, including product analytics, by emailing privacy@musicalfocus.com;
• Withdraw consent at any time (the launch list and the audit's launch and tips emails — the unsubscribe link in any email, or email us) without affecting anything that ran on consent before withdrawal;
• Complain to the Information Commissioner's Office (ico.org.uk) — though we'd appreciate the chance to fix things first at privacy@musicalfocus.com.

Exercising any of these is free. We may need to verify your identity first.

8. Cookies and similar technologies

We use essential cookies only: the sign-in session cookies that keep you logged in and, if you untick “keep me signed in”, a cookie that lasts only for your browser session and records that choice. Our analytics runs cookieless by configuration, and our error monitoring sets none. We do not use advertising cookies or trackers of any kind.

The app also keeps a few things in your browser's own storage. While you sign in or sign up, it keeps the email you entered (and, when signing up, the role you chose), so the code screen survives a refresh; the app ignores it after 10 minutes and removes it when you sign in with the code. After a payment, it keeps a marker, which the app uses for 15 minutes to show that your payment is being processed. While you edit a plan or a template, it keeps the weight locks you set, until you close the tab. It keeps a copy of the app's offline page, so the app can show something when you have no connection. And, once you change them, it keeps three settings, so the app looks the way you left it: Breathe's sound and volume, the view you chose for each project and template, and how your projects list is sorted. The app uses these only as this policy describes, and you can clear them at any time in your browser.

Paddle checkout. Paddle's checkout script loads only when paid plans are on sale. While Musical Focus is in private beta they are not, so it does not load at all. What it stores on your device will be described here before paid plans open.

9. Security

Data is encrypted in transit, access to your data is enforced at the database level so accounts can only ever read their own rows, and secrets are never stored in client-side code. No system is perfectly secure, but security is designed in, not bolted on.

10. Changes to this policy

If we change this policy materially, we'll tell you in the app or by email before the change takes effect, and update the date at the top. Continued use after the effective date means the updated policy applies. This version takes effect on the date shown at the top.

What changed in this version:

• The insight programme now includes everyone unless they object, with a switch in your Profile; a “no” given under the earlier opt-in is still honoured.
• The audit no longer stores your email address — only a keyed fingerprint for up to 24 months — and asks separately, with one box, whether you'd like launch and tips emails.
• Retention: accounts are deleted after 27 months without activity, following a notice at 24 months (previously 12 months), and every other retention period is now stated, including what is kept after an account is deleted and for how long.
• “Last seen”: we now keep the date each account was last active, to apply that rule.
• The Emails switch in your Profile turns off getting-started emails, and we list every service provider, including the tool we use to build the app.
• Backups and technical details: we now say how long copies of our database are kept, exactly what error reports and analytics events carry, and that our sign-in system keeps the IP address, browser and operating system of each signed-in session.

Questions? privacy@musicalfocus.com.