Privacy Policy

1. Data controller

This Privacy Policy applies to Songbench (referred to as "we", "us" or "the site"), accessible at https://songbench.online. Songbench is a project owned and operated by an independent developer; there is no separate legal entity. For any privacy or data-protection matter, contact [email protected]. This policy was last updated on 2026-11-14.

2. What we collect - and what we do not

Core principle: Songbench is a fully client-side audio tool. Audio files are decoded, processed and downloaded on your own device. Our servers never receive your audio, so we cannot see, store or share it.

We do not collect:

• No name, account or password for the free tools - they need no registration at all;
• No audio files, file names or any metadata from your files;
• No advertising identifiers, no browser fingerprinting, no analytics and no advertising scripts;
• No third-party fonts or CDN calls for free usage (the Google sign-in script loads only when a paid Pro download is requested);
• No IP-based user profiling by this site.

We receive your information only in these cases:

• When you email us at [email protected], we receive your address and message so we can reply;
• When you choose to sign in with Google for a paid Pro download, we receive and verify your Google ID token and see your email address, name and Google account identifier (sub). We use these only to keep you signed in for that download and to attach a verified email to the Waffo order. We do not create a user profile or database record, send marketing email, or share this data with advertisers;
• When you buy Songbench Pro, payment is handled by Waffo Pancake; we never receive or store your full card number;
• Our hosting provider (Cloudflare Pages) may keep standard web-server access logs (requested URL, IP address, browser type) for security and delivery. This is the host's data practice, governed by its own policy.

3. How we use information

• Customer support: only to answer the email you send us;
• Identity for paid downloads: to confirm a real Google account before a Pro batch export and to attach a verified email to a Waffo order;
• Legal compliance and security: to respond to lawful requests and prevent abuse;
• We do not use any information for advertising or marketing.

Because audio and processing happen locally, we need no personal data to "provide the service".

4. Cookies and tracking

For free and trial usage this site sets no cookies at all and deploys no analytics, advertising or tracking scripts. Opening a tool makes no background network request to our servers.

If, and only if, you request a paid Pro download and sign in with Google, we set two first-party cookies: sb_session (HttpOnly, Secure, SameSite=Lax) holding Google's signed ID token, and sb_signed (a non-personal flag used to know whether to check the session). Both expire within one hour and can be removed at any time with the Sign out button. Google Identity Services is loaded from Google only at that moment; its own data practices are governed by the Google Privacy Policy. No cookie is used for advertising, analytics or cross-site tracking.

5. Sharing and disclosure

We do not sell your personal information, including the "sale" as defined under laws such as the CCPA. We share information only in these cases:

• Payment processor: card data is handled exclusively by the PCI-DSS-compliant processor Waffo Pancake and never touches our servers;
• Identity provider: the Google ID token produced at sign-in is sent only to Google's tokeninfo endpoint for verification; we do not forward it to any other party. A verified email may be passed to Waffo Pancake to prefill a checkout you started;
• Hosting and infrastructure: the site is hosted on Cloudflare Pages, subject to its privacy policy and data-processing terms;
• Legal requirements: disclosure under law, court order or a legitimate request from an authority;
• Business transfers: in a merger or acquisition, with prior notice and continued protection obligations;
• With your consent: for any other purpose with your explicit prior consent.

6. Data security

• Transport encryption: HTTPS / TLS enforced site-wide;
• Local processing: audio is not uploaded, so there is no server-side audio breach risk;
• Payment isolation: card data is processed by Waffo Pancake; we store no card numbers;
• Support email: stored in our mailbox, used only to reply, and deleted when the thread closes.

If a security event affecting your rights occurs, we will notify you and the relevant authority within the timeframe required by applicable law (referring to a 72-hour window where applicable).

7. Retention

• Support email: deleted after the thread is closed, not retained long-term;
• Google sign-in: the ID token lives only in your browser cookie for at most one hour. We keep no server-side session store, no account table and no login history;
• Payment records: retained by Waffo Pancake under its compliance obligations; we store none;
• Hosting access logs: handled by Cloudflare under its standard retention.

8. Your rights

Depending on your jurisdiction (for example GDPR or CCPA), you may have rights to access, rectify, erase, restrict, port, object to processing and withdraw consent. To exercise them, email [email protected] and we will respond within 30 calendar days. If you believe we have not handled a request properly, you may complain to your local data-protection authority.

9. Children

The service is intended for users aged 13 and above. We do not knowingly collect personal information from younger children. If you believe a child has provided us information, contact us and we will delete it promptly.

10. Third-party links and services

The site may link to third parties (for example the Waffo checkout or social platforms). This policy covers only information we collect directly; for third-party data practices, review their policies before use.

11. Changes

If we make material changes, we will give at least 15 days' notice via an on-page notice or the email used at purchase, and update the "last updated" date above. Continued use after the effective date means acceptance.

12. Contact

For privacy and data-protection matters, contact [email protected]. This mailbox is monitored and is the point of contact for access, deletion and other privacy requests. The related terms are in the Terms of Service.