Privacy Policy

• Account data (Clerk). When you sign in, Clerk processes identifiers such as your user ID, email, name or username, and profile image. We use this to authenticate you and show your account in the app.
• Generation history (Supabase). We store the data needed to run the product: for example prompts, genre, tempo, layer data for MIDI you generate, timestamps, and sharing settings when you save or share a generation.
• Usage and performance (Vercel). We collect aggregated analytics and technical metrics to understand traffic, errors, and performance. That helps us keep the service fast and reliable.
• Support and chat (Crisp, when loaded). If you use in-app chat, Crisp may process messages and technical metadata needed to deliver that feature.
• Billing (Stripe). For paid plans, Stripe processes payment details. We receive billing status and limited customer references from Stripe—not your full card number.
• Rate limiting (Upstash). We may store short-lived technical data (for example IP or request fingerprints) to enforce fair use and protect the API from abuse.

We use cookies and similar technologies where needed for the product to work. Clerk sets session cookies so you stay signed in. We may store preferences (such as theme) in your browser. Analytics cookies or identifiers may be set by our hosting/analytics providers as described in their policies. You can control cookies through your browser; disabling some cookies may limit sign-in or personalization.

We rely on processors we trust to run pulp. They only receive what they need to perform their role:

• Clerk — authentication and session management.
• Supabase — database storage for generations, credits, and related app data.
• Stripe — payments and subscription status for paid plans.
• Upstash — rate limiting and abuse protection.
• Vercel — hosting, analytics, and performance insights.
• Crisp — optional customer chat when enabled in the app.

Each provider has its own privacy policy. We choose configurations that minimize data collection for our use case, but you should review their terms if you want full detail.

We keep account and generation data while your account is active and as needed to provide the service, comply with law, resolve disputes, and maintain security. If you delete your account, we work to remove or anonymize personal data within a reasonable period, subject to legal retention requirements.

Depending on where you live, you may have rights to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate information.
• Request deletion of your account and associated data, where applicable.
• Object to or restrict certain processing, where the law allows.

To exercise these rights, email us at privacy@bypapaya.com. We may need to verify your identity before fulfilling a request.

We use industry-standard practices (encryption in transit, access controls, and secure infrastructure) appropriate to the nature of the service. No online service is risk-free; we continuously work to reduce risk and respond to issues responsibly.

Questions about this policy: privacy@bypapaya.com