Privacy Policy
What we collect, why, how long we keep it, and your rights. We collect little, sell nothing, and run no advertising or analytics trackers.
Effective 25 October 2026 · version 2026-10-25
The data controller for ky.ax is the operator of Ky ("Ky", "we"), based in the United Kingdom. Questions and requests: privacy@ky.ax.
What we collect and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address and password (hashed, never readable by us); or your Google account's email, name and subject id if you sign in with Google | To run your account and let you back in | Contract | While your account exists |
| The MIDI files you upload or send from a plugin, and the results | To run the check and show you the results | Contract | Account checks: while your account exists, or until you delete the check. Anonymous checks: 30 days |
| A hash of your IP address, your browser's user-agent string, timestamps | Daily limits, abuse prevention, security logs | Legitimate interests (keeping the service up and fair) | Up to 90 days, then removed by a nightly job |
| A claim token for an anonymous check, kept in your browser's local storage | So you can attach the check to an account you create afterwards | Contract | Until you claim the check or clear your browser storage |
| Cloudflare's request logs (sampled; URL, status, timing, coarse location) | Diagnosing faults | Legitimate interests | Up to 7 days at Cloudflare |
| API keys you create (stored hashed) and the name of the tool you connected | To let plugins check files on your behalf | Contract | Until revoked |
| Integration interest ("tell me when the Ableton plugin is ready") with your email | To tell you | Consent | Until we tell you or you ask us to stop |
We do not use advertising or analytics trackers, fingerprinting, or third-party cookies. The only cookie is the session cookie that keeps you signed in (and a ten-minute cookie during Google sign-in). Our analysis servers may keep a cache of results, keyed by a fingerprint of the file, for up to 30 days.
Where it goes
- Cloudflare hosts the site, the database and the file storage (data may be processed in the EU, UK and US under Cloudflare's data processing terms).
- Our own analysis servers process the files. They are our hardware, not a cloud AI service; your music is not sent to any third-party model provider.
- Google, only if you choose "Continue with Google", under Google's privacy policy; Google processes data in the US under its data transfer terms.
- Resend (email delivery, US), only for password-reset email, if it is switched on.
- Nobody else. We don't sell data, and we don't share it except with these processors, or if the law requires it.
Your music is not training data
Uploaded files are compared against the catalogue and then stored for you. They are not added to the catalogue, not used to train or tune any model, and not shown to other users.
Your rights
Under UK and EU data protection law you can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere. Most of this you can do yourself: delete a check from its result page or your list of checks, or delete your account (Account → Delete account), which removes your account, files and results. For anything else write to privacy@ky.ax. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local authority.
Security
Passwords are salted, peppered and hashed; sessions and API keys are stored only as hashes; everything travels over TLS; files and results are private to your account. See Security. If you find a problem, email security@ky.ax.
Children
Ky is not for anyone under 16. If you think a child has given us data, email privacy@ky.ax and we will delete it.
Changes
We will post changes here with a new version and effective date, and tell you if they matter.