Privacy Policy

1. Who we are

This Privacy Policy explains how CHORUS MUSIC LTD (‘we’, ‘us’ or ‘our’), a company registered in the United Kingdom at 124 City Road, London, England EC1V 2NX, collects and uses personal data when you visit https://writewithchorus.com or use our songwriting app and related services (the ‘Services’). We are the ‘controller’ of this personal data under UK and EU data protection law, which means we decide how and why it is used.

Questions or requests about your data? Email us at [email protected], or write to us at the address above.

This policy should be read together with our Terms and Conditions.

2. What personal data we collect

Information you give us

• Account details: your email address and password (stored in hashed form), and if you sign in with Google or Apple, the name and email address (or Apple’s private relay address) that account shares with us.
• Your Content: the songs, lyrics, chords, recordings, notes and other material you create, upload or store in the Services, including any songs you choose to share. Recordings may contain your voice. We do not use recordings to identify you by your voice.
• Payment information: when you subscribe, your card details are collected and handled by Stripe. We do not see or store your full card number. We receive confirmation of payment and limited details such as card type, the last four digits and billing country.
• Communications and feedback: messages you send us, answers to cancellation questions or surveys, and anything you tell us if you take part in user research.

Information we collect automatically

• Usage and device data: how you use the Services (for example, features used, songs started, exercises completed, dates and times), your IP address, browser and device type, operating system, language, approximate location (country) and referring pages.
• Cookies and similar technologies: see section 7.

Information from others

We receive payment status information from Stripe and limited information from Google or Apple if you use them to sign in. We do not otherwise obtain personal data about you from third parties.

Sensitive information in your songs

Songs are personal, and your lyrics or recordings may mention sensitive matters such as health, relationships, beliefs or sexuality. We do not ask for this kind of information, and we do not look for it, extract it or use it to profile you. If you include it in your songs, it is covered by the same protections and limits described in this policy and in section 3.3 of our Terms.

3. How we use your data and why we are allowed to

The law requires us to have a ‘legal basis’ for each use of your personal data. The table shows what we do and the basis we rely on.

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You can ask us for more detail about how we reached that conclusion.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Your songs

Your songs belong to you. We do not sell, publish or license them, and we do not use them to train AI models that generate lyrics or music. We do not use them to choose or target advertising. The detail is set out in section 3 of our Terms. Statistics and insights we produce from songs in aggregate do not reproduce substantial parts of them and do not identify you.

4. Who we share your data with

We do not sell your personal data. We share it only with the following, and only as needed:

• Google (Firebase and Google Analytics): hosting and storing our app data, including your account and Your Content, authentication (including Google sign-in), and analytics.
• Anthropic and OpenAI: our AI providers for features such as Genius. If you use such a feature, the content you submit to it is sent to one or both providers to generate a response. We do not send your content to them unless you use the feature. Under their API terms they do not use that content to train their models by default, and we have not agreed to any such use.
• Apple: if you choose to sign in with Apple, Apple tells us that you signed in and shares your name and email address (or a private relay address) with us.
• Stripe: payment processing and subscription billing.
• Brevo: sending service emails.
• Cloudflare: delivering and securing our website and app.
• Meta and other advertising partners: if you consent to advertising cookies, we use tools from these partners to measure our own advertising, for example by telling them when someone signs up or starts a trial, and we may use limited customer information (such as a hashed email address) to build audiences for our advertising where we have a legal basis to do so. The advertising network(s) that show ads on our website may also set cookies, as described in section 7.
• Professional advisers, authorities and others: our accountants, lawyers and insurers, and law enforcement, regulators or courts where we are legally required to, or need to protect our rights or the safety of others.
• A buyer or successor: if we are involved in a merger, sale or reorganisation, your data may be transferred to the new owner, who must continue to protect it in line with this policy.

These providers act on our instructions under contracts that require them to protect your data (in the case of analytics and advertising partners, on their own terms where they act as independent controllers). If you sign in with a third-party account, that provider’s own privacy policy applies to what it collects.

5. Transfers outside the UK and EEA

Some of the providers above are based in, or process data in, the United States and other countries outside the UK and the European Economic Area. Where we transfer personal data to such countries, we make sure it is protected by an appropriate safeguard, such as the UK–US Data Bridge or the EU–US Data Privacy Framework (where the recipient is certified), or standard contractual clauses (with the UK Addendum or the UK International Data Transfer Agreement, where relevant). You can contact us to ask for more information or a copy of the safeguards.

6. How long we keep your data

• Account details and Your Content: for as long as you have an account. If you delete Your Content or your account, we delete it from our systems within 30 days, including from backups, unless the law requires us to keep it.
• Payment and billing records: usually six years, to meet UK accounting and tax requirements. Stripe keeps its own records under its own policy.
• Support messages, feedback and research notes: for as long as needed to deal with your enquiry or the research, and then deleted or anonymised.
• Usage and analytics data: for a limited period set in our analytics tools.
• Aggregated statistics and insights: these no longer identify you, so we may keep them indefinitely.

7. Cookies and similar technologies

We use cookies and similar technologies (such as pixels and local storage) in three ways:

• Essential: needed to keep you signed in, keep the Services secure and make them work. These do not need consent.
• Analytics: to understand how the Services are used, including through Google Analytics. We use these only with your consent. You can also opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout.
• Advertising: set by us and by advertising partners to show and measure ads. We use these only with your consent.

You can accept, reject or change your choices at any time using the cookie settings on our website, or through your browser settings. Rejecting non-essential cookies will not stop you using the Services. We honour the Global Privacy Control opt-out signal. Because there is no agreed standard for ‘Do Not Track’ signals, we do not respond to them.

8. AI-powered features

Some features of the Services use artificial intelligence provided by a third party, currently Anthropic and OpenAI (see section 4). These features only process your content when you choose to use them. The providers act on our instructions. Under their terms they do not use your content to train their models by default, and we have not agreed to any such use. They may keep your content for a limited period (for example, up to 30 days) to detect abuse before deleting it. Other analysis we carry out, such as counting which words are rhymed most often or which chords are common in a genre, is statistical and does not generate lyrics or music from your songs.

9. Security

We use appropriate technical and organisational measures to protect your personal data, such as encryption in transit, access controls and the security features of our hosting providers. No system is completely secure, so we cannot guarantee that your data will never be accessed by someone who should not have it. If a breach is likely to put your rights at risk, we will notify you and the relevant authority as required by law. Please use a strong, unique password.

10. Your rights

If you are in the UK or the European Economic Area, you have the right to:

• be told how your data is used (this policy);
• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased, in some circumstances;
• restrict how we use your data, in some circumstances;
• receive your data in a portable format, where we use it based on contract or consent;
• object to uses based on legitimate interests, including our individual review of Content and contacting users about partnership opportunities. If you object, we will stop unless we have compelling grounds that override your interests; and
• withdraw consent at any time, where we rely on it. This does not affect what we did before you withdrew it.

To use any of these rights, email [email protected]. We may need to verify your identity first. We aim to respond within one month. You can also review, update, export or delete much of your data in your account settings.

You also have the right to complain to your data protection authority. In the UK this is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to resolve your concern first, so please contact us.

11. US residents

If you live in a US state with a privacy law, such as California, you may have the right to know what personal information we collect, to access, correct or delete it, to receive a copy of it, to opt out of targeted advertising or the ‘sale’ or ‘sharing’ of personal information, and not to be discriminated against for using these rights. We do not sell personal information for money. Where we use advertising cookies or pixels, which can count as ‘sharing’ for targeted advertising under some US laws, you can opt out by turning those cookies off in our cookie settings, by using the Global Privacy Control signal, or by emailing us. We do not knowingly collect or use sensitive personal information to infer characteristics about you. To make a request, email [email protected]. If we decline a request, you may appeal by replying to us, and if the appeal is denied you may complain to your state attorney general.

12. Other countries

If you live somewhere else, you may have rights under your local data protection law. Please contact us and we will deal with your request in accordance with the law that applies to you.

13. Children

The Services are for people aged 18 or over, and we do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, email us and we will delete it.

14. Third-party websites

The Services may link to or show advertisements from third parties. We are not responsible for their privacy practices, so please read their privacy policies.

15. Changes to this policy

We may update this policy from time to time. The ‘Last updated’ date at the top shows when it was last changed. If we make a material change, such as using your data for a new purpose, we will tell you by email or in the Services before it takes effect, and where the law requires your consent, we will ask for it.

16. Contact us

For any question about this policy or how we use your data, contact us at:

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.