Privacy Policy

1. Who handles your data

Maru is the controller of the data described here. Questions and requests go to hello@maruaudio.com.

2. What we collect

• Account information. When you sign in with Google or GitHub, we receive basic profile details (typically your name, email address, and avatar) to create and identify your account. We also keep session records and the time of your last sign-in.
• Your creator work. The projects you create and every saved revision of them: source files, presets, project settings, listing text, tags and cover artwork, and the samples and other files you upload, MIDI clips, racks and sound banks.
• Agent conversations and AI requests. Your original brief, your messages to the Studio agent and its replies, the actions it took, images and audio you attach, and the prompts and settings you submit to generation features. Conversations are not shown to other users; see section 4 for who can access them.
• Audio you submit for processing. If you choose server-side stem separation, the audio file you submit and the stems produced from it, for the duration of the job.
• Connected services and tokens. If you install our GitHub App, the installation identifier (we do not store a long-lived GitHub token). If you create access tokens for command-line or agent tools, a record of those tokens.
• Purchases and product access. Products acquired, order and provider references, prices, product-license snapshots, receipts, fulfillment status, and account entitlements. Our payment provider processes payment details; we do not store your complete card number.
• Plug-in activation. When you activate a Maru plug-in, we store which product is activated on which of your computers. For each computer that is: a hash of a random key the plug-in creates for itself, a one-way hashed digest of the computer’s hardware identifier (the identifier itself never leaves your computer), the computer name you see in your account, the operating system and plug-in version and format, and the times of activation and checks. For each activation or check we keep the country and network (ASN) it came from, not your IP address. We use this to provide the license, enforce its computer limit, and detect licenses shared beyond their terms. It is not used for advertising.
• Newsletter signups. If you subscribe, we store your email address, signup time, the page where you subscribed, and the version of the newsletter consent. These records are private and available only to authorized staff. Subscribing does not create an account. You can request removal using the contact address below. The exit prompt also stores a dismissal timestamp or signup flag in your browser to avoid repeated prompts.
• Transactional messages. Delivery information for account, receipt, access, and support messages, including whether a message was accepted, delivered, failed, or suppressed.
• Applications and inquiries. If you apply to work with us or contact us about a collaboration, we collect what you send: resume, interests, location, experience, preferred role, contact details, message text and any supporting material. These are private and visible only to you and authorized staff.
• Contact form messages. Your name (if given), email address, message, and the IP address and browser user-agent the message was sent from, plus your account if you were signed in.
• Security records. IP addresses, user-agents, rate-limit events and the outcome of sensitive actions (such as form submissions), sometimes with a hashed email address, used to prevent abuse.
• Usage, analytics and diagnostic data. Server and request logs, performance measurements (such as page load times), the pages and features you use, events such as starting a download or checkout, approximate location derived from your IP address, device and browser type, and error reports. We use this to keep the Service running, fix problems, and understand and improve how it is used. Our main site analytics runs on our own servers and is cookieless; the third-party analytics and monitoring providers we use are listed in section 7.
• Advertising cookies, only if you accept them. With your consent, the Google Ads tag and the Meta Pixel record which pages you visit and whether you start or complete a checkout or send us a brief, so we can show Maru ads to past visitors and measure them (section 8). We send product identifiers and amounts, never your name, email address or order details.

3. Where it lives

Maru runs on Cloudflare, which hosts the website and stores our databases, files and email on our behalf under its terms. Hosted audio generation and server-side stem separation run on an inference server we operate ourselves, on rented infrastructure, or are sent to the hosted inference providers listed in section 7.

4. What is public, and who can see private work

New modules you create in Studio are created as public, and you can change that at any time from the Share control. While a project is public or unlisted, anyone who can open it can play it, read its latest saved source, fork it and embed it, and your profile lists your public work. Your unsaved edits, your brief, your agent conversations, your private projects and your revision history are not shown to other users. The Terms set this out in full.

Authorized staff, and service providers working on our behalf, may access private projects and agent conversations to operate, secure, support and improve the Service (including as described in section 5), to investigate abuse or act on a report, and when required by law.

5. AI features and model providers

The Studio agent runs on our servers and uses a third-party large language model provider, currently OpenAI. On each turn we send the provider your conversation history, any images you attached, and the project context the agent reads or writes, such as module source code. Audio attachments are not sent to the model provider; the agent sees only their file names. If you enable web search, your query is also run through the provider’s search tool. The provider processes this under its API terms, which may include retaining it for a limited period for abuse monitoring. We may use other model providers in the future and will list them in section 7.

Some features run entirely in your browser (including local stem separation, transcription and beat analysis) and the audio they process does not leave your device. Their model files are downloaded from our storage or from Hugging Face, which sees your IP address when you download from it. If you choose a bring-your-own-key provider such as Fadr, the audio you submit is sent directly to that provider under your own account with it, and your key is stored only in your browser.

We may use the information described in this policy (including your content, private projects, prompts, agent conversations and AI output) to develop, train, evaluate and improve the Service, its AI features and our machine-learning models. Where practical we de-identify or aggregate information used for this purpose.

6. How we use it

We use the information above to:

• Provide, maintain, and secure the Service.
• Save your work and associate it with your account.
• Run the Studio agent and AI features you use, and carry out the actions you ask the agent to take.
• Serve public pages, embeds, forks and profiles.
• Develop, train, evaluate and improve the Service, its AI features and machine-learning models, and build new features and products (section 5).
• Understand how products and preview tools are used and improve them.
• Process acquisitions, provide receipts, assign product access, support redownloads, and resolve payment or account issues.
• Review applications and inquiries, respond to your messages, and act on reports and takedown requests.

We do not sell your personal information. Google and Meta receive the advertising signals described in section 2 only if you accept advertising cookies.

7. Sharing and sub-processors

We share data only with the service providers (“sub-processors”) that help us operate Maru, and where required by law or needed to protect the Service, our users, or our rights. Sub-processors process data on our behalf, for the purposes below, under their own terms and our agreements with them. The current list:

We may add or replace sub-processors as the Service grows. When we do, we update this list and the version and date above. Whatever you publish is shared with everyone who can open it, as described in section 4. If the Service is reorganized, merged or sold, data may transfer to the new operator under this policy.

These providers may process data in the United States, Canada, the European Union and other countries outside the one you live in, where privacy law may differ from yours. We rely on their contractual commitments to protect it.

8. Cookies and browser storage

We use our own cookies to keep you signed in. We also store preferences, cached model files, drafts and any bring-your-own-key API keys in your browser’s local storage, which stays on your device. Clearing your browser data removes what is stored locally.

Advertising cookies from Google and Meta are optional. They are loaded only after you choose “Accept” in the banner, and they let those companies recognize your browser across sites so we can show you Maru ads. Declining changes nothing else about the Service. You can change your choice here at any time; withdrawing it stops further collection, and you can clear cookies already set from your browser settings.

9. Deleting your account

In account settings, “Delete my creator data” removes your creator work while leaving your sign-in account in place. To request deletion of your account as well, write to hello@maruaudio.com from the address on your account. When we process your account-deletion request, we delete or de-identify the personal information associated with your account, and remove your projects and profile from the Service, within a reasonable period, which we aim to keep within 30 days.

Some information is not removed, or not removed immediately:

• Content others already have. Forks and copies other people made of your public or unlisted work remain theirs (fork rule), as do copies outside our control, such as embeds, archives, search-engine caches and downloads.
• Content the Service needs to keep working. Files, links and references that other users’ projects, forks or racks still rely on may be kept, without your name or other information identifying you.
• De-identified and aggregated data, and improvements to the Service and to machine-learning models that were already made using your information (section 6).
• Backups and logs, which expire on their own schedule and are not restored to the live Service.
• Records we must or may keep to meet legal, tax and accounting obligations, resolve disputes, prevent fraud and abuse, enforce our terms, or protect the Service.

10. Retention

We keep your data for as long as your account is active or as needed to provide the Service, fulfill purchases, resolve disputes, and meet legal, tax, accounting, and security obligations. Contact-form messages and security records are kept as long as needed to respond and to protect the Service. Audio submitted for server-side separation is discarded when the job ends, and its results expire shortly after. Data created inside preview tools may be reset or removed as those tools evolve; do not treat preview project storage as your only copy. Plug-in activation records are kept while the computer is activated and for 90 days after it is removed; the license check log is kept for 13 months.

11. Security

We take reasonable measures to protect your data, but no method of transmission or storage is completely secure. Preview tools are provided without warranty; please do not store sensitive or irreplaceable project data in them.

12. Your choices

You may request access to, correction of, export of, or deletion of your personal data by contacting us at hello@maruaudio.com. Depending on where you live you may have additional rights under local law, and we will honor them where they apply, including the right to withdraw consent and to complain to your privacy regulator. You can also change any project’s visibility, or stop using the Service, at any time.

13. Children

Maru is not for people under 13, or under the higher minimum age your local law may set. We do not knowingly collect data from them. If you believe a child has created an account, write to us and we will remove it.

14. Changes to this policy

We may update this policy. When we do, we will revise the version and date above.

15. Contact

For any privacy question, deletion request, or report, contact us at hello@maruaudio.com.

See also our Terms & Conditions.