Privacy Policy

This policy is operated by Magic Unicorn Unconventional Technology & Stuff Inc., doing business as "Majik's Studio", and covers majiks.online and the public rights registry at majiks.media (served by the same application). Our browser studio at majiks.music has its own privacy policy tailored to how it works (most of its processing happens in your browser).

• Account information: when you sign in through Unicorn Commander (Keycloak SSO) we receive your email address, display name, and profile image — including when you use Google or Microsoft sign-in, in which case those providers share your basic profile. We never see your password.
• Listening telemetry: play events for the tracks you stream — track, timestamp, listen duration, completion, playback source, a session identifier, a one-way hash of your IP address, and your browser's user-agent string. This powers play limits, artist payouts, recommendations, and abuse prevention.
• Purchases and credits: records of tracks you buy (license type, price, date), your credit balance, and an immutable credit-transaction ledger. Cart contents and checkout manifests are stored server-side for order fulfillment and dispute resolution.
• Creator content: audio files, artwork, metadata, lyrics, pricing, generation metadata (for AI disclosure), and audio fingerprints we generate for provenance and copyright enforcement.
• Technical data: IP address, browser type, and device information in server logs, kept for security and performance.

We use two analytics systems:

• PostHog (PostHog Inc., US cloud) — product analytics and feature flags. PostHog receives usage events and device information and derives coarse location from your IP address. Events are used to understand and improve the product, not for advertising.
• Umami (self-hosted on our own infrastructure) — privacy-focused aggregate event counts. No cross-site tracking.

We do not use Google Analytics, advertising pixels, or data brokers, and we do not sell or share personal data for advertising.

All payments are processed by Stripe, Inc. We never store your card number, CVV, or bank credentials. Stripe also operates creator payouts via Stripe Connect Express; creators onboarding for payouts provide their details directly to Stripe under Stripe's own privacy policy. We keep transaction records (amount, date, license type) for purchase history, creator earnings, taxes, and dispute handling.

We use essential cookies for sign-in sessions and security (CSRF protection). These are required for the Service to function. We use browser local storage for player preferences and interface state. PostHog sets an analytics identifier as described in Section 3. We do not use third-party advertising cookies.

When creators publish tracks we generate audio fingerprints — mathematical representations that cannot be turned back into audio — for provenance certificates, duplicate detection, and DMCA enforcement. We also record AI-generation metadata (for example, the generation engine) to power the platform's AI-disclosure labeling and the public registry at majiks.media. Registry pages are public by design: they show works, recordings, artist names, splits, and AI provenance.

• Operate the Service: streaming, purchases, playlists, radio
• Enforce play limits and subscription benefits, including auto-purchase
• Process payments, credits, and creator payouts
• Generate recommendations and discovery features
• Detect and prevent abuse, fraud, and copyright infringement
• Communicate with you about your account and purchases

We do not train machine-learning models on your uploads, your listening history, or your personal data.

We do not sell personal data. We share it only with processors needed to run the platform:

• Stripe — payments, subscriptions, creator payouts
• PostHog — product analytics (US cloud)
• Cloudflare — DNS, CDN, and DDoS protection in front of the site
• Unicorn Commander (Keycloak) — authentication, operated on our own infrastructure

Hosting is on infrastructure we operate. We may disclose information when required by law or to protect the Service and its users.

Account data is kept while your account is active. Listening history is retained to run play limits and recommendations. Purchase and credit-ledger records are retained indefinitely because they document licensing agreements between buyers and creators. If you delete your account, personal data is removed and transaction records are anonymized, kept only for creator payouts, tax, and legal compliance.

Depending on where you live, you may have the right to access, correct, export, delete, or restrict processing of your personal data, and the right not to be discriminated against for exercising those rights. We honor GDPR and CCPA/CPRA requests from everyone, resident or not. We do not "sell" or "share" personal information as those terms are defined in the CCPA.

To make a request, email [email protected] from the address on your account. We respond within 30 days.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has an account, contact us and we will delete it.

We are a U.S. company and process data in the United States. Where data of EU/UK users is transferred, we rely on our processors' safeguards (for example, Stripe's and PostHog's standard contractual clauses / Data Privacy Framework participation).

We use encrypted connections (HTTPS/TLS), secure session management, hashed IPs in play telemetry, and rate limiting. No method of transmission or storage is 100% secure; if a breach affecting your data occurs, we will notify you as required by law.

We may update this policy. Material changes will be communicated by email or a notice on the platform, and the date at the top will change. Continued use after the effective date constitutes acceptance.

Privacy questions and requests: [email protected] — or see the contact page.