Privacy policy.
What happens to your audio, account information and saved results when you use BPM Finder.
- Audio stays on your device. Analysis runs in your browser, including optional audio models.
- Saving is your choice. Pro’s Save Results checkbox stores track names and measurements in your account, without uploading audio.
- Account data is separate. Signing in, email delivery, subscriptions and site performance involve the providers described below.
The sections below explain these practices and the choices available to you.
01 Information we process
Audio and analysis on your device
When you choose an audio file, your browser reads and analyzes it locally. We do not upload the recording to our servers or send it to an external AI service for analysis. Playback, waveform generation, BPM, key, Camelot and optional Energy, Dance and Happy calculations run on your device. Model and runtime files are downloaded to your browser when needed.
Audio and unsaved analysis results are held in memory for the current page session. Refreshing or closing the page clears them. Export CSV creates a download on your device; it does not itself save a copy to your account. We do not use your recordings or saved results to train AI models.
Accounts and sign-in
- Email registration: your email address, an account identifier, a display name derived from your email, registration and verification dates, and a salted password hash. Your password is processed to create or verify that hash; it is not stored as readable text.
- Verification: your email address, a digest of the verification code, delivery status, expiry time and attempt count. Resend receives your address and the email content to deliver the code.
- Google sign-in: your Google account identifier, verified email address, name and profile picture, as supplied by Google. We do not receive your Google password or request access to Gmail, Drive or your music library.
- Sessions and security: session and sign-in information, authentication timestamps and rate-limit records. A network address supplied by our hosting provider may be used to derive an abuse-prevention identifier.
Optional saved results
When an eligible signed-in user selects Save Results, subsequent completed results are stored with their account. A snapshot can include the track name, duration, BPM, musical key, Camelot notation, Energy, Dance and Happy scores when available, manual edits, analysis-engine information and saved-record identifiers and timestamps. The audio file and its contents are not included. Track names may themselves contain personal information, so choose them with that in mind.
Subscriptions, support and technical information
If you use paid checkout, we process your account email and identifier, chosen plan, amount and currency, checkout and transaction identifiers, subscription status, billing periods and payment-event records. Payment-card details are collected by Waffo Pancake and its payment partners; our application does not store full card numbers or card security codes.
If you contact support, we receive the message, your contact details and any information you choose to include. Hosting, security and performance services can process IP addresses, request URLs, browser and device information, request times, response codes, errors and page-performance measurements. This technical processing is separate from local audio analysis.
02 How we use information
We use information for the purposes below. Where data-protection law requires a legal basis, the basis depends on the purpose and circumstances:
| Purpose | Legal basis |
|---|---|
| Create accounts, authenticate users and provide saved history | Performance of our contract with you |
| Process subscriptions, payments, cancellation and refunds | Performance of a contract; applicable legal obligations |
| Answer support requests and send necessary service notices | Performance of a contract; legitimate interests in responding and maintaining the Service |
| Prevent abuse, secure accounts and diagnose failures | Legitimate interests in protecting users and operating a reliable Service |
| Measure site performance and improve reliability | Legitimate interests, or consent where required by applicable law |
| Meet legal requirements and resolve disputes | Legal obligations; legitimate interests in establishing or defending legal claims |
We do not sell personal information or share it for cross-context behavioral advertising. We do not use analysis scores to make legal or similarly significant decisions about you.
05 Keeping information secure
We use HTTPS for the production site, salted scrypt password hashes, protected session cookies, sign-in checks, verification-code expiry and request rate limits. Access to saved snapshots and subscription information is checked against the signed-in account. Service credentials are kept on the server rather than included in browser code.
No transmission or storage system can be guaranteed completely secure. Keep your credentials private and tell us about suspected account misuse at support@bpmfder.com. If a personal-data breach requires notification, we will notify affected people and relevant authorities within the deadlines required by applicable law.
06 How long we keep information
| Information | Retention and removal |
|---|---|
| Audio and unsaved results | Kept in the page’s memory for the current session, cleared on refresh or close. Your own downloads remain on your device until you remove them. |
| Session information | The session has a configured maximum age of 7 days and may renew during use. Signing out clears the session cookie in that browser. |
| Verification codes and rate limits | Codes expire after 10 minutes. Successful registration removes the code record; expired records are cleaned up when later code requests run. Rate-limit windows vary by action, from 1 minute to 24 hours; expired counters are removed when later rate-limit checks run. Expiry does not imply immediate background deletion. |
| Account information | Retained while the account is maintained. You can request account deletion by email, subject to records that must be kept for legal, security or dispute reasons. |
| Saved snapshots | Retained until you delete them or they are removed as part of an account-deletion request, subject to applicable exceptions. Subscription cancellation does not delete existing snapshots. |
| Billing, support and operational records | Kept for the periods needed for the relevant transaction, request, security investigation, legal obligation or dispute. |
You can view, export and delete your saved snapshots from Saved Results, including after Pro expires. Unchecking Save Results stops future saves and does not remove existing snapshots. Clear all affects only the current workspace. Service providers may retain records under their own policies and legal obligations.
07 Your rights and choices
Depending on where you live and applicable law, you may have the right to:
- Know what personal information we process and obtain access or a copy.
- Correct inaccurate or incomplete information.
- Request deletion, subject to applicable exceptions.
- Restrict certain processing or object to processing based on legitimate interests.
- Receive eligible information in a portable, machine-readable form.
- Withdraw consent for processing that relies on consent, without affecting earlier lawful processing.
- Complain to a competent data-protection authority and, where applicable, appeal a decision on a request.
Email support@bpmfder.com to exercise a right, request account deletion or raise an objection to performance measurement. We may ask for information needed to verify ownership and clarify the request. Do not send passwords or full payment-card details. We will respond within the time required by applicable law and explain any lawful extension, exception or refusal. We do not discriminate against people for exercising applicable privacy rights.
Deleting your account and canceling renewal are separate actions. If you want both, say so in your request. You can also cancel renewal directly on Pricing while signed in. Removing Google’s access permission alone does not delete an existing BPM Finder account or saved results.
08 International processing
Cloudflare operates a global network, and our authentication, email and payment providers may process information in countries outside your home country, including the United States. Data-protection laws can differ between locations. Local audio analysis still takes place on your device.
The provider privacy policies linked in Sharing and service providers describe their international data-processing practices.
09 Children and eligibility
The Service is intended for people aged 18 or older, as stated in our Terms. We do not knowingly collect personal information from children under 18. If you believe a child has supplied personal information, contact support@bpmfder.com so we can investigate and remove it where appropriate.
10 Third-party services and links
Our pages may link to music resources, research and other external websites. Google sign-in and hosted checkout also involve third-party pages. Those providers control their own websites and independent data practices. Review their privacy notices when using them. This policy covers BPM Finder’s processing and does not replace those notices.
11 Changes to this policy
We may update this policy as the Service or legal requirements change. The version and effective date appear at the top. For material changes, we will provide notice through the Service or your account email before the change takes effect where required, and seek consent when the law requires it. An update does not by itself authorize a new use that requires your consent.
12 Contact us
For privacy questions, data-access requests, corrections, account deletion or security concerns, email support@bpmfder.com. Tell us which account or data your request concerns so we can respond. You can also manage individual snapshots in Saved Results and subscription renewal on Pricing.