Legal

Privacy Policy — Toxic Sound

Last updated: October 5, 2026

Toxic Sound ("we," "us," "our"), operated by Kailon James Brown, operating as Toxic Sound, British Columbia, Canada, respects your privacy. This policy explains what personal information we collect, why, who we share it with, and your rights. It applies to toxicsound.org and related services (the "Service").

We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

1. Information we collect

1.1 Account information

When you register, we collect your email address and any profile information you provide (e.g., display name). We use Supabase for authentication; passwords are handled by our auth provider and never stored by us in readable form.

1.2 Payment information

Payments are processed by Stripe. We receive confirmation of payment, subscription status, and the last four digits / card brand for your receipts. We never see or store your full card number. Stripe's handling of your data is governed by Stripe's own privacy policy.

1.3 Content you create

Prompts and custom lyrics you submit.
Generated outputs: audio tracks, lyrics, and cover art produced from your prompts.
Public sharing choices: tracks you publish to the public feed, ratings you leave.

1.4 Usage and technical data

Device and browser type, approximate location (from IP), pages visited, features used, generation history, error logs.
Cookies and similar technologies (see Section 8).

1.5 Communications

Emails you send us (support, abuse reports) and our correspondence with you, including via Resend.

2. Why we collect it (purposes)

Purpose	Legal basis (PIPEDA)
Provide and operate the Service (accounts, generations, library)	Consent via Terms / contract performance
Process payments and manage subscriptions/credits	Contract performance
Customer support and abuse/fraud prevention	Legitimate interest, legal obligation
Improve the Service (aggregated, de-identified analytics)	Legitimate interest
Legal compliance (tax records, law enforcement requests)	Legal obligation
Marketing emails (if you opt in)	Express consent (CASL) — unsubscribe anytime

We do not sell your personal information. We do not use your prompts, lyrics, or tracks to train third-party AI models.

3. Who we share it with

We share personal information only as needed, with:

Supabase (database, authentication, file storage) — account, content, usage data.
Stripe (payments) — payment and subscription data.
fal.ai / MiniMax (AI generation providers) — your prompts and generation parameters, so tracks can be generated. They do not receive your name or email from us.
Resend (transactional email) — your email address for receipts, notifications.
Lovable (hosting/platform) — technical/operational data.
Law enforcement or regulators — only when required by law (e.g., valid court order) or to address the serious violations in our Terms (e.g., CSAM, which we report).

All service providers are bound by contractual obligations to protect your information and use it only for the services they provide to us.

4. International transfers

Our service providers process and store data outside Canada, primarily in the United States (Supabase, Stripe, fal.ai, Resend). By using the Service, you consent to your information being transferred to and processed in these jurisdictions, where it may be subject to foreign laws (including lawful access requests). We take reasonable steps to ensure providers protect your data to a comparable standard.

5. Retention

Account data: kept while your account is active.
Generated content: kept while your account is active; deleted within a reasonable period after account deletion (backups may persist up to 90 days).
Payment records: kept as required by tax law (generally 6–7 years in Canada).
Support correspondence: kept up to 2 years.
De-identified analytics: may be kept indefinitely.

6. Security

We use industry-standard safeguards: encrypted connections (TLS), access controls, and reputable infrastructure providers. No system is perfectly secure; in the event of a breach affecting your information, we will notify you and the relevant privacy commissioner as required by law.

7. Your rights

Under PIPEDA/PIPA you may:

Access — request a copy of the personal information we hold about you.
Correction — ask us to fix inaccurate information.
Deletion — request deletion of your account and personal information (subject to legal retention duties above).
Withdraw consent — for optional uses like marketing; withdrawing consent for essential processing means we can't provide the Service.
Challenge compliance — complain to us first, then to the Office of the Privacy Commissioner of Canada or the BC Information and Privacy Commissioner.

To exercise any right, email toxicsoundai@gmail.com. We respond within 30 days.

8. Cookies

We use:

Essential cookies — login sessions, security, load balancing. The Service won't work without these.
Preference cookies — e.g., player volume, theme.
Analytics cookies — aggregated usage measurement.

You can block non-essential cookies in your browser settings; some features may degrade. We do not use third-party advertising trackers.

9. Children

The Service is 18+ only. We do not knowingly collect information from minors. If you believe a minor has provided us information, contact toxicsoundai@gmail.com and we will delete it.

10. Changes to this policy

We will post updates here with a new "Last updated" date. Material changes will be announced (banner or email) at least 14 days before taking effect.

11. Contact

Privacy questions or requests: toxicsoundai@gmail.com
General: toxicsoundai@gmail.com

Kailon James Brown, operating as Toxic Sound, British Columbia, Canada