WritingRoom Privacy Policy

Effective: October 8, 2026.

This Privacy Policy explains what information WritingRoom ("we", "us", "our") collects from people who use writingroom.io (the "Service"), how we use it, and the choices you have. WritingRoom is operated by Terry Michaels Studios LLC, based in the United States.

For a plain-English summary aimed at songwriters, see Privacy & Your IP. This document is the formal version.

1. Information we collect

Account information: name, email address, profile photo (optional), authentication identifiers from your sign-in provider, account creation date, last sign-in time.

Content: song titles, lyrics, chord annotations, structure, metadata, voice memos, demo recordings, scratchpad and "No Judgment Zone" pad entries, split sheet entries (writer name, percentage, IPI/CAE number, PRO affiliation, address, signature image, dated signature), camp memberships, modification logs.

Communications: announcements posted within camps, comments on lyrics (when comment-mode observation is enabled), email correspondence with us.

Technical: browser type, OS, screen size; IP address (used for fraud detection and rate-limiting; retained 30 days); cookies for session authentication and saved preferences (no advertising cookies).

What we don't collect: payment card numbers, government identifiers, health/biometric data, precise location, data from third-party social or messaging apps.

2. How we use information

To operate the Service: store your songs, keep them the same on every device, show you the pages, send announcements, run the rhymes feature. To authenticate you. To communicate (notifications of important changes, support, opt-in product updates). To protect the Service (abuse detection, rate limits, security investigation). To improve the Service via aggregate, anonymized usage stats, never tied to your identity.

We do not use your information to train AI models, sell or rent your data, or display advertising.

3. How we share information

With your collaborators: the writers, organizers, and admins you invite to a camp or room. You decide who you invite.

With our service providers (only what's necessary, contractually bound not to use your data for their own purposes):

• Base44 · application platform: app code and database. Receives: account info and the content you create.
• Cloudflare · DNS, email forwarding, edge caching, and storage for audio and uploaded files. Receives: your voice memos, demos, and uploaded files, and email forwarded to or from your address.
• Google (Workspace) · the email we send and get. Receives: your forwarded email body and headers.
• Google (sign-in, Calendar, Drive) · Google signs you in and gives us your name, email, and photo. Only if you connect Google Calendar, we ask for permission to add events to your calendar, so your writes show up there. Only if you import from Google Drive, we read the files you pick, and we don't keep the access we're given.
• Zoom · only if you connect your own Zoom. We ask to create meetings in your Zoom account and to read your Zoom email address. Receives: the title and time of the meetings you schedule.
• Stripe · payment processing. Receives: your payment details, which you enter on Stripe's own page, and your email. We never see or store your card number.
• Brevo · sends the email we send you, like invites, receipts, and notices. Receives: your email address, your name, and the message.
• Anthropic · the AI language model behind the features listed in How AI is Used. Receives: the text you send to a feature you press, and the text of public posts that the safety check looks at.
• Look-up services · Datamuse (rhymes), Spotify and Apple Music (finding releases), and credits.fm (checking songwriter credits). Receives: only the word, title, artist, or name you look up.
• Timestamp services · when you seal a song, a fingerprint of the sealed record (not the song itself) goes to the public OpenTimestamps servers, FreeTSA, and DigiCert so the date can be proven.

With law enforcement: if we receive a valid legal request, we will respond in compliance with applicable law and notify you unless legally prohibited.

With acquirers: if WritingRoom is acquired, your data may transfer. We will notify you in advance and you may export and delete before transfer.

We do not share with advertisers, ad networks, AI training data brokers, other camp organizers outside camps you've joined, or your friends or family unless you specifically invite them.

4. Security

Industry-standard security: TLS for data in transit; encrypted storage at rest via Base44; access controls limiting which staff (currently Terry only) can view production data. We do not store passwords. Authentication is delegated to your sign-in provider. If we discover a breach affecting your data, we will notify you within 72 hours of confirmation.

5. Retention

• Account info: as long as your account is active, plus 30 days after deletion.
• Songs and content: as long as your account is active. A song you delete yourself sits in Trash for 30 days, then it is gone for good.
• Voice memos and demo files, including Demo Studio takes and stems: same as song content, except that a deleted take is final after about 12 seconds.
• IP address logs: 30 days.
• Modification logs: permanently within the song record.
• Email correspondence: 3 years.

When you delete your account: our team processes the request by hand, usually within 48 hours, and emails you when it's done. Your account stays active until then. Then your name is removed from all songs you co-wrote (replaced with "Former co-writer" on splits to preserve historical accuracy of signed documents); private songs are permanently deleted; voice memos and demos are deleted.

6. Your rights

• Access: Request an export of all data we hold about you, as a plain text file you can open. Email [email protected].
• Correct: Edit your own profile, songs, and content directly. For data you cannot edit, request correction by email.
• Delete: Open Settings, then Account, and use Delete my account. We process it by hand, usually within 48 hours, and email you when it's done. Deletion is permanent.
• Object/Restrict: Email us with concerns; we respond within 14 days.
• Portability: All exports come as files you can open and reuse (a plain text file, PDF, MP3, WAV).

EU/UK/California residents have specific rights under GDPR / UK GDPR / CCPA. Email us with the words "GDPR request" or "CCPA request".

7. Children

WritingRoom is not directed to children under 16. If we discover collection from a child under 16, we will delete it.

8. International transfers

Servers and providers are in the United States. By using the Service from outside the US, you consent to transfer.

9. Changes to this policy

Material changes announced by email at least 14 days before effective. Continued use after the effective date constitutes acceptance.

10. Contact

Terry Michaels Studios LLC, [email protected]. Subject: "Privacy" or specific request type.

*Custom Label agreements are executed directly with Terry Michaels Studios LLC.