SignlDAW Privacy Policy

Effective date: 11 October 2026 · Version: 2026-10-11.1

This policy explains what personal data we process when you use the SignlDAW desktop app, your SignlDAW account and signldaw.com, and what rights you have.

1. Who we are

SignlDAW OÜ, registry code 17507170, Ahtri tn 12, 15551 Tallinn, Estonia ("SignlDAW", "we", "us") is the controller of your personal data. Contact us at admin@signldaw.com.

2. The short version

• Your music stays on your computer. We don't receive your projects, recordings or audio unless you send them to us yourself, for example as a screenshot in a problem report.
• When you collaborate, your project goes to the people you invite, not to us.
• We don't sell your personal data or use it for advertising.
• Crash reports are off unless you turn them on, in Account menu → Share Diagnostics.

3. What we collect, why, and for how long

Your account

You need an account to use the commercial edition of SignlDAW. Auth0 handles sign-in through Google; Apple sign-in may be offered later. SignlDAW does not issue a separate password. We receive your name, email address, account ID and basic profile information such as your profile picture. We never see your password. The app stores your sign-in securely in your operating system's credential store (Keychain on macOS, Credential Manager on Windows). Your chosen identity provider manages your login credentials and account recovery.

You need to give an email address to create an account. Without one, we can't provide SignlDAW.

• Why: to create your account, sign you in, keep it secure and link it to your subscription.
• Legal basis: performing our contract with you (GDPR Art. 6(1)(b)).
• How long: while your account exists. We delete it within 30 days after you close your account.

Subscriptions and payments

For future paid purchases, Creem is the intended reseller and Merchant of Record for SignlDAW Plus and Pro, subject to account approval and payment activation. Creem collects your payment and billing details, such as card details, billing address and tax information. It handles them as an independent controller under its own privacy notice, and the checkout may use cookies that Creem needs for payment and fraud prevention. We never see your full card details. We receive and store your Creem customer ID and your subscription plan, status, billing period and renewal date, along with transaction references, all linked to your account.

• Why: to give you the paid features you pay for, manage your subscription, handle refunds and support, and keep business records.
• Legal basis: contract; and our legal obligations under accounting law (Art. 6(1)(c)).
• How long: while your account exists. When you close your account, we delete your subscription details. The only exception is transaction references that form part of our accounting records: the Estonian Accounting Act (§ 12) requires us to keep those for 7 years from the end of the financial year in which they were recorded.

Crash and error reports (only if you turn them on)

Crash reports are off by default. If you turn them on, then whenever SignlDAW crashes or hits an error it sends a report to our error-reporting service. A report contains:

• technical details about the problem, such as where in the app it happened and a snapshot of the app's state at the time;
• your app version, operating system and device details, and whether each app session ended normally;
• your account ID (an identifier, not your name or email) and your plan.

We don't add your name or email to reports. A crash snapshot can occasionally include something that was in the app's memory at the time, such as a file or project name.

• Why: to find and fix crashes and bugs.
• Legal basis: your consent (Art. 6(1)(a), and the EU ePrivacy rule on accessing information on your device).
• How long: up to 90 days.
• Your choice: turn reports on or off at any time in Account menu → Share Diagnostics. Turning them off withdraws your consent for future reports.

Optional feature usage

The optional feature-usage choice is preselected during first-time account setup. You can turn it off before continuing; no feature analytics are sent until you complete that setup with it enabled. Existing saved choices are preserved. You can change the setting at any time in S account menu → Usage sharing. This is separate from crash diagnostics. When enabled, Sentry receives named feature actions (such as opening or starting Tone Transfer), event times, app version/environment, plan and a hashed account identifier. We use these to count actions and participating accounts over time. We do not include recordings, song names, project names, file paths or search terms in usage events.

• Why: to understand which features are used and improve the product.
• Legal basis: your consent, which you can withdraw in the account menu without losing access to features.
• How long: up to 90 days, subject to the configured Sentry retention period.

Feature allowances and agreement records

Our account service stores your account ID, trial start time, the feature requested, an operation or collaboration project ID, its UTC month and authorization time to enforce allowances consistently across devices. It also stores referral codes, referrer links and earned free-period dates when you use the referral program. No project names, recordings or MIDI are stored in allowance or referral records. These operational records are separate from optional analytics. It also records the versions of the Terms/EULA and Privacy Policy you acknowledged and the acceptance time. These records are kept while your account exists and erased through the account-deletion process, subject to any legally required retention. If your friend has already earned a referral bonus, deleting your account does not cancel their bonus: we retain its dates and an opaque reference to its origin with their account, replacing your account ID in that reference.

• Why: to provide the plan you selected, prevent duplicate charges against allowances and record your agreement.
• Legal basis: performing our contract and our legitimate interest in maintaining agreement records.

Problem reports and support

When you use Report a problem or email us, we receive what you send: your description, any screenshots you attach, and your contact email if you give one. Problem reports also include the app version, your operating system, and the name and ID of the open project. We store problem reports with our cloud storage provider.

• Why: to answer you and fix the problem.
• Legal basis: our legitimate interest in supporting users and improving SignlDAW; contract, where your request concerns your account or subscription.
• How long: up to 12 months after your issue is resolved.

Collaboration

To connect you with the people you collaborate with, SignlDAW uses our collaboration infrastructure. It handles:

• connection details: your IP address and network port, connection status, and session and device identifiers;
• invitations: invite links and session details, which are stored encrypted;
• availability: whether your device is online, which is shown to collaborators you've paired with.

Your project content (audio, MIDI, project files and versions) is sent directly between your device and your collaborators' devices. If a direct connection isn't possible, it passes through a relay in our collaboration infrastructure, which forwards it without storing it.

The people you collaborate with receive whatever you share and the name shown on your contributions. As with any direct connection, they can also see your IP address.

• Why: to provide collaboration.
• Legal basis: contract.
• How long: session and invitation data are deleted when the session ends, and after 24 hours at the latest. Pairings with collaborators (device and project identifiers) are kept until you or your collaborator remove them.

Music search

When you search for music in SignlDAW, your search terms are sent to third-party music catalogue services, which return the results. These services receive your search terms and IP address and handle them under their own privacy policies. We don't receive or store your searches.

When you select a catalogue recording, the app obtains fresh public recording metadata from Apple and sends its catalogue ID, title, artist, album, duration and store link to our authenticated link service. That service searches YouTube metadata through Google to find a direct video link and queries ReccoBeats metadata to find a direct Spotify track link. ReccoBeats receives the song title and candidate track IDs, together with our server’s IP address; it receives no account identifier, recording or project state. Apple receives the catalogue ID and your IP address; Google receives the title and artist and our server's IP address. Older clients may ask our server to obtain Apple's catalogue metadata directly. We cache public catalogue identities and matched video and track links for up to 24 hours, and partial or unavailable matches for up to 15 minutes, then remove expired records during hourly maintenance. The cache contains no account ID or listening history. Authentication and request security processing follow the account and security sections of this policy. Opening an external link sends your browser to that provider, which processes the visit under its own privacy policy. No recording, project audio or instrument state is sent to the link service or these metadata providers.

• Legal basis: contract (providing the feature you're using).

System audio capture and reference analysis

Capture starts only when you choose it. On supported Macs, the operating system asks for screen/system-audio recording permission; SignlDAW receives audio and does not save screen video. Windows uses the selected system playback output. A loopback device can be selected where needed. Other applications, notifications or private conversations playing through the same output may be included, so stop anything you do not intend to capture.

Short passages and separated audio are processed in temporary local files for Tone Transfer and instrument creation. They are not uploaded to us or used to improve our general models. Temporary files are deleted after active processing releases them; abnormal shutdown can leave files until cleanup. Effect settings and any created instrument you choose to keep remain on your device, and an instrument may include derived audio or model data. Music links open your browser or the source service, which receives the request under its own privacy policy.

• Legal basis: performing our contract by providing the capture and analysis you request. Operating-system permission controls apply separately.
• Your choice: cancel capture, capture another passage, or close the reference picker at any time before analysis begins.

Software updates

SignlDAW checks for updates by contacting our update service, which receives your IP address, app version and operating system.

• Legal basis: our legitimate interest in keeping SignlDAW secure and up to date.
• How long: kept as short-term server logs (see Security below).

Website and waitlist

The website is hosted by Cloudflare. The website code does not set cookies, use local or session storage, or load analytics or advertising trackers. Cloudflare processes connection and request details to deliver and protect the site. See our Cookie Policy for details. If that changes, we'll update this policy and ask for your consent where the law requires it.

If you join the waitlist, we use your email address to send your invitation and occasional news about SignlDAW through Kit, our email service provider. The form asks you to explicitly agree before subscribing; we send your email from our website server to Kit rather than loading a Kit tracking script in your browser. Every email has an unsubscribe link. We only send marketing emails to people who have agreed to receive them.

• Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• How long: until you unsubscribe or ask us to delete it. Limited suppression information may be retained to respect your unsubscribe choice and prevent further marketing; you can ask us about this when requesting deletion.

Review installers are hosted on GitHub. Following a download or release-notes link sends your browser to GitHub, which processes connection and request details under its own privacy policy. App sign-in, trial eligibility and app data processing are covered by the other sections of this policy.

Security and abuse prevention

Our servers and service providers process IP addresses and request details to keep our services secure, prevent abuse (for example, by limiting how often invitations can be created) and diagnose outages.

For Plus-trial eligibility, the app sends one-way hashes of a stable device identifier and a random installation identifier retained in your operating system’s secure storage. Raw hardware identifiers are not sent. The server verifies your email with your authentication provider and stores keyed, one-way hashes of the verified mailbox, account identity and device signals. The trusted connection IP is also keyed and hashed for short-term trial-start throttling; an IP address alone does not permanently restrict an account. We allow multiple verified users on a shared computer. These signals are used for security, not advertising. If you think a shared-device check is mistaken, contact admin@signldaw.com. Free and paid access remain available.

Trial-eligibility hash records are retained for up to 24 months, including after account deletion, so deletion or reinstall does not immediately create another trial. Network hashes are cleared after 24 hours; other request logs follow the retention below. Expired records are removed during scheduled maintenance.

• Legal basis: our legitimate interest in securing our services.
• How long: request logs typically no longer than 30 days; trial-eligibility records follow the separate limits above.

4. Who we share data with

The following service providers process data on our behalf, under contracts that require them to protect it:

• an authentication provider;
• a cloud hosting and collaboration infrastructure provider;
• an error-reporting service;
• a cloud storage provider (for problem reports);
• an email service provider.

Data is also shared with:

• Creem, as the seller of Plus and Pro subscriptions (an independent controller);
• Google or Apple, if you choose their sign-in service (independent controllers);
• third-party music catalogue services, when you search for music in SignlDAW;
• the collaborators you choose;
• authorities, courts or professional advisers, where the law requires it or to protect our legal rights;
• a buyer or successor, if our business is sold or reorganised.

You can ask us for the names of our current service providers.

5. International transfers

Some of our providers process data outside the European Economic Area, for example in the United States. Where the destination country isn't covered by an EU adequacy decision (such as the EU–US Data Privacy Framework for certified companies), we use the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

6. Your rights

Under the GDPR, and similar laws where you live, you can:

• access your data and get a copy of it;
• correct it;
• have it deleted;
• restrict or object to processing, including anything we do based on our legitimate interests;
• receive the data you gave us in a portable format;
• withdraw your consent at any time, for example by turning off crash reports or unsubscribing from emails. This doesn't affect processing that happened before you withdrew it.

To use these rights, email admin@signldaw.com. You can also request account deletion in Account menu → Delete Account. We may need to confirm your identity first. We'll reply within one month; the GDPR allows us two more months for complex requests. Deletion blocks account access immediately and queues subscription cancellation and identity erasure. Cancellation is processed before the billing link is erased. A one-way account-ID hash is retained for up to 30 days to reject old tokens and delayed billing events.

You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority where you live or work.

We don't sell or share personal information for targeted advertising. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

7. Security

We protect your data with encryption in transit to our services and with access controls, and the app keeps your sign-in credentials in your operating system's secure storage. No system is perfectly secure. If a breach affects your data, we'll tell you where the law requires it.

8. Children

SignlDAW isn't for anyone under 16, and we don't knowingly collect data from children under 16. If we learn that we have, we'll delete it.

9. Changes to this policy

We may update this policy. If we make significant changes, we'll tell you in the app or by email before they take effect. The effective date at the top shows which version is current.

10. Contact

SignlDAW OÜ · Ahtri tn 12, 15551 Tallinn, Estonia · admin@signldaw.com