Privacy Policy

Last updated: September 15, 2026

Important — Larkiro is a desktop application that uses cloud-powered AI generation. Your creative work is generated through our cloud service (hosted on Cloudflare) and downloaded to your local device. This policy explains what data is involved, how it flows, and your rights under applicable privacy laws.

Controller and Contact Information

The data controller responsible for your personal data under applicable privacy laws (including the EU General Data Protection Regulation "GDPR" and the California Consumer Privacy Act "CCPA") is:

Larkiro
Email: [email protected]
Website: https://larkiro.com

1. Overview & Architecture

Larkiro ("we", "us", or "our") is a desktop application for AI-assisted music creation. The application runs on your device and connects to our cloud generation service for AI music processing. Here's how data flows:

• Your device (desktop app) — stores your creative work, settings, and device identifier locally.
• Larkiro Cloud Service (Cloudflare Worker) — receives your generation requests, authenticates your device account, deducts credits, and routes requests to an AI engine.
• AI Music Engines — generate music and voice models from your prompts. We operate a primary/secondary engine topology so that creation continues if one engine is unavailable (see Section 4).
• AI Lyrics Engines — generate lyrics and power in-app text assistance.
• Cloud Storage (Cloudflare R2) — temporarily stores generated audio files until your desktop app downloads them.

You do not need to provide or manage any API keys. The cloud service handles all AI provider interactions on your behalf. Because requests are routed across more than one upstream engine, your prompts and uploaded audio may be processed by different providers over time; Section 4 lists them all.

2. Data Stored on Your Device (Local)

The following data is stored solely on your computer:

• Your Creative Work — songs, lyrics, voice profiles, reference tracks, project files, and any media you create or import. These remain in folders you choose and control on your local filesystem.
• Device Identifier — a unique device identifier (UUID) used to authenticate your account with the cloud service. On its own it is pseudonymous and does not reveal your name or contact details. It becomes linkable to you only if you add a recovery email (see below) or make a purchase.
• Application Settings — preferences, language selection, and UI configuration.
• Recovery Email (optional) — if you purchase credits, the email address on your order is associated with your device account so that you can recover your credit balance if you reinstall or lose your device. You may also bind an email yourself for self-service account recovery. This is the only identifier that can link your account to a real person.

Legal basis (GDPR): Processing of this data is necessary for the performance of a contract (Art. 6(1)(b) GDPR) and for our legitimate interest in delivering the functionality of the application (Art. 6(1)(f) GDPR).

3. Data Transmitted to Our Cloud Service

When you create music, the following data is transmitted to our cloud service:

• Generation Requests — your text prompts, style parameters, and generation settings are sent to our Cloudflare Worker for processing. The Worker authenticates your device, deducts credits, and forwards the request to the AI music engine.
  Legal basis (GDPR): Performance of a contract (Art. 6(1)(b) GDPR).
• Voice Clone Samples — when you use the voice cloning feature, your audio sample is uploaded to the cloud service and forwarded to the AI engine to create your voice model. The sample is streamed through our service and is not persisted on our servers; it is retained by the upstream AI engine as part of your voice model, subject to that engine's own retention terms.
  Legal basis (GDPR): Your explicit consent (Art. 6(1)(a) GDPR) and performance of a contract (Art. 6(1)(b) GDPR).
• Cover Reference Tracks — when you use AI cover features, the reference audio is uploaded to the cloud service and forwarded to the AI engine, which returns a file reference used for the generation. Our service does not persist the audio bytes; retention on the engine side is governed by that engine's terms.
  Legal basis (GDPR): Your explicit consent (Art. 6(1)(a) GDPR) and performance of a contract (Art. 6(1)(b) GDPR).
• Account & Billing Data — your device identifier (stored as a SHA-256 hash, never in plaintext), credit balance, credit transaction ledger, generation task records, and — if you make a purchase — your order email address are stored in our cloud database (Cloudflare D1). The email address enables self-service recovery of your credit balance. Payment processing is handled by Lemon Squeezy (Privacy Policy). We do not store your payment card details or billing address.
  Legal basis (GDPR): Performance of a contract (Art. 6(1)(b) GDPR) and legal obligation for tax/accounting records (Art. 6(1)(c) GDPR).
• IP Address (hashed) — to prevent abuse of the free tier (creating fresh device identifiers to repeatedly claim free generations), we store a SHA-256 hash of your request IP address together with a counter and a rolling window start time. The plaintext IP is not persisted in our database. We also maintain short-lived hashed rate-limit counters for account-level and IP-level request throttling.
  Legal basis (GDPR): Our legitimate interest in preventing fraud and abuse (Art. 6(1)(f) GDPR).
• Generated Audio (Temporary) — finished tracks are temporarily stored in Cloudflare R2 until your desktop app downloads them. After successful download confirmation, files are retained for a grace period (default 48 hours) and then automatically deleted. Unclaimed files are deleted after 7 days.
  Legal basis (GDPR): Performance of a contract (Art. 6(1)(b) GDPR).

4. Data Transmitted to Third Parties

We operate a multi-engine topology for resilience. Which engine handles a given request depends on availability and the type of creation; we may change engines over time without altering what you send them.

• Mureka — our primary AI music engine. Receives your generation prompts and style parameters for music generation, your voice samples for voice model creation, and your reference tracks for AI covers. Mureka operates under its own terms and privacy policy.
• Replicate — our secondary AI music engine, used when the primary engine is unavailable or for certain creation types. Replicate hosts third-party music models, which currently include models from MiniMax and Google. Your prompts are forwarded to Replicate and to whichever model serves the request. See the Replicate Privacy Policy.
• Google Cloud (Vertex AI / Gemini, Lyria) — powers lyrics generation and in-app text assistance via the Gemini model family, and provides a dormant fallback music engine (Lyria) that is only activated if both music engines above are unavailable. See the Google Cloud Privacy Notice.
• DeepSeek — a fallback provider for lyrics and in-app text assistance, used only if the primary lyrics provider fails. See the DeepSeek Privacy Policy.
• Cloudflare — our cloud infrastructure provider (Workers, D1 database, R2 object storage, Queues). Cloudflare processes data for hosting, security, and CDN purposes under their Privacy Policy. Standard server access logs (IP address, user agent, timestamp) may be recorded for operational security and DDoS protection, typically retained for less than 7 days.
• Lemon Squeezy — our merchant of record and payment processor for credit pack purchases. They handle payment data and applicable taxes under their Privacy Policy. We receive order confirmation, transaction metadata, and your order email address.
• Resend — our transactional email provider, used solely to send account-recovery verification codes to the email address you provide. See the Resend Privacy Policy. We store verification codes only as SHA-256 hashes, valid for 10 minutes.

5. International Data Transfers & Safeguards

Our cloud service operates on Cloudflare's global network, which may involve data transfers to countries outside the European Economic Area ("EEA"), the United Kingdom, or your country of residence.

When such transfers occur, we rely on the following safeguards:

• Cloudflare: Offers EU Standard Contractual Clauses (SCCs) and holds ISO 27001 certification. See the Cloudflare Privacy Policy.
• Lemon Squeezy: Processes data in the United States with appropriate safeguards including SCCs where required.
• Google Cloud & Replicate: Both are US-based providers offering SCCs and established transfer mechanisms. See their respective privacy documentation linked in Section 4.
• AI Music & Lyrics Engines: Data transfers to engine providers (including Mureka and DeepSeek, which may process data outside the EEA/UK) are initiated as part of the service you requested. We recommend reviewing each provider's transfer mechanisms before uploading sensitive audio.

6. What We Do NOT Collect

• No analytics SDKs, crash reporting, or behavioral tracking in the desktop application.
• No telemetry, usage statistics, or product-improvement data collection.
• No advertising identifiers, no data-broker enrichment, and no profiling of you as a marketing audience.
• We do not sell, rent, or share any personal data with advertisers or data brokers.
• We do not store your payment card details, billing address, or full plaintext device identifier / IP address in our database.

For clarity: we do retain server-side operational records necessary to run a paid credit service — hashed account identifiers, credit balances and ledger entries, generation task status, hashed IP counters for abuse prevention, and your order email. These are used for billing, delivery, fraud prevention, and support; they are not used for advertising or sold to third parties.

7. Cookies & Similar Technologies

This website does not use cookies for tracking or advertising.

• Our hosting provider (Cloudflare) may set strictly necessary security cookies (e.g. __cf_bm) solely for DDoS protection, bot mitigation, and network integrity.
• We do not set any analytics cookies, marketing cookies, third-party advertising cookies, or social media pixels.

8. Data Retention

• Local data on your device: Retained until you delete it by uninstalling the application or removing the relevant files.
• Generated audio in cloud storage (R2): Retained for up to 48 hours after successful download confirmation, or up to 7 days if never downloaded. Automatically deleted thereafter by a scheduled cleanup job.
• Download links: Signed download tokens expire 1 hour after issuance.
• Account & transaction records: Retained as required by tax and accounting laws (typically 7–10 years) or as stated in the Lemon Squeezy Privacy Policy.
• Recovery email & verification codes: Your bound email is retained for as long as your account exists (delete it on request). Recovery verification codes are stored only as SHA-256 hashes, expire after 10 minutes, and are invalidated after 5 failed attempts.
• Hashed IP abuse counters: Reset on a rolling window and periodically purged; the plaintext IP is never stored in our database.
• Server access logs: Retained for approximately 7 days for security purposes, then automatically deleted or anonymized.
• Voice clone samples: Not persisted on our servers. The resulting voice model is retained for your ongoing use, subject to the upstream engine's retention terms.

9. Children's Privacy (COPPA / GDPR Article 8)

Larkiro is not directed at, and is not intended for use by, children. We do not knowingly collect personal data from children.

• United States (COPPA): Larkiro is not intended for children under the age of 13.
• European Union (GDPR Art. 8): Where the age of digital consent in your Member State is higher (e.g. 16), you must be at least that age to use Larkiro, or have the consent of a parent or legal guardian.

10. Your Privacy Rights

10.1 Rights Under GDPR (EEA / UK Residents)

You have the right to:

• Right of Access (Art. 15): Confirm whether we process any of your personal data and receive a copy of it.
• Right to Rectification (Art. 16): Request correction of any inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten") (Art. 17): Request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction of Processing (Art. 18): Restrict how we process your personal data in certain circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on our legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time.
• Right to Lodge a Complaint (Art. 77): Lodge a complaint with your local Data Protection Authority.

Note: Most of your creative data resides on your own device. You can delete it at any time by uninstalling Larkiro or removing files from your filesystem. For cloud-side data (account records, transaction history), please contact us and we will assist.

10.2 Rights Under CCPA / CPRA (California Residents)

• Categories of personal information we collect (12-month lookback):
  • Identifiers (CCPA Category A): Device identifier stored as a SHA-256 hash; SHA-256 hash of your IP address used for free-tier abuse prevention; IP address in server access logs (retained < 7 days); email address bound to your account for purchase confirmation and account recovery.
  • Commercial information (CCPA Category B): Credit balance, credit pack purchases, and the credit transaction ledger.
  • Internet or network activity (CCPA Category F): Generation task records (task type, engine used, status, timestamps) and hashed rate-limit counters. We do not collect browsing history unrelated to the service.
  • Audio information (CCPA Category F): Voice clone samples and reference tracks transmitted for processing (not persisted on our servers).
  • We do not collect biometric information, health information, precise geolocation, or sensitive personal information as defined in Cal. Civ. Code § 1798.140(ae). Voice samples are used solely to create a voice model at your direction and are not used to identify you.
• Right to Know: Request disclosure of the specific pieces and categories of personal information we have collected about you.
• Right to Delete: Request deletion of personal information we have collected from you, subject to exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale / Sharing: We do not sell or share personal information for cross-context behavioral advertising. To exercise any CCPA rights, email us at [email protected] with "CCPA Request" in the subject line.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

11. AI-Generated Content

Music, lyrics, and media produced through Larkiro are AI-generated content. You are responsible for complying with applicable laws (including mandatory disclosure and labeling requirements, such as the EU AI Act, China's Generative AI Regulations, and similar legislation) and for ensuring your use of generated content does not infringe third-party rights (including copyright, trademark, rights of publicity, and privacy rights). Larkiro embeds metadata markers indicating AI origin in output files to assist with compliance.

12. Links to Third-Party Websites & Services

This Privacy Policy and the Larkiro application may contain links to third-party websites or services. We have no control over, and assume no responsibility for, the privacy practices of any third-party sites or services. We encourage you to review their respective privacy policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time as the product evolves, laws change, or our practices are updated. Material changes will be posted on this page with a revised "Last updated" date, and where changes are significant we will provide reasonable notice (e.g., via an in-app notification or prominent notice on our website) before the changes take effect.