Privacy Policy

Basement Stream is where a musician keeps their demos: audio, markers, lyrics, voice notes. This page says in plain language what we store, why, and how to get rid of it.

What we store

• Account: email, display name, interface language. If you sign in through Telegram, also your Telegram ID, username and first name.
• Your content: audio files and their versions, cover art, titles, markers, lyrics, text and voice comments, stems, band membership.
• Technical: error logs and page-speed metrics, plus housekeeping records such as when a token was last used.

We don't sell data, show ads, or build advertising profiles.

TikTok

Connecting TikTok is optional — everything else works without it. If you do connect it, we use the official TikTok Display API to read, and only read:

• your profile: account identifier, display name, avatar (scope user.info.basic);
• your account counters: followers, following, likes, video count (scope user.info.stats);
• your public videos and their counters — views, likes, comments, shares (scope video.list).

This data is used for exactly one thing: showing you your own stats on the TikTok page inside the app. We never post on your behalf, never read direct messages, never share this data with anyone, and never use it for advertising or model training. The numbers themselves aren't stored in our database — they're fetched from TikTok when you open the page.

What we do store is the TikTok access and refresh tokens (needed to request the stats) and a snapshot of your name and avatar. You can disconnect at any time with the «Disconnect» button on the TikTok page: we revoke the token with TikTok and delete our record. You can also revoke it from TikTok's own security settings, under connected apps.

Instagram

Also optional, also read-only, and only works with a professional (Creator or Business) account. Through the official Instagram Graph API we read:

• your profile: id, username, name, account type, avatar, follower, following and post counts (scope instagram_business_basic);
• your posts and reels: caption, type, permalink, date, likes and comments (same scope);
• per-post metrics: views, reach, shares and saves (scope instagram_business_manage_insights).

Used for one thing: showing you your own stats on the Instagram page inside the app, and handing them to your own AI assistant if you connected one over MCP. We don't publish posts, don't read or write comments, don't touch direct messages, never share this data and never use it for advertising or model training. The numbers aren't stored — they're fetched from Instagram on request.

We store the access token and a profile snapshot (username, avatar, account type). Disconnect with the button on the Instagram page, or by removing the app in Instagram's own settings — in that case Meta sends us a deletion request and we erase the token and snapshot automatically. The status of such a request is shown on the data deletion page.

Who else touches it

We use processors that handle data on our behalf:

• Vercel — application hosting;
• Supabase — database and authentication;
• Cloudflare R2 — audio and image storage;
• Replicate — stem separation (audio is sent there when you ask for stems);
• Sentry — error logging;
• Vercel Speed Insights — anonymous performance metrics;
• an email provider — sign-in links;
• Telegram — if you use the bot or the mini app.

Beyond that, we disclose data only where the law requires it.

Public links

A share link like /s/<token> lets anyone holding the link play a song or album without signing in. It exposes the audio and the title only — markers, lyrics and comments stay hidden. You create these links yourself and can revoke them.

Retention and deletion

Content stays until you delete it. Deleted songs go to a trash bin first, where they can be restored or destroyed for good. To delete your whole account and everything in it, write to hello@basement.stream— we'll do it within 30 days, TikTok connection included.

Cookies

Strictly necessary ones only: your sign-in session, language and theme preference, and a short-lived cookie holding a one-time token while you connect TikTok (CSRF protection). No advertising or tracking cookies.

Children

The service isn't intended for children under 13.

Changes

If something changes materially we'll update the date above and, if we have your email, tell you about it.

Contact

Questions, deletion or access requests: hello@basement.stream.