Disband

Privacy

Last updated 11 Nov 2026

In short: your files are deleted within an hour, we don't store your name or email address, and nothing on this site tracks you.

Who is responsible

The operator named in the imprint.

What we process

Your audio

  • What: the files you upload, their names and the stems we make from them.
  • Why: to split them, which is the service you ask for (Art. 6(1)(b) GDPR).
  • How long: an upload is deleted as soon as the GPU has read it. Stems and the file name are deleted one hour after the split, or earlier when you delete the separation. What a failure leaves behind is deleted within a day.
  • We don't listen to, analyse or share your files beyond splitting them, and they are never used to train models.

Your account

  • What: a random account ID and the user ID of your Google or GitHub sign-in. The provider may also send your name, email address and picture, but we store only the user ID. Also your credit balance, and your API keys' names and when they were last used.
  • Why: to keep you signed in and provide the service (Art. 6(1)(b) GDPR).
  • How long: until you delete your account in Settings.

Usage

  • What: the credits each separation used, and which API key started it, if any.
  • Why: to show you your usage (Art. 6(1)(b) GDPR).
  • How long: 30 days.

Credit records

  • What: the credits added to or taken from your account by purchases, refunds and grants.
  • Why: to keep your balance right and handle refunds (Art. 6(1)(b) GDPR).
  • How long: until you delete your account.

Fair use of free credits

  • What: how many free credits were used that day by your account, your sign-in, your IP address (for IPv6 only its /64 and /48 prefix) and, for hosting providers, your network (ASN).
  • Why: our legitimate interest in keeping free credits available to everyone, by stopping one person from collecting the free credits of many accounts (Art. 6(1)(f) GDPR).
  • How long: the counts are deleted the next day. A separation keeps the IP address it was started from until it is deleted, to count its credits once the upload is in. Accounts holding bought credits are not counted by network.

Running the site

  • What: your IP address and request details, which Cloudflare processes to deliver the site and block attacks, and our error logs, which contain IDs but no IP addresses, files, cookies or headers.
  • Why: our legitimate interest in running the site securely and fixing errors (Art. 6(1)(f) GDPR).
  • How long: we keep no request logs. Cloudflare keeps request data only as long as it needs to deliver and protect the site. Error logs are deleted after 30 days.

Visit statistics

  • What: for visits from outside the EU and UK, Cloudflare Web Analytics counts page views, the page a visitor came from, their browser, country and how fast pages load. It sets no cookie, stores nothing in your browser and doesn't recognise you on a later visit. Visits from the EU and UK aren't counted.
  • Why: our legitimate interest in knowing how people find Disband and whether its pages load quickly (Art. 6(1)(f) GDPR).
  • How long: Cloudflare keeps only the counts and drops your IP address at the data centre it reaches.

Support emails

  • What: your email address and what you write.
  • Why: to answer you: about your account under Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering questions about Disband (Art. 6(1)(f)).
  • How long: deleted one year after your request is resolved.

Payments

  • Who: credit packs are sold by Polar, the seller (merchant of record), which handles checkout, payment, VAT and invoices under its privacy policy. We never see your card or billing details.
  • What we exchange: we give Polar your account ID and the IP address you buy from, which Polar uses for tax and fraud checks. Polar tells us the pack bought, the amount, the order ID and any refund.
  • Why: to add the credits you bought and handle refunds (Art. 6(1)(b) GDPR).
  • How long: as credit records, above. Whether a checkout was paid is kept for a day, to show it when you come back from Polar.

Cookies and browser storage

  • __Host-session keeps you signed in, for 30 days.
  • __Host-oauth protects a sign-in in progress, for 10 minutes.
  • Local storage remembers a language or a collapsed sidebar once you choose one.
  • A song you pick before signing in waits in your browser until it starts or you close the sign-in.

Each is needed for something you ask the site to do, so none needs consent (§ 25(2) no. 2 TDDDG). There is no tracking or advertising, and the visit statistics above use neither cookies nor browser storage.

Who else receives data

These process data for us under a data processing agreement and only on our instructions:

  • Cloudflare, Inc. (USA): hosting, database, file storage and visit statistics. EU-US Data Privacy Framework.
  • Runpod Inc. (USA): the GPUs that split your audio, which receive your file. Standard contractual clauses.
  • Functional Software, Inc. (Sentry, USA, data stored in the EU): our error logs. EU-US Data Privacy Framework.
  • Fastmail Pty Ltd (Australia, servers in the USA): the inbox behind support@disband.io. Standard contractual clauses.

These are responsible for what they process themselves:

  • Google and GitHub, when you sign in with them.
  • Polar Software Inc. (USA), as the seller of credit packs. Standard contractual clauses.

Transfers outside the EU rely on the EU-US Data Privacy Framework (Art. 45 GDPR) or standard contractual clauses (Art. 46 GDPR). Ask us for a copy of the clauses.

Your rights

You can ask us at any time to:

  • tell you what data we hold about you and give you a copy (Art. 15 and 20 GDPR)
  • correct it (Art. 16)
  • delete it (Art. 17), which you can also do yourself by deleting your account in Settings
  • restrict its processing (Art. 18)

Right to object: where we rely on legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR).

Write to support@disband.io with your account ID from Settings. You can also complain to a data protection authority, in the country you live in or ours: the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Kiel.

Other

  • You don't have to give us any data, but without signing in you can't split songs.
  • We make no automated decisions about you with legal or similarly significant effects (Art. 22 GDPR).
  • When we suspend an account, we keep it and its credit records until any dispute or legal claim about it is settled, our legitimate interest in preventing fraud and abuse (Art. 6(1)(f), Art. 17(3)(e) GDPR). You can ask us to delete it then.
  • Backups of our database keep deleted data for up to 30 days, after which it is gone.
  • When what we process changes, we update this page and its date.