Last updated: 14 October 2026
Language. This document is currently provided in English only. The English version is the legally binding text. Translations into Dutch, German, French, Italian, Spanish, Portuguese, and Japanese can be requested at privacy@tracksensei.com and are provided for convenience without altering the binding English original. Nederlandse vertaling is op verzoek beschikbaar; de Engelse versie blijft juridisch bindend.
TrackSensei ("we", "us", "our") operates the website tracksensei.com and the TrackSensei web application. This Privacy Policy explains which information we collect when you use the service, why we collect it, who we share it with, how long we keep it and which rights you have.
TrackSensei is a sole proprietorship (eenmanszaak) run by Stephan Kiekens, trading as TrackSensei, registered with the Netherlands Chamber of Commerce (KvK) under number 71997067, Loopakker 1, 4824 SB Breda, the Netherlands. Stephan Kiekens is the data controller for the personal data described in this policy.
For anything related to privacy and your personal data, contact Stephan Kiekens at privacy@tracksensei.com. TrackSensei has not appointed a Data Protection Officer; privacy questions are handled by Stephan Kiekens personally.
Account information: When you register with an email address, we collect your email address, an optional display name and your password. Your password is stored as a one-way cryptographic hash (bcrypt), so we never store or see your actual password. If you sign up or sign in with Google, we receive your email address, your name and your Google account identifier from Google instead of a password. We also store your language preference, whether your email address is verified, whether you opted in to emails from us, and your cookie choice (Section 5).
How you found us: When you create an account, we store the page you first landed on, the referring website, any campaign tags in the link (UTM parameters), the Google click identifier (gclid) if you arrived through a Google ad and accepted all cookies, your browser's time zone (which we use to estimate your country), your IP address and your browser's user agent. We only store the gclid with your consent: if you chose Essentials only, it is not stored, and if you withdraw your consent later, we delete it. If you answer the optional "How did you hear about us?" question in the app, we store that answer too.
Audio files: When you analyze a track, your audio (WAV, MP3, FLAC, AIFF, OGG) is processed entirely in your browser using the Web Audio API. Your audio is never uploaded to our servers. Only the resulting numerical measurements (loudness, spectral balance, stereo correlation, dynamics, tempo and similar descriptors) and the file name are sent to TrackSensei for scoring and feedback.
Ableton project files (.als): If you add an Ableton Live project file, it is parsed in your browser as well. The .als file itself is not uploaded. Only a structural summary in JSON format is sent to us: the tracks and their names, the devices and plugins on them, MIDI and arrangement structure, automation and similar project data. .als files contain no audio, only references to audio files.
Analysis results and projects: We store the results of each analysis: the measurements described above, scores, the issues we found, the written AI feedback and any visualizations. If you organize your tracks into projects, we also store the project name, the versions in it, a short summary per version and the summary text you choose to add.
Reference tracks: You can compare your track with a reference track, either as a one-off reference during an analysis or as part of a saved reference set (see below). Each reference track is analyzed in your browser with the same analyzer; the audio itself never leaves your device. We never receive or store the audio of a reference track. We only receive and store the numerical features of the track, a one-way SHA-256 hash of the audio file (used to recognize duplicate uploads; it cannot be turned back into audio), the file name, the file size and the file type, and for a one-off reference the genre you chose. Besides powering your comparison, these features go into our calibration data set, which keeps our genre targets aligned with professionally released music. For calibration we use them in anonymized form: the genre targets are calculated from the features of many tracks together and never contain your identity or your file names. This is part of how TrackSensei works, so there is no separate switch for it in the app; see Section 7 for how long we keep this data and how to have it deleted.
Reference sets: You can save named collections of reference tracks ("reference sets") to your profile and use them as the scoring baseline for your own uploads. For each track we store the feature data described above, the display name you give it and optional details such as duration, BPM and detected key, so the app can list your sets without re-reading the audio. Reference sets are private to your account: they are scoped to your account, every request is filtered on your user id, and other users cannot see them.
Chat conversations: Messages you exchange with the AI mentor, including issue-specific threads, are stored with the analysis they belong to so you can revisit the conversation.
Usage data: We record how many analyses, chat messages and AI tokens you use, to apply the limits of your plan and to monitor our costs. We also keep standard server logs (IP address, browser type, timestamps, requested pages) for security and debugging.
Payment information: Payments are processed by Stripe. We never receive or store your card number or bank details. We do store your Stripe customer and subscription identifiers, your plan, changes to your plan, and records of one-time purchases (Release Checks and Boosters), so we can show your billing history and give you what you paid for. Stripe handles payment data under its own Privacy Policy.
Feedback you send us: If you rate an answer or send feedback through the app, we store that feedback with your account.
Error reports: When something breaks in the app or on our server, an error report is sent to our error-monitoring provider (see Section 6). It contains technical details about the error, your browser and the page you were on. For errors in the browser it can include a short replay of the screen in which all text is masked and all media is blocked.
We use your information to provide and improve TrackSensei. Our processing is based on the following legal bases under Article 6 of the General Data Protection Regulation (GDPR):
Your audio is analyzed locally in your browser and never reaches our servers or any third party. To generate written feedback, we send the numerical measurements of your track, the structural summary of your .als project (if you added one), your genre and production settings, and your chat messages to Anthropic's Claude API. Your audio is never sent to Anthropic. Anthropic processes this data under its Privacy Policy and commercial terms, and does not use API data to train its models.
We also use Anthropic's API to map genre names we do not recognize to one of our genre profiles. Only the genre name is sent for that.
When you first visit TrackSensei, a banner asks you to choose between Essentials only and Accept all. Your choice is stored in your browser's local storage and applied on every visit. When you are logged in, or when you sign up or log in after choosing, we also save the choice with your account, so our server can follow it (see below). You can change your choice at any time with the Cookie settings link at the bottom of every page; the change applies from that moment on.
These are needed to run the service and do not require consent:
The same choice applies to our server. After Accept all, our server also reports purchases to Google Ads if you arrived through a Google ad, as described in Section 3. This server-side report does not use cookies.
If you choose Essentials only, Google stays in denied mode and our server sends nothing about you to Google Ads. It only keeps its own usage records in our database, for running the service, plan limits and cost control (Section 3).
We load our fonts from Google Fonts, which means your browser requests them from Google's servers and Google receives your IP address.
We do not sell or rent your personal data, and we do not share it with third parties for their own marketing. We share data only with the service providers below, each for the purpose described:
Some of these providers are based in the United States or process data outside the European Economic Area (EEA). When personal data is transferred outside the EEA, we rely on the safeguards the GDPR provides for this, such as an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses.
Audio and .als files: Your audio and your .als files never reach our servers, so we do not store them at any point. We only keep the numerical measurements and the structural summary described in Section 2, as part of your analysis.
Analyses in a project: Analyses that belong to a project are kept while you keep working on that project. When a project gets no new version for 120 days, the full reports, scores and chat messages of its versions are deleted. The project itself stays, with its list of versions, a short score summary per version and the open issues, so you can pick it up again. After 365 days without a new version, the project is scheduled for deletion and is deleted seven days later. If you opted in to emails from us, we email you when that seven-day period starts.
Analyses outside a project: Analyses that are not part of a project are deleted 365 days after they were created, together with their chat messages.
Release Checks: The report of a track you unlocked with a Release Check stays readable for one year after the purchase, also when the project it belongs to is inactive during that year.
Chat messages: Chat messages, including issue threads, are deleted together with the analysis they belong to.
Reference sets: Reference sets and the feature data in them are kept for as long as your account exists, because their purpose is to give you a stable baseline over time. You can delete a single track, a whole set or all of your sets at any time from Profile → Reference sets. Deletions are immediate and permanent.
Reference track calibration data: The feature data of reference tracks in our calibration data set (Section 2) is kept for as long as we run our calibration, so we can re-aggregate the targets when our analysis methods change. When you delete your account, the link to you and the file name are removed straight away; the remaining feature data contains no audio and no information that identifies you. You can ask us to delete your reference-track data without deleting your account by emailing privacy@tracksensei.com.
Account data: Your account data is kept as long as your account exists. When you delete your account (Profile → Data & privacy → Delete account), we delete your account and all data linked to it from our database straight away: analyses, chats, projects, reference sets, usage records, purchase records and feedback. We cancel any running subscription, delete your customer record at Stripe and remove you from our email list. Data deleted from our live database can remain in our hosting provider's database backups until those backups expire; we do not use backups to restore deleted accounts.
Abuse-prevention record: To stop the free monthly limit from being reset by repeatedly deleting and re-creating an account with the same email address, account deletion leaves one minimal record: a one-way HMAC fingerprint of your normalized email address (it cannot be turned back into the address and contains no other personal data) together with the number of free analyses and chat questions that email address had used in the current month. This record is deleted automatically 30 days after the account deletion. For accounts that took part in an earlier Pro trial (no longer offered), the same fingerprint also notes that the trial was used, and that note is kept until 365 days after the trial started. We rely on our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR; Art. 17(3) GDPR allows keeping this minimum despite a deletion request).
Invoices and payment records: We keep invoices and payment records for as long as Dutch tax law requires (currently seven years). Stripe keeps its own payment records under its legal obligations.
Server logs and error reports: Server logs and error reports are kept for a limited period by our hosting and error-monitoring providers and are used only for security and debugging.
We take security seriously. Measures include: bcrypt password hashing, short-lived access tokens and HTTP-only refresh cookies, CSRF protection, rate limiting and brute-force protection, bot checks on our forms, encrypted connections (HTTPS/TLS), per-user isolation of reference sets at the database level, input validation on all endpoints, and regular security reviews.
Under the GDPR you have the right to: access the personal data we hold about you, have inaccurate data corrected, have your data deleted (the "right to be forgotten"), receive your data in a portable format, object to processing based on our legitimate interest, restrict processing, and withdraw your consent at any time without affecting processing that took place before.
Some of these rights can be exercised directly in the app:
For everything else, such as a copy of your data (we send it as a JSON file), deleting individual analyses, deleting your reference-track calibration data or any other request, email privacy@tracksensei.com. We respond within one month, as the GDPR requires.
If you believe we handle your data incorrectly, please contact us first so we can fix it. You also have the right to lodge a complaint with a data protection authority, in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority in the EU country where you live.
TrackSensei is not intended for users under 16 years of age. We do not knowingly collect data from minors.
We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email. The date at the top of this page shows when the policy was last changed.
Privacy questions and requests: privacy@tracksensei.com (handled by Stephan Kiekens). General questions: hello@tracksensei.com.
TrackSensei is operated by Stephan Kiekens, trading as TrackSensei (sole proprietorship). KvK 71997067. Loopakker 1, 4824 SB Breda, the Netherlands. hello@tracksensei.com. Legal notice.