This page explains what Session Sheet ("we") collects when you use the site and the app, why, and what you can do about it. The short version: we keep what we need to run your account and your library, we use Google Analytics (with your consent where the law asks for it) to see which pages help, we don't sell any of it, and we don't run ads.
What we collect
- Account details. Your email address, and — if you sign in with Google — your name and profile picture. Sign-in is handled by Google Firebase Authentication; we never see your Google password.
- Your library. The packages, lyric takes, Styles versions, sound lanes, reference tracks and ratings you create, stored in your account so they follow you across browsers. A copy is cached in your browser's local storage.
- What you send the writer. Briefs, topics, notes and lyrics you submit for generation are sent to our AI provider to produce your package.
- Suno links you import. When you import one of your Suno songs, we fetch its public title, style prompt and lyrics from Suno.
- Usage counters. How many packages and studio actions your account used each day, to apply the free quota.
- Messages. What you send through the contact form or the waitlist: name, email, message, and a one-way hash of your IP address used only to limit spam.
- Analytics. Which pages you view, roughly where you are (country and city, from your IP address), your device and browser, the site that sent you, and actions such as running a free checker, signing up or sending the contact form. Collected by Google Analytics through Google Tag Manager, only as described under cookies below.
- Where you first came from. If analytics is allowed, we remember the first link that brought you here (its campaign tags such as
utm_source, the referring site and the first page you saw). If you then create an account, we save that with a record of the signup (how you signed up, and when) so we can tell which guides and posts bring people in. That record holds no name or email. - Free checkers. Text you paste into the lyric and Styles checkers is checked in your browser and never sent to us.
- Server logs. Our host keeps standard request logs (IP address, browser, pages requested) for a limited time for security and debugging.
Who processes it
- Google Firebase — sign-in and the database that stores your account and library.
- Anthropic — the AI model that writes and edits your packages. It receives the content of each request, not your account details.
- Vercel — hosting.
- Google Analytics and Google Tag Manager — site analytics, as described above. Advertising features are off: we don't use your data for ads.
These providers process data on our behalf under their own terms and security practices. We don't sell or rent personal data, and we don't share it for advertising.
Cookies and local storage
We set one essential cookie, __session, which keeps you signed in for up to 14 days. Firebase stores your sign-in state in your browser, and the app caches your library in local storage so it loads instantly.
Analytics cookies are separate: Google Analytics' _ga cookies (up to 2 years), and our ss_attr cookie (up to 90 days, or until you sign up), which remembers the first link that brought you here. In the EU, the EEA, the UK and Switzerland they are off until you choose Accept in the cookie banner. Elsewhere they are on by default and you can turn them off. Either way, "Cookie settings" at the bottom of every page lets you change your choice; declining removes these cookies. We remember your choice in local storage. We use no advertising cookies.
How long we keep it
Your account and library stay until you delete them or ask us to. Usage counters and spam-limit records are short-lived. Google Analytics keeps event data for 14 months. Signup source records stay while the account exists. Contact messages are kept as long as needed to answer them.
Your choices and rights
You can edit or delete packages, takes, lanes and tracks in the app at any time. To get a copy of your data, correct it, or delete your account entirely, contact us from the email on your account and we'll handle it. Depending on where you live (for example the EU, UK or California), you may have further rights, including to object to processing or to complain to your data protection authority.
Children
Session Sheet isn't meant for children under 13 (or the minimum age in your country), and we don't knowingly collect their data.
Security
Data travels over HTTPS. Each account can only read and write its own library, enforced by database rules, and API keys stay on our servers. No system is perfectly secure; if we learn of a breach that affects you, we'll tell you.
Changes
If we change this policy in a way that matters, we'll update the date above and, for significant changes, tell signed-in users.
Contact
Questions about privacy? Send us a message.