Privacy Policy

01Who we are

Marya Labs ("we", "us") is the data controller for the personal data described in this policy. We are a small independent studio building music production software. We are not currently incorporated as a limited company.

You can reach us about anything in this policy at support@maryalabs.io. We aim to reply within a few working days, and we handle formal data rights requests within the one-month statutory deadline.

This policy is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

02The short version

Because the honest summary is unusually favourable to you, it is worth stating plainly before the detail:

• This website collects your email address and, if you write to us, your name and message. It sets no tracking cookies and runs no analytics.
• Your Marya Labs account shares one identity across product services. You may use a verified email/password account or Google. Supabase stores your name, email, verification status, credential hash when you add a password, and session/security records for the shared account. Google supplies your provider identifier and available profile information when selected. We send verification and recovery emails through our configured SMTP service; matching emails do not automatically link identities. Existing desktop-build integration is deferred.
• Your AI provider sign-in tokens are encrypted on your own machine and are never transmitted to us.
• Your audio never reaches us. Raw audio does not leave your computer through anything we build.
• However: when you use DAWN, the content of your work — and, if you use Mac control, screenshots of your screen — is sent to the AI provider you signed in to with your own account. We are not in that path, but you should understand it clearly. See What DAWN sends to your AI provider.

03What this website collects

Everything below is collected only when you actively submit it or download something. We do not build advertising profiles, we do not sell data, and we do not share it with data brokers.

About the IP hash

We do not store raw IP addresses in our database. We store a SHA-256 hash of the address combined with a secret salt, which lets us count unique downloads and apply rate limits without holding the address itself.

We describe this as pseudonymised, not anonymised, and that distinction is deliberate. A salted hash is still personal data under UK GDPR, because it can be linked back to an individual by someone holding the salt. We are not going to call it anonymous when it is not.

What we do not collect

• No advertising or analytics cookies. See the Cookies and Tracking Notice.
• No third-party trackers, pixels, or session recording.
• No full payment-card numbers or security codes. Stripe hosts Checkout and billing settings; we retain Stripe customer/subscription references and billing events.
• No special category data (health, biometrics, beliefs, and so on). Please do not send any in a support message.

04Account, billing, and device data

We store your display name, email address, verified provider identifiers, account creation dates, sessions, pseudonymised connection addresses, browser/device descriptions, and connected-device activity to provide and secure your account. Explicit account linking requires an authenticated action; we do not merge accounts solely by matching email addresses.

We store Stripe identifiers, subscription status and billing periods, plan entitlements, credit grants and deductions, and administrator audit events. Payment history and invoices are retrieved from Stripe for your account. Authentication and payment providers also process information under their own terms. The lawful bases for account/service delivery are performance of contract, for security are legitimate interests, and for required financial retention are legal obligation.

Account Settings lets you edit your display name, unlink additional providers, revoke sessions/devices, and explicitly request deletion. A deletion request cancels subscriptions and revokes access; personal account data is removed after review. Required financial and accountability records are retained under the applicable retention schedule. We do not delete invoices to conceal financial history.

Your account does not require you to provide audio, project files, API keys, or screenshots to this portal. Desktop account and AI-backend integration remains deferred for existing builds.

05What the DAWN and MeterStack software sends us

• Desktop account integration is deferred. Existing builds do not obtain the portal’s purchased benefits until the documented authentication and entitlement APIs are integrated. Public downloads remain independently configurable.
• No analytics in the shipped build. DAWN contains an optional product-analytics feature which is switched off by default. Even when switched on, the released build has no delivery endpoint configured, so it transmits nothing.
• No crash reporting in the shipped build. The same applies to crash telemetry, which additionally requires you to consent to a specific version of the wording. If the wording changes, prior consent is invalidated rather than carried over. Crash records never read the text of the error message, only its type and a sanitised stack outline.
• No auto-update. There is no background updater, no auto-download, and no scheduled check. With no update feed configured, the update check performs no network activity at all — not even a DNS lookup.
• No audio. Raw audio never leaves your machine through our software. Where MeterStack passes measurements to DAWN, it does so over a local socket on your own computer, and the receiver actively rejects raw audio if anything tries to send it.

Where your sign-in tokens are kept

Provider credentials — in the free beta, your ChatGPT/Codex or MiniMax account tokens — are stored in an encrypted vault on your own machine. DAWN’s configuration file holds only opaque references to those records, never the credential itself. Credentials are stripped from logs, error messages, and audit records before anything is written to disk. They are never sent to us.

Because we never hold them, we cannot recover them for you if you lose them, and we cannot disclose them to anyone else.

06What DAWN sends to your AI provider

In the free beta, DAWN supports ChatGPT/Codex and MiniMax account sign-in, or local models through Ollama and LM Studio. Requests go to the selected account provider or your configured local server. Local servers and models are installed separately; check their configuration and any additional network services they use.

In that exchange, the provider receives:

• What you type to the agent.
• Context about your session — including track names and project and arrangement structure.
• The results of actions the agent takes, so it can decide what to do next.
• If you use a feature that generates audio, your text prompt and settings such as duration, key, and tempo.
• If you use web search, your search query, which is passed to search engines through an intermediary that queries several backends.
• If you use Mac control: a screenshot of your screen.

The screenshot point, specifically

DAWN’s Mac control lets the agent see your screen and operate macOS applications on your behalf. To do this it captures a screenshot and attaches it to the next request to your AI provider, where the provider supports images. That screenshot is a picture of whatever was on your screen — which may include applications, documents, messages, or other content that has nothing to do with music.

Two things limit this, and both are real, but neither makes it risk-free:

• DAWN refuses to capture an unredacted screenshot when it detects a password or other secure input field visible on screen, and it refuses to type into one.
• The image is used for that single turn and then discarded. Screenshot data is never written into DAWN’s audit log, its saved history, or its log files, and text recognition runs locally on your Mac rather than in the cloud.

What those protections do not do is prevent the image reaching your provider in the first place. That is the purpose of the feature. If you work with confidential material on the same machine, consider whether Mac control should be enabled while you do. It can be switched off in settings, and there is a kill switch.

We are not a party to that exchange

When DAWN talks to your provider, it uses your account under your contract with them. We are not an intermediary and the traffic does not pass through us. What the provider does with your data — whether it retains it, how long for, and whether it uses it to train models — is governed by your agreement with that provider, not by this policy.

For the same reason, those providers are not our sub-processors. We do not choose them, we do not pay them, and we cannot instruct them on your behalf. Please read the privacy terms of any provider before connecting it. See the Sub-processors page for how we draw this line.

07Data DAWN keeps on your own computer

DAWN stores a fair amount locally, in a folder called `.dawn` in your home directory. This is your data on your machine; we have no access to it. It is listed here so you know what exists and can delete it if you want to.

The audit log deliberately redacts what it records: text you typed, window and screen text, and any shell or AppleScript commands are replaced with a redaction marker and a character count. The record shows that something happened and what kind of thing it was, without preserving the content.

Local learning is on by default, with a first-run notice. It records how you rate and correct the agent’s work so it improves for you, and it is explicitly barred from capturing credentials, screenshots, raw audio or MIDI, or your full session state. You can pause it, inspect what it holds, export it, or tell it to forget.

Deleting the `.dawn` folder removes all of it. Since none of it reaches us, we cannot delete it for you.

08How long we keep website data

These periods apply to the data this website holds. They are set out in code alongside the deletion routine, so the published schedule and what actually happens stay in step.

We may keep a record longer where we have to — for example, if it is relevant to a legal claim. If we do, we keep only what is necessary for that purpose.

09Your rights

Under UK GDPR you have the following rights over personal data we hold about you. Exercising them is free, and you do not need to give a reason.

Access (Art. 15)

Ask for a copy of the personal data we hold about you.

Rectification (Art. 16)

Ask us to correct anything inaccurate.

Erasure (Art. 17)

Ask us to delete it. For marketing data we will simply do so.

Restriction (Art. 18)

Ask us to stop using it while a dispute about it is resolved.

Portability (Art. 20)

Ask for it in a machine-readable format, or ask us to send it elsewhere.

Objection (Art. 21)

Object to processing based on legitimate interests. You can object to direct marketing at any time and we must stop.

Withdraw consent (Art. 7(3))

Where we rely on consent, withdraw it at any time. Every email we send includes an unsubscribe link.

To exercise any of these, email support@maryalabs.io. We will respond within one month. We may ask you to confirm your identity, but only to the extent needed to be sure we are not disclosing your data to someone else.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk. We would appreciate the chance to put it right first, but you are not obliged to come to us before going to them.

10Who else sees this data

We keep the list short on purpose. The full detail, including what each party does and where they are located, is on the Sub-processors page.

• Our hosting provider, which runs the server and database this website uses.
• Our email provider, which delivers the messages you asked for.
• That is the whole list for website data.

We do not sell personal data, we do not share it for advertising, and we do not transfer it to anyone for their own purposes. We may disclose data if we are legally required to, and we will tell you if that happens unless we are prohibited from doing so.

11International transfers

Our infrastructure providers may process data outside the UK. Where that happens, we rely on UK adequacy regulations or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as appropriate.

If you connect an AI provider to DAWN, your data goes wherever that provider processes it. That transfer is under your contract with them, not ours.

12Children

Our products are not directed at children. You must be at least 16 years old to use them, as set out in the Terms of Service. DAWN needs an account with an AI provider and can operate your computer, which is not appropriate for a child.

If you believe a child has given us personal data, contact support@maryalabs.io and we will delete it.

13Changes to this policy

We will update this policy when what we do changes. The date at the top always reflects the current version.

If we make a change that materially affects your rights — for example, if we start collecting something new or begin transmitting data from the software — we will say so clearly rather than quietly revising the text, and we will notify subscribers by email.