Ovrtone Get Ovrtone

Privacy

Privacy policy

Your music stays on your Mac. Here’s what we do collect, and why.

Effective October 26, 2026. This policy covers the website ovrtone.app, the Ovrtone app for macOS, Ovrtone accounts and the engineer. Ovrtone is made by Cooper and Co. Technology LLC (“we”, “us”). Questions or requests: privacy@ovrtone.app.

The short version

What stays on your Mac

Your projects and everything in them (audio, MIDI, recordings, plugin settings, chains and presets) and your settings are kept in files on your Mac. So is your taste profile (below) and the list of plugins installed on it, except that crash reports and usage statistics name a third-party plugin when Ovrtone checks it or it crashes (you can turn that off). We don’t keep your chats with the engineer. Crash reports and usage statistics are built to leave out your audio, your chats and the names of your projects, tracks and files; the exceptions are described below. If you use your own AI, its key or sign-in stays on your Mac (keys in your Mac’s Keychain) and is never sent to us.

What we collect, and why

When you visit ovrtone.app

The waitlist

Before downloads opened, ovrtone.app had a waitlist; it no longer takes sign-ups. If you joined, we keep your email address, the time, your browser’s description of itself (its “user agent”) and how you found us: the site you came from and the campaign tags in the link, if any. We use them to email you about access and the launch, and to learn which posts and ads bring people. The list is stored with Supabase.

Your account

Ovrtone needs an account: it holds what you’ve paid for. An account needs an email address. We sign you in with a code sent to that address through Resend, our email service. We keep your email, your name if you give it, when you signed in and from which IP address (to keep accounts secure), whether you agreed to marketing email, and how you found us: the campaign tags in the link that first brought you to ovrtone.app, or else the name of the site you came from, or “direct” (“app” if you signed up in Ovrtone). It’s recorded once and never changed. If you joined through someone’s referral link, we keep who referred you with your account, and every account has its own referral code. We record the rewards that referrals earn. The person who referred you sees only counts (how many rewards they’ve earned), never your name, email or anything else about you. Accounts are stored with Supabase, in the United States.

When Ovrtone starts, and from time to time while it runs, it asks our server what your account covers. The answer is a signed note (what your account covers, any invite, and when the note expires), kept on your Mac so Ovrtone keeps working offline for a while.

Payments

Payments for Ovrtone go through Stripe’s checkout, where Link, Stripe’s payment service, is the merchant of record: it collects and processes your payment details under Stripe’s privacy policy. We never see your card number. We keep what you paid for, whether payments went through, when anything renews, and Stripe’s reference numbers for your customer record and any subscription. Stripe may also tell us your billing email and country. We attach how you found us (above) to your checkout and any subscription at Stripe, so we can see which campaigns lead to purchases.

The engineer

When you ask the engineer for something, the app sends your message, the engineer’s instructions and the project information it reads to do the job: track, region and plugin names, plugin settings, meter and loudness readings, the results of the tools it uses, and the changes it plans. It doesn’t send your audio, your email address or your payment details.

Ovrtone’s engineer on our account (a plan, a trial, an invite or a top-up) runs on Kimi models from Moonshot AI. The app sends each request to our account server, which passes it to Moonshot AI Pte. Ltd., a Singapore company that is part of Moonshot AI, a company based in China. Moonshot’s privacy policy says it stores what it collects on servers in Singapore. Moonshot receives each request from our server under our account, without your name, email address, account ID or IP address; anything you write in a message or name in your project goes with it. Moonshot’s terms let it use what it receives to provide and improve its services, including training its models, unless agreed otherwise in writing, and they set no fixed period for keeping it. We don’t have such an agreement with Moonshot. See Moonshot’s privacy policy and its terms.

We ask first. Before the engineer sends your first request on our account, the app’s chat (or your account page) tells you it runs on Kimi from Moonshot AI and that your messages and project details are processed on Moonshot’s servers in Singapore, and asks whether you agree. Until you do, our server sends nothing to Moonshot for you. We record when you agreed. You can withdraw it at any time on your account page; the engineer on our account then stops until you agree again. Without it, the rest of Ovrtone works, and the license lets you run the engineer on your own AI.

The provider may change. We may move the engineer to a host in the United States that runs the same Kimi models. We’ll update this policy and tell account holders before we do.

Our server doesn’t keep what the requests say. For each request it records the time, the model, its size, its cost and a random ID for the conversation (so we can count conversations), to run your account’s usage limits and billing.

Your taste. When you ask the engineer for chords, Ovrtone ranks the options against a profile of the chords you tend to pick and keep: how much you like extended or borrowed chords, open or close voicings, and your usual keys and tempos. The profile is a file on your Mac and isn’t sent to our server. When the engineer uses it, the ranked options and a short summary of the profile go with that request to the AI that runs the engineer (Moonshot AI on our account, or your own provider). To start over, ask the engineer to reset your taste, or run daw taste reset --yes; to stop it learning, run daw config set taste.learning off. A switch in Settings is coming.

With your own AI, requests go straight from your Mac to the provider you chose, under your own agreement with it, and we don’t see them.

Crash reports and usage statistics

Crash reports go to Sentry when the app or its audio engine crashes, freezes for more than two seconds or hits an error. A report holds the stack trace (where in Ovrtone’s code it happened), Ovrtone’s version, build and release channel, your macOS version and Mac model, and technical details of the app at that moment, such as memory use. When a third-party plugin crashes or hangs, the report says only which plugin, its maker, its format and your Mac model. Sentry also counts app sessions (when one starts and ends, and whether it crashed) so we can measure how often Ovrtone crashes. File paths are removed from reports before they leave your Mac, or as soon as Sentry receives them, and Sentry removes IP addresses on arrival. The audio engine’s crash reports include a small snapshot of the memory of the threads that crashed, which can hold fragments of what they were handling, such as part of a file name; Sentry turns it into a stack trace and then deletes it. We don’t attach files or screenshots, or a record of what you clicked. We use crash reports only to find and fix bugs.

Usage statistics go to PostHog: which commands run (for example “fx add”), whether they were run from the app, the command line or an AI agent (and that agent app’s name), how long they took and whether they worked; when a session and the audio engine start and stop, and whether the last session ended normally; Ovrtone’s version, build and channel, your macOS version and Mac model; your audio device’s sample rate and buffer size (not its name); how the audio engine performed (dropouts, load, and how many tracks and plugins were running); the names of the tools any connected AI agent called; and plugin checks, crashes and hangs with the plugin’s name and maker. They never include what you typed into a command, the names of projects, tracks, regions or files, file paths, audio or your chats, and PostHog doesn’t store your IP address with them or work out your location from it. We use them to see which features are used and where Ovrtone is slow or fails.

Your choice. When Ovrtone first opens, it asks whether to send crash reports and whether to share usage statistics. Nothing is sent until you answer, and both stay off unless you say yes. You can change either, and whether plugins are named, any time in Settings › General › Privacy (“Send crash reports”, “Share usage statistics”, “Name plugins in reports”) or with daw config set telemetry.crashes off, telemetry.usage off and telemetry.plugin_names off. Turning usage statistics off also deletes any waiting on your Mac to be sent; turning crash reports off takes effect the next time Ovrtone starts. In beta and friends builds, reports are linked to your Ovrtone account ID (not your email address) if you’re signed in, so we can follow up with you about a crash. Otherwise, and always in stable builds, they carry a random ID made on your Mac (for usage statistics, a new one each month) and aren’t linked to your account. To have your reports deleted, email privacy@ovrtone.app.

Feedback

When you send feedback from Ovrtone (Help › Send Feedback…), we receive what you write, the kind of feedback and your rating if you give one. If you’re signed in, it’s linked to your account ID; we get your email address only if you tick “You can reply to me”. If you report that something’s wrong and tick “Include diagnostic info”, it also sends what that box lists: Ovrtone’s version, your macOS version, your audio settings (including your audio device’s name), this song’s name and its track and plugin names, and its recent log (the last 200 lines) with your folder paths removed; file names stay. You can see exactly what’s included before you send it. Feedback is stored on our account server and emailed to us through Resend. If you’re not signed in, we use a scrambled (hashed) form of your IP address, changed daily, only to limit how much feedback can be sent; we don’t store the address itself. We use feedback to fix problems and improve Ovrtone, and to answer you if you asked us to.

Invites

If you redeem an invite code, we record which code your account used, its credit and when it ends, and how much of the credit you’ve used.

Email and social media

When you write to us, we keep the conversation to answer you. We send marketing email only if you agreed to it, and you can stop it at any time. If you interact with our Facebook or Instagram pages, Meta’s privacy policy applies to that, and we see what Meta shows page owners.

Who else handles it

We use these service providers, each only for the job described above: Netlify (the website), Supabase (accounts and the waitlist), Stripe (payments), Moonshot AI (Ovrtone’s engineer on our account), Resend (sending sign-in codes and account email, and emailing us the feedback you send), Sentry (crash reports; Sentry’s privacy policy), PostHog (usage statistics; PostHog’s privacy policy), Meta (ad measurement), Google (website fonts) and Apple (our email). Sentry and PostHog process this information only on our behalf, under data processing agreements, and don’t sell or share it. Moonshot AI isn’t bound that way: it handles the engineer’s requests under its own terms, as described under “The engineer”. We may also disclose information when the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business, in which case this policy keeps applying to it.

We don’t sell personal information. Under California law, letting the Meta Pixel run on our website may count as “sharing” for advertising. You can opt out of that by turning on Global Privacy Control, or by emailing us.

Cookies

The website sets no cookies of its own. The Meta Pixel sets Meta’s cookie (described above). To know which campaign or site brought you, the website keeps one item in your browser’s storage (not a cookie), named “ovrtone-source”: the campaign tags of the link you arrived by (source, medium and campaign), or else the name of the site you came from, or “direct”, with the time. If you arrived by someone’s referral link, it keeps that link’s referral code too, the same way. Never the full address, and never click IDs. It’s kept for at most 30 days and cleared once you create an account, when it’s saved with your account. Nothing is stored when your browser sends a Global Privacy Control signal. The app uses no cookies. It keeps a random install ID in Ovrtone’s settings on your Mac for crash reports and usage statistics; it isn’t tied to your account or email, and it’s used only if you said yes to them.

How long we keep it

Your rights

You can ask us for a copy of your personal information, to correct it, to delete it (or delete your account yourself), to receive it in a portable format, or to stop or limit a use of it, and you can withdraw consent you gave (such as to marketing email) at any time. Email privacy@ovrtone.app. We may need to confirm it’s you, and we’ll answer within 30 days. We won’t treat you differently for using these rights.

In the EU, UK and similar places, we rely on these legal bases: performing our contract with you (your account, payments and the engineer); our legitimate interests (keeping the service secure, and learning which of our marketing works); and your consent (crash reports and usage statistics from the app, marketing email, cookies where the law requires consent, and sending the engineer’s requests on our account to Moonshot AI in Singapore). You can withdraw consent at any time in Settings › General › Privacy, on your account page or by emailing us; this doesn’t affect what was sent before. You can also complain to your data protection authority.

In California, you have the right to know what we collect and how we use it, to delete and correct it, to opt out of its “sale” or “sharing” (we don’t sell it; see above for sharing), and not to be discriminated against for using these rights.

What we collect, in California’s categories: identifiers (your email address, account and install IDs, and your IP address when you sign in); commercial information (what you bought); internet or other electronic network activity (website visits, how you found us, and the app’s usage statistics and crash reports); device information (Mac model, macOS version, audio settings); the content of feedback you send us; and the content of your requests to the engineer (passed to Moonshot AI on our account, not kept by us). We use each for the purposes above, keep it for the periods in “How long we keep it”, and don’t sell any of it. Only the Meta Pixel’s website data may count as “sharing”; crash reports and usage statistics go only to service providers that process them for us. The engineer’s requests go to Moonshot AI, which may use them under its own terms as described above; we pay Moonshot to answer them and receive nothing else for them.

Security

Data travels encrypted (HTTPS). Accounts are protected so each person can read only their own records, and the records that decide what accounts cover and invites can be changed only by our server. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.

Where it’s processed

We and most of our service providers are in the United States, so your information is processed there. Sentry is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. For our other providers in the United States, including PostHog, transfers from the EU, the UK and Switzerland rely on the European Commission’s standard contractual clauses (with the UK’s addendum for UK data) or another lawful safeguard in our agreements with them.

The engineer on our account is processed by Moonshot AI in Singapore (see “The engineer”). Singapore has no adequacy decision from the EU, the UK or Switzerland, and we don’t have standard contractual clauses with Moonshot, so your requests there are protected by Moonshot’s terms and Singapore’s law rather than by the GDPR’s rules. Ovrtone asks everyone before the engineer sends a first request on our account (see “The engineer”), and sends nothing until you agree; if you’re in the EU, the UK or Switzerland, that is the explicit consent this transfer relies on (GDPR Article 49(1)(a)). You can withdraw it at any time on your account page.

Children

Ovrtone isn’t meant for children under 13, and we don’t knowingly collect their information. If you believe a child has given us personal information, email us and we’ll delete it.

Changes

When this policy changes, we’ll update it here with a new effective date. If a change matters for account holders, we’ll email them before it takes effect.