Privacy and data handling in this preview
This notice describes the current technical data flows of the SunoAPI preview. Operating-entity details, public privacy contact and a final retention policy still need confirmation before launch.
Account and authentication#
Supabase manages account authentication. Signing in with Google supplies identity information such as an account identifier and email address; your login session uses cookies. Account identifiers link your API keys, balance, payment-customer mapping and task history.
Song requests and API keys#
Your musical brief or lyrics, style tags, model choice and task information are processed by this service and its music-generation provider, TTAPI. Request data, credit transactions and result metadata are stored in the project database. API keys are stored server-side so requests can be authenticated. Do not include confidential personal information in a musical brief or lyrics.
What stays in this browser#
The workbench holds an entered API key in page memory and clears it on reload. It saves the latest task ID in this tab’s session storage for recovery. Login cookies support account access. Your analytics preference is stored in local storage under sunoapi:analytics-consent.
Payments#
Stripe hosts checkout and the billing portal. This service uses Stripe customer, subscription and invoice identifiers to associate payments and credits with your account. Payment-card entry happens on Stripe rather than in the workbench.
Optional analytics#
When a measurement ID is configured, analytics loads only after you choose Allow. Declining does not prevent account features. The current integration excludes dashboard, sign-in, authentication and API page views, strips URL queries and fragments from its page context, and disables Google signals and ad-personalization signals. It records permitted product events as well as public page views. You can reset the analytics preference by removing this site’s sunoapi:analytics-consent local-storage entry in your browser; the choice appears again on a subsequent visit.
Service providers and retention#
The preview uses Vercel for hosting, Supabase for account and database services, Google for optional sign-in and analytics, Stripe for billing, and TTAPI for music generation. Different providers process the data needed for their function. This preview does not publish a fixed deletion schedule or an audio-link retention guarantee. Do not treat a returned URL as permanent storage.
Questions and account-data requests#
During this owner-led preview, use your existing contact with the service owner for account-data, deletion or privacy questions. Include your account email and a description of the request, but never send API keys or payment-card details. A public support address and the operating entity will be added before launch.