Privacy Policy
Your projects and audio previews stay on your computer when you use 1surface’s local Library, preview generation and playback. You do not need an account to use these features.
This policy explains the information we process when you visit our website, create an account, allow analytics or contact us, and the choices and rights you have.
Who we are
1SURFACE LTD is responsible for the personal information described in this policy. We are registered in Scotland under company number SC898747, with our registered office at Unit 33, Morris Park, 37 Rosyth Road, Glasgow, United Kingdom, G5 0YD.
Contact contact@1surface.com with privacy questions, requests or complaints.
Your projects and device
The app stores its library index, project information, previews and preferences on your device. This can include project names and locations, musical and track information, tags and scan settings. Account sign-in information is also stored locally when you sign in.
Preview generation uses Ableton Live on your computer. Where it needs Accessibility or Screen Recording permission, these permissions are used to operate or read Live’s interface locally. Screen captures used for preview generation are not uploaded to us. You can manage these permissions in your operating system’s settings.
Your own backup or file-sync services may copy local files independently of 1surface.
Accounts and access requests
If you create an account, we process your email address, handle, account identifier, authentication and security records, and any profile details you provide. We use these to create and secure your account and send necessary verification and service messages. Without the required information, we cannot provide account-based features; local use remains available.
If you choose Google sign-in, Google provides basic account details such as your email address, account identifier, name and profile picture. This does not give us access to your Gmail or Drive content.
If you request early access through the website, we also keep the details you submit, the request and review status, and a record of your agreement to the terms and acknowledgement of this policy. We use these to manage your request and contact you about access.
Creating an account or requesting access does not subscribe you to marketing emails or research. Account and access emails are used for verification, security and responding to your request.
Website and online connections
Our hosting and service providers receive connection information, such as IP addresses, request times and technical request details, when you use online services. We use this information to deliver those services, prevent abuse and investigate security problems.
The website does not use advertising cookies or behavioural analytics. The app uses local storage for preferences and sign-in information. It also retrieves feature configuration from PostHog independently of optional product analytics; switching analytics off does not stop these configuration requests.
Optional product analytics
Product analytics are off unless you allow them in Settings → Data Controls. If you opt in, PostHog receives limited information about app use, preview generation and playback to help us improve 1surface. These events exclude your account details, project names, file paths and music. They use a random identifier, not your account identity. This is pseudonymous data, not a guarantee of anonymity. Session recording and automatic click tracking are disabled.
You can withdraw consent without affecting local features. This stops collection and clears unsent events, but does not erase events already received. Opting in again uses a new identifier.
To request deletion of earlier analytics, contact contact@1surface.com. These records use random references stored locally and are not linked to accounts, so account deletion alone cannot identify them. If you already have an exported reference file, you can choose which entries to send us privately. The current app settings do not offer reference export; contact us for assistance before clearing local app data. Keep any references you hold until your request is resolved.
Error reports and support
Automatic diagnostics. Automatic error reporting is enabled by default when configured in the app and is separate from optional product analytics. Reports sent to Sentry can include app and device details, error information, stack traces and an account identifier where available. We filter common sensitive information, but filtering may not remove every personal detail. Contact us with questions or an objection to this processing.
Reports you send. When you send a report through Report a problem, we receive your description and basic technical details, such as app version, operating system, processor architecture and Library, scanning, preview or playback status. These are sent privately through Sentry, independently of automatic diagnostics and analytics preferences. Your projects, audio, screenshots, logs and account details are not automatically attached. The description is sent as you write it, so include only information you intend to share. Report drafts are saved on your device until successfully sent or cleared.
Email support. If you email us, we receive your address, correspondence and any files you choose to include. We use this information to respond and resolve the issue.
Why we use personal information
We rely on the following legal grounds:
| Purpose | Legal ground |
|---|---|
| Creating and managing your account and providing services you request | Performing our agreement with you, or taking steps at your request before an agreement |
| Securing the service, retrieving feature configuration, preventing abuse, reviewing access requests and investigating support or reliability problems | Our legitimate interests in running a safe, reliable service, balanced against your rights |
| Collecting optional product analytics | Your consent |
| Handling privacy requests and complaints, and keeping records required by law | Our legal obligations |
You can withdraw consent at any time without affecting the lawfulness of earlier processing.
Who receives information
We use service providers for the following purposes. They receive the information needed for the services they provide, not your local project library simply because they are listed here.
| Provider | Purpose |
|---|---|
| Supabase | Account authentication and database services |
| Vercel and Railway | Website and online service hosting |
| Resend | Verification and service emails |
| PostHog | Optional product analytics and feature configuration |
| Sentry | Error diagnostics and reports you send |
| Proton | Support correspondence and restricted business records |
| Stripe and its payment affiliate | Earlier payment and transaction records |
Records from earlier online use may include conversations, project context or diagnostic material sent at that time. Earlier purchase records may include billing references and transaction information. These are separate from your local project library, and existing purchase and refund rights remain protected.
We may also share information with professional advisers or authorities where necessary to comply with the law or establish, exercise or defend legal rights. We do not sell personal information or use it for third-party advertising.
International transfers
Our providers may process personal information outside the UK.
Contact contact@1surface.com for information about processing locations and copies of applicable transfer safeguards.
How long we keep information
We keep account information while your account exists. Access-request information linked to an account is kept with that account. For earlier email-only access requests, we keep the information needed to respond and a minimal record of withdrawals to prevent accidental re-contact.
Support correspondence is kept for as long as needed to resolve the request and deal with related follow-up or disputes. We assess this by whether the issue is resolved, whether further contact is reasonably expected, and whether a legal obligation or claim requires the record.
Limited records may be kept where required by law or needed for an active security investigation or legal claim. Accounting and transaction evidence from earlier purchases is kept for six years after the end of the last relevant company financial year, or longer for a specific legal requirement or unresolved matter.
Deleting your account
You can request account deletion in the app or by contacting us. The app schedules permanent account deletion after a 30-day recovery period. Removal is then processed and failures are retried; the scheduled date does not guarantee that every provider copy is erased at that instant. Contact us before the scheduled date to request recovery. This recovery period does not limit your statutory right to request erasure.
Deleting an account does not delete your original Ableton projects, audio or device-local library. Those remain under your control. Some account data may remain on an offline device until it reconnects. Limited records and backup copies may remain for legal obligations, recovery or unresolved matters. Recovery does not restore local account data already cleared.
Your rights and complaints
Depending on the circumstances, you can ask to access, correct or delete your personal information, restrict its use, or receive a portable copy. Contact contact@1surface.com to make a request. We may need to verify your identity.
Your right to object: You can object to processing based on our legitimate interests, including the security, access-review and reliability processing described above. You can also withdraw consent to optional analytics at any time.
You can raise a privacy complaint at the same email address. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and explain the outcome. You also have the right to complain to the UK Information Commissioner’s Office or another relevant data protection authority.
Changes to this policy
We will update this policy when our practices change and show the revision date above. We will tell you about material changes and ask for consent where required. A policy update does not automatically opt you into optional processing.