Privacy Policy

effective november 11, 2026

The short version: I collect what the tool needs to work, the site shows no ads, I never sell your data, and if you want your account gone, one email does it.

1. Who's handling your data

sunogpt.ai is run by me, ChillPanic. This is a one-person business, not an ad network. For anything privacy related: chillpanic@sunogpt.ai.

2. What I collect

Your email and login. Your password is stored by Supabase in hashed form, I never see it. If you sign in with Google, Google shares your email address and basic profile info (your name and profile photo) with the site.
Your prompts and results. The song ideas you type, the conversation with the generator, and the outputs it writes. That includes attempts that fail, so I can find and fix what broke. This is also what powers your History panel.
Ratings and feedback. Your thumbs up or down and any comment you leave with it.
Usage numbers. Prompts used this month, your plan, pack credits, and when your account was created.
Billing identifiers from Stripe. A customer ID and subscription ID so your plan works. Never your card number. Card details live with Stripe and never touch my servers.
A referral code, if you arrived through an affiliate link.
Where you came from. If you click a link with tracking tags (like the ones in my YouTube descriptions and emails) or come from another website, I note the tags, that website's name, the first page you landed on, and the day. It's saved with your account when you sign up and with your order when you buy, so I know which videos and emails actually help people.
Personal offer data. If I sent you a personal offer link (like the Brain), I store your email and when you first opened the page, so the countdown on your offer page stays accurate.

3. What I don't collect

No fingerprinting, no session recording. I don't collect or look at your IP address or browser details, and nothing I built logs them. A few standard things exist outside my code: the login system (Supabase) keeps normal sign-in security records, like the IP and browser of each session, the way any login system does, my hosting providers keep standard server logs on their side, and Vercel Web Analytics counts how many people visit each page, without cookies and without telling me who you are.

One exception: the free Starter Sheet page (sunogpt.ai/free) and the 10,000 SUNO Prompts page (sunogpt.ai/10k), with the thank-you page you see after buying the book, run Meta's pixel, so when I run Facebook and Instagram ads I can see which ad got people to sign up or buy. It tells Meta that your browser visited the page, whether you signed up or started checkout, and, if you buy the book, that a purchase was made and for how much, along with the browser details that come with any web request. It never sends your email. Meta sets its own cookie for this and handles the data under its own privacy policy. No other page on the site has it. If you're in the UK or Europe, the Starter Sheet page asks you first, and the pixel only loads if you tap Accept. To change your answer, clear this site's data in your browser and it'll ask again. The book page and its thank-you page don't load the pixel at all for visitors in the UK or Europe.

4. Where your data goes, and why

The site runs on a small set of services, and each one gets only what it needs:

Supabase is the database and login system. Everything in section 2 is stored there.
Anthropic (Claude) is the AI that writes your prompts. Your song idea and conversation are sent to Claude's API to generate each result. If your request references a real artist, the AI may run up to two web searches to nail the sound. Anthropic's API terms say they don't train their models on this data.
Stripe handles payments and gets your email so receipts and billing work.
Resend delivers the account and trial emails I send (section 6).
Kit runs my email list, so your address is stored there too.
Vercel hosts the website and counts page visits.
Meta gets visit, sign-up, checkout and purchase signals from the pages named in section 3, so I can tell which Facebook and Instagram ads work.
Google Fonts serves the site's fonts on most pages, which means your browser requests the font files from Google's servers.

Your data is never sold to anyone. There's no "partners" list. One honest exception worth naming: if SUNO GPT is ever acquired or handed off, your data goes with the service to whoever runs it next, under this same policy or better, and I'll email account holders first.

5. What I can see

Here's something privacy policies don't usually spell out: to run and improve the tool, I have an admin dashboard that shows me recent prompt ideas, thumbs-down feedback, and aggregate stats like top genres and usage costs. I sometimes run recent idea snippets through the AI to summarize what people are making. I use all of this to fix problems and make the prompts better, not to snoop on individuals.

6. Emails you might get

A sign-up confirmation, so your account works.
Receipts and billing emails from Stripe.
At most three one-time helper emails from me if you go quiet during the free trial: a welcome, a reminder, and a "you used them all" note. Each sends once, ever. Reply "no thanks" to any of them and I'll take you off by hand.
Account and service notices when something actually affects you: a price change, or a meaningful change to these documents.
If you bought the Brain, an email when a new version ships, so you get your lifetime updates.
Very occasionally, a personal offer from me. Same deal: reply "no thanks" and that's the end of it.
Occasional SunoGPT news, tips, and offers from my email list (Kit runs it). Every one has an unsubscribe link that works instantly, and unsubscribing never affects your account.

That's the whole list. Your address is never given to anyone else's list.

7. Cookies and your browser

Signing in uses Supabase session cookies, the kind that keep you logged in. Two more small cookies remember where you came from (section 2): the first time, kept for a year, and the latest time, kept for 90 days. The only advertising cookie is Meta's, and only on the pages named in section 3. The site also keeps four small notes in your own browser's storage: which affiliate link referred you (honored for 60 days), a plan you picked before signing up (used within 24 hours), your recent "surprise me" genres so you don't get repeats, and your answer to the cookie question on the Starter Sheet page, if you were asked. Those stay on your device.

8. How long I keep things

Your data stays as long as your account exists, history included, so your past generations are there when you want them. Want out? Email chillpanic@sunogpt.ai from your account email and say "delete my account". I'll delete the account and everything tied to it from the database. Two leftovers I can't reach: Stripe keeps its own billing records because tax law requires it, and copies in routine database backups age out on their own within a few weeks.

9. Your rights

Email me to get a copy of your data, correct it, or delete it. If you're in the EU or UK (GDPR) or California (CCPA), those laws give you these rights formally. I honor them for everyone, no forms, no 30-page process.

10. Kids

SUNO GPT isn't for children under 13, and I don't knowingly keep data on anyone under 13. If that's somehow happened, email me and it's gone.

11. Changes

If this policy changes in a meaningful way, I'll update the date at the top, and for anything big I'll email account holders.