Penwork Studio — Privacy Policy

Who this policy covers

This Privacy Policy explains how Harmony Stack ("we", "us") handles information in the Penwork Studio iOS app (the "App") and on the Penwork Studio pages of this website. It works alongside our Terms of Service.

Harmony Stack is the controller of the personal information described here. If you don't agree with this policy, please don't use the App.

What stays on your device

Penwork Studio is built local-first. The following is stored in the App's own storage on your iPhone or iPad and is not transmitted to us:

• Your songs, lyrics, titles, and notes;
• Folders, catalog organization, and search history within the App;
• Song tags — BPM, key, scale — and syllable, rhyme, and flow analysis;
• Voice recordings you capture, unless you run a feature that transcribes or processes them;
• In-app usage counters (for example, how many suggestions you've generated) used to show your own limits and stats;
• App settings and preferences.

Your device backup (iCloud Backup or a computer backup) may include this data. That backup is controlled by you and Apple, not by us.

What we collect and why

Here is everything that leaves your device, in one place.

We don't ask for your name, phone number, contacts, location, photos library, or health data, and the App doesn't read them.

AI features — what leaves your device

Penwork Studio is bring-your-own-key. AI-assisted features — line suggestions, rewrites, transcription, summaries, and similar tools — only work after you enter your own API key from an AI provider. Until you do, those features don't run and nothing is sent anywhere.

When you do run one, the App sends only the content that feature needs — the prompt and settings you chose, plus the lyric text or audio you pointed it at — directly from your device to that provider, over an encrypted connection, authenticated with your key. It does not pass through Harmony Stack servers, and we never receive a copy.

• Your whole catalog is never sent. Songs you didn't include stay on your device.
• Nothing is sent in the background. A request happens only when you trigger it.
• We can't read your prompts or results. There is no Harmony Stack copy to read, sell, or train on — we don't train models on your writing and don't build profiles from it.
• Your relationship is with that provider. Because the request runs on your key and your account, their terms and privacy policy govern how they handle, log, and retain it. Read them before you send sensitive material — most major providers state they don't train on API content by default, but that's their commitment to you, not ours.
• Don't submit what you can't share. Avoid sending someone else's unreleased work, confidential material, or sensitive personal information through an AI feature.

Voice capture and transcription

If you use voice capture, iOS asks for microphone permission, and speech features ask for speech recognition permission. You can decline, and you can change your mind later in iOS Settings → Privacy & Security.

Recordings are saved on your device. If you run transcription or an audio summary, that audio goes directly to the AI provider your key belongs to, is converted to text, and comes back to your device — we never hold a copy. Deleting a recording in the App removes it from your device.

Accounts and sign-in

An account is optional — the writing tools work without one. If you create one, we store your email address and a basic profile record with our hosting and authentication provider so we can sign you in.

We do not store your password; authentication is handled by our provider. We don't post anything anywhere on your behalf, and we don't use your address for marketing unless you ask us to.

Purchases and subscriptions

All purchases go through the Apple App Store. Apple processes the payment — we never see or receive your card number, billing address, or Apple Account credentials. We receive only what's needed to unlock features, such as whether a plan is active and when it renews or lapses.

Apple's own privacy policy governs the payment itself. Refunds and billing history are handled in your Apple Account.

Your own API keys

AI features run on a key you provide. That key is stored in your device's Keychain — the same place iOS keeps passwords — and is sent only to the provider it belongs to, on requests you start. It is never transmitted to Harmony Stack, and we can't see it.

Usage under your own key is billed to you by that provider and governed by their terms and privacy policy. You can remove the key in the App at any time, which turns the AI features back off.

Notifications

If you allow notifications, the App schedules reminders locally on your device. Reminder content isn't sent to our servers, and we don't use notifications for advertising.

Turn them off any time in iOS Settings → Notifications.

What we don't do

• We don't sell or share your personal information, in the ordinary sense or as those terms are defined under California law;
• We don't show ads and include no advertising SDKs;
• We don't include third-party analytics or attribution SDKs, and we don't track you across other apps or websites — so the App doesn't need to ask for tracking permission;
• We don't buy personal information from data brokers or enrich your profile from outside sources;
• We don't use your lyrics, recordings, or prompts to train AI models;
• We don't make automated decisions that produce legal or similarly significant effects about you.

Who we share data with

We share the limited data described above only with service providers who process it on our behalf, under contract, for the purposes we specify:

• Apple — App Store distribution, in-app purchases, system speech recognition, and opt-in crash diagnostics;
• Supabase — hosting and authentication for optional accounts;
• Our email provider — to receive and answer support messages.

AI providers are not on that list, because we don't send them anything. When you add your own key, you are the one contracting with that provider; the App simply makes the request from your device on your behalf. The same applies to any other keyed service a feature connects to — music, voice, or audio processing — and the feature tells you what it's about to send.

We may also disclose information if legally required, to enforce our Terms, or to protect the rights and safety of our users or the public. If Harmony Stack is ever acquired or merged, data may transfer as part of that transaction, subject to this policy.

How long we keep data

• On-device content — kept until you delete it or remove the App;
• AI requests — we keep nothing, because nothing reaches us; the provider you keyed in retains requests according to its own policy;
• Account records — kept while the account exists, then deleted on request;
• Purchase status — kept while a plan is active and for the period required by tax and accounting rules;
• Support emails — kept as long as needed to resolve the issue and keep a reasonable support history.

Deleting your data

On your device: delete individual songs or recordings in the App, or delete the App to remove its local data entirely. Deleting the App may permanently remove your catalog — export or back up first.

Your account: email harmonystack@gmail.com from your account address and ask us to delete it. We'll delete the account and associated records, and confirm when it's done.

Subscriptions: cancel in iOS Settings → your Apple Account → Subscriptions. Deleting an account doesn't cancel a subscription, and cancelling doesn't delete an account — do both if you want both.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Because most of your content never leaves your device, you already control it directly — for anything we hold, email us and we'll act on your request.

If you're in the EEA or UK

We process personal information to perform our contract with you (running the features you request), on legitimate interests (keeping the App working, secure, and free of abuse), and on consent where iOS asks for it (microphone, speech recognition, notifications). You may lodge a complaint with your local supervisory authority.

If you're in California

We do not sell or share personal information, and we don't process it for cross-context behavioral advertising. We won't discriminate against you for exercising any privacy right.

We answer verified requests within the time the applicable law allows — normally within 30 days. We may need to confirm your identity, usually by asking you to write from the email address on the account.

International transfers

Harmony Stack is based in the United States, and our providers process data on servers in the United States and other countries. If you use the App from outside the United States, the limited data described here is transferred there.

Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses through our agreements with those providers.

Children

Penwork Studio is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child has provided us information, email us and we'll delete it.

Security

Requests to our providers use encrypted connections (HTTPS/TLS). API keys are stored in your device's Keychain. Account data sits with a managed provider with its own access controls, and we keep access to it limited to what's needed to run the service.

No system is perfectly secure. Keep your device passcode-protected and updated, and let us know right away if you think your account has been compromised.

Changes to this policy

We'll update this policy as the App changes or as the law requires. The effective date at the top always reflects the current version, and we'll note material changes in the App or in a release note where practical.

Continuing to use the App after an update means you accept the revised policy.

How to reach us

Privacy questions, access or deletion requests, or anything unclear here — email harmonystack@gmail.com. We typically reply within 1–2 business days.

Harmony Stack — developer of Penwork Studio, available on the Apple App Store.