Last updated 11 October 2026
Privacy policy
Thermal is made by Martori Studio. This page says what Thermal keeps about you, why, who it goes to, and how to have it deleted. Questions go to hello@martori.studio.
The short version
- Your track is analysed in your browser. The audio file is not uploaded to Thermal; only the measurements are.
- Thermal keeps what you make and save so you can come back to it, and nothing is sold.
- Thermal uploads or posts to your SoundCloud, Instagram, Facebook, TikTok or YouTube only when you connect the account and press the button that names it.
- You can disconnect an account, delete what you made, or ask for everything to be deleted. See deleting your data.
What Thermal keeps
Your account
Your email address and, if you give one, your name. Sign-in is run by Netlify Identity; your password goes to it and is never shown to Thermal. If you sign in with Google, Google shares your email address and name.
What you make and save
- Readings: the words you enter (the artist name, notes about the music) and the measurements of your track, such as tempo, key, loudness and an audio fingerprint. Not the audio itself.
- Releases: titles, dates, codes, credits, lyrics, and the contacts, pitches and submissions you add.
- Images, video and audio you generate or upload, your calendar, and your release links.
- Pages you publish, such as a press page, a listen page, a show page or a spoken pitch. These are public to anyone with the link, until you take them down.
Accounts you connect
When you connect SoundCloud, Instagram, Facebook, TikTok or YouTube, Thermal keeps the account's name, the permissions you granted, and the keys the platform issues. The keys are encrypted (AES-256-GCM) before they are stored. For a post you schedule, Thermal keeps the caption, its time and status, and the link once it is posted; the image or video is held privately until it is sent, then deleted.
Your voice
If you record a voice memo, the recording is sent to ElevenLabs to be written out as text. If you clone your voice, your consent recording is sent to ElevenLabs; Thermal keeps the voice's id, its label, the transcript and the date, not the recording.
Payments
Payments are handled by Stripe. Thermal keeps your plan, your Stripe customer id, the plan's status and its renewal date. Card details go to Stripe and never to Thermal.
How Thermal is used
Thermal records which pages and features are used, with a random visitor id and session id kept in your browser. These records leave out email addresses, names, lyrics and links, and hold no IP address. Views of the public pages you publish are counted with an approximate city, region and country and the kind of device, again without an IP address.
Keeping free use fair
To limit free runs, Thermal briefly keeps your IP address and runs a human check from Cloudflare Turnstile. The IP records are deleted after two days.
Trying Thermal without an account
A guest's work is kept for seven days. If you make an account, it moves to your account; if not, it is deleted.
Your audio
Thermal decodes and measures your track in your browser. The file stays on your device. It leaves only when you choose:
- Uploading to SoundCloud from Thermal sends it from your browser straight to your SoundCloud account.
- A video you post to a connected account is held privately until it is sent, then deleted.
- Voice memos and voice cloning go to ElevenLabs, as above.
Why
To run Thermal: to read your music, write and make the things you ask for, keep your work, publish the pages you publish, send the posts you confirm, take payment, keep free use fair, keep Thermal secure, and see which parts of it help so they can be made better. Thermal does not sell your personal data and does not use your music, words or images to train models.
Who it goes to
Only what each service needs to do its part:
- Netlify: hosting, sign-in and storage.
- Supabase: the database and private file storage.
- Anthropic and Google: the words, measurements and prompts behind what Thermal writes, and the prompts for images and video, under their API terms.
- ElevenLabs: text to be spoken, voice memos to be written out, voice clones.
- fal: prompts and images for image and video generation, when used.
- Stripe: your email and account id at checkout.
- Cloudflare: the human check before a free run.
- Resend: notice emails to you, when they are switched on.
- Spotify: a song's ISRC, title and artist name, to find the release in Spotify's catalogue. No account data.
- SoundCloud, Instagram, Facebook, TikTok and YouTube: only the tracks, images, videos and words you choose to send, to the account you connected.
- Google Ads: Thermal's public pages carry Google's advertising tag, which sets Google's cookies and counts when an account is made. Google's use is covered by Google's privacy policy.
Thermal may also share information when the law requires it, or to protect people from harm.
YouTube
Posting to YouTube uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy. Thermal's use of information from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can remove Thermal's access at any time from your Google account's permissions.
Cookies and your browser
- Signing in: Netlify Identity's cookies keep you signed in.
- Your browser's storage: your appearance settings, the random visitor and session ids above, and work you keep on this device, such as boards and drafts.
- Google Ads: Google's own cookies on the public pages. You can limit them in your browser or in Google's ad settings.
How long
- Your account and your work: until you delete them or your account.
- Guest work: seven days unless it is claimed.
- IP records for free runs: two days.
- A connected account's keys: until you disconnect it.
- The file for a post: until it is sent or stopped.
- Payment records: as long as the law requires.
Your choices
You can see, correct, export or delete your information. Most of it is in Thermal itself: edit or delete readings, releases and pages; export a release as PDF, DOCX, ZIP, CSV or Markdown; disconnect accounts in Put it out; delete your whole account in Account. For anything else, or a copy of everything, write to hello@martori.studio from your account's email. Thermal answers within 30 days. Depending on where you live you may have further rights, including to object or to complain to a data protection authority.
Deleting your data
Deleting your data says how to disconnect an account, delete what you made, or have your whole account deleted.
Security
Thermal uses encrypted connections, encrypts the keys of connected accounts, keeps files private unless you publish them, and limits who and what can read the database. No system is perfectly secure; if something goes wrong that affects you, you will be told.
Children
Thermal is not for anyone under 13, or the minimum age for this kind of service where they live. If you believe a child has given Thermal their information, write to hello@martori.studio and it will be deleted.
Where it is handled
Thermal's services run in the United States and in the other countries where the providers above operate.
Changes
When this policy changes, the date at the top changes. A change that matters to how your information is used will be shown in Thermal or sent to your email first.
Contact
Martori Studio, hello@martori.studio.