Privacy Policy

Miso Labs, Inc., a Delaware, USA corporation (“Miso,” “we,” “us”), operates the Miso website, app, and related hosted APIs and media services. This policy explains how we handle personal information through those Services. Miso is responsible for the processing it determines and controls. Contact us about privacy or your rights at contact@miso.fm.

Our mailing address is Miso Labs, Inc., 169 Madison Ave STE 74706, New York, NY 10016, USA.

Miso uses public blockchain and distributed-storage systems. Wallet activity, ownership records, credits, and content you publish can be visible to anyone. A wallet address is not necessarily anonymous. Read the public-information section before publishing or transacting.

1. Information we process

Sign-in and account information

When you sign in with Google through Enoki, the sign-in flow processes an identity token and the account identifiers needed to establish your session and derive your Sui address. Depending on the permissions and token supplied by the provider, that token may also contain your email address or basic Google profile information. Our authentication service receives your identity token and address for protected requests and verifies them with Enoki. We do not receive your Google password.

We also process signatures, authorization challenges, session information, and transaction status needed to authenticate requests and prevent unauthorized use. User signing happens on the client; Miso’s API does not hold your user signing key. Eligible sponsored transactions use a separate sponsor key operated for network fees.

Profiles, music, and content you provide

We process usernames, wallet-to-username associations, avatars, artist or group profiles, biographies, links, and other details you choose to provide. Artist and publishing tools handle recordings, stems, artwork, lyrics, credits, contributor information, release metadata, rights allocations, and payout addresses. Some information may be submitted by collaborators rather than directly by the person it describes.

When you email us or submit a linked contact or onboarding form, we receive the information you include, such as contact details, your message, attachments, and support history. Please do not send passwords, private keys, or unnecessary sensitive information.

Public transactions and holdings

We read and process public Sui data, including addresses, Records and other objects held by an address, purchases, transfer amounts and recipients, transaction digests, timestamps, catalog changes, and royalty allocations or payments. We use this information to display collections, balances, receipts, catalogs, and royalty activity and to process requested operations. Linking a profile or username to an address can link that identity to its public history.

The current app uses blockchain balances for purchases and transfers. Its purchase flow does not ask Miso to collect a payment-card number or bank-account login. If you use an external service to acquire or move funds, that service handles its own account and payment information.

Technical and request information

Our hosting, API, and media infrastructure processes IP addresses, request URLs, browser and device information supplied with requests, timestamps, response status, and diagnostic or security information. Requests can reveal which releases, images, audio files, models, or wallet information you access. We use IP addresses and account identifiers for rate limiting and abuse prevention. Providers may generate their own operational logs.

Data stored on your device

The app uses browser storage for sign-in sessions, preferences, language, onboarding state, mixer settings, and transaction recovery information. It also uses local databases, browser file storage, and caches for downloaded audio, offline-library information, app resources, and optional AI model files. This data can remain on the device between visits. Local storage is not the same as a Miso-hosted account database.

2. How and why we use information

We use information to:

• Authenticate you, maintain sessions, and authorize account and artist actions.
• Display and deliver music, profiles, catalog information, collections, and receipts.
• Execute requested purchases, transfers, edits, and royalty operations, including eligible fee sponsorship.
• Store and serve uploaded media, maintain username associations, and support local playback and downloads.
• Respond to support requests, investigate faults, and maintain reliable Services.
• Detect abuse, enforce our terms, protect users and infrastructure, and handle rights complaints.
• Meet legal obligations, respond to lawful requests, and establish or defend legal claims.

Where European Economic Area or UK data-protection law applies, we rely on performance of a contract for information necessary to deliver a Service you request; legitimate interests for proportionate security, reliability, abuse prevention, and support, subject to your rights; and legal obligations where processing is required by law. Where an activity requires consent, such as nonessential tracking where applicable, we will seek that consent separately. You can withdraw consent without affecting earlier lawful processing. Merely using the Services is not blanket consent.

If you do not provide information needed for sign-in, authorization, a transaction, or an upload, we may be unable to provide that feature. We do not use the optional assistant to make decisions about you that have legal or similarly significant effects.

3. Public information and distributed storage

Sui is a public blockchain. Transactions, addresses, object ownership, and published catalog or rights information can be read, indexed, copied, and combined with other information by anyone, including people outside Miso. Deleting a profile or stopping use of the app does not erase those records.

Published audio, stems, artwork, metadata, and some artist media may be stored on Walrus and mirrored through Miso’s storage and CDN. Public media is not a private file vault; a person with a relevant identifier may be able to retrieve it. Distributed copies may remain accessible independently of Miso, including after we stop displaying a release or remove a copy we control. A public file is still subject to applicable copyright and privacy rights.

Usernames and public avatars can also be retrieved through our APIs. Only publish information you have authority to share. Avoid including home addresses, identity documents, private contact details, or sensitive information in public content or metadata.

We cannot rewrite blockchain history or promise deletion from independent networks. This technical limitation does not waive your legal rights or remove our duties concerning information we control. We will assess correction, removal, restriction, and other requests and explain what we can do.

4. The optional AI assistant

The current assistant runs its language model in your browser. Conversation text and the context assembled for local generation are processed on your device rather than sent to a hosted language-model inference service. The assistant can call Miso’s APIs to retrieve catalog, artist, release, or wallet-related information; those requests send the identifiers needed for the lookup and ordinary request information to the API.

Loading the assistant downloads model and runtime files. Depending on the configured model, those files come from Miso’s CDN or third-party model/runtime hosts, including Hugging Face and the hosts used by WebLLM. Those hosts receive download request information such as your IP address. Local generation does not mean every supporting network request stays on your device.

You can unload the assistant and manage its cached files through the app’s data controls. If you send us a conversation in a support request, we receive the text you choose to share.

5. Who receives information

We disclose information where needed for the following purposes:

• Infrastructure providers: Cloudflare provides hosting, request security, media processing, storage, caching, and related infrastructure for our website, APIs, and media services.
• Sign-in and wallet providers: Google and Mysten Labs’ Enoki process information for sign-in, address derivation, and wallet authorization. Blockchain RPC and related infrastructure providers receive requests needed to read or submit blockchain activity.
• Public networks and transaction participants: Sui validators, readers, storage operators, recipients, and other participants can receive or observe public transactions and published data as described above.
• Media, model, and form providers: Embedded Cloudflare Stream video, optional model downloads, and linked forms such as Typeform send information to the provider when loaded or used. Information you submit through a form is also made available to its operator.
• Professional and legal recipients: We may disclose relevant information to advisers, authorities, or other parties where reasonably necessary for legal compliance, protecting rights and safety, or resolving disputes.
• Business transfers: Information may be transferred as part of a merger, financing, acquisition, or sale of assets, subject to applicable law and appropriate confidentiality protections.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use the Services to build targeted-advertising profiles. Public publication and operational disclosures described here still occur.

Independent services have their own privacy practices. Our use of a provider does not eliminate Miso’s responsibilities under applicable law.

6. Cookies, storage, and tracking choices

Miso uses browser storage and similar technologies to keep sign-in and requested features working, remember preferences, and cache resources. Hosting, security, sign-in, and embedded-content providers may use their own cookies or equivalent technologies when you interact with them. Our current first-party app and website do not include advertising pixels or a third-party behavioral analytics SDK.

You can manage cookies and site storage in your browser. In the app, use Settings → Data to manage downloaded sessions, cached assistant files, and local app data. Clearing data may sign you out and remove downloads, preferences, and locally saved mixes or recovery information. It does not delete on-chain assets or information retained on servers. Some controls depend on browser support.

Because we do not sell information or share it for targeted advertising, there is no such activity to opt out of in the current Services. Browser “Do Not Track” signals do not currently change essential processing. We will honor legally required opt-out preference signals where applicable and obtain consent before introducing technologies that require it.

7. Retention and security

Retention depends on where information is held and what it is used for. Sign-in state, preferences, and downloaded resources are stored in your browser as described above. Transactions and ownership records are held on public networks. Our hosted services support storage of username associations and uploaded media; hosting and security providers may also retain operational information. Processing a request does not necessarily mean we keep its contents afterward.

For personal information we actually retain under our control, we keep it only for as long as needed to provide the feature you use, resolve a support request, investigate a security issue or dispute, or meet an applicable legal obligation. We consider whether the account or content remains in use, whether an issue is resolved, and any applicable statutory recordkeeping or claims period. We delete or de-identify that information when it is no longer needed, subject to legal requirements. Contact us to request deletion or information about a particular record; we will respond within the applicable legal deadlines. A cache expiry or username renewal period is not a deletion guarantee.

Browser data remains until cleared, replaced, expired, or evicted by your browser, depending on the type of data. Public blockchain history can persist indefinitely. Distributed media and independent copies have retention rules we cannot centrally control.

We use measures designed to protect information, including signed authorization for protected actions, access controls, and request limits. No network, device, or storage system can be guaranteed secure. Protect the accounts and devices you use to access Miso.

8. International processing

Miso uses providers and public networks that operate internationally. Your information may be processed outside your country, where privacy protections differ. Where applicable law requires safeguards for transfers that Miso controls, we must use an authorized transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact us for information about the mechanism relevant to your data. Public blockchain publication also makes information accessible worldwide; it is not a private transfer confined to Miso’s providers.

9. Your rights and requests

Depending on your location and applicable law, you may have rights to access or obtain a copy of your information; correct it; request deletion; restrict or object to processing; receive portable data; withdraw consent; or opt out of certain uses. Where applicable, California and other US state laws also provide rights to know about collection and disclosure, opt out of sale or targeted-advertising sharing, limit specified uses of sensitive information, and receive nondiscriminatory treatment for exercising rights. These rights have legal conditions and exceptions.

Send requests to contact@miso.fm. Tell us what you are requesting and provide enough information to locate the relevant account or record, such as your public wallet address. We may ask for proportionate proof of identity or authority, including verification of an authorized agent. Never send your private key or Google password. We will respond within applicable legal deadlines and explain any limitation or refusal. You may contact us to appeal a decision where an appeal right applies.

You can update available profile fields through the app and manage local data through its settings. Server-side deletion requests are separate from clearing browser storage. Our public-data limitations are described above; we will still consider measures available within our control.

You may complain to your local data-protection authority or other competent regulator. Where EEA or UK law applies, you may object to processing based on legitimate interests and withdraw consent where consent is our basis. We will not penalize you for exercising a legal privacy right.

10. Children

Accounts are intended for people aged 18 or older who have reached the age of majority where they live. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us so we can investigate and take appropriate action, including deletion of information we control where required. Public-network limitations do not remove our child-protection obligations.

11. Changes and contact

We will update this policy when our practices change and display the updated date. We will provide additional notice or seek consent when required for a material change. Contact Miso Labs, Inc. at contact@miso.fm with privacy questions, complaints, or requests.