Privacy

Privacy Policy

What MashKey (mashkey.com) collects, why, who processes it, how long we keep it, and how to delete it. Written to be read, not to be impressive.

Last updated October 5, 2026 · MashKey is made by Sthetic Creative Group, LLC.

The short version: we collect what MashKey needs to work — your account, what you make, and the audio you add.We do not sell your data, we do not use it for advertising, and analytics only run if you accept them. You can delete your account and everything in it from inside the app.

Who is responsible

Sthetic Creative Group, LLC, 7533 S Center View Ct #6340, West Jordan, UT 84084, USA, is the data controller for MashKey — the company that decides what is collected, why, and for how long. It is the company to contact about everything on this page.

Privacy and data requests: privacy@mashkey.com. Help and account questions: support@mashkey.com.

What we collect

Your account

Your email address, your name and your account type. MashKey has no passwords of its own: signing in with email and a password, with Sign in with Apple or with Google is handled by our app platform (Base44), so we never see your password and Apple or Google only tells us your name and email.

What you make

The songs and tracks you save — title, artist name, genre, description, lyrics, the keys you played and when, your keyboard layout, the beat, the cover, and the counts you see (plays, favorites, remixes). Plus your saved keyboards, vocal presets, setlists, favorites, and the creator page you publish (display name, bio, tagline, links you add). A song you release is public to signed-in players, so they can hear and remix it.

Recordings and audio you add

When you record a vocal take, a harmony or a sound for the Voice Kit, the audio is turned into a file and uploaded to our app platform's storage so your songs play back anywhere. A sound in your Voice Kit is stored privately, with no public link: it plays for you through a short-lived signed link, and becomes playable by anyone else only when the song it is in is released or the keyboard is shared. Vocal takes and harmonies are stored as public files at long, unguessable web addresses: they are not listed anywhere, but anyone who has the exact link can play them, and the recordings inside a released song are heard by whoever listens to it. Treat that link as the private part, and do not record anything you would not be comfortable having heard.

Cover art

Album covers are drawn inside the app, or you can upload your own image. An uploaded cover is stored as a file and fingerprinted (a hash of the image) so no two creators are ever given the same artwork; it is also screened for content that breaks our rules.

The confirmation you give for audio you add

Every sound you add to a keyboard's Voice Kit — recorded or uploaded — asks you to confirm first that you made it or have the rights to use it. We keep a record of that confirmation (the file, when you gave it, and whether you recorded or uploaded it) so the claim can be checked if someone reports it.

What you send to the AI tools

MashKey has AI features: the lyrics co-writer, the bio writer, beat and vibe helpers, the cover check, the vocal coach's preset suggestion, AI mastering and the help assistant. When you use one, the text you type — and the song context that tool needs to do its job (for a cover check, the image) — is sent through our app platform to an AI model provider to write the answer. We store only which tool was used and when, never your prompt or the content. The help assistant receives your question and the help articles that match it, and nothing else: no account details, no songs, no recordings, and it cannot look anything up. Questions to the assistant are not kept as a transcript — the conversation lives in the page until you close it, and only becomes permanent if you turn it into a support ticket.

Support tickets

If you contact us, we store what you send so we can answer it: the name and email you give, the category and subject you choose, your message, anything you add such as the page address, device details or an attached screenshot, the messages we exchange, and the ticket's status and reference number. Screenshots are stored as private files with no public link. To stop automated spam we keep a one-way hash of the sender's address — never the address itself — and limit how often messages can be sent.

Notifications

In-app notifications (the bell) are stored on your account. If you install the mobile app and allow notifications, a push token is handled by our app platform so it can deliver them to your phone; you can turn notifications off in your device settings at any time.

Analytics — only if you accept

With your consent, we use Google Analytics 4 (Google LLC) and Base44 product analytics (Wix.com Ltd.) to see how MashKey is used: pages viewed, the site that sent you, how long a visit lasted, the kind of device and browser, and a few feature events (opening the studio, publishing, sharing, using the help center). Rough location (country or city) is derived from your IP address; Google Analytics 4 does not store the address itself. We never send them your name, email, account ID, song titles, lyrics, recordings or anything you type, and sign-in screens and Settings are never tracked. If you are signed in, Base44's product events are linked to your account ID so we can count active players. If you reject analytics, or your browser sends Global Privacy Control, none of it is collected.

How you found MashKey

On a first visit we note one word for where you came from — for example tiktok, instagram, shared-link or direct — and the kind of page you landed on. If you create an account, those two words are saved once on your account so we can see which channels bring new players. The full address of the site that sent you is not kept, and this is skipped if your browser sends Global Privacy Control.

Technical logs and your device

Our app platform keeps server-side technical logs of requests to MashKey's backend to operate and secure it. In your own browser we store what makes the app yours — theme, keyboard layout, studio settings, your analytics choice and help-article votes — in local storage on your device, not on our servers.

Why we use it, and what allows it

Where the law asks us to name a reason for each use (GDPR Article 6 in the EEA, the UK and Switzerland), the reason sits under each one.

To run your account and the app — contract

Creating your account, signing you in, saving and playing what you make, storing the audio you record, keeping your keyboards, presets and settings, and letting other players hear and remix what you release. The service cannot be provided without this.

To keep MashKey safe and within the rules — our legitimate interests

Screening released songs, covers and audio against our rules and the law, answering reports and takedown notices, blocking and rate-limiting spam, fraud and abuse, and keeping short-lived technical logs so the service can be run and defended. We have weighed this against your rights: it is limited to what those jobs need, and none of it is used to profile or advertise to you.

To answer you, and to know what works — our legitimate interests

Support tickets, the help center and the help assistant (which receives your question and the matching help articles, and nothing else), and the one word we keep about how you found MashKey, so we know which of our posts brought players in.

Analytics and product improvement — your consent

Understanding which parts of the app get used, in aggregate, through Google Analytics and Base44 product analytics. None of it loads until you accept, and you can withdraw at any time. In the EEA, the UK and Switzerland you must also be 16 or over, or have a parent or guardian agree.

The optional AI tools — your consent

The lyrics co-writer, the AI bio, beat and vibe helpers, cover art and the cover check, the vocal coach’s suggestion and AI mastering run only when you choose to use them, and each sends only the text you typed (plus the image, for a cover check) and the song context that tool needs. In the EEA, the UK and Switzerland you must be 16 or over, or have a parent or guardian agree — until that is answered, those tools stay off.

Notifications — your consent

A push token, so your phone can show MashKey’s in-app notifications, only if you install the mobile app and allow them. Turn them off in your device settings at any time.

Records we are required to keep — legal obligation

The confirmations you give when you add audio to a Voice Kit and when you release a song, and the records needed to answer a copyright notice (DMCA, 17 U.S.C. § 512) or a lawful request.

Who processes it

We do not sell your data and we do not share it for targeted advertising. These are the services that handle it for us:

·Base44 (Wix.com Ltd.) — app hosting, database, sign-in, file storage, realtime jam rooms, push delivery, support tickets, the AI coaches and the help assistant, server-side technical logs and (consent-based) product analytics — United States.
·AI model providers, through Base44 — writing the reply when you use an AI feature: the text you sent (and the image, for a cover check) plus the song context that tool needs; no account data — United States.
·Google LLC — Google Analytics 4 (only after you accept), Google Fonts (receives your IP address and basic browser information to serve the typefaces; no cookies), and Google sign-in if you use it — United States.
·Apple — Sign in with Apple, if you use it; Apple tells us only your name and email — United States.

Your data is processed in the United States. Where personal data leaves the EEA, the UK or Switzerland, our providers rely on the EU-U.S. Data Privacy Framework — and its UK Extension and the Swiss-U.S. Data Privacy Framework — where the company is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses together with the UK Addendum to those clauses. You can ask us for a copy of the safeguards that apply to a particular provider.

How long we keep it

Nothing keeps itself. Each kind of data has a life, and most of it ends when you delete the thing it belongs to, or your account.

Your account and everything you make

While your account exists: your email, name and account type, your profile and creator page, your songs and tracks, your keyboards, vocal presets, setlists, favorites and the counts you see. Deleted with the account, or item by item whenever you choose. Nothing expires behind your back.

Voice recordings, vocals and other audio

A voice recording is personal data, and it is kept no longer than the thing that uses it. A sound in your Voice Kit is kept privately while the keyboard that uses it exists; a vocal take or harmony is kept while the song it belongs to exists. Neither outlives your account. Unpublishing a release, or deleting the song or keyboard that holds a recording, removes it from MashKey — it is not held back in a separate archive you cannot reach.

Rights confirmations

The confirmation you gave for a sound you added, and for a release, stay while the item does — that is what lets a report about it be answered — and go when you delete the item or your account.

Support tickets

Kept so a thread has its history, and removed when you delete your account. Email us to have one removed sooner. An attached screenshot goes with the ticket, and the spam hash exists only while the ticket does.

AI usage counts

While your account exists: one row per AI request, holding which tool was used and when — never what you asked it.

Listening history and play counts

While your account exists, so your history works and the charts mean something. Removed with the account.

Analytics

Google Analytics retention is set to 2 months. Base44’s own product events are kept by our app platform in aggregate, and the one-word record of how you found us lives on your account until you delete it.

Technical logs

Kept by our app platform for a short period, for security and to run the service, then discarded.

Your choices and your rights

Take a copy of everything, yourself, right now: Settings → Account → Download my data writes one file to your device holding your account, your songs and tracks with the audio links that go with them, your keyboards, vocal presets, setlists, favorites, creator page and support history. No request to send, no waiting.

Delete your account and everything in it, yourself, inside the app: Settings → Account → Delete my account, then type DELETE to confirm. That removes your profile and creator page, your songs and tracks, your keyboards and vocal presets, the keyboards you shared, your setlists, your favorites, your support tickets, your listening history and your audio records.

Turn analytics off, or change your mind later: use the cookie banner, the switch in Settings, or the button below at any time. We stop collecting and delete the analytics cookies.

Hide or remove something without leaving: unpublish a song, delete a keyboard you shared, block a creator, or delete an individual recording with its keyboard or song.

Every right you have, and how to use it:

·Access — a copy of everything we hold about you. Download it in the app, or email us and we will send it.
·Correction — fix anything that is wrong. Most of it you can edit yourself: your name, your profile, your songs.
·Erasure — delete your account and everything in it in the app, or ask us to remove one specific thing.
·Restriction — ask us to hold how something is used while a question about it is worked out.
·Portability — one file, straight from the app, that you can take elsewhere.
·Objection — object to anything we do on the basis of our legitimate interests (moderation, security, knowing which of our posts brought players in). We will stop unless we have a compelling reason not to.
·Withdraw consent — analytics and the AI tools only run because you allowed them. Turn analytics off in Settings at any time, and the same switch covers the AI tools’ age check. Withdrawing never affects what happened before you withdrew it.

We answer every request within one month of receiving it. If a request is complicated, or you have made several, we tell you within that month and may take up to two more before we answer.

Complaining: if you think we have something wrong, tell us first — privacy@mashkey.com — but you do not have to. You can complain to your national data protection authority in the EEA, to the UK Information Commissioner’s Office (ico.org.uk) or, in Switzerland, to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of there; Global Privacy Control is honored anyway.

Cookies and analytics

MashKey uses the cookies and local storage it needs to keep you signed in and to remember your theme, keyboard and settings. Analytics cookies are set only after you press Accept analytics — until then the Google Analytics script is not loaded at all, advertising features and ad personalization are off, and Google signals are off. Nothing else that tracks you or embeds another company’s tracker loads before you choose.

In the EEA, the UK and Switzerland, accepting analytics also asks you to confirm that you are 16 or over, or that a parent or guardian agrees. Until that is answered, analytics stays off — and the same answer governs the AI tools.

The full list, with each cookie's name, purpose and lifetime, is in the Cookie Policy.

Keeping it safe

Your account is protected by our app platform's authentication, data access is restricted per account, private files such as ticket screenshots have no public link, and the app is served over HTTPS. MashKey never asks for your password outside the sign-in screen — if anyone asks you for it by email or message, it is not us. No system is perfect, so choose a strong password or use Sign in with Apple or Google, and tell us straight away if you think someone got into your account.

Children

MashKey is not directed to children under 13 and we do not knowingly collect their personal information. You must be at least 13 to create an account, and old enough to consent to this kind of processing where you live; if you are below that age but 13 or older, use MashKey only with a parent or guardian’s permission. If you believe a child under 13 has given us information, email privacy@mashkey.com and we will delete it.

In the EEA, the UK and Switzerland, agreeing to the optional extras — analytics and the AI tools — is something you can only do yourself from 16. If you are 13 to 15 there, those stay off until a parent or guardian agrees: the app asks that plainly, keeps the answer on your device, and it can be changed at any time in Settings → Legal & copyright.

Changes to this policy

This policy changes as the app does. The date at the top always shows the current version, and if a change matters — for example in what we collect or who processes it — it will be visible here before it takes effect. Continuing to use MashKey after a change means you accept the new version.

Contact

Sthetic Creative Group, LLC, 7533 S Center View Ct #6340, West Jordan, UT 84084, USA — the controller for MashKey. If a representative for your region is listed above, you can contact them instead, about anything this policy covers.

·Privacy and data requests: privacy@mashkey.com
·Help and account questions: support@mashkey.com
·Copyright (DMCA) notices and counter-notices: dmca@mashkey.com

Rights, sharing & takedowns Cookie Policy Contact us