Leylines is currently in an open beta. This policy applies now, and we may update it as the product develops and will post changes here.
1. Who we are
Cybermoon LLC, a Colorado limited liability company with its registered office at 1500 N Grant St Ste R, Denver, CO 80203, is the data controller for Leylines. Email is how you reach us: [email protected]. This policy describes what data the Leylines plugin, the Leylines web services, and this website collect, why, and what happens to it.
2. Data we collect
2.1 Email address and sign-in credentials
We collect your email address when you join the waitlist, apply for the beta, buy or are issued a license, or sign in to your account. Your license is tied to this address. You can sign in two ways: with a magic link sent to your email, or with a password you set on your account.
If you set a password, we never store the password itself. We store a salted, heavily iterated one-way hash of it (PBKDF2-HMAC-SHA256), which cannot be turned back into your password. Sign-in links, password-reset links, and email-confirmation links are stored the same way, as a hash of the link's secret rather than the secret itself. They are single-use and expire quickly. We record the IP address that requested a sign-in or password-reset link so we can investigate abuse of those flows.
2.2 Your username and avatar
When you first sign in you choose a username. We store it and show it to people you connect with: in a session, on an invite, and in your friends’ friends lists. It is also the name shown next to your posts on our community forum. It does not have to be your real name, it does not have to be unique, and you can change it at any time from your account page.
Your avatar is not an image you upload. We store a short random string, and both the website and the plugin draw the same picture from it, so no photo of you is ever sent to us or held by us.
2.3 Machine fingerprint hash (activation)
When you activate Leylines on a machine, the plugin computes a one-way hash derived from machine characteristics and sends it to our activation service. We store the hash (not the underlying hardware details) to enforce per-license activation limits and let you deactivate machines from your account dashboard.
2.4 Peer-to-peer connectivity (WebRTC)
Leylines sessions connect peer-to-peer by default. As with any peer-to-peer technology, peers in the same session can see each other's IP addresses. This visibility is mutual and inherent to direct connections. Only join sessions with people you trust. When a direct connection is not possible, traffic may pass through a relay we operate; relay servers forward encrypted traffic and are not a listening point for your audio content. We log limited connection metadata (timestamps, coarse data volume, and your license identifier) to operate relays, enforce usage limits, and prevent abuse. We do not log or listen to the content of your audio.
2.5 Optional cloud chunk storage (Cloud tier)
If you use the optional Cloud tier, audio chunks from your sessions are stored with our storage provider so offline collaborators can catch up. Paid Cloud subscriptions are not offered during the beta.
Your Cloud data is deleted when you ask us to delete it. During the beta that request is handled by our support team: email [email protected] and we remove your uploaded chunks. A self-serve control in your account dashboard is being added during the beta and will do the same thing without the email. We also delete Cloud data on our own schedule: while your Cloud access is valid we do not delete any of your Cloud audio, and if your Cloud access ends we keep it for 90 days from the day it ended and then delete it. Cloud data that no longer belongs to any account is deleted 90 days after it becomes ownerless. If you have bought a license from us, we do not delete your Cloud audio on this schedule at all.
In the account audio library, recordings belong to the contributor's account. Project membership controls who can read shared recordings; plugin instance and recording epoch identifiers preserve their origin. Deleting a shared project or leaving it keeps your personal library copy. Removing a library item removes your personal reference; bytes still used by a shared project remain until its references are removed. Account erasure removes your recordings and references, including shared copies. The access and retention rules above still apply; a library copy is not a promise of unlimited free storage. Temporary upload copies are removed after their short upload authorization expires.
If you explicitly allow an older recording to upload, we keep that permission assertion with the recording's exact version identifier and your account as the asserting account and storage payer. Its original contributor remains unknown. This assertion does not verify who recorded the audio or establish legal ownership. It follows the same access, deletion, and retention rules as the associated recording.
A planned, currently unavailable interrupted-upload recovery feature records your account and project, the exact recording version and byte fingerprint, the original selection revision, random upload identifiers, and the original upload deadline. These let us resume the same upload without restoring a recording you deleted. Attempt records are removed when their deadline or authorization ends, or when the account is erased. The additional byte fingerprint is cleared when its storage object is retired. Existing upload authorization windows and deletion safeguards still apply. This metadata does not establish who recorded the audio.
A planned, currently unavailable derived-recording feature lets a creator declare which exact cloud recordings they used. Its metadata records the output version and byte fingerprint, the creator and storage-payer account, an operation identifier, the declared source versions and their bounded relationships, whether other inputs are unknown, and update revisions. Contributor names are resolved when an authorized person views a source, rather than saved in that relationship metadata. Erasing a source removes its identifying details and leaves an anonymous source-unavailable relationship; independent derived audio remains. This does not verify recording ownership or how audio was processed, grant access to a source, or remove files someone already exported.
2.6 Payments
Payments are processed by Paddle, our reseller of record. We receive transaction metadata (amount, product, billing country) but never see or store your full card details.
2.7 Website & diagnostics
Today this website runs no third-party analytics or advertising tags, and sets no advertising cookies. Our host collects aggregate, privacy-preserving traffic metrics. We may add analytics or advertising measurement in future, including a social-platform measurement tag. If we do, we will name the provider in the subprocessor list in section 4 and update this section before it goes live, and where the law requires consent for it we will ask you first. Server logs are retained for a short period for security and debugging.
The Leylines plugin includes optional crash reporting that is off by default and only sends data if you turn it on in the plugin's settings. When enabled, a crash report contains the same one-way machine-fingerprint hash described in section 2.3, a stack trace of where the plugin crashed, and the product name, plugin version, and operating system. It does not include your audio, session content, or the underlying hardware details behind the hash. We keep crash reports for as long as we need them to diagnose and fix the crash and to see whether it comes back.
The plugin also includes an optional bandwidth statistics report that is likewise off by default and only sends data if you turn it on. When enabled, it reports every few minutes: a scrambled session identifier (a one-way salted hash of the session code, never the code itself), whether the connection went direct or through a relay, the number of bytes sent and received, how many people were connected, and the start and end time of the reporting period. That is the complete list. It contains no audio, no session content, no file or track names, no IP address, and no machine fingerprint, and it is not linked to your account or licence. We use it only to measure how much session traffic needs a relay, so we can size and price that capacity. These reports are deleted after 90 days.
2.8 Beta application answers
If you apply for the beta, we store the answers you give on that form: which DAW you use and, if you choose “something else”, the name you type; what you produce on (Windows, Linux or macOS); what you tell us you produce and are working on, which is a free-text box of up to 1000 characters; how many people you make music with; whether any of them would install it too; how you heard about Leylines; and whether you agreed to be asked for feedback. We also record that you ticked the early-beta acknowledgement, so that your agreement to it is evidenced rather than assumed.
Confirming your email records your beta application. Invites are issued as daily capacity allows; an application may wait in the queue. A new submission before confirmation replaces the pending answers. Once confirmed, retries resume the recorded application rather than creating another record or silently changing its answers.
We use these answers to understand who is testing Leylines and to prioritise what we build, and for nothing else. They are not sold, not shared, and not used for advertising or ad measurement. They are kept while the beta programme runs; there is no automatic deletion schedule for them yet, so if you want yours removed sooner, email [email protected] and we will delete them.
After confirmation, we keep a progress receipt containing your email, confirmation time, application and invitation status, and a one-way hash of the confirmation token. This lets an interrupted confirmation resume without issuing another license. The token keeps its original 24-hour expiry. A temporary copy of your answers is removed from the receipt when the application is allocated an invite or a queue place; the application answers described above remain in the application database. Email retry content is removed once the provider acknowledges it. An unfinished receipt or unresolved email retry is retained for recovery, under the same beta-programme removal policy above. Account deletion removes these receipts and retry content as well.
To stop an interrupted confirmation from restoring deleted information, we retain a random operation identifier and a cleanup deadline after account deletion. This marker contains no email, account identifier, answers, confirmation token or email content. It becomes eligible for cleanup one hour after the latest original confirmation-link expiry; later confirmation processing removes expired markers in bounded batches. If cancellation cannot be recorded, deletion is shown as incomplete and your account remains available so you can retry.
2.9 Applications you have not confirmed yet
When you submit the beta form we do not store your application straight away. We hold your email address and your answers in a temporary record and send you a link asking you to confirm the address is yours. This is so that nobody can put someone else’s email address into a public form and have us store their details, or send them mail they never asked for.
If you click the link, that temporary record becomes a real application, and section 2.8 describes what happens to it from then on. If you do not click it, the temporary record is deleted automatically within 24 hours and nothing about you is kept. You do not need to ask us, and there is nothing you need to do.
While it exists, that record is used for one thing only: sending you the confirmation link and, if you click it, creating your application. It is not read for any other purpose, not shared, and not used for advertising.
3. How we use data
- Deliver and activate your license.
- Operate session connectivity, relays, and optional cloud sync.
- Send transactional email (receipts and magic sign-in links).
- Prevent fraud and enforce license limits.
- Internal operations reporting: we compile the data described in section 2 into a daily summary for our own operations team (for example, which accounts were recently active and aggregate usage counts). This stays inside Cybermoon and its email subprocessor and is never shared further.
- Understand who is testing Leylines and prioritise what we build, from the application answers described in section 2.8.
- Send you beta announcements and, if you opt in, occasional product updates. Every non-transactional email has a one-click unsubscribe. We do not sell your personal data.
4. Subprocessors
We share data with the following service providers:
- Cloudflare: hosting, edge network, and cloud storage.
- Paddle: payment processing and tax as reseller of record.
- Resend: transactional email delivery.
Each subprocessor is bound by a data-processing agreement and processes data only to provide its service to us.
5. Data retention
Account and license records are kept while your account exists. Stopping your use of Leylines does not delete your account and does not delete anything attached to it: your account record, purchase history, license records, activated machines and their names, and any forum posts all stay, so that coming back works and so that we keep the transaction records we are required to keep. We do not delete your data because you have been away.
A machine’s name starts as the computer name the plugin reads from that machine, which often contains a person’s own name. We never delete it on a schedule, and you can change or remove it yourself at any time from the license page in your account dashboard. Once you do, the plugin no longer overwrites it. Removing a name does not free that machine’s seat and does not change your license.
The one thing of yours we delete on a schedule is your Cloud-stored audio. If you have bought a license from us, we never delete it on a schedule. Otherwise: while your Cloud access is valid nothing is deleted, and once your Cloud access ends we keep your Cloud audio for 90 days from that day and then delete it. Cloud audio that no longer belongs to any account is deleted 90 days after it becomes ownerless. If we cannot tell whether your Cloud access is still valid, we keep the audio.
Two pieces of shared-project housekeeping are also deleted on a schedule, and neither is your audio. A project invite link stops working after an hour; we delete the record of it 30 days later. The project activity log, which records who invited whom, who joined and who was removed, is kept for one year and then deleted. Both exist so that a dispute about who had access can be answered, and both are deleted straight away if you ask us to erase your data under section 6.
You can delete your account and its data at any time from your account dashboard. If you ask us to erase your data under section 6, we do not wait for those 90-day windows: we delete everything we hold about you straight away, and your account record itself is deleted last, after the data attached to it is gone. Cloud-stored audio chunks follow section 2.5. Server logs are retained for a short period.
6. Your rights
Wherever you live, you may request access to, correction of, export of, or deletion of your personal data by emailing [email protected]. We will respond within the timeframes required by applicable law.
7. Security & breach notification
We use industry-standard measures to protect data in transit and at rest. If a breach affects your personal data, we will notify affected users and regulators as required by law. Report suspected security issues to [email protected]. We will notify affected users and regulators within the timeframes required by applicable law.
8. Children
Leylines is not intended for anyone under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us data, contact [email protected] and we will delete it.
9. Changes to this policy
We will post changes here and update the "Last updated" date. Material changes will be announced by email where required.
10. Contact
Privacy questions: [email protected].