Privacy policy.

Who we are

IronLabs Tech makes Auralyn and runs ironlabstech.com and the IronLabs Tech account service. We are based in Winnipeg, Manitoba, Canada.

Privacy contact: the owner of IronLabs Tech, at support@ironlabstech.com. Send questions and requests about your information to that address; we handle privacy requests by email.

The short version

• Auralyn plays the music and video on your computer. It never uploads your media files, your library or your listening history.
• You can try Auralyn for 14 days without an account or a card, once per computer.
• An account holds your name, your email address, how you sign in (a one-way hash of your password, your Google account ID, your passkeys' public keys), your licences and the computers you activated.
• Payments are processed by Stripe. We never see your full card number.
• No advertising, no selling or renting of your information, and no tracking cookies. The website counts visits with Cloudflare Web Analytics, which uses no cookies.
• You can download a copy of what your account holds, or delete the account, from the account page.

Your IronLabs Tech account

An account keeps your licence keys, your computers and your billing in one place, in Auralyn and on this website. You can also activate Auralyn with a licence key and no account. When you have an account, we store:

• Profile. Your name and email address, whether and when you confirmed the email, and when you created the account.
• Password. Only a salted one-way hash (PBKDF2-SHA256). We cannot read your password. An account made with Google has no password until you add one.
• Google sign-in. If you continue with Google, Google tells us your Google account ID, your email address, whether Google has confirmed it, and your name. We store the Google account ID to recognise you next time; a new account takes its name and email from Google. We ask Google for nothing else (the "openid email profile" permissions): no contacts, files or other Google data. You can disconnect Google under Account → Security.
• Passkeys. For each passkey you add: its public key and ID, a counter that helps detect copied passkeys, the ways your device said it can be used (such as USB or built-in), whether it syncs between your devices, the name you give it, and when it was added and last used. The private key stays on your device or in your password manager; we never receive it, or your fingerprint or face.
• Two-step login. If you turn it on, we store the secret your authenticator app shares with us, encrypted, the time you turned it on, and the last code used so it cannot be used twice. Recovery codes are stored only as one-way hashes, with whether each was used.
• Sign-ins. Each sign-in starts a session. We keep a hash of its token, whether it is the app or the website, how you signed in (password, Google, passkey, or the website for Auralyn's "Sign in with the browser"), short labels for the browser and system (such as "Safari" and "macOS", never the full browser description), the approximate country, and when it started, was last used and expires. The country comes from our network provider, Cloudflare, which works it out from the IP address; we do not store the IP address with it. App sessions last up to 180 days and renew while you use them; website sessions last 30 days. You can see your sessions under Account → Security and sign out of any one of them, and "Sign out everywhere" ends all of them.
• Account activity. A list of recent changes, shown under Account → Security so you can spot anything you did not do: sign-ins, computers activated, password, email, two-step login, passkey and Google changes, each with the time and the same short labels as a session. Entries are deleted after 90 days.
• Avatar and member number. Your avatar is a pattern drawn from your account ID; we store only the number of the pattern you chose. We do not take or store photos. Each Lifetime licence bought is given a member number in order of purchase (the first 1,000 are "founding members"), shown on your account page and in Auralyn.
• Email codes. To confirm your email, reset your password or change your email, we email you a one-time code. We store it as a hash; it works for 15 minutes and is deleted once used or expired.
• Licences. The plan and its status, the licence key, the email address used at checkout, the renewal or end date, the versions it covers, the device limit, and Stripe's reference numbers for the purchase (customer, subscription, checkout and payment IDs).
• Computers. When you activate Auralyn: a random ID that Auralyn creates for that installation (not a hardware serial number), a device name ("Mac" or "Windows PC" unless you rename it; we never read your computer's name), the platform, the Auralyn version, and when it was activated, last checked in and deactivated.
• Activation attempts. Each time a computer tries to activate a licence, whether or not it succeeds: a one-way hash of that installation's random ID (never the ID itself), the approximate country and the time. The country comes from Cloudflare, as for sign-ins; we do not store the IP address with it. We use these records only to spot licence keys being shared, and delete them after 90 days. If many different computers are turned away from one licence, we may email the licence owner about it.
• Security records. To slow down password guessing and abuse, we count recent attempts per IP address and per email address. Counters for an email address use a one-way hash, never the address, and no record holds a readable IP address next to an email. After you sign in, we remember a hash of that IP address for 30 days so other people's failed guesses do not lock you out there. We also remember a one-way hash of your account with the browser, system and country labels of each sign-in for 30 days, so we email you only about sign-ins from somewhere new. These records are deleted automatically within about a month.

On this website

The pages of ironlabstech.com are static. They set no cookies, run no advertising, and apart from Cloudflare's visitor-count script, load no scripts or fonts from other companies. Our web host, Hostinger, keeps standard server logs of requests, such as the IP address, the date and time, the page requested and the browser type. Hostinger keeps these logs for a short period for security and troubleshooting.

We count visits with Cloudflare Web Analytics. Its script sets no cookies and stores nothing in your browser. For each page you view it sends Cloudflare the page address, the page you came from, your browser and device type, and how fast the page loaded. Cloudflare says it discards your IP address at its nearest data centre and does not use it to follow you. We see only totals, such as page views, countries, browsers and the sites visitors came from.

The account page (ironlabstech.com/account/) is where you sign in. Its forms send what you type to our account service at api.ironlabstech.com. When you sign in, the account service sets one cookie, ironlabs_session, which keeps you signed in. It is needed for the account page to work, is not used for tracking, lasts up to 30 days and is removed when you sign out. While you continue with Google, a second cookie, ironlabs_google, links the page you left to Google's answer; it lasts 10 minutes and is used for nothing else. When Auralyn opens the account page to sign in, the page keeps Auralyn's one-time sign-in request in your browser's session storage until you finish or close the tab; after 15 minutes it is ignored. The account page stores nothing else in your browser.

The cart and checkout pages (ironlabstech.com/cart/ and /checkout/) use the same sign-in and the same cookie. To keep your order between pages, they save the plan you chose in your browser's session storage. When you continue to payment, they also save the time and the IDs of the licences your account already has, so the page you return to after paying can tell which licence is new. Session storage belongs to that browser tab and is cleared when you close the tab.

When you buy

Checkout is run by Stripe. Auralyn is sold through Stripe Managed Payments, so the checkout page says "Sold through Link": Link, a Stripe service, is the merchant of record. It takes your payment, works out and collects sales tax, and sends your receipt. Stripe and Link collect your name, email, billing address, payment details and tax location under their own privacy policies: Stripe's privacy policy and Link's privacy policy, which covers purchases sold through Link.

The first time you continue to payment, our account service creates a customer record at Stripe with your account's name, email address and account ID, so the purchase can be matched to your account. This happens before you pay, so it also happens if you leave checkout without paying.

We never see your full card number. In our Stripe dashboard we can see your name, email address and billing address, your card's brand and last four digits, and your purchase and subscription history: what you bought, the amounts and tax, and the status of payments, renewals and refunds. Our account service stores only what is listed under Licences above. We use this information only to deliver your licence, handle refunds, cancellations and support, and keep the business records the law requires.

Monthly plans are managed on Stripe's billing page (Manage billing, in your account or in Auralyn), where you can update your card, see invoices and cancel.

Emails we send

The account service sends these emails from accounts@ironlabstech.com through Resend: the code to confirm your email, the code to reset your password, the code to confirm a new email address, your licence key after a purchase, and security emails. A security email tells you about a sign-in from a browser or computer your account has not used in the last 30 days, a new computer activated, and changes to your password, email address, two-step login, recovery codes, passkeys or Google sign-in, with the time, browser and system labels and approximate country. Security emails cannot be turned off, because they protect your account. All of these are sent without open or click tracking. Apart from these, we email customers only about changes that affect them: a new Monthly price, at least 30 days before it applies, and significant changes to the Terms of sale and use or this policy. If you join the beta or the launch list (below), we send you a confirmation from the same address, and later only the emails that sign-up is for.

News and offers, only if you ask. We email news about IronLabs Tech products, and offers such as discounts for Auralyn owners, only if you turn them on: each has its own switch under Account → Email preferences (also in Auralyn's Settings → Account), and both start off. When you create an account you can also tick an unticked box, "Email me about IronLabs Tech products and offers", which turns both on. We keep the date you turned each one on, and a record of each time you turned it on or off and how (when you created your account, on the account page or in Auralyn, with an email's unsubscribe link, or by deleting your account). Every such email says who it is from, gives our mailing address and has an unsubscribe link; mail apps that offer their own one-click Unsubscribe button use it too. You can also turn the switch off anytime. We then stop sending them right away, and at the latest within 10 business days.

Stripe and Link send their own receipts and billing emails. When you write to us, we receive what you send at our Hostinger mailbox and use it only to help you. We keep support emails for 2 years after your last contact with us.

Beta sign-up

If you sign up to test Auralyn on our beta page, we collect your email address, the date you ticked the box asking us to email you about the beta and, if you choose to enter them, your name and your Mac model. We use them only to invite testers and to email you about the beta. They are stored on the IronLabs Tech account service, which runs on Cloudflare, and are not linked to any account. We do not store your IP address with them; to stop abuse, the service briefly counts sign-up attempts using a one-way hash of the IP address and of the email address, and deletes those counts within about a month. We keep your details for 18 months after you last sign up, then delete them automatically, or sooner if you email support@ironlabstech.com and ask.

Launch list

If you ask us to email you when Auralyn goes on sale, we collect your email address, the date you ticked the box, and which plan you were looking at, if any. We use them only to send you a confirmation now and one email when Auralyn goes on sale. They are stored on the IronLabs Tech account service, which runs on Cloudflare, and are not linked to any account; the emails are sent through Resend. We do not store your IP address with them; to stop abuse, the service briefly counts sign-up attempts using a one-way hash of the IP address and of the email address, and deletes those counts within about a month.

Each email has a link that removes you from the list at once. Otherwise we delete your details 30 days after the launch email, and at the latest 18 months after you last signed up. You can also email support@ironlabstech.com and ask.

In Auralyn

Your library, playlists, listening and viewing history, recommendations and smart playlists are stored and worked out on your computer. Auralyn has no advertising and sends no usage analytics. Any online request shows the service you reach your IP address. This is what each online feature sends:

You can turn lyrics, artist information and movie and TV information off in Settings → Privacy → Online lookups.

Free trial. The trial is one per computer. So that reinstalling Auralyn does not start a new one, the account service remembers when each computer's trial began. It receives only a one-way code made from the computer's hardware ID, which cannot be turned back into that ID, and stores it scrambled again with a key only our server holds. No account, name or email is involved. If you are offline at first launch, the trial is counted on your computer and checked later.

Your cloud accounts. The sign-in for Google Drive, Dropbox, OneDrive, Box and Plex is kept encrypted on your computer. Your files and sign-ins go directly between your computer and those services, never through IronLabs Tech's servers, and we cannot see them. Disconnecting removes the sign-in from your computer and, for Google Drive, Dropbox and Box, asks the service to end Auralyn's access. Microsoft offers apps no way to do that for OneDrive, so remove Auralyn from your Microsoft account's app permissions if you want its access ended there too. You can also remove Auralyn's access from your Google, Dropbox, Microsoft, Box or Plex account settings.

Google user data. Auralyn asks Google only for access to the files you pick for it in Google's file picker (the drive.file permission), never the rest of your Google Drive, and uses that access only to list and play the music and video you picked. It uses that data for nothing else, does not use it for advertising or to train AI models, does not sell it, and never sends it to IronLabs Tech's servers or to the optional online AI. Auralyn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Signing in from Auralyn. You can sign in inside Auralyn with your email and password (and your two-step code, if it is on), or choose "Sign in with the browser" to use Google, a passkey or your password on this website. Auralyn then opens the account page with a one-time request; once you are signed in there, the page hands Auralyn a one-time code that works for 2 minutes and only with a secret that never leaves your copy of Auralyn. Your Google or passkey sign-in happens in your browser; Auralyn receives only its own session.

Your listening stays on your computer. Play counts, hours listened, your top songs and artists and any yearly summary are worked out by Auralyn from the history on your computer. None of it is sent to IronLabs Tech or shown on your account page.

Licence checks. A Lifetime licence works offline once it is activated; when online, Auralyn checks it at most once a week. A Monthly licence checks in at least every 30 days, with 14 more days of grace if your computer is offline. Each check sends the details in the table above, so we can confirm the licence is still valid and update "last checked in" for that computer.

Crash reports. Auralyn sends a crash report only if you say yes: at first launch, in Settings → Privacy (Ask after a crash, Send automatically or Don't send), or in the message it shows after a crash, where "Show what's sent" shows the report exactly as it would go. A report holds what went wrong and which versions you have, as in the table above. Auralyn removes file names, paths, email addresses and keys before it saves a report, and our server checks again before keeping it. We do not store your IP address with a report or link it to your account, licence or computer. Until a report is sent it stays on your computer, and Don't send deletes it. We use reports only to find and fix crashes.

Logs and diagnostics. Auralyn's logs, and the memory files (minidumps) a crash leaves on your computer, stay there and are never uploaded. Help → Export Diagnostics saves a text file (versions, settings, library counts and logs with file names, paths and email addresses removed); we receive it only if you choose to send it to us.

Why we use your information

• To create and run your account and keep it secure, including sign-in with Google, passkeys and two-step login, showing where you are signed in and what changed recently, and emailing you about security changes.
• To deliver your licence, activate your computers and check that the licence is valid.
• To process purchases, renewals, refunds and cancellations, with Stripe.
• To send the emails listed above and answer your questions.
• To send news and offers, only if you asked for them.
• To keep the free trial to one per computer.
• To find and fix crashes, from the crash reports you choose to send.
• To prevent fraud and abuse, and to keep the records that tax and other laws require.

We do not sell or rent your information, use it for advertising, or share it except with the providers below and where the law requires.

Who handles your information for us

The lookup services in the app (LRCLIB, Wikipedia, MusicBrainz, Wikidata, Wikimedia Commons and TVmaze) receive only what the table under "In Auralyn" says, and only while those features are on. Google, Dropbox, Microsoft, Box, Plex, Hugging Face, OpenRouter and any AI provider you choose are not our providers: you connect them yourself, and they handle your information under their own privacy policies.

We are in Canada, and these providers store and process information in the places listed above, so your information may be kept outside the country where you live and is then subject to the laws there.

How long we keep it

• Your account stays until you delete it.
• Sessions end after 30 days on the website and 180 days without use in the app, and email codes after 15 minutes. Expired ones are deleted every day.
• Sign-ins in progress (a Google sign-in, a passkey request, a two-step code wait or Auralyn's browser sign-in) last 2 to 10 minutes and are deleted once used or expired.
• Account activity is deleted after 90 days.
• Activation attempts are deleted after 90 days.
• Crash reports are deleted after 90 days.
• Google sign-in, passkeys and two-step login stay until you remove them or delete the account.
• Security records are deleted within about a month.
• Website server logs are kept by Hostinger for a short period for security and troubleshooting.
• Support emails are kept for 2 years after your last contact with us.
• Free trial records (the one-way computer code and its dates) are kept for 3 years after the last request from that computer.
• Your agreement to news and offers (the record of each time you turned them on or off, and how) is kept while that email list is on, and for 3 years after you last turned it off or deleted the account, as proof of what you agreed to.
• Payment records are kept by Stripe under its own policy and the law. We keep Stripe's reference numbers for each purchase for 7 years for tax and accounting, and longer while the licence bought with it still exists (see below).
• Backups: our database provider, Cloudflare, keeps restore points of the account database for up to 30 days, so deleted information can remain in them for up to 30 days.

When you delete your account, any renewing plan is cancelled at the end of its paid period, you are signed out everywhere, and we delete your name, email address, password hash, sessions, pending codes, Google sign-in, passkeys, two-step login and recovery codes, account activity, email choices and avatar. The record of your email consent is kept as described above. We keep the licence and computer records without your name or email for as long as the licence exists, because copies you already activated need them: a Lifetime copy keeps working offline. Those records still hold the licence key, its plan and status, Stripe's reference numbers for the purchase, and each computer's random ID, platform, version and dates.

Your choices and rights

• See and download your information: Account → Privacy and data → Download my data gives you a file with your profile, sign-in methods (never their secrets), licences, computers, sessions, account activity, email choices and their history, and pending email codes. The security records described above are not in it; they are deleted within about a month.
• Correct it: change your name, email address and password in your account or in Auralyn's Settings → Account.
• Delete it: Account → Privacy and data → Delete account, or in Auralyn's Settings → Account.
• Control your computers and sign-ins: deactivate or rename a computer, sign out of one session or everywhere, add or remove passkeys, connect or disconnect Google, and turn two-step login on or off.
• News and offers: turn either switch off under Account → Email preferences or in Auralyn's Settings → Account, or use the unsubscribe link in any such email.
• In the app: turn off online lookups and automatic update checks, choose whether crash reports are sent, disconnect Google Drive, Dropbox, OneDrive, Box and Plex, turn off the online AI, and pause or reset listening history.

For anything else, such as a question about what we hold, email support@ironlabstech.com. We answer within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the privacy authority where you live.

If you are in the EU or UK

Under the EU and UK data protection law (the GDPR), IronLabs Tech is the controller of the information described in this policy that we hold: your account, licences, computers, crash reports you send, our account emails and your messages to us. Stripe and Link are responsible for what they collect at checkout, under their own privacy policies.

We rely on these legal bases:

• To provide what you asked for (our contract with you): creating and running your account, delivering your licence, activating your computers and checking the licence, purchases, renewals, refunds and cancellations, and the emails described under "Emails we send".
• With your consent: news and offers by email, and crash reports from the app. You can withdraw it anytime, as above.
• To meet legal obligations: keeping payment, tax and accounting records.
• For our legitimate interests in keeping our service secure and working and in helping you: security records and rate limits, session labels, account activity and security emails, preventing fraud and abuse (including licence keys being shared), keeping the free trial to one per computer, website server logs, and answering your messages.

You have the right to access your information, correct it, delete it, receive it in a portable file (Download my data gives you one), and restrict or object to how we use it. Email support@ironlabstech.com and we will answer within 30 days. You can also complain to the data protection authority where you live or work, such as your country's supervisory authority in the EU or the Information Commissioner's Office in the UK (ico.org.uk).

Security

Passwords, session tokens, email codes and recovery codes are stored only as hashes, and two-step login secrets are encrypted. You can add passkeys and two-step login for stronger sign-in. Auralyn and this website reach the account service only over HTTPS, and sign-ins and codes are rate-limited. Licences are signed so they can be checked offline. No system is perfectly secure; if a breach affects your information, we will tell you and the authorities as the law requires.

Children

You must be at least 16 to create an account. We do not knowingly hold information about anyone younger.

Changes

We will update this page when Auralyn, the account service or this website changes how it handles information, and change the date at the top. If a change is significant, we will also email our customers about it.

Contact

Email support@ironlabstech.com.