Uki makes a music app for people who want to own their music. This policy explains what we collect, why, who we share it with, and the choices you have. Uki is operated by Open Shore, LLC (“Uki,” “we,” “us”).
The short version
- We collect only what's needed to run your account, your library, and your purchases.
- We don't sell your data, run ads, or track you across other apps.
- Your music and listening data are yours: export everything or delete your account anytime.
Who can use Uki: age policy
Uki is intended for a general audience but is not directed to children under 13. You must be at least 13 years old (or the minimum age of digital consent in your country, if higher) to create an account or use account-based features.
- If you are under the age of majority where you live (often 18), you may use Uki only with the involvement of a parent or legal guardian, who is responsible for any purchases made.
- In the EEA and UK, where local law sets a higher minimum age for consent to data processing (up to 16), you must meet that age or have verifiable parental/guardian consent.
- We do not knowingly collect personal information from children under 13. If we learn we have, we will delete it. If you believe a child under 13 has given us data, contact us (below).
Information we collect
Account information
Your email address, and a securely hashed password if you choose password sign-in. We assign you an account identifier. Authentication is provided by Supabase.
Your library and content
Music you capture, import, or collect; album metadata and cover images; mixtapes; wishlists; and notes you add. Audio you upload or collect is stored in our cloud storage so it can sync and stream to your devices. If you use record identification, the photo you take of a cover is sent to our assistant service to identify the release.
Purchases
Records of what you own and your order history (amounts, dates, artist payouts, status). Payments are processed on the web by Stripe; we never receive or store your full card number.
Usage data
Play events and counts, radio listening sessions and subscriptions, and preferences, used to power features like recommendations and to sync your experience across devices. Not used for advertising.
Assistant (“Spin”) interactions
When you use Spin, we send your prompt and relevant context (such as references to tracks in your library, and any image you provide) to our assistant relay, which uses Anthropic's Claude model to respond. You can opt into an on-device assistant that runs entirely on your device and sends nothing to us.
Diagnostics
If the app hits an error we may send a crash/error report (message, stack trace, page, device/browser type) to our error-monitoring provider (Sentry). Reports are sampled and fingerprint-normalized to strip identifiers.
Optional connected services
If you connect Dropbox or Google Drive to import music, we access only the files you choose (and, if you enable mirroring, write copies back to a Uki folder). Access tokens are encrypted on your device. You can disconnect at any time.
What we do NOT do
- No third-party analytics or advertising SDKs (no Google Analytics, Mixpanel, ad networks).
- No tracking of you across other companies' apps or websites.
- No selling or renting of your personal data.
Cookies & storage
We keep cookies to a minimum. We use only essential cookies (sign-in, secure checkout, and bot protection) plus optional analytics you control. We set no advertising cookies and do no cross-site tracking. Full details, and how to control them, are in our Cookies & Storage policy.
Our website also records anonymous, aggregate event counts, such as page views and button taps, with no cookies and no identifiers. Cloudflare provides a coarse country from your IP address. This tells us, in aggregate, which pages resonate. It never identifies you.
How we use information
- Provide and sync your account, library, purchases, and settings across devices.
- Process purchases (via Stripe) and record ownership.
- Power features you invoke (the Spin assistant, recommendations, radio).
- Keep the service reliable and secure (diagnostics, abuse/rate-limiting).
- Communicate with you about your account.
Our lawful bases, by purpose. We process your account, library, purchases, and settings to perform our contract with you. We rely on your consent for optional analytics in the app, which you can withdraw anytime in Settings. We rely on our legitimate interest to keep the service secure and reliable, to prevent fraud and abuse, and to understand, in aggregate, which pages resonate. Where the law requires it, we process data to meet legal obligations (for example, tax and accounting).
Who we share information with
We share data only with providers that process it on our behalf:
- Supabase: authentication and database hosting.
- Cloudflare: storage and backend workers (assistant relay, radio proxy, error relay).
- Stripe: payment processing (handles card data directly).
- Anthropic: powers the Spin assistant when you use its cloud mode.
- Sentry: error monitoring.
- Dropbox / Google: only if you connect them, only for files you choose.
Metadata lookups (Discogs, MusicBrainz, Cover Art Archive) and radio stream providers receive no personal data, only anonymous queries or stream URLs.
Data retention
We keep your data while your account is active. When you delete your account, we delete your audio files and remove your account; associated records are deleted or de-identified. Some records may be retained where required for legal, tax, or fraud-prevention reasons.
Your rights and choices
- Export: a complete machine-readable copy of your library, metadata, receipts, and play history.
- Delete: remove your account and audio in-app (Settings → Account → Delete account).
- Depending on where you live (e.g. EEA/UK under GDPR, California under CCPA/CPRA), you may have rights to access, correct, delete, or port your data and to object to or restrict certain processing. We do not “sell” or “share” personal information as defined under California law. Contact us to exercise these rights.
- Complain: if you are in the EEA or the UK, you have the right to lodge a complaint with your local data protection authority, for example the UK Information Commissioner's Office (ICO).
Security
Passwords are hashed; connected-service tokens are encrypted on your device; data in transit is encrypted (HTTPS). No system is perfectly secure, but we work to protect your information.
International transfers
We use providers that may process data in other countries, including the United States. Where personal data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (SCCs), and the UK Addendum where applicable, as the transfer mechanism.
Changes to this policy
We'll update this policy as the app evolves and post the new date above. Material changes will be communicated in-app or by email.
Contact
Questions or requests: support@uki.audio.
Open Shore, LLC
8914 15th Ave NE
Seattle, WA 98115
United States