Privacy Policy

Hooka needs an account so we can give you credits and run generations in the cloud. We store only what that requires.

1. Controller

See Legal Notice for full contact details.

2. What We Store and Why

Account

• Email address, an internal account ID, sign-up, activation and sign-in timestamps — to create your account, send activation links and sign-in codes, and let you sign in inside the plugin. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Credit balance and records of credits added (e.g. the feedback bonus) — to run the free credit allowance. Legal basis: Art. 6(1)(b) GDPR.
• Sign-ups from disposable email domains are blocked to protect the free allowance from abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Generations

• For every generation we store the musical settings you chose (key, scale, progression, rhythm and other options), the generated MIDI data, technical metadata (model, duration, errors) and, if you give one, your rating or comment on the take. We use this to charge credits correctly, keep your history, fix errors and improve output quality. Legal basis: Art. 6(1)(b) GDPR; for quality improvement, legitimate interest (Art. 6(1)(f) GDPR).
• To generate a melody, our server sends only the musical settings to an AI model provider. Your email address and account ID are not sent.

Feedback

• If you send feedback from the plugin, we store your message, your email address, the Hooka version and your operating system, so we can reply, reproduce bugs and add bonus credits. Legal basis: Art. 6(1)(b) and (f) GDPR.

Product News (Optional)

• If you tick the checkbox at sign-up, we also email you occasional product news and offers. We store the checkbox state and its timestamp as proof. Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it anytime without affecting your account.

Website, Downloads and Server Logs

When you visit this site or download Hooka, our hosting providers process your IP address and technical request data (time, path, browser) to deliver the pages and files and to protect against attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). These logs are deleted by the providers according to their own retention schedules. Fonts and scripts are served from our own domain; no third-party font or CDN requests are made.

3. What We Don't Do

• No analytics or advertising cookies, no tracking pixels.
• No selling or sharing of your email with third parties for their own purposes.
• No automated decision-making or profiling with legal effect.

4. Recipients / Processors

• Supabase (database, authentication, serverless functions; EU region) — stores account, generation and feedback data and sends sign-in emails.
• Resend (email delivery) — delivers transactional emails. Processing may occur in the US under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.
• Cloudflare (website hosting and download storage) — processes request data to deliver pages and files. Processing may occur in the US under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.
• OpenRouter (AI request routing) and Google (Gemini API, the AI model OpenRouter forwards to) — receive only the musical settings of a generation, no personal data. Processing occurs in the US.

5. Retention

• Account, generation and feedback data are stored as long as your account exists.
• When you delete your account (in the plugin's account settings or by email), your account and the generations linked to it are deleted. Feedback messages you sent (including the email address in them) are kept to work on reported bugs; email us and we delete them as well.
• Data we must keep for legal reasons is kept only for the statutory period.

6. Your Rights

Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and to withdraw your consent at any time (Art. 7(3)) — the lawfulness of processing before withdrawal is not affected.

Send an informal email to hello@gethooka.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

7. Contact

Privacy inquiries: hello@gethooka.com