Privacy Policy

SunoSync is a backup tool. It reads your Suno library and writes it to your disk. This page says what it keeps in the middle, which is very little, and how to have that deleted.

Who holds it

The data described here is held by SunoSync, operating from Vietnam, at hello@sunosync.com. We are the controller of it, and that address is where every request about it goes.

What we store

• Your email address — the whole of your account, and where the sign-in code goes. If you sign in with Google instead, that address is what Google tells us, and it is the only thing we ask Google for: no name, no picture, no contacts. An address Google has not verified is refused rather than stored.
• The export jobs you have run: when, how far they got, what settings, and the error if one failed.
• Your Pro status and payment records: which provider, the provider's reference, the amount and the date.
• Short-lived sign-in and pairing codes, stored hashed, with the IP address that asked for them so a code cannot be guessed at scale.
• For each browser you have connected the extension from: the browser it reported itself as, when it paired, when it was last used, and the IP address it paired from. You can see this list on your Connect page and sign every browser out from it. We do not look the address up anywhere, so we do not learn a place from it.

We do not build a profile, we do not sell anything to anyone, and there is no advertising on this site.

Your Suno session

Your Suno session credential is used to read your library and is held only for as long as a running export needs it. It is never shown in the interface, never written to a log and never shared. It expires on Suno's side in about a minute, and it is deleted when the job ends.

Your exported files

Exported files are yours. Audio, artwork and video go straight from Suno's servers to the folder you picked — those files never pass through us. Where a job produces something on our side for you to download, it is deleted after the retention window shown on the job.

The browser extension

The extension reads one thing from suno.com: the session token of the tab you are already signed into. It relays that token to our API so your library can be listed, and does so only while an export is running.

It also stores, in your browser and nowhere else, the token that pairs the browser with your account, your export settings, and how far an export has got so an interrupted run can resume.

It reads no other site, no browsing history and no other tab. Nothing else on your disk is read. None of this is sold, shared with anyone, or used for anything but making the copy you asked for.

Analytics

This site and the extension use Google Analytics, through Firebase, to count how the product is used: pages opened, exports started and finished, how long they took and how many files they covered, and where something failed. Google is a processor for this and receives your IP address and the usual details of your browser as part of it.

What it never receives is anything about your library. No song titles, no lyrics, no styles, no folder names, no file paths and not the folder you export into. The extension sends counts and durations and nothing else, and our API drops anything it is not expecting before it goes on to Google.

Once you are signed in, events are labelled with your account's internal number so a session on the site and one in the extension can be recognised as the same person. That number is not your email address, and it is not shared outside Google Analytics.

The extension identifies itself with a random identifier generated when it is installed. It is not derived from anything about you or your machine, and removing the extension takes it with it. Any content blocker that stops Google Analytics stops all of this, and nothing on the site or in the extension works any differently when it is blocked.

Cookies and local storage

The site sets a session cookie once you sign in, because otherwise it cannot tell it is you. Two preferences are kept in your own browser and are never sent to us: your light or dark theme choice, and which file types you last ticked on the download form. Both stay on the device you set them on and go when you clear the site's data. Google Analytics sets its own cookies to recognise a returning browser and to hold a session together. There are no advertising cookies and nothing here is used to follow you onto other sites.

Who else sees anything

• Lemon Squeezy — takes card and wallet payments as merchant of record. They see your card and billing details, keep their own record of the order under their own privacy policy, and tell us that a payment settled and for which email. The card itself is entered on their checkout and never reaches us, so there is no card detail here to pass on to anyone.
• Our second card payment provider — takes payments from cards issued outside the United States and the European Union. They see your card and payment details and keep their own record of the transaction under their own privacy policy, and tell us that a payment settled and for which email. The card is entered on their checkout and never reaches us. Unlike Lemon Squeezy they are not the merchant of record: the sale is ours, and theirs is the payment. Write to us and we will name them and their policy.
• NOWPayments — takes crypto payments. They see the invoice and the wallet the money came from, keep their own record of it, and tell us that a payment settled and for which email.
• Resend — delivers our email, so it handles your address and the contents of the sign-in and receipt messages we send you.
• Our own servers, which host the API and the database described above.

Nobody else. We do not sell your data and we do not share it for anyone else's marketing.

Why we are allowed to hold it

We hold your email, jobs and Pro status because we cannot perform the contract you bought without them. We hold payment records because tax law requires us to keep them. We hold the IP address behind a code request because we have a legitimate interest in codes not being brute-forced, and the address a browser paired from because you have a legitimate interest in recognising your own connected browsers and in noticing one you do not recognise.

How long we keep it

Your account and its jobs stay until you ask us to delete them. Sign-in and pairing codes expire in minutes and are cleared after that. The address a browser paired from is erased the moment that browser is disconnected. Payment records are kept as long as tax law requires, which is typically several years, and they survive deletion of the rest of your account for that reason.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Write to hello@sunosync.com and we will answer within 30 days. If you are in the EU or the UK you may also complain to your national data protection authority.

Children

SunoSync is not for children. We do not knowingly hold data about anyone under 16; if we learn that we have, we delete it.

Changes

If this policy changes, the date at the top of the page changes with it.

Contact

Questions about any of this, or a deletion request: hello@sunosync.com.