Privacy

Your account. An email address, so you can sign back in and so a payment can be tied to you. If you sign in with Google we receive the email address and name on that account and nothing else — no contacts, no calendar, no drive.

Your songs. The title, genre, tempo, key, lyrics and style words you wrote, and the audio itself. Audio lives in a private bucket; the rules on it allow one account to reach one folder, and that folder is yours.

Recordings of your voice. If you clone your voice, the minute you record is sent to ElevenLabs and the clone is kept on their account. We store a row saying that voice is yours and the moment you confirmed, in words, that it is your own voice. That confirmation is kept because consent that cannot be produced afterwards is not consent.

Songs you train a sound on. Sent to ElevenLabs for training, with a record of whether they came from your channel or you brought them, and your confirmation that the music is yours.

What you have made and spent. Songs generated, credits granted and spent, purchases. This is how an allowance is counted; without it the free tier would be a suggestion.

Your public profile, if you make one. A name, an @handle, a short description and links you choose to add. This is meant to be seen — it is how somebody finds you to work with. Songs appear on the collaboration radar only for songs you switch on, one at a time, and switching one off removes it.

Collaboration. A request between you and one other person, and the messages afterwards. Nobody else can read them, and neither of you can read them before you have both agreed — that is enforced in the database, not by a screen.

What kind of thing you make. A count. When you finish a song the genre is added to a tally against your account — “dubstep, eleven” — and when you open a room, the room is. That is the whole of it: a label, how many times, and when it last happened. It is what lets the welcome screen and the copilot suggest the kind of thing you actually make instead of asking every time, and it is why that works on your phone as well as your laptop.
What is deliberately not kept is the times themselves. There is no row per song and no row per visit, so no record exists of when you work, how long for, or in what order — the app cannot reconstruct that because it was never written down. You can see the whole tally on your account screen and clear it there, which stops the suggestions and deletes the counts.

Prompts that were refused. When the safety check refuses something you asked for, what is written down is the rule that refused it, where in the app it happened, the time, and the first 200 characters of what you typed. Prompts that are allowed are not written down this way, and none of this is read by anybody unless a refusal has to be looked into. It is kept because a platform that says it enforces its rules and cannot show a single instance of doing so is making a claim rather than a statement.

Your card. Payments go to Paystack, on their page. No card number, expiry or CVV passes through this app or is stored by it. What comes back is a reference and a customer code.

Your address, as an address. The IP a request arrives from is hashed with a secret before anything is written down, and only the hash is stored. It is used for two things: noticing that a hundred free accounts came from one place, and noticing that a suspended account has come back from the same machine. The address itself is not recoverable from what is kept.

Only what each one needs to do its job:

• Supabase — the database, the audio, and sign-in.
• Vercel — hosting. Requests pass through it.
• ElevenLabs — music, voices and trained sounds. Lyrics, style words, recordings of your voice and songs you train on are sent there.
• Anthropic — the copilot and the writing help. What you type into those goes there.
• Paystack — payments. Your email, so a receipt reaches you.
• Google — only if you choose to sign in with it.

Nothing is sold, and nothing is handed to an advertiser. There is no advertising on FutureBox to hand it to.

Your songs, voices and profile stay until you delete them or delete your account. Counting rows — what was generated, what credits moved — are kept while the account exists, because an allowance that forgets is not an allowance.

The tally of what kind of thing you make stays until you clear it on your account screen, or until the account goes.

The live visitor count keeps a random id your browser made up and a timestamp, for two minutes. It is not tied to your account and it disappears on its own.

You can clear the tally of what you make on your account screen, on its own, without deleting anything else — wanting the suggestions to stop is not the same as wanting the account gone, and only offering the second is not offering a choice.

You can delete any song, any cloned voice and any trained sound from inside the app at any time. Deleting a voice or a sound removes it from ElevenLabs as well as from here — removing only our row would be hiding it, not deleting it.

To delete your whole account and everything in it, there is a button at the bottom of your channel. It asks you to type your email address first, and then it is immediate: the songs, the videos, the episodes and every file behind them, any cloned voice — from ElevenLabs as well as from here — any trained sound, your credits, your collaborations and the account itself. If you are on a plan it is cancelled first, and if that cancellation fails nothing is deleted, because being charged for an account you no longer have is worse than still having it.

One thing does not go with it. A record of a refused prompt stays, with the account detached from it — the rule, the time and a hashed address, and no name, no email and no account. A platform that forgets every refusal the moment somebody signs up again has no memory at all. Everything that identifies you is gone.

If you would rather it were done for you, ask on the help page from the address you signed up with, so it can be matched to your account.

A copy of what is held about you, a correction to anything wrong in it, or its deletion. Ask on the help page from the address you signed up with, so it can be matched to your account. Under South Africa's POPIA you may also complain to the Information Regulator if you are not satisfied with the answer. Who FutureBox is, in the words the law asks for, is on the supplier page.

An account is held by somebody 18 or older. FutureBox is not built for children, and an account is not knowingly created for anybody under 18 — where a younger person uses it, a parent or guardian holds the account and agrees to this on their behalf. If you believe an account has been created for a child without that, say so on the help page and it will be removed.

If this changes in a way that affects what is collected or who sees it, the date at the top changes and anybody with an account is told by email before it takes effect.