Privacy Policy
Last updated: October 13, 2026
1. Operator
This website and the cut.audio application are operated by Solid Grid Systems GmbH, Bundesallee 187, 10717 Berlin, Germany.
2. Your Audio Never Leaves Your Device
All audio processing runs locally, in your browser or in the downloadable app. Your files are never uploaded to us, and there is no server that could receive them — the decoding, the editing and the encoding all happen on your own machine. This includes the AI tools: their models are downloaded to your device and run there. It also includes recordings: when you use the recorder, your browser asks for access to your microphone, and the recording stays in your browser. You can withdraw that permission at any time in your browser's settings. This is the central promise of the Service and everything below is written so as not to weaken it.
3. What We Collect, in Short
The free tools work without an account. The paid subscription, Pro, comes with an account: it is created when you buy, and you sign in with it so that what you bought is unlocked, in your browser and in the Windows app. What reaches us or a service provider is: the technical data every request to a website carries (section 4), anonymous usage measurements (section 6), a hashed daily count of your free exports and a price lookup (section 5), and — only if you buy or sign in — the data needed for payment and your account (sections 7 and 8).
4. Hosting and Delivery (Cloudflare)
This website and our server are delivered through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Every request passes through Cloudflare, which processes your IP address, the requested address, your browser's user agent and the time of the request in order to deliver the pages and to protect them against attacks. Cloudflare acts as our processor. Transfers to the USA are based on the EU–US Data Privacy Framework, under which Cloudflare is certified. The legal basis is our legitimate interest in delivering the website securely and reliably (Art. 6(1)(f) GDPR).
5. Our Own Server
Some features talk to our own server, which runs in Germany. It provides the download information for the desktop app, the AI models, accounts, and the four functions below. Its request log does not record IP addresses.
Localized price. Pages that show the price of Pro, and the limit notices that offer it, ask our server for it. Our server asks our payment provider Paddle (section 7) for the price in your currency and forwards your IP address to Paddle for that one request, because Paddle determines your country, currency and tax from it. Nothing about the request is stored. The legal basis is our legitimate interest in showing you the price you would actually pay (Art. 6(1)(f) GDPR).
Free export count. Free use includes a limited number of exports per day. To count them without storing anything on your device, our server counts under a one-way hash of your IP address, your browser's user agent and a random key that is replaced every day. The count exists only in the server's memory, is deleted at 00:00 UTC together with the key, and cannot be traced back to your address. Your browser asks for the count, and reports the export, only when you press Export; nothing is sent while you browse or load a file. The legal basis is our legitimate interest in offering a free tier with a daily allowance (Art. 6(1)(f) GDPR).
Link to the desktop app by email. If you ask us to email you the link to the desktop app — for example because you are reading on your phone — we send one email to the address you enter. The address is not saved; it is held in the server's memory for at most 24 hours, only to stop the form being used to flood someone else's inbox. The legal basis is your request (Art. 6(1)(b) GDPR).
Update check (desktop app). The Windows app asks our server once a day whether a newer version is available. The request carries the version you are running, your operating system and the product name — and, like any request, your IP address. It carries no licence key, no device identifier and no account, so we cannot tell which installation asked. To know how many installations are still on an older version, our server counts under a one-way hash of your IP address, the version and a random key that is replaced every day; the hash exists only in the server's memory and is deleted at 00:00 UTC together with the key. The resulting number — one entry per counted check, carrying only the version and the operating system — is kept in our self-hosted usage measurement (section 6) so that the distribution can be read over time. That entry contains no IP address and no hash of one. Nothing is downloaded or installed — the app only shows a note in its menu linking to the download page. The legal basis is our legitimate interest in being able to deliver corrections for software installed on your computer (Art. 6(1)(f) GDPR).
6. Usage Measurement
This website uses a privacy-focused, cookieless analytics tool that we self-host. Data never leaves our infrastructure, no cookies are set, and no cross-site tracking takes place.
Besides page views (URL, referrer, browser, OS, country, screen size), we record how the tools are used — that a file was loaded, exported or refused, and which tool it happened in. These measurements describe your file, never its contents: the extension, whether the file header matches it, the length and size as coarse ranges rather than exact values, and the reason a file could not be opened. We never record filenames, and nothing you type is recorded.
One measurement needs saying plainly, because it is the only one that reads any part of a file: when a file cannot be decoded, we record the first four bytes of its header, as a number. Those bytes are the format marker every audio file begins with — "this is an MP3", "this is a WAV" — and they are recorded only for files that failed, because that is how we work out which formats to support next. If those four bytes happen to be readable text, we record only the fact that they were, not the text. No audio, and no part of a file beyond its format marker, is ever transmitted.
We also count steps of buying and signing in on this website: that a checkout was opened or completed, that a sign-in code was requested, that a password was set. These carry no email address and nothing you type. Two further kinds of entry are added to the same measurement by our server and do not come from your browser. One for each purchase: which product, whether it is a first payment or a renewal, and which place on the site offered it. And one each time the Windows app signs in: whether by code or by password, the operating system, whether the computer is new to the account, or the reason a sign-in was refused. None of these entries contains an email address, an account, an IP address, a licence key or an identifier of your computer.
The measurements exist to find and fix faults — every improvement to which formats open and why files were being refused came from them — and to understand which tools are worth building on. The legal basis is our legitimate interest in a working and improving service (Art. 6(1)(f) GDPR).
7. Payments (Paddle)
Subscriptions are sold by Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, which acts as the merchant of record, as were the Studio licences on sale until October 2026: Paddle is the seller, processes your payment and is responsible for the payment data you enter in its checkout. See Paddle's privacy notice.
Paddle's checkout is not loaded when you visit a page. It loads only when you press a buy button, open the checkout page, or return from a payment method that took you to another site. From that moment Paddle's scripts run in your browser, together with services Paddle uses to render and secure the checkout — among them Stripe (fraud prevention), Sentry (error reporting) and Paddle Retain (formerly ProfitWell). These may set their own cookies. The legal basis is the performance of the contract you are entering into (Art. 6(1)(b) GDPR).
8. Your Account
If you buy, we store your email address, the status of your subscription or licence and the account data needed to sign you in and to check whether your purchase is valid, on our server in Germany. When you activate the Windows app with your account, we also store an identifier of that computer and its operating system, so that a licence can be limited to the number of computers it covers. While a subscription unlocks the app, the app asks our server from time to time whether the subscription is still running — in the days around each renewal, at most once a day — and sends the signed activation file from your computer for that, which contains your email address, your licence key and that computer's identifier. We receive your email address from Paddle when you buy. This data is used solely to provide the Service — signing you in, checking your subscription or licence, and communicating with you about it (Art. 6(1)(b) GDPR) — and is kept for as long as your account exists. You may request its deletion at any time; data Paddle must keep for tax and accounting purposes is kept by Paddle under its own obligations.
All emails we send — the welcome email after you buy, sign-in codes, password resets and the desktop link from section 5 — go out through Resend (Plus Five Five, Inc., USA), which processes the recipient address and the content of those emails on our behalf. Transfers to the USA are based on the EU–US Data Privacy Framework, under which Resend is certified, and on the EU Standard Contractual Clauses in Resend's data processing agreement.
If you tick the box for product news in Paddle's checkout, we may also email you about new features of cut.audio. This is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time — every such email contains a link to unsubscribe, or simply write to us. Without that box ticked, we email you only about your account and your purchase.
9. Storage on Your Device
This site sets no cookies of its own, and a page view stores nothing on your device — which is why there is no consent banner. Something is stored only when you use a function that needs it, and only what that function needs (§ 25(2) no. 2 TDDDG):
• Light or dark mode (mui-mode in local storage) — when you switch it, so the site remembers your choice.
• Sign-in token (pocketbase_auth in local storage) — when you sign in, so you stay signed in. Removed when you sign out.
• AI models (in your browser's cache storage) — when you first use an AI tool, so the model is not downloaded again every time.
• Paddle's checkout — the cookies described in section 7, once you open it.
You can remove all of it at any time by clearing this site's data in your browser. The desktop app keeps its own settings, its daily export count and the result of its daily update check on your computer, so that it does not have to ask again the same day, and for a subscriber the date of its last subscription check. Apart from that update check (section 5) it sends no usage measurements.
10. Your Rights (GDPR)
If you are located in the EU, you have the right to access, correct, or delete your personal data, to restrict its processing, to data portability, and to object to processing based on our legitimate interest (Art. 21 GDPR). You also have the right to lodge a complaint with a supervisory authority. To exercise your rights, contact us at [email protected].
11. Changes
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date.
Contact
For privacy-related inquiries, contact us at [email protected].