Encrypted in transit.
Every page, API call, and file download is served over HTTPS with modern TLS. Plain HTTP requests are redirected, and browsers are told to remember that with HSTS.
Locked,not loud.
You trust us with unreleased music, your story, and your account. Here is exactly how we protect them, in plain terms, without badges we have not earned.
Hashed with bcrypt.
Passwords are hashed with bcrypt and a per-password salt before they are stored. Nobody at Trackgleam can read your password, and we will never ask you for it.
Essential cookies only.
Sign-in uses an HTTP-only, secure, same-site session cookie that page scripts cannot read. Signing out ends the session on this device.
Enforced on the server.
What your plan includes, from cover counts to clean exports, is checked on our servers on every request. Changing something in your browser does not change what you can generate or download.
Provider calls from servers only.
Calls to language, image, and voice providers are made only from our server routes. API keys live in server configuration and never reach your browser. Your inputs are sent to a provider only to make your kit.
Rate limits everywhere.
The public demo, sign-in, forms, and generation endpoints are rate limited per visitor, and paid plans have daily fair-use ceilings. That protects your account from guessing attacks and keeps the service up for everyone.
Card details never touch us.
Billing is handled by Stripe. Your card number goes straight to Stripe's checkout; we only receive whether a payment succeeded and which plan it was for.
Your releases are yours.
Every read and write checks that the release belongs to the signed-in account, or to a Label team you were invited to. Kits are never shared between accounts.
How longwe keep it.
Less data kept for less time is the simplest security there is.
- Account, profile, releases, kits, covers
- Kept while your account is open. Deleted from our database and file storage when you delete them or your account.
- Public demo inputs
- Not tied to an account. Kept in a short-lived cache, then discarded.
- Server logs
- Kept for up to 30 days to investigate errors and abuse, then deleted.
- Billing records
- Kept by Stripe and by us as long as US tax law requires.
- Backups
- Rolled over within 30 days, so deleted data leaves backups on that schedule.
Found a hole? Tell us first.
Email security@trackgleam.org with what you found and how to reproduce it. We acknowledge reports within two business days and keep you updated until it is fixed. If you act in good faith, avoid other people's data, and give us reasonable time before going public, we will not pursue legal action, and we will thank you by name if you want.
- Test only against your own account.
- No denial of service, spam, or social engineering of our team.
- Do not access, change, or keep anyone else's data.