Privacy Policy

1. Who is responsible for your data

This Privacy Policy explains how Distrib by Yamka LLP, a limited liability partnership registered in the Republic of Kazakhstan, BIN 260840024988 (“SameSet”, “we”, “us”) collects, uses and protects personal data when you use the SameSet app, the SameSet Remote Script for Ableton Live, the website sameset.app and related services (the “Service”). We are the controller of the personal data described here, except for payment data, which Paddle controls as Merchant of Record (section 6).

Contact for all privacy matters, including requests under the GDPR, UK GDPR, CCPA/CPRA and the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”: [email protected].

Company details: Distrib by Yamka LLP (TOO «Distrib by Yamka»), a limited liability partnership registered in the Republic of Kazakhstan. Business Identification Number (BIN): 260840024988. Registered address: 28 Zhuravleva St., building 3, apt. 334, floor 12, Almaty, Republic of Kazakhstan. Director: Vladimir Orekhov. Email: [email protected].

2. Data we process

Account data — provided by you or created by the app:

• display name you enter (it does not have to be your real name);
• your email address and when you confirmed it — required to create and join Rooms; you confirm it with a one-time code when you set up the app, and it also lets you sign in on another Mac and in your web account;
• a random account ID and login tokens for each Mac signed in to the Account (we store only SHA-256 hashes of the tokens; the tokens themselves stay on your Macs), and when each sign-in was created;
• your plan, the date the account was created, and for paid plans the Paddle customer ID, subscription ID, subscription status, billing period and next billing date.

Room and session data:

• room codes, which Account hosts a Room, when it was created, last used and closed;
• participants’ display names and roles, presence information (for example which track a person is on), network latency, and room chat messages and reactions (kept only in the server’s memory while the room is open — up to the last 50 messages — and never written to disk);
• the log of edits made in the Room (for example changes to clips, notes, mixer and device parameters) needed to synchronise participants who connect later;
• hours of use per billing period and the total size of projects in your open Rooms, to apply plan limits.

Project content — Ableton Live sets, audio files, samples and plugin presets that participants share, and file metadata such as names, sizes and hashes. See section 4 for how briefly we keep them.

Technical data — IP address, connection times, app and protocol version, error messages and security events (for example failed room-code or sign-in attempts), recorded in server logs and in short-lived memory counters used to prevent abuse. To stop free-plan and free-trial abuse we also keep one-way salted hashes of the network address a host connects from (shared weekly Free hours per network), of emails confirmed on a device, and counts of people per email domain. For security, each account also keeps the network addresses (IPv6 shortened to a /64 network) and hashed device IDs it signed in from during the last 30 days, so we can block abuse — for example an account, device or network that breaks the Terms.

Web account data — if you open your account on sameset.app: a sign-in session record (a hash of the session identifier, when it was created and last used, and the browser and operating system type, for example “Safari · macOS”).

Support data — if you email us, your email address, the content of your message and any information you choose to include.

Beta requests — if you request a beta invite on sameset.app: your email, the computer you use (Mac or Windows), the role and short description you choose to write, an optional Telegram or Instagram handle, the language of the page and a shortened network address (to limit spam). We use them only to invite you and ask about the beta, and delete a request on your request.

Problem reports — only when you press “Report a problem” in the app: your description, app and Live versions, operating system, the state of the current session (room code, your role, number of participants) and, if you leave “Attach logs” on, recent SameSet and Ableton Live log files. Logs can contain names of your tracks, clips, devices, plugins and project files; login tokens are removed before sending. Reports are kept for 90 days.

We do not intentionally collect special categories of personal data, precise location, contacts, microphone or camera data. The app does not read your projects unless you share them in a Room.

3. Why we use it and our legal bases

• To create and run your Account, Rooms and synchronisation, to transfer project files between participants and to apply plan limits — performance of our contract with you (GDPR Art. 6(1)(b)).
• To confirm your email address, sign you in to your Account on another Mac and prevent abuse of the free plan with throwaway accounts — performance of a contract and our legitimate interests. To check that an address can receive mail and is not a disposable one, we look up the public DNS mail records of its domain (only the part after “@”, never the full address) through Cloudflare’s DNS resolver.
• To process subscriptions and link payments to your Account — performance of a contract; Paddle processes the payment itself.
• To keep the Service secure, prevent fraud, abuse and brute-force attempts, and fix errors — our legitimate interests in a secure, working service (Art. 6(1)(f)).
• To answer your requests and send essential service messages (for example about changes to Terms or prices) — contract and legitimate interests.
• To comply with legal obligations, such as tax, accounting and lawful requests from authorities — legal obligation (Art. 6(1)(c)).
• Where the law requires consent (for example under the law of Kazakhstan), by installing the app, creating an Account and sharing Content you consent to the processing described in this policy. You can withdraw consent at any time by deleting your Account; this does not affect processing carried out before withdrawal.

We do not use your data for advertising, profiling or automated decision-making that produces legal or similarly significant effects, and we do not use your Content to train machine-learning or AI models.

4. Your projects are not stored

Project files, samples, presets and the edit log of a Room are processed only to deliver them to the participants of that Room:

• they are transferred over TLS-encrypted connections and held on our server in Helsinki, Finland (European Union) only while the Room is in use;
• when the Host ends the Session they are deleted automatically within about 10 minutes (enough for participants to finish downloading);
• an inactive Room is deleted with all its files and edit log 24 hours after the last activity;
• automatic deletion runs at least hourly; we keep no backups of project content, so deleted content cannot be restored.

The Service is not end-to-end encrypted: files are encrypted in transit but are processed by our server in readable form while the Session is open. We do not access them except automatically to operate the Service, or where strictly necessary to investigate abuse or comply with law.

Projects downloaded by participants are saved on their own computers (by default in ~/Music/SameSet) and remain there after the Session; we have no access to them and cannot delete them.

5. Data stored on your Mac

The app stores on your Mac: your display name, email address, account ID and login token (in ~/.together/profile.json, readable only by your macOS user), app caches and downloaded updates (~/Library/Caches/SameSet), downloaded projects (~/Music/SameSet), project versions — copies of the Live set file without samples, made on each save and update (~/Library/Application Support/SameSet/Versions, up to 1 GB per project, thinned out over 30 days), received plugin presets (in your Ableton User Library) and the SameSet Remote Script. Ableton Live communicates with the app only on your computer (localhost). Uninstalling the app and deleting these folders removes this data.

If you allow notifications, macOS shows them through Apple’s notification system on your device.

6. Payments

Paid plans are sold by Paddle.com Market Limited (“Paddle”), which acts as Merchant of Record and as an independent controller of the data you give it during checkout: name, email address, billing address, country, payment method details and tax information. Paddle’s privacy policy applies to that data (paddle.com/legal/privacy).

Paddle sends us, through signed webhooks, the information needed to activate and manage your plan: customer and subscription IDs, plan, status, billing dates, currency and amounts. We do not receive or store your card details, and we don’t store the email you use at checkout — only its hash for the free-trial rule below (an email you add yourself for sign-in is described in section 2). When you ask for help with billing we may look up your purchase in Paddle’s dashboard.

To make sure a free trial is used only once, we keep one-way salted hashes of your account ID, email address, device ID, Paddle customer ID and email, and card type with its last 4 digits and expiry date (Paddle sends these in the payment notification). The hashes can’t be turned back into the original data; we only compare them when a new trial starts. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f)).

When you open the checkout page, Paddle.js is loaded from Paddle and may use cookies and similar technologies for fraud prevention and to complete the purchase.

7. Website, cookies and similar technologies

sameset.app does not use analytics, advertising pixels or tracking cookies, and we honour Global Privacy Control and Do Not Track signals by default because we do not track.

• The site is delivered through Cloudflare, which processes your IP address and may set strictly necessary security cookies (for example to detect bots).
• Fonts are loaded from Google Fonts, which receives your IP address and browser information to deliver the files.
• If you sign in to your account on the website, we set one strictly necessary cookie (__Host-ss) that keeps you signed in. It is HttpOnly, Secure and SameSite=Strict, is used only to authenticate you and expires after 30 days without use (at most 90 days). Signing out deletes it.
• If you close the “Site available in Russian” banner, your browser remembers it in local storage on your device; this value is never sent to us.
• The checkout page loads Paddle.js as described in section 6.

8. Who we share data with

We share personal data only as needed to run the Service:

• other participants in your Rooms — your display name, role, presence, edits and the Content you share;
• Hetzner Online GmbH (Germany) — server hosting in Finland;
• Cloudflare, Inc. (USA) — website delivery, DNS (including lookups of email domains described in section 3), protection against attacks, and routing of emails sent to [email protected];
• Resend, Inc. (USA) — delivery of confirmation codes, sign-in links and email-confirmation emails;
• our email provider — to receive and answer your emails;
• Paddle — payments, as an independent controller;
• Google (Google Fonts) — delivery of website fonts;
• professional advisers, auditors and authorities where required by law, to protect rights and safety, or in connection with a merger or acquisition (with notice to you).

We do not sell personal data and do not “share” it for cross-context behavioural advertising as those terms are defined in California law.

9. International transfers

Our servers are in the European Union. The Service is operated from the Republic of Kazakhstan, and some of our providers are located in other countries, including the United States and the United Kingdom. Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on adequacy decisions (such as the EU–US Data Privacy Framework for certified providers) or Standard Contractual Clauses, together with additional safeguards where appropriate.

10. How long we keep data

• Project files, samples, presets and Room edit logs — while the Room is in use; deleted about 10 minutes after the Host ends the Session or 24 hours after the last activity.
• Room records and codes — deleted together with the Room.
• Account data — while your Account exists. You can ask us to delete it at any time; Accounts inactive for more than 24 months may be deleted.
• Usage hours — the last six billing periods.
• Subscription and payment records — as long as needed for accounting, tax and legal claims (typically up to 5 years after the transaction), unless the law requires longer.
• Account email address — while your Account exists (you can change it in your web account). Confirmation codes — 15 minutes and at most 5 attempts; email sign-in links — 15 minutes; confirmation links — 24 hours; all work once. Results of email-domain checks — up to 1 hour, in memory.
• Web sign-in sessions — until you sign out, or 30 days without use (at most 90 days). Server logs with IP addresses — up to 14 days; abuse-prevention counters (for example failed room-code attempts) — kept only in memory for a few hours at most; hashed limits for Free hours, devices and email domains, and an account’s recent network addresses and device IDs — up to 30 days; blocks — until they are lifted.
• Support emails — up to 24 months after the conversation ends.

11. Security

We protect data with measures appropriate to the risk, including: TLS encryption for all connections with certificate pinning in the app; storing only hashes of login tokens; strict file permissions and a sandboxed, unprivileged server process; a firewall and key-only administrative access; rate limits against guessing room codes; automatic deletion of project content; digitally signed app updates; and access to production systems limited to the people who operate the Service.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify you and the competent authorities as required by law.

12. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data (you can change your display name in the app at any time);
• delete your data and Account;
• restrict or object to processing based on legitimate interests;
• data portability — receive data you provided in a machine-readable format;
• withdraw consent where processing is based on consent;
• not be discriminated against for exercising your privacy rights;
• lodge a complaint with a data protection authority, for example in the EU/EEA country where you live or work, the UK Information Commissioner’s Office, or the authorised body for personal data protection in Kazakhstan.

To exercise your rights, email [email protected] and include your account ID (SameSet → Account) so we can find your data. We may ask for information to verify that the request comes from you. We respond within one month (or the period required by your local law) and do not charge a fee. Residents of California and other US states may also use an authorised agent.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided personal data to us, contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy. We will post the new version on this page with a new “Last updated” date and, for significant changes, notify you in the app or by email before they take effect.

15. Contact

Privacy questions and requests: [email protected].