Skip to content

Privacy Policy

Last updated: October 5, 2026

What data we collect

When you use DiffBeats, we collect and store the following:

We do not access your repository files or commit diffs.

How we use your data

Generation visibility and private repositories

When the GitHub App is installed on a private repository, generations created from that repository are automatically set to unlisted visibility. Unlisted generations are accessible via direct URL but are not indexed, listed publicly, or discoverable through search.

You can change generation visibility at any time from the dashboard:

Data sent to AI services

The title and text of what you submit (a blog post, pasted text, or a pull request title and description) are sent to OpenRouter (Google Gemini) for lyrics generation. The system prompt explicitly instructs the model to never reproduce secrets, API keys, tokens, passwords, private URLs, IP addresses, email addresses, or PII.

Generated lyrics and a short style description are sent to Google (Gemini API, Lyria) for audio synthesis. If you choose MiniMax as your music model in settings, they are sent to fal.ai (MiniMax Music) instead. Audio from Google carries an inaudible SynthID watermark that identifies it as AI-generated.

Cover art is generated by fal.ai (FLUX) from the song's genre only. No submitted text is sent for cover art.

When you submit a URL or add a feed, the public page is fetched through Jina Reader to extract its text. Feeds are checked about every 15 minutes, and each new post gets one song.

Third-party services

Analytics and session recording

We use PostHog for product analytics. PostHog collects:

PostHog analytics data is sent to our self-hosted proxy and forwarded to PostHog (US region). Google Analytics data is loaded via Google Tag Manager and sent to Google.

When a song fails to generate, our servers send an error report to PostHog. These reports contain the error message and the stage that failed, and no account or visitor data.

Embedded player

The DiffBeats player on other websites loads from diffbeats.com and reads the page's address to find its song. It sets no cookies and uses no local storage. When a reader views, plays, or finishes a song, or clicks the DiffBeats link, the player sends the song ID and the event name. We keep only daily totals per song. We do not store the reader's IP address or browser details.

Cookie consent

If you visit DiffBeats from the European Economic Area, the United Kingdom, or Switzerland, analytics cookies are disabled by default and a consent banner is shown. Neither PostHog nor Google Analytics loads until you click Accept. Visitors from other regions have analytics enabled by default; you can opt out by clearing thediffbeats.consent key from local storage and refusing the banner, or by contacting us.

Cookies and local storage

We use cookies and local storage for:

We do not use advertising cookies.

Data retention

Generations and associated metadata are retained until you delete them. Deleted generations are kept in a recoverable state for 30 days, after which they are permanently and irreversibly removed from our systems, including any stored audio and image files.

Data deletion

You can delete individual generations from the dashboard. Deleted generations can be restored within 30 days. After 30 days they are permanently removed.

You can also delete your entire account and all associated data from your dashboard settings. Account deletion is immediate and permanent (bypasses the 30-day trash window), including cancellation of any active subscription.

Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Contact

Questions about this policy? Email hello@diffbeats.com.