What leaves your phone
Songs in progress are private in a way finished ones are not. This page is the honest inventory: four things use the network, two of them only because you asked, one that is on for everyone, and one you switch on by paying for it. Without that last one there is no copy of your songs anywhere but the phone.
The inventory
Four lines on the left. Two happen only when you ask, and one only if you pay.
What it does
- A photograph of handwriting, sent to be read
- A take you spoke and asked to have written down
- Counts of which features get used, and crashes when it crashes
- With a subscription: your songs, words, takes and videos, backed up under your account
What it deliberately does not
- Anything at all, without a subscription, except the three above
- The takes you sing — never sent to be read unless you asked for its words
- Anything you type into search
- Your contacts, your location, or an advertising identifier
- Anything to anyone but you: nothing you write is public, ever
The content that leaves
Reading a page, and writing down what you said
Two things a phone cannot do by itself, and both of them wait for you to ask.
Ordinary text recognition is built for printed receipts and fails on cursive, so the app uses a vision model instead: when you photograph a page, that image goes to our own server, which passes it to Google's Gemini API and hands back a transcript, with the words the model was unsure of marked as uncertain rather than guessed at. Our server is the one holding the key, which is why the request goes through it rather than straight from your phone.
Speaking works the same way: choose Speak, say the words, and when you stop, that take goes the same route and comes back as text for you to correct. A take you record with the Record button is never sent to be read, and neither is any take already on a song.
Nothing else about the song goes with either of them — not the other drafts, not the title. What does go is an identifier, because the monthly allowance has to be counted against somebody: an anonymous one made on the phone, or your account if you signed in. The photograph and the take are both kept whatever the transcription does, so a failed reading costs you nothing.
The transcription is instructed not to tidy what it reads or hears. Invented words, dialect, deliberate misspellings, crossed-out lines and a line sung four times over are the content of a song in progress, and a model left to its own instincts will quietly correct all of them.
The other one
Which features get used, and what breaks
Counts and labels about the app. Never a word of what is in it.
The app reports to Google Firebase which of its features get used and when it crashes. An event is a short label and a few values: a take being saved, how long it ran, whether a song had been sitting untouched for a week or a year. Numbers are banded rather than exact — “over 50”, not “417” — because a precise count identifies one person and a band answers the same question without doing so.
Nothing you write or record is part of it. Not a lyric, not a title, not a chord sheet, not a note, not a file name, not a search you type — a search arrives as how long the query was and how many songs it matched, and never as the query. A crash report says which line of our code failed, not what was on the screen.
There is no switch for this in the app, which we would rather state than bury. Reporting is on for everyone, and what is reported is built so that it cannot describe you.
Consequences
What local-first actually costs you
Being honest about the upside means being honest about the trade. Without a subscription your songs live on one device, which is exactly the point and also means a lost or wiped phone loses them. Everything the app holds sits inside its own documents, so your phone's ordinary backup carries it — and Get a copy of everything, in settings, hands you the lot in one file for nothing, whenever you want it.
A subscription adds the other copy: your songs, your words, your takes and your videos on our servers, under an account, so they come back after a phone is lost rather than after a phone is restored. It is the thing being sold, it is off until you buy it, and the privacy policy says exactly what it holds.
Nothing to sign up for
Install it and the drawer is yours, on your phone, immediately. An account is only for the backup.
Free. No account, no advertising, and nothing to sign up for.