Privacy

Your account. An email address, so you can sign back in and so a payment can be tied to you. If you sign in with Google we receive the email address and name on that account and nothing else — no contacts, no calendar, no drive.

Your songs. The title, genre, tempo, key, lyrics and style words you wrote, and the audio itself. Audio lives in a private bucket; the rules on it allow one account to reach one folder, and that folder is yours.

What the engines cost us. Each time a song, a picture or a video is made for you, we write down which engine ran, what it cost us in fractions of a dollar, and your account. It holds nothing you made and nothing you typed. It exists so that one person cannot use up a month that everybody shares, and so the ceilings can be raised honestly rather than guessed at.

A cover art you ordered. When a sleeve is drawn for one of your songs we write down the job's number at the image engine, which song it was for, what it cost you, and whether the picture was ever copied into the app. It holds no picture and none of the words you typed. It exists because the copy used to be made by your own browser: close the tab before the picture arrives and it was lost, paid for, with nothing left anywhere that knew it existed. With this row the app can go back and fetch it, and a cover the engine fails to make gives the credits back. The row stops mattering the moment the picture is saved.

An allowance you set for a child. When you hand your phone to a child and set what they may spend, we write down one row: your account, the number of credits you allowed, and how many of them have gone. It holds nothing about the child — no name, no age, nothing they chose, and nothing they made. It exists because an allowance kept in the page would not be one: the limit is applied where credits are actually spent, so it holds on a reload, in a second tab, and before the page has finished loading. Ending kids mode deletes the row.

Kids credits you bought. A kids pack puts credits on a balance of their own, spent only in the kids room. We keep your account, the balance, a line for each purchase, spend and refund with the payment reference, and for a monthly pack the payment provider’s customer code so the next month’s credits reach the right account. Nothing about the child is in it. It stays while the account does, because it is money you paid.

Stories and songs kept for a child. When you keep a storybook for the kids room, or a child keeps a song they made, the pages, the pictures, the readings and the audio are stored on your account so they are there on every device you sign in from. They were on the one device that made them until 9 October 2026. They are yours alone: the files sit in a private store where only your own account can read them, nothing on our side can open them, and nothing about them is shown to anybody else or used to train anything. The row holds nothing about the child — no name, no age, nothing beyond the words you wrote and what the app was asked to make. Taking a story or a song off the shelf deletes the files with it.

Which singing voice is yours. A singing voice is trained on Kits' own site, on one account that this whole app shares, so nothing in their system knows which member a voice was made for. We keep a row saying so: the voice's number, your account, and when it was given to you. It holds no recording and no sound. It exists so that the picker shows you only your own, and so the engine refuses anybody else who sends your voice's number — without it, every member could sing in every member's cloned voice. You can ask for it to be taken back at any time, which frees the slot and leaves the voice on the Kits account.

Recordings of your voice. If you clone your voice, the minute you record is sent to ElevenLabs and the clone is kept on their account. We store a row saying that voice is yours and the moment you confirmed, in words, that it is your own voice. That confirmation is kept because consent that cannot be produced afterwards is not consent.

Songs you train a sound on. Sent to ElevenLabs for training, with a record of whether they came from your channel or you brought them, and your confirmation that the music is yours.

What you have made and spent. Songs generated, credits granted and spent, purchases. This is how an allowance is counted; without it the free tier would be a suggestion.

Your public profile, if you make one. A name, an @handle, a short description and links you choose to add. This is meant to be seen — it is how somebody finds you to work with. Songs appear on the collaboration radar only for songs you switch on, one at a time, and switching one off removes it.

Collaboration. A request between you and one other person, and the messages afterwards. Nobody else can read them, and neither of you can read them before you have both agreed — that is enforced in the database, not by a screen.

What kind of thing you make. A count. When you finish a song the genre is added to a tally against your account — “dubstep, eleven” — and when you open a room, the room is. That is the whole of it: a label, how many times, and when it last happened. It is what lets the welcome screen and the copilot suggest the kind of thing you actually make instead of asking every time, and it is why that works on your phone as well as your laptop.
What is deliberately not kept is the times themselves. There is no row per song and no row per visit, so no record exists of when you work, how long for, or in what order — the app cannot reconstruct that because it was never written down. You can see the whole tally on your account screen and clear it there, which stops the suggestions and deletes the counts.

Photographs of people, if you add a cast. The video desk lets you keep a small cast — a picture and a name for each person a presenter clip can be made of. The picture is kept in the same private bucket as your audio, and when you make a clip it is sent to ElevenLabs to be animated. A photograph of somebody is information about them whether or not they hold the account, which is why the app asks you to confirm the face is yours or that you have their permission before a clip is made, and why that confirmation is kept. Take a cast member out and the picture goes with them.

Who you work together with. When two people accept a collaboration and open a shared room, a row records the pair and which room it is. If either of you chooses to share a social link so the two of you can talk elsewhere, that link is kept against the pair and shown to the other person — only to them, and only after you both agreed.

The live room. What you post there, what you mark as liked, and a note that you are currently watching. If you report somebody’s link, a row records that you reported it — that is how the same link being reported twice takes it down, and it means a report is not anonymous to us even though it is to the person reported.

A loop in the jam room. While your looper plays and “Let the room add my loop” is on, the loop itself is kept so that others in the room can add it to theirs: the tempo, the pad patterns and any voice layer you recorded off your microphone, under the name on your channel. It is kept only while the loop plays — it is deleted when you stop, clear it or leave, and one that has not been heard from for fifteen seconds is no longer shown to anybody. Turn the switch off and it is not shared at all. Somebody who has already added your loop keeps their copy on their own device.

Bids on album art. The once-off fee that makes you a bidder on a piece, every bid you place, and what you won. An auction cannot work without a record of who bid what, and the artist can see the bids on their own piece.

Anything you queue to post. The marketing desk can hold a caption and a date so it can remind you when the time comes. What is kept is what you wrote and which platform it is for. It reminds rather than posts — nothing is sent anywhere on your behalf from that queue.

Your TONE3000 sign-in. If you choose an amp sound from TONE3000, you sign in to their account, not ours. What is kept here is what they hand back so you do not have to sign in again every time: a token for your TONE3000 account, held on our server and never in your browser. We cannot read your TONE3000 password and we never see it — the sign-in happens on their page. While a sign-in is in progress, one short-lived row holds a random reference and nothing about you; it is deleted the moment you come back, and in any case within fifteen minutes. Signing out of TONE3000 on their side ends our access too, and deleting your account here deletes the token.

A word that came out wrong. If you tell us an Afrikaans word was said badly, what is kept is the word, how you say it should sound, and which room you were in. It is how the pronunciation list gets better, and it is read by a person before anything changes.

Competitions, if you enter one. Your entry, and whether it won.

Prompts that were refused. When the safety check refuses something you asked for, what is written down is the rule that refused it, where in the app it happened, the time, and the first 200 characters of what you typed. Prompts that are allowed are not written down this way, and none of this is read by anybody unless a refusal has to be looked into. It is kept because a platform that says it enforces its rules and cannot show a single instance of doing so is making a claim rather than a statement.

Your card. Payments go to Paystack, on their page. No card number, expiry or CVV passes through this app or is stored by it. What comes back is a reference and a customer code. In the Android app from the Play Store, payments go through Google Play instead, on Google’s own sheet; what comes back is a purchase token, which is kept with your account so the purchase is delivered once and a monthly plan can renew.

Your address, as an address. The IP a request arrives from is hashed with a secret before anything is written down, and only the hash is stored. It is used for two things: noticing that a hundred free accounts came from one place, and noticing that a suspended account has come back from the same machine. The address itself is not recoverable from what is kept.

Only what each one needs to do its job:

• Supabase — the database, the audio, and sign-in.
• Vercel — hosting. Requests pass through it.
• ElevenLabs — music, voices and trained sounds. Lyrics, style words, recordings of your voice and songs you train on are sent there.
• Anthropic — the copilot and the writing help. What you type into those goes there.
• Paystack — payments. Your email, so a receipt reaches you.
• Google Play — payments in the Android app. Google already knows you as the Play account paying; we ask Google about each purchase token to check it was paid, and keep the token with your account.
• Kits.AI — singing conversion. When you put a take through “sing it in another voice”, the recording of you singing is sent to them. It is a recording of your voice, and everything this page says below about what happens to one applies here too.
• Music.ai — reading a song. When you ask for the chords, the key, the tempo or where the sections are, the audio is sent to them to be listened to.
• Resend — email. Your address and the letter itself, whenever anything is sent to you: an invitation, a password reset, a receipt.
• Kling — video. Their engine is no longer used to make clips, as of 9 October 2026. Where a clip was already being made when that changed, we still ask them whether it is finished, which sends them that job’s number and nothing else. What you typed to describe a clip went to them before that date.
• Google — two separate things. If you choose to sign in with Google, they confirm it is you. And when you make a song, a video or a picture, what you typed to describe it is sent to Google’s AI service, along with any picture you attached for it to start from.
• TONE3000 — amp and pedal models, and only if you connect your own TONE3000 account. What reaches them is your decision to connect it and which tones you ask for.

Google’s AI service and TONE3000 were added to this list on 9 October 2026, and Google’s entry rewritten: it had said “only if you choose to sign in with it”, which stopped being the whole truth the day songs started being made on Google’s own service. Nothing about what is sent changed on the day this page was corrected — what changed is that this page now says so.

Kits.AI, Music.ai, Resend and Kling were added to this list on 24 September 2026, in a legal audit before handing the app over to be rated. They had been receiving what is described above for some time; the list had six names on it and should have had ten. Nothing about what is sent changed — what changed is that this page now says so.

Nothing is sold, and nothing is handed to an advertiser. There is no advertising on FutureBox to hand it to.

The voice engine is a company in its own right with its own terms, and once a recording of you reaches it, what happens next is governed by those and not only by this page. Four things are worth knowing before you clone your voice, and none of them is obvious from the outside.

• A person may listen to it. The voice engine reserves the right to moderate everything sent to it and everything it produces, and to pass that material to third parties who help them do it. This is how a platform stops itself being used to fake somebody's voice, and it is the reason our own safety check is not the only one. But it does mean a recording of you is not machine-only.
• It leaves South Africa. They host in the United States, the Netherlands and Singapore, and everything is stored in the United States regardless of where it was recorded. POPIA allows that where the receiving party is bound to comparable protection; they are, under the European standard contractual clauses in the data-processing agreement that applies to our account.
• Deleting the clone does not delete their licence. When you delete a cloned voice, the model is deleted from their side as well as ours — that part is real and this app does it. What we cannot undo is the licence they already hold over the recordings you gave them, which by their own terms is perpetual, and their retention limit for data generated about a voice is three years from your last contact with them. Everything else on this page about deletion is accurate; this is the edge of it.
• Your voice is treated here as special personal information. A voice identifies a person the way a fingerprint does, and POPIA puts that in a stricter category than an email address. That is why cloning asks you to confirm in words that the voice is your own, and why that confirmation is stored with the moment you gave it. It is also why the voice features are switched off entirely for anybody under 18 — the engine's own rules prohibit sending it a child's voice, with no parental-permission exception.

If that is more than you want, you do not have to clone anything. Writing songs, generating music, making videos and running a channel all work without a recording of your voice ever leaving this app.

And it is not only the voice engine any more. Everything above is about ElevenLabs, where a cloned voice goes. Singing conversion — “sing it in another voice” — sends your recording to a different company, Kits.AI, in the United States.

We are not going to pretend the same protections cover both. With ElevenLabs there is a signed data-processing agreement, a stated retention limit and standard contractual clauses that POPIA accepts as the basis for the recording leaving the country. With Kits.AI, as of 24 September 2026, we do not have those on file. Their published terms govern what they do with it, we have asked them for an agreement, and until there is one this page is going to keep saying this rather than leaving you to assume.

What that means for you, plainly: if you want your voice to go no further than the engine we have an agreement with, use the voice features and not the singing conversion. Everything else in the booth — recording, takes, the timeline, mixing — happens on your own device and sends your voice nowhere at all.

The full list of companies the voice engine uses behind the scenes is published by them at compliance.elevenlabs.io, and they are required to give us thirty days' notice before adding one. If one of them is ever the reason something here has to change, the date at the top of this page changes with it.

Your songs, voices and profile stay until you delete them or delete your account. Counting rows — what was generated, what credits moved — are kept while the account exists, because an allowance that forgets is not an allowance.

The tally of what kind of thing you make stays until you clear it on your account screen, or until the account goes.

The live visitor count keeps a random id your browser made up and a timestamp, for two minutes. It is not tied to your account and it disappears on its own.

You can clear the tally of what you make on your account screen, on its own, without deleting anything else — wanting the suggestions to stop is not the same as wanting the account gone, and only offering the second is not offering a choice.

You can delete any song, any cloned voice and any trained sound from inside the app at any time. Deleting a voice or a sound removes it from ElevenLabs as well as from here — removing only our row would be hiding it, not deleting it.

To delete your whole account and everything in it, there is a button at the bottom of your channel. It asks you to type your email address first, and then it is immediate: the songs, the videos, the episodes and every file behind them, any cloned voice — from ElevenLabs as well as from here — any trained sound, your credits, your collaborations and the account itself. If you are on a plan it is cancelled first, and if that cancellation fails nothing is deleted, because being charged for an account you no longer have is worse than still having it.

One thing does not go with it. A record of a refused prompt stays, with the account detached from it — the rule, the time and a hashed address, and no name, no email and no account. A platform that forgets every refusal the moment somebody signs up again has no memory at all. Everything that identifies you is gone.

If you would rather it were done for you, ask on the help page from the address you signed up with, so it can be matched to your account.

A copy of what is held about you, a correction to anything wrong in it, or its deletion. Ask on the help page from the address you signed up with, so it can be matched to your account. Under South Africa's POPIA you may also complain to the Information Regulator if you are not satisfied with the answer. Who FutureBox is, in the words the law asks for, is on the supplier page.

An account is held by somebody 18 or older. An account is not knowingly created for anybody under 18 — where a younger person uses FutureBox, a parent or guardian holds the account and, as the child's competent person under POPIA, agrees to this on their behalf. If you believe an account has been created for a child without that, say so on the help page and it will be removed.

The kids room. A grown-up opens it on their own account and hands the phone over. Nothing about the child is asked for or kept — no name, no age, no photograph, no location. What the child makes is sent where it has to go to be made, and nowhere else: the words they type or say to the music engine for a song, their drawing to the picture and video engines to bring it to life, and a story's text to the reading voice (a stock voice, never the child's). The microphone in the room turns speech into words using the phone's own speech recogniser, which on many Android phones is Google's; a recording made in the kids editor stays on the phone. Stories and songs are kept only when the grown-up or the child keeps them on the shelf, and go when they are taken off it or the account is deleted. Nothing made in the room is shown to anybody else, and there is no chat, no advertising and no tracking for advertising.

One rule has no exception. No recording of anybody under 18 may be sent to the voice engine — not with a parent's permission, not on a parent's account. So where an account is held by a parent for a younger person, the voice features are off: no cloning, no singing conversion, no reading in your own voice. Everything else works.

If personal information held here is ever accessed by somebody who should not have it, you will be told: what happened, what of yours was involved, and what to do about it. So will South Africa's Information Regulator. That is what POPIA requires and it is not conditional on the breach being our fault — if it happens at one of the suppliers named above and they tell us, we tell you.

You do not have to wait to be told. If you think something is wrong with your account, say so on the help page and it will be looked at rather than triaged.

If this changes in a way that affects what is collected or who sees it, the date at the top changes and anybody with an account is told by email before it takes effect.