Short version: we collect only what we need to run the service, we don’t sell your data, and we don’t track you across the web.
When you sign up, we collect your email and a securely-stored password. When you subscribe, you give your payment details directly to our payment processor — we never see or store your card. When you use the COOK. app, we record basic activity (IP, timestamps, the device the app is running on) so we can keep your account secure, enforce your subscription, and prevent abuse.
To run your account, deliver the app, validate your license, send transactional email (verification, password reset, receipts), respond to support, and stop fraud or abuse. That’s the whole list. We don’t use your data for advertising and we don’t sell or rent it.
A small number of vendors help us run the service. Each only receives the data needed to do its job:
We do not share your data with any other third parties for their own purposes.
We keep your account data while your account is active. If you delete your account, we delete it within 30 days, except for billing records we’re legally required to retain.
You can update your email, cancel your subscription, manage your active devices, or delete your account from your dashboard or by emailing us. To request a copy of your data or have it deleted, reach out to privacy@cooklabpro.com from the address on your account — we’ll respond within 30 days.
We use industry-standard practices to protect your data and the COOK. app is signed and notarized by Apple. If you believe you’ve found a vulnerability, please email security@cooklabpro.com.
If we update this policy in a meaningful way, we’ll post the new effective date here and let active users know by email at least 14 days before changes take effect.
Privacy: privacy@cooklabpro.com
Account / billing: support@cooklabpro.com
Medusa uses your verified Cook Lab account to store coin balances, purchases and generated takes. Browser storage and an account preference remember when you skip or complete the first-visit guide. To prevent repeated free claims, we use a signed browser cookie (lasting up to one year) and keyed hashes of account, email, IP/network and device identifiers. Accounts sharing a network or browser share the free daily allowance. Keyed hashes of the original signup network and browser remain linked to the account while it exists, so changing connections or clearing cookies does not reset that shared allowance. IPv6 addresses are grouped by network.
Cloudflare Turnstile processes browser verification signals for account creation and free previews. Signup attempt limits use keyed network, browser and email hashes; attempt records are eligible for cleanup after 48 hours. ProxyCheck receives your IP address to check for proxies, VPNs and other abusive traffic. These checks determine eligibility for free previews. If verification is unavailable or a connection is flagged, free generation is unavailable. Network risk results are cached for ten minutes. Daily quota records and expired risk-cache entries are cleaned up after fourteen days; purchase ledgers and one-time welcome claims remain to reconcile your balance and prevent repeated grants.
Generated MIDI is processed by our privately hosted Medusa service. Mixed audio auditions are rendered privately on our server and cached for up to seven days. Only the mixed audition is played in your browser; individual samples and plugin presets are not provided. MIDI-only exports contain your separate musical layers. We do not publish your generated takes or provide the Medusa desktop app through this preview.