Privacy Policy

1. Scope

CUA (Copyright Evidence Infrastructure) is operated by Her Own Sky LLC. It creates verifiable evidence that a piece of work existed, in a particular form, at a particular time.

CUA is infrastructure used by platforms. In most cases you will reach it through a platform you already use, and that platform — not CUA — holds your account and decides what to send us. This policy covers what CUA itself does with information once it arrives.

2. What we collect

2.1 Sent to us when a work is registered

• The audio file, uploaded directly or fetched from a URL the platform provides.
• Work details: title, artist name, an artist identifier supplied by the platform, and optionally album, release year, duration, lyrics and credits.

The artist identifier is chosen by the platform. It is usually their own internal user ID, not a name or an email address.

2.2 Generated by us

• An acoustic fingerprint (Chromaprint) describing how the recording sounds.
• A SHA-256 hash of the exact file submitted.
• A timestamp, a certificate PDF, and where enabled a blockchain transaction.

A fingerprint and a hash are one-way. Neither can be turned back into the recording, and neither contains the audio itself.

2.3 Sent to us through our forms

• API access requests: name, work email, platform or company, and optionally website, platform type, expected volume, timeline and free text.
• Contact messages: name, email, topic, and your message.

2.4 Collected automatically

• Server logs recording the time, method and path of requests, kept by our hosting provider.
• A salted hash of your IP address when you submit a form, used to enforce rate limits and review abuse. We do not store the address itself.
• Your browser's user agent string alongside a form submission.

We do not use cookies, analytics, advertising trackers or fingerprinting scripts. See section 9.

3. What becomes public, and what is permanent

The point of CUA is that a third party can check a claim without asking us to vouch for it. That only works if some information is published. This section says exactly what.

3.1 Verification pages

Every completed registration has a verification page at a URL containing its identifier. Anyone holding that URL can see the work's title, artist name, album, registration date, status, certificate link and blockchain reference. The page is not listed or indexed by us, but it is not secret either.

What is not public: lyrics, credits, the platform's own identifier for the artist, file details and internal metadata. Public reads are limited to a fixed set of verification fields rather than the whole record.

3.2 The blockchain record

Where blockchain anchoring is enabled, we write a record to the Polygon public blockchain. It contains:

• the registration identifier, title, artist name and artist identifier;
• the album, if one was given;
• the original registration date;
• the SHA-256 hash and the acoustic fingerprint hash;
• the issuer (Her Own Sky LLC) and a verification link.

The audio file itself is never written to the blockchain. Only hashes of it are.

4. How we use it

• To create the evidence record — fingerprint, hash, timestamp, certificate and, where enabled, the blockchain anchor.
• To let anyone verify it through the verification page and the public verification endpoint.
• To search for possible unauthorised uploads, where a rights holder asks us to. We query YouTube using the work's title and artist name, and show possible matches to that rights holder only.
• To answer you when you use a form.
• To keep the service working and safe — diagnosing faults, enforcing rate limits, preventing abuse.
• To meet legal obligations, including responding to properly made copyright notices.

We do not sell personal information, we do not share it with advertisers, and we do not use it to train machine learning models.

5. Who we share it with

We use a small number of providers to run the service:

5.1 The platform you came through

If you reached CUA through a platform, that platform sent us the work and can see the registrations it created. Their handling of your data is governed by their own privacy policy, not this one.

5.2 Legal disclosure

We may disclose information where we are legally required to — a subpoena, a court order, or a valid legal process — or where it is necessary to investigate fraud or protect the safety of people or the service.

5.3 Business transfers

If Her Own Sky LLC is merged, acquired, or sells the assets behind CUA, information held by the service may transfer to the acquiring entity, which would remain bound by this policy until it is superseded with notice.

6. Retention

7. Your rights

Depending on where you live you may have the right to access your personal information, correct it, delete it, receive it in a portable format, restrict or object to how it is processed, and not be treated differently for asking.

To exercise any of these, send us a privacy request. We will ask for enough information to be sure the request is genuinely yours, and we will respond within the period the law allows.

If you registered through a platform, you may also need to ask that platform to delete its own copy of your data.

8. Security

• All traffic is served over HTTPS.
• Requests that create or change anything require an API key; verification is deliberately public.
• Database access is restricted by row level security, with write access limited to the service itself.
• Audio is discarded as soon as it has been fingerprinted, so there is no library of recordings to lose.
• Public forms are rate limited, and IP addresses are stored only as a salted hash.

No system is perfectly secure. If you believe you have found a vulnerability, please tell us before disclosing it publicly, and we will work with you.

9. Cookies and tracking

CUA sets no cookies. There is no analytics, no advertising network, no session tracking and no third-party script running on these pages. Fonts are the only external resource the site loads.

Because we do not track visitors, there is nothing for a Do Not Track signal to change, and no consent banner to click.

10. International users

Our servers are in the United States. If you use CUA from elsewhere, your information is transferred to and processed in the United States. The blockchain records described in section 3.2 are, by their nature, distributed worldwide.

The data controller is Her Own Sky LLC. We process information to perform the service requested, to meet legal obligations, and for the legitimate interest of operating and protecting the service. We have not designated an EU representative; the service is operated from the United States.

11. Children

CUA is not directed at children under 13 and we do not knowingly collect their information. If you believe a child's information has been registered with us, tell us and we will remove what we can — noting the blockchain limitation in section 7.

12. California privacy rights

California residents may ask what personal information we collect, ask us to delete it, and ask us not to sell it. We do not sell personal information and never have. You will not be treated differently for exercising these rights.

Make a request through the privacy request form, or in writing to the address in section 14.

13. Changes to this policy

We may update this policy as the service changes. The date at the top of the page shows when it last changed. Where a change materially affects how we handle information already given to us, we will say so rather than relying on you noticing a new date.

14. Contact

For any privacy question or request, the privacy request form reaches us directly. You can also write to us: