Legal
Last updated 26 September 2026
The short version. We store your account, your projects and a record of what each composition cost. We don't sell your data, we don't use your projects to train models, and we don't run advertising. The only analytics on the site is a tag we build ourselves.
An email address, the composer name you choose to print on exported scores, and whatever Google passes us to identify you if you sign in with it. If you sign up with a password, we keep only a salted scrypt hash of it: a one-way scramble that can check a password but can't be turned back into one. Sign in with Google and we hold no password at all.
The briefs you write, the plans and scores generated from them, scores you import, and their version history. This is the material the service exists to hold, and it is visible only to your account.
Your plan, your credit balance, and a ledger of every charge and refund — what it was for, when, and what it cost us to run. We never see your card details. Payments are handled by our payment processor, and card numbers go to them, not to us.
Ordinary server logs: IP address, browser, timestamps, which endpoint was called and whether it worked. We use these to keep the service running, to debug failures, and to catch abuse.
Composing sends your brief and the piece being written to the third-party AI model providers that power our composers. They process it only to return the music, and are bound by their terms not to train on data sent through their APIs.
We do not train models on your projects, and we do not licence your work to anyone for that purpose.
We share data only with the providers needed to run the service:
We don't sell personal data, and we don't share it for advertising. If the business is ever sold, your data may transfer with it, and you'd be told first.
Your projects stay until you delete them or close your account. Closing it removes your projects and your personal details at once. The record of credits spent and bought is kept as long as tax and accounting rules require, attached to nothing that identifies you. Logs are kept for a limited period and then discarded.
Depending on where you live you may have the right to see the data we hold, correct it, delete it, take it elsewhere, or object to some processing. Two of those need no email. Download your data, in the account menu, gives you one file with your account, its credit history and every piece you can open, each as MusicXML and ABC with its versions and chat. Delete account, in the same menu, closes it for good. For anything else, write to hello@larkato.com and we'll action it.
We use what's needed to keep you signed in and to remember your preferences — your theme choice, for instance, which is stored in your own browser and never reaches us. No advertising cookies.
For analytics we use a single tag, and we make it ourselves: Kicklace, the customer-records tool this same company builds. It records which pages you open, how you arrived — the site that linked you, or the campaign in the link — and when you download a file. It keeps one random id in your browser's own storage, sets no cookies, and goes to no ad network. It loads from kicklace.com, so that name appears in your browser's network tab: that is us, not somebody we handed you to.
The service isn't intended for children under 13, and we don't knowingly collect their data. If you believe a child has given us data, tell us and we'll remove it.
We'll post any update here and change the date at the top. Material changes get notice in the app or by email first.