Your files, with clear boundaries

This policy describes the information handled by midiviewer.io when you visit the site, create an account, purchase Credits, or request an audio conversion. Questions and privacy requests can be sent to support@midiviewer.io.

Who operates this service

midiviewer.io is operated by Luo Yao, an individual based in mainland China. The operator and data controller can be contacted at support@midiviewer.io or by mail at 167 Yueji Street, Jinjiang District, Chengdu, Sichuan, China.

Files that stay in your browser

The Viewer, Inspector, Player, Visualizer, and Editor read MIDI files in browser memory. Those tools do not send the selected MIDI file to midiviewer.io. Closing or refreshing the page clears their in-memory workspace. When you first start playback, your browser requests a public General MIDI SoundFont from jsDelivr; that provider receives the ordinary technical information associated with a web request, such as your IP address and user agent.

Information we process

Account and authentication

When you create or use an account, we process your name, email address, verification status, authentication credential or Google sign-in identifier, session identifiers, session expiry, IP address, and user agent. Short-lived verification and password-reset records are used to complete those requests.

Policy acknowledgement

At account creation and checkout initiation, we record your account identifier, the Terms and Privacy Policy versions you acknowledge, the minimum age you confirm, a server timestamp, and the signup method or selected checkout product. This records your acknowledgement, not independent age verification or proof of completed payment. These acknowledgement records do not add IP addresses or user agents.

Conversion Jobs

Before upload, a MIDI is inspected locally. Only after you confirm an MP3 or WAV export does the browser upload the file to private temporary storage. We also record the original filename, file size and content type, requested output format, Job and request identifiers, status, timestamps, storage object keys, and failure information needed to operate and support the conversion.

Billing and Credits

We record Stripe customer, order, payment, and subscription references; product, amount, currency, payment status, subscription period, Credit grants, Credit usage, refunds, and chargebacks. Stripe handles payment-card details; full card numbers are not stored by midiviewer.io.

Support and technical records

If you contact support, we process the message and contact details you provide. Hosting, security, rate-limiting, and error systems may process IP addresses, request paths, timestamps, user agents, and diagnostic identifiers.

Why we use this information

We use the information above to provide requested tools and conversions, authenticate accounts, deliver verification and reset emails, administer Credits and billing, prevent abuse and fraud, diagnose failures, answer support requests, comply with legal and accounting obligations, and establish or defend legal claims. We do not sell personal information or use it for cross-context behavioural advertising.

Temporary file lifecycle

When a conversion completes or reaches a final failure, the conversion worker attempts to delete the source MIDI immediately; a private-storage lifecycle is the fallback if immediate cleanup fails. A successful output is available through the product for 24 hours, and each generated download URL is short-lived. Job history can remain after the source and output files are no longer available.

Service providers

Cloudflare provides site delivery, Workers, private object storage, queues, and database infrastructure. Stripe provides checkout, payment, subscription, and billing-portal services. Resend delivers transactional account emails. Google processes Google sign-in when you choose that option. jsDelivr delivers the public SoundFont requested when playback begins. These providers process information under their own terms and privacy commitments as applicable to their role.

Retention

Local-tool MIDI data lasts only for the browser session. Conversion inputs and outputs follow the temporary lifecycle above. Verification tokens and sessions expire. Account, Job history, Credit ledger, order, subscription, webhook, security, and support records are retained only while needed for the service, accounting and legal obligations, dispute resolution, fraud prevention, and enforcement. When a record is no longer needed, it is deleted or de-identified where reasonably possible.

Your choices and rights

You may ask to access, correct, export, or delete personal information associated with your account, or object to or restrict certain processing, by emailing support@midiviewer.io. We may need to verify your identity and may retain information where law, payment records, fraud prevention, or legal claims require it. Depending on where you live, you may also complain to your local data-protection authority and have additional rights. We will not discriminate against you for making a valid privacy request.

International processing and security

Our providers may process information in countries other than your own. We use access controls, private storage, short-lived signed URLs, and other technical and organisational safeguards appropriate to the service, but no internet transmission or storage system can be guaranteed completely secure.

Children

Accounts, billing, and cloud-conversion services are available only to people aged 18 or older and are not directed to children. Browser-only MIDI tools do not require an account or request a user’s age. If you believe a child has created an account or provided personal information, contact us so we can investigate and take appropriate action.

Changes

We may update this policy when the service or legal requirements change. Material changes will be identified by a new “Last updated” date and, when appropriate, an additional notice.