b2b privacy policy

Effective October 19, 2026

b2b is made by Keya LLC. This policy covers b2b for Mac, the b2b app for iPhone and Android, the website at b2b.keya.dev and the demo at demo.b2b.keya.dev.

  • Your music files stay in your own cloud storage and on your devices. b2b's servers never receive, store or relay them. The only audio that reaches them is voice you dictate, which is transcribed and discarded.
  • Signing in is optional. Signed in, your playlists, your tag edits, a copy of your library's track details and your Ask history are kept in our database, so your devices stay in step. Deleting your account deletes them.
  • No advertising, and no tracking across other sites or apps. Usage and crash reports are sent only while you are signed in, and never include your music, your library or anything you type.
  • If you share a track or playlist by link, we keep that link's details until you turn it off.

b2b for Mac

b2b for Mac reads your rekordbox library on your Mac. It publishes a copy of the library (track list, waveforms and covers, and smaller copies of tracks when your phone asks for them) to the b2b folder in your own Dropbox, through the Dropbox folder on your Mac. None of that passes through our servers. The b2b website talks to it on your Mac directly.

When it is paired with your b2b account, it also exchanges the data described under Your b2b account with our database, and it keeps your Ask history on your Mac.

Dropbox

You connect b2b to your own Dropbox account on Dropbox's sign-in page. The phone app keeps the access Dropbox grants in the iPhone keychain and talks to Dropbox directly. It reads the library b2b for Mac publishes to the b2b folder in your Dropbox (track list, waveforms, cover art) and the music files that library points to. It writes your tag edits, links you add to Wanted, and a note of which phone is connected into that b2b folder as small files, so b2b for Mac can pick them up. It also writes what you did with suggested tracks there (see Playlist suggestions). Dropbox's own privacy policy covers your Dropbox.

On the website, Dropbox is for when the page can't reach b2b for Mac on your computer. The website asks Dropbox for permission to read, never to write, and keeps that access in your browser's own storage. It reads the same library and music files straight from Dropbox, and keeps a copy of the track list, waveforms and covers in that browser, so the page opens without a connection.

Your b2b account

Signing in is optional. You sign in with Apple, Google or a code sent to your email, through Clerk, our sign-in service, which keeps your email address, your name and an account ID. If you ask b2b to email you a link, it goes to that address only, sent through our own mail service. Signing in can show a check from Cloudflare that you aren't a bot.

Signed in, what you do is kept in our database (run by Convex) so your phone, the website and your Mac stay in step: tag and track detail edits, your playlists and their versions (with each version's name, note and who saved it, and who a playlist's shared folder is shared with), links you add to Wanted, and requests for phone copies of tracks. Ask's questions and answers are kept there too, as described under Ask.

When you pair b2b for Mac with your account, the database keeps the name your Mac goes by, when it last checked in and published your library, how many tracks the library has and how many of them have their audio in Dropbox, and what, if anything, is stopping it. The Mac also sends a copy of your library's track details: for each track its title, mix, artist, tempo, key, length, genre, tags, label, rating and the date it was added, with your playlists and tag categories. It holds no audio, file names or paths, and each new copy replaces the last. It is what assistants you connect can read (below).

Your music files are never part of any of it.

Delete your account in the app under Settings, Account, or on the website under Options, Account. That deletes everything our database keeps for the account, including the library copy, and then the sign-in itself. Shared links, daily Ask counts and usage reports are handled as described below; email us to have those removed too.

Assistants you connect

You can connect an AI assistant, such as Claude or ChatGPT, to your b2b account at b2b.keya.dev/mcp. You sign in to b2b and approve it, and it can then read your library copy and your playlists, and add tracks you ask for to your Acquire inbox. What it reads goes to that assistant's provider and is handled under that provider's privacy policy. To stop it, remove b2b from the assistant's connectors.

Voice

b2b records only while you hold the mic button (or the key for it on the website), and only if you allow microphone access. When you let go, the clip is sent over an encrypted connection to our server at b2b.keya.dev, from the phone app with your b2b sign-in or, signed out, your Dropbox access token, and from the website through b2b for Mac or with your sign-in. With the Dropbox token, the server uses it only to ask Dropbox which account is asking, and remembers the answer in memory for up to five minutes. It then has the clip transcribed by Deepgram's Nova-3 speech-to-text model, which runs on Cloudflare Workers AI, and sends the text back. A clip can pick up music playing in the room.

When b2b reads an answer aloud, the answer's text goes to our server and to Deepgram's Aura-2 speech model on Cloudflare Workers AI, and the speech comes back. We don't store the recording or the speech. The text made from a recording is kept only when it is an Ask question you asked while signed in, as described under Ask. Every clip is sent with Deepgram's model-improvement program turned off, and Cloudflare, which runs our server, says it doesn't use content sent to Workers AI to train AI models.

Ask

When you ask b2b something about your library, the words you typed or spoke, with the names of your genres, tags and playlists, go to our server and from there to an AI model. Signed out, we don't store them, and your Ask history is kept by b2b for Mac on your own Mac.

That model runs on Cloudflare Workers AI and turns the sentence into a filter. For accounts where Ask's conversation is turned on, a question that asks for advice or follows up on an earlier answer goes to an Anthropic Claude model instead, reached through OpenRouter, a service that passes requests on to AI model providers. They receive the question, the names of your genres and tags, the recent conversation and what it looks up in your library copy to answer: track titles, artists, tempo, key and genre, and your playlists. The conversation itself is held by your browser or the app, and our server keeps a daily count of such questions and of the tokens they used for your account. OpenRouter's privacy policy says it does not use what is sent or answered for model training, and that a model provider handles it under its own terms.

Signed in, b2b keeps each question and its answer in your account's database, to make Ask better, and the app's History lists your questions from there: what you asked, including the names you picked with @, the conversation before it, what the model looked up and answered, the answer as the app showed it, the tracks it showed, the model, prompt and app version, and how long it took and what it cost. It keeps whether you gave the answer a thumbs up or down, and what you did with it: staged, discarded or undid its tag changes; opened, played, added or loaded a track it showed; saved or played a playlist it made, and how you changed that playlist in the week after (the playlist as Ask made it is kept beside your changes). It notes when you ask the same question again within two minutes, and after a thumbs down your next question is kept as the correction. Clearing History in the app hides your questions from the list; deleting your account deletes all of it.

We may share or license this Ask data with others, for example to help train or test AI models, only after it is de-identified: your account ID, name and email are removed, each record gets a new random ID that can't be traced back to you, and words you typed that could identify you are taken out. We don't try to re-identify it, and anyone who receives it must agree in writing not to try either.

Playlist suggestions

When you make or edit a playlist in the app, it suggests tracks from your library for the playlist's name and the vibe you gave it. To read the name and vibe, the app sends them, with the names of your genres, tags and playlists, to our server and from there to an AI model on Cloudflare Workers AI, which answers with the names that fit. We don't store them. The ranking itself happens on your phone.

To make suggestions better, the app keeps what happened to them: which tracks it suggested, and which you added, declined or flagged, with the reason and any note you typed or said. That record, with the playlist's name and vibe, is a small file in the b2b folder of your own Dropbox, not on our servers, and is used to test changes to how suggestions are chosen. Delete the feedback folder inside it to delete them. Nothing is kept for the sample library.

Mix ratings

While the app mixes one track into the next, you can rate the mix with a thumbs up or down. To make mixing better, the app keeps each mix you rated, or skipped, paused or scrubbed through: the two tracks, how the app planned and played the transition, your rating and what you did. That record is a small file in the same feedback folder of your own Dropbox, not on our servers, and is used to test changes to how mixes are planned. Delete the feedback folder to delete them. Nothing is kept for the sample library.

AI Mix picks

With AI Mix as the play order, the app picks each next track from the ones still to come in what is playing. To make those picks better, it keeps each one and what followed it: the track playing and the ones played before it, the tracks it chose from with their scores, the track it picked, and whether that track played through, you skipped it or you chose another. That record is a small file in the same feedback folder of your own Dropbox (from the website, b2b for Mac writes it there), not on our servers, and is used to test changes to how next tracks are picked. Delete the feedback folder to delete them. Nothing is kept for the sample library.

Shared links

When you share a track or a playlist by link, our server (run on Cloudflare) stores what the link's page shows: titles, artists, keys, tempos and lengths, the Dropbox links to the files, a preview image (the cover and a waveform drawing) and small covers. It files them under your b2b account or, if you shared from the phone signed out, your Dropbox account's ID, which is how you see and turn off your own links. The music itself is never sent to us: the page plays and downloads it straight from your Dropbox.

For each link we count how many times its page was opened and played. To count a play once, the server briefly holds the listener's IP address in memory; it isn't stored. Turning a link off deletes its preview image and stops the page; the record stays, marked off, so the link can't be reused. Anyone with a link can open it until you turn it off.

A playlist published from the b2b website (its tracks, notes and the name you share it under) is stored the same way, with the ID of the account that published it if it was published signed in; comments and collaborators are left out. Email us and we'll take one down.

Stores and other services

b2b for Mac contacts the services you use it with directly from your Mac, not through our servers: Beatport, Bandcamp and Apple to find a track's versions and prices and to fill a cart you asked for, Spotify, SoundCloud, Instagram and TikTok to read a link you gave it, and Mixcloud and SoundCloud to upload a mix you chose to publish. Each of them handles what it receives under its own privacy policy.

When you search the stores in the phone app, the words you searched for go from your phone to Apple and Bandcamp. When you share a Spotify link to the app, or paste one in, the app asks Spotify (open.spotify.com) for the playlist's or track's public title, cover and track count. The link itself is saved to the b2b folder in your Dropbox.

The demo

The demo at demo.b2b.keya.dev is b2b on a demo library, with no account and no sign-in. What you do there, such as tags you stage and playlists you make, stays in your browser; Options, Reset demo clears it. Its music is short excerpts of tracks released under CC0, a public-domain dedication, served by b2b and credited in Options; they are the only audio b2b serves.

If you use Ask or voice in the demo, your words or dictation go to our server and an AI model on Cloudflare Workers AI, as described under Voice and Ask, and aren't stored. To keep the demo available to everyone, the server limits how many calls come from one IP address in a minute, and counts the demo's calls each day for all visitors together. The demo sends no usage reports and connects to no Dropbox, Mac or account.

Usage and crash reports

While you are signed in to a b2b account, the website at b2b.keya.dev and the app send a short record of what was used to PostHog, an analytics service: that b2b was opened, which area or tab was shown, that a sign-in finished and with which provider, that Ask answered and how many tracks it found, that a playlist was made, opened, saved, deleted or published, that a track played, that a mix started and in which style, how a mix was rated, which play order was picked, how many inbox tracks were wanted or archived, how many tracks went to a store's cart or were processed, that something was shared to the app, and how setting up b2b for Mac went: which kind of computer and browser the setup page saw, that the download was started, that b2b for Mac answered and was linked to your account, how many tracks your library has in rough steps and how long reading it took, the first thing you did with it, and which setup step stopped you, if one did. If b2b hits an error, the kind of error and where in our code it happened are sent too. Each record carries your b2b account's ID, an ID the app creates when it is installed, the time, the kind of device, its language, time zone and screen size, and the browser or app version, and, as with any internet request, PostHog sees your IP address, from which it works out an approximate location (city and country).

These records never contain anything you typed or said, an Ask question or its answer, or the name of a track, an artist or a playlist. No name or email address is sent, and b2b does not record your screen, your clicks or your keystrokes. PostHog's code keeps an ID in the browser's storage (not a cookie) or in the app's files; signing out clears it and stops the reports. Signed out, nothing is sent and PostHog's code is not loaded at all.

Page statistics

Cloudflare, which runs our servers, adds its Web Analytics script to the pages of b2b.keya.dev. On shared-link pages and on these pages (terms, privacy, copyright, support and not found) it runs, and reports to Cloudflare the page's address, how long the page took to load, and the kind and version of browser and system that opened it. It sets no cookie and keeps nothing in the browser. In the b2b app and the demo, the page's security policy blocks it, so it sends nothing.

Fonts

The website, the demo and shared-link pages load their typefaces from Google Fonts, so Google sees the IP address of anyone who opens them. These pages use your device's own fonts.

App updates

When it starts, the phone app asks Expo's update service whether a newer version of its code is available. That request carries the app's version, the platform and a random ID the app creates when it is installed. b2b for Mac asks b2b.keya.dev whether a newer version of it is available. Neither request carries anything about you or your library.

TestFlight

If you test b2b through Apple's TestFlight, Apple shares with us the crash reports and feedback you choose to send, and the name and email address you were invited with. If you joined through a public link, you stay anonymous to us.

What stays on your phone

A copy of your library's track list, waveforms and covers, the tracks you download, your recents and settings, tag edits waiting to reach your Mac, the vibe of each playlist you made, and the tracks you asked never to be suggested. Deleting the app deletes all of it.

Who else handles your data

Only the services named above: Cloudflare (our servers, AI models, page statistics and the sign-in check), Deepgram (the speech models, run by Cloudflare), Clerk (sign-in), Convex (our database), Dropbox, OpenRouter and Anthropic (Ask's conversation), PostHog (usage and crash reports), Apple and Google (Sign in with Apple and Google, the app stores and TestFlight, and Google's fonts), Expo (app updates), and the stores and services named under Stores and other services, each only for the feature you used, and each under its own privacy policy. An assistant you connect is yours, and its provider handles what it reads under its own policy. We share nothing else with anyone, and we never sell personal data. De-identified Ask data may be shared or licensed as described under Ask. As with any internet request, each of these services sees your device's IP address.

Your choices

Children

b2b is for people 18 and over. It isn't directed to children under 13, and we don't knowingly collect their data.

Changes

If what b2b does with data changes, we'll update this page and the date at the top.

Contact

Keya LLC, support@keya.dev