Privacy policy

Last updated October 24, 2026.

This policy covers GBK Composer at https://compose.grepawk.com, including GBK Studio, shared song pages, and the GBK Composer plugin/MCP server used from ChatGPT and other MCP clients.

Account information

You sign in with Google or GitHub. We receive and store your provider account id, your display name (GitHub login or Google name) and, when the provider supplies a verified address, your email address. We do not receive your Google or GitHub password. A single username/password account exists only for app-store review (OpenAI's reviewers); its password is stored on our server only as a salted hash. A session cookie keeps you signed in for up to 30 days, and a CSRF cookie protects requests.

Your music and conversations

• Projects, compositions and their revision history (notes, tracks, sections, controller automation, titles), rendered WAV/MIDI files, and your conversations with the in-app composer agent are stored on our server in SQLite databases and files, linked to your account.
• Songs are private by default. A song becomes public only when you publish or share it; a published song's page, title, owner name and audio can then be viewed by anyone with the link and may appear on the Explore page.

Using the plugin without an account

The GBK Composer plugin works without signing in. When you create a composition this way, we store the composition, its revision history and its MIDI files on our server with no account and no name attached, and return a private access key (plus a separate read-only key) to the calling app, such as ChatGPT. We do not keep a copy of the key in a form that lets us give it back. Anyone holding the key can open the composition, so keep it private. If the key is lost, the composition cannot be recovered. While you still have the key you can sign in and claim the composition into your GBK account, which then becomes the way to recover it. Private Studio links contain only the read-only key, inside the part of the link after #, which browsers do not send to servers. Guest compositions are subject to size, rate and daily limits.

AI processing

The in-app composer agent sends your chat messages and the relevant project context to xAI's API to generate responses. The API key is held only on our server and is never sent to your browser. When you use GBK Composer from ChatGPT, your prompts are handled by ChatGPT under OpenAI's terms; our server receives only the tool calls ChatGPT makes (for example, create or edit a composition).

Audio rendering

Our server does not render audio. Synthesis runs in your browser (GBK Studio, or the player shown inside ChatGPT). For signed-in users, a WAV rendered in a connected Studio tab is uploaded to your account so you can download it. MIDI files are created on our server from the stored notes.

Usage statistics

To see whether the plugin works for people, our server counts a few steps per day as plain totals: page views of this site, plugin connections, compositions created, edits, render requests, renders finished in the browser, MIDI/WAV downloads, claims, publishes and deletions, split only by guest or signed-in and by player or Studio. These counters contain no IP address, account id, cookie, prompt, composition content or access key, and cannot be linked to you. No third-party analytics run on this site.

Logs and diagnostics

Our server keeps operational logs (such as request times, paths, IP addresses for rate limiting, account ids, and tool or error codes) and usage counters for daily limits. When something breaks in your browser, the app sends an error report (error message, stack trace, page URL without its query string, browser user agent, app version, recent app actions, and your account id if you are signed in; no IP address, cookies or tokens) so we can fix bugs. Only the most recent reports are kept. We do not use third-party analytics or advertising trackers and do not sell personal data.

Retention and deletion

Account data is kept while your account is active. You can unpublish or delete content from the app; to delete your account and its data, ask through support. Rendered files (WAV/MIDI) are deleted automatically after 30 days. Compositions created without an account are kept until you delete them with the plugin's delete tool (it needs the private key), claim them into a GBK account, or ask us to delete them: send the composition id through support (never post the access key publicly); we may ask you to prove you hold the key privately. Without the key we cannot identify which compositions are yours.

Changes and contact

We will update this page when practices change. Questions: see support.