Privacy policy¶
Last updated: 30 September 2026
This policy explains what Tuneline Studio at https://tuneline-studio.vercel.app ("Tuneline") collects, why, who
handles it and what you can do about it. Tuneline is a personal project run by Karthikeyan Balasundaram. For any
question or request about your information, email karthikkeyan11007@gmail.com.
What Tuneline collects¶
| What | Where it comes from | Why |
|---|---|---|
| Your email address, name and profile picture (and your GitHub username) | GitHub or Google, when you sign in with them. Accounts created earlier with email also have a password, stored only as a hash. | To create your account, sign you in and show who is signed in. |
| What you create | You: pipelines, uploaded datasets, runs with their logs, metrics and reports, registered models, deployments, golden sets, and the computers you connect (their name and GPU details). | To provide the features you use. |
| Your provider keys | You, in Settings → API keys. | To start runs, test keys and manage endpoints with your own accounts at those providers. |
| Technical records | Your browser and the servers: IP address, browser type, and the times of requests and sign-ins. | To keep the service working and secure. |
Tuneline has no advertising or analytics trackers, and it doesn't sell, rent or share your information for marketing. Your browser keeps your sign-in session in local storage so you stay signed in; no advertising cookies are used.
Signing in with GitHub or Google¶
When you choose Continue with GitHub or Continue with Google, GitHub or Google asks you to approve what it shares with Tuneline. Tuneline asks only for your basic profile: your name, email address and profile picture (and, on GitHub, your username). It doesn't ask for access to your repositories, Gmail, Google Drive or any other data, and it never posts or acts on your behalf there.
Tuneline's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your provider keys¶
- Keys are stored encrypted in Supabase Vault. The web page never gets them back; it only shows the last four characters.
- They are used only to act for you: to start the runs and endpoints you ask for, check their status and test keys. A running job receives only the keys its pipeline needs.
- They are never written to logs.
See API keys and security for details.
Who handles your information¶
| Service | Role | What it handles |
|---|---|---|
| Supabase (United States) | Database, sign-in and file storage | Your account, what you create and your encrypted keys |
| Vercel (United States) | Hosts the website and its server | Requests to the site, including IP addresses in its logs |
| GitHub and Google | Sign-in, if you use them | What you approve them to share |
| Google Fonts | Fonts for the website and these docs | Your IP address, when the fonts load |
| Hugging Face, Kaggle, Modal, RunPod, Weights & Biases and OpenAI-compatible APIs | Only the ones you add keys for and choose in a pipeline | The data, models and settings of the runs and endpoints you start there, under your own account with each |
Each of these follows its own privacy policy. What a run sends to a provider, for example a model pushed to your Hugging Face account, is kept there under your account and that provider's terms.
Where it's kept and for how long¶
- Your information is stored in the United States.
- Your account and what you create are kept until you delete them or ask for your account to be deleted.
- Run logs are deleted automatically after 60 days.
- Server and sign-in logs are kept only for Supabase's and Vercel's standard log retention.
- Models and datasets in your own Hugging Face (or other provider) account stay there until you delete them.
Your choices¶
- See and change: most of your information is visible in the app. You can delete pipelines, datasets, keys and computers yourself.
- Delete your account: email karthikkeyan11007@gmail.com from the address you sign in with. Your account and everything stored with it in Tuneline are deleted within 30 days.
- Get a copy: ask by email for a copy of your information.
- Remove Tuneline's access: on GitHub under Settings → Applications → Authorized OAuth Apps; on Google under Google Account → Security → Your connections to third-party apps & services.
Depending on where you live, you may have further rights, such as to object to processing or to complain to a data protection authority. Email to use any of them.
Email¶
Tuneline doesn't send marketing email. The only email it may send is about signing in, such as a confirmation link.
Security¶
Connections use HTTPS, each person's data is kept apart in the database by row level security, and provider keys are encrypted. No system is perfectly secure: if you find a security problem, email karthikkeyan11007@gmail.com and don't post it publicly.
Children¶
Tuneline isn't meant for anyone under 16. Don't create an account if you are under 16.
Changes to this policy¶
When this policy changes, the new version is posted on this page with a new date. Significant changes are also announced in the app.
Contact¶
Karthikeyan Balasundaram, karthikkeyan11007@gmail.com. See also the Terms of service.