CortexDJ

Privacy policy

Last updated: November 3, 2026. What changed: on macOS, CortexDJ 2.38 keeps Pro and Lifetime licence keys encrypted with a key held in your Keychain and makes its settings folder readable only by your macOS user; its new Send to rekordbox writes a playlist file on your computer and sends nothing. Earlier the same day: the free key from inside the app is made only after you confirm your address, and it comes in a second e-mail; product e-mails go only to addresses that were confirmed; the community board sets a form cookie that ties its forms and e-mailed links to your browser; e-mail is delivered through Amazon SES (since October 31, 2026) instead of Resend. Previous update (November 2, 2026): CortexDJ 2.37 listens to your tracks with a sound model that ships with the app, learns from your edits, keeps your recent sets, starts a backup player beside live sets and can show what is playing on a page only this computer can open, all on your computer; diagnostics, if you turn them on, also say whether the previous session ended normally. Previous update (October 31, 2026): CortexDJ 2.35 can use a rekordbox collection XML you choose as its BPM reference; it reads that file on your computer only and never changes it. Previous update (October 28, 2026): a section on the community board, which asks you to confirm your e-mail address before a post appears and can e-mail you about replies. Previous update (October 19, 2026): the app section now says that CortexDJ can use the key, energy and tempo another DJ program already stored on your computer for a track. Previous update (October 15, 2026): the operator is named; the Meta (Facebook) Pixel and Conversions API were removed from the website; the app section covers version 2.32 (diagnostics opt-in, no device names, update checks you can switch off, free key from inside the app) next to what earlier versions do; the free-key confirmation e-mail is described.

Who we are

CortexDJ is developed and operated by Toma Tomov (“we”, “us”), who is the controller of the personal data described here. Contact: hello@cortexdj.com.

Purchases are made through Lemon Squeezy, which is the merchant of record: Lemon Squeezy sells and charges for your order and handles billing, taxes, invoices and refunds. It processes your payment details under its own privacy policy; we never see your card details.

The app: what stays on your computer

  • CortexDJ runs locally. It analyzes your music files (tempo, key, energy, structure) and stores the results in a cache folder next to your music and in your user app-data folder.
  • It reads key, energy and BPM tags already written into your files (for example by other DJ software or by the store you bought them from).
  • If another DJ program on this computer has already analyzed a track, CortexDJ can use the key, energy and tempo that program stored locally for that track. It only reads those results; it never changes the other program’s files, and nothing is uploaded.
  • If you choose a rekordbox collection XML as your BPM reference, CortexDJ reads the track locations, file sizes, lengths and BPM values in it, on your computer only; nothing is sent, and the file is never changed.
  • Sound analysis (version 2.37 and later): CortexDJ also listens to each track on your computer to tell its style, its instruments and where the vocals are. It uses a sound model that ships with the app (YAMNet, published by Google). Nothing is downloaded for it and nothing is sent. The results are stored with the rest of the analysis: in your library on this computer and in small cache files in the .aidj_cache folder next to your music. To name styles the way you do, it compares tracks with the genre tags already in your library, on this computer and in memory only.
  • Learning from your edits (version 2.37 and later, on unless you turn it off): CortexDJ notes what you do with the sets it plans and leans its next sets your way. It records the track list of every set it plans; the tracks you keep, replace, move, remove or add; the transitions you change or rate; the stars you give a set; and, in a live set, the tracks played through to their mix-out, the tracks you skip or play by hand, and the order of the tracks you pick. It keeps this in feedback.db in your user app-data folder, next to config.json and library.db (with feedback.db-wal and feedback.db-shm beside it while the app runs). It holds file paths and scores, never audio. It uses the stars in your library but does not store them. It is never uploaded or sent anywhere, Diagnostics included. In Settings → Mixing → LEARNING, “Learn from my edits” turns it off, “What CortexDJ learned…” shows what it knows with a Forget button for each item, and “Reset learning” deletes it. Removing a track from your library also removes what was learned about it.
  • Backup player (version 2.37 and later, during live sets): CortexDJ starts a second CortexDJ process on this computer that keeps the music going if the main app crashes or stops responding. It keeps the running order of the set in your user app-data folder (deleted after 7 days), reads tempo and cue points from your library on this computer, talks only to the main app on this computer (127.0.0.1) and never contacts the internet. Each set gets a new random code, which the two processes check without ever sending it. Settings → Audio → BACKUP PLAYER: “Keep the music going if CortexDJ stops during a live set” (on by default) turns it off.
  • Stream DJ mode (version 2.37 and later, Pro and Lifetime): it can write the artist and title of the playing track to a text file where you choose, with a small .json file beside it. If you turn it on (it is off by default), it also shows them on a now-playing page served only to this computer (127.0.0.1, port 8791 unless that one is taken): other devices and websites cannot read it. It keeps a list of the tracks each stream played in your user app-data folder (streams); to avoid repeats it uses the play dates your library already keeps. Stream DJ mode itself sends nothing; a live stream to a service runs only if you tick “Live stream”, as before.
  • Your recent sets (version 2.37 and later): CortexDJ keeps your last 30 sets, their running order (the tracks’ file paths, titles and artists) and their transitions, with your edits, in the sets folder of its app-data folder, so you can open them again. They never leave your computer.
  • Send to rekordbox (version 2.38 and later): CortexDJ writes a playlist file (for a Mixed set, also the mix and its track list) in Music › CortexDJ › rekordbox on your computer, for you to import into rekordbox. It never writes into rekordbox’s own library or settings, and nothing is sent.
  • Settings, including your licence key and your broadcast/stream keys, stay in your user app-data folder. Stream keys are stored encrypted: DPAPI on Windows, a Keychain-held key on macOS. On macOS (version 2.38 and later), Pro and Lifetime licence keys are encrypted with that Keychain-held key too (free keys stay in plain text), and the settings folder and its files can be read only by your macOS user. On Windows, licence keys stay as before in your Windows user’s own app-data folder.
  • Your music, mixes, library, file names and analysis are never uploaded by the app.

The app: when it contacts the internet

Version 2.32 and later

  • Update check (automatic, can be turned off): each time the app starts, it downloads a small file from cortexdj.com naming the latest version. The request carries the app version and whether you use Windows or macOS. Nothing is installed without asking you. Turn it off in Settings → About → Privacy.
  • Licence activation (when you activate a key): the app sends the key (which contains the e-mail address it was issued to) and a hashed identifier derived from your computer’s system ID, so we can enforce the limit of two computers per key. The identifier contains no name or hardware serial number, but it is stored next to your licence and therefore next to your e-mail address.
  • Pro subscription renewal (automatic, subscription keys only): near the end date the app asks cortexdj.com for your renewed key, at most once a day, sending the key and the same computer identifier. Free and Lifetime keys never trigger it.
  • Free key from inside the app (only when you ask): the e-mail address you type is sent to cortexdj.com. We e-mail a 6-digit code and a confirmation link; the request is kept for up to 30 minutes. Only after you confirm is the key made: it is handed to the app and e-mailed to you, for another computer.
  • Live-streaming and publishing (only when you start them): the app connects to the service you choose (for example YouTube, Twitch, Facebook or Mixcloud), under that service’s own privacy policy.

Version 2.31 and earlier

  • The update check runs each time the app starts and can’t be switched off.
  • Activation and Pro subscription renewal work as above; renewal is checked automatically, at most about once every 20 hours, from two weeks before a subscription key’s end date.
  • Diagnostics are on by default (see below).

Like any website, cortexdj.com and its content-delivery network (Cloudflare) receive your IP address with these requests and may keep standard access logs.

Diagnostics

Version 2.32 and later: off unless you turn them on. Nothing is sent unless you tick “Send diagnostics” in the first-start notice or in Settings → About → Privacy. When on, the app reports about once an hour while it runs, and right after a mix finishes or fails: a random diagnostics ID (not your licence or computer identifier, so a report can’t be matched to your e-mail), the app and operating-system versions, CPU/RAM/disk load, uptime, your plan, which supported controller model is connected, how many audio outputs and other MIDI ports there are (counts only, never device names), the video encoder in use, whether the previous session ended normally (version 2.37 and later; for this the app keeps a small file in your app-data folder that holds only the app version and a code made from the diagnostics ID, reported only if diagnostics are still on at the next start), and short error and activity lines (for example that a mix of 20 tracks rendered in 97 seconds). Names, file names, paths and e-mail addresses are removed from every line before it is sent. Turning diagnostics off stops all reports at once and the app forgets the diagnostics ID.

Version 2.31 and earlier: on by default. The app sends a report about every 90 seconds while it is open, and once more after a mix finishes. It contains the app version, operating system, CPU/RAM/disk load, uptime, the names of connected MIDI and audio devices (device names sometimes include a person’s name, such as “Alex’s headphones”), the video encoder, your plan, recent error messages and activity counts, with titles, file names and paths stripped out. It carries the same computer identifier as activation, so a report can be linked to the e-mail on your licence. Turn it off in Settings → Audio → “Share diagnostics”; updating to 2.32 or later makes diagnostics opt-in. Since October 15, 2026 our server no longer stores the device names from these reports, only how many devices there are, and the names already stored are dropped the next time that install reports, or straight away if you ask us.

Either way, our server stores a truncated IP address with each report (the last part removed, e.g. 203.0.113.0).

The website and e-mail

  • Free-key form. When you request a free key we store your e-mail address with the date and the full IP address of the request, so we can block abuse of a form that mints keys and sends mail. We use the address to send the key and the download links and, once the address is confirmed (with the confirmation link or code, or because the key was activated in the app), occasional product e-mails; you can unsubscribe from product e-mails at any time.
  • Confirmation e-mail. If the anti-bot check can’t run in your browser, we e-mail you a one-time confirmation link instead of refusing. Until you open it (at most 48 hours) we keep the address in a pending request; the link itself contains a random ID, not your address.
  • Anti-bot check. The form uses Cloudflare Turnstile. Cloudflare receives your IP address and browser signals to run it, under its own privacy policy. It does not receive your e-mail address.
  • E-mail delivery. Every e-mail from cortexdj.com (keys, confirmations and product e-mails) leaves our own mail server through Amazon SES (Amazon Web Services), which receives the recipient’s address and the message, and nothing else from the sign-up record. Before October 31, 2026 keys and confirmation e-mails went through Resend.
  • No advertising trackers. The site uses no advertising pixels and no analytics cookies. (It used the Meta Pixel until October 15, 2026; that and the server-side Meta Conversions API were removed.)
  • Cookies and local storage. Lemon Squeezy’s affiliate script sets an ls_aff_ref cookie when you arrive through an affiliate link, so the referrer is credited if you buy. If you arrive with utm_ campaign parameters, the home page keeps them in your browser’s local storage for 30 days and passes them to the checkout, so we can see which campaign led to a purchase.
  • Purchases. Lemon Squeezy tells us the e-mail address, plan and order details of a purchase so we can issue and renew your key; we log them with a fingerprint of the key.

Community board

  • What is public. When you post on the community board, your display name, the date and what you wrote are shown to everyone and can be indexed by search engines. Use a nickname if you prefer.
  • Your e-mail address. Posting needs an e-mail address, and it is never shown on the board. We send it a link to confirm it, and your post appears only after you open that link and press the button. We also use it to answer you about your post, and, if you ask for it, to tell you about replies (below). Only the CortexDJ team sees it.
  • Confirmed-address cookie. When you confirm, your browser gets a cookie (cm_v, 180 days, used only on the board) that remembers the confirmed address, so your next posts appear straight away. Delete it to make the board ask again.
  • Form cookie. Every visitor of the board gets a cookie with a random value (cm_b, 30 days, used only on the board). It ties the board’s forms and the links we e-mail to your browser, so another website cannot post, confirm or sign in in your name. It contains nothing about you.
  • Reply e-mails. If you tick “Email me when someone replies” or press Subscribe on a topic (confirmed by e-mail first), we e-mail you when a new reply appears there. Every such e-mail has a link that stops them.
  • Editing and deleting. You can edit or delete your own posts in the browser where you confirmed your address, or in another browser after opening a one-time link we e-mail to that address. A deleted post is removed for good.
  • What else only we see. The app version and operating system fields are optional. We also keep a one-way hash of your IP address with each post, to stop spam and to count one vote per visitor on ideas; the IP address itself is not stored with the post.
  • Anti-bot check. The posting forms use Cloudflare Turnstile, as described above. Posting over Tor is blocked.
  • E-mail delivery. Confirmation links and reply e-mails, and the copy of each new post that goes to the team, leave our own mail server through Amazon SES (Amazon Web Services).

Why we process it (EU and UK visitors)

  • To issue, activate and renew licence keys and to deliver what you bought: performance of a contract.
  • To keep the free-key form, activation and downloads safe from abuse (IP addresses, rate limits, logs): our legitimate interest in running a secure service.
  • To run the community board and keep it free of spam (your posts, the IP hash, rate limits): our legitimate interest in offering a place for questions, ideas and bug reports.
  • Diagnostics in version 2.32 and later, and product e-mails: your consent, which you can withdraw at any time.

You can ask to see, correct or delete your data, object to processing, or ask for a copy, by e-mailing hello@cortexdj.com. You may also complain to your data-protection authority. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Retention and deletion

We keep the sign-up record (e-mail, date, IP) and your activation records for as long as your licence exists, and diagnostics reports for as long as an install keeps sending them. Pending confirmations expire after 48 hours (website) or 30 minutes (app). Posts that are not confirmed within 48 hours are deleted, with the address. Confirmed community posts stay up until you ask us to remove them, or until we remove them for breaking the board rules; the address, the optional fields and the IP hash are kept with the post, and a subscription until you stop it. Ask us and we will delete any or all of it; deleting activation records frees your computer slots, so tell us if you want to keep the licence usable.

Contact

Privacy questions and requests: hello@cortexdj.com. We answer from a real mailbox, not a ticket system.