How we protect your account, payments, and music

Accounts are protected by email + password sign-in and optional Google sign-in, issued by our managed authentication provider. Session tokens are stored in the browser and rotated automatically; sign out clears them locally.

Administrative actions are gated by a server-side role check — client-side state cannot grant elevated access.

Checkout is processed by PayPal and (where enabled) Stripe. MusicCarnival never sees or stores your full card number, CVV, or PayPal credentials. Payment confirmations are verified server-side before any download is unlocked.

Master audio files (MP3 / WAV) live in private storage buckets. Access is granted only to the buyer's account, via row-level rules that match your library entries to the requested file. Public links to master files are never exposed; downloads use short-lived signed URLs.

We collect the minimum needed to deliver your purchase: your email, name (if provided), order details, and download history. We do not sell personal data.

To request a copy of your data or deletion of your account, email support@musiccarnival.store.

We rely on a small number of trusted providers to run the service: a managed database/auth/storage backend, PayPal and Stripe for payments, and an email delivery provider for transactional messages. Each is used only for its stated purpose.

If you believe you have found a vulnerability, please email support@musiccarnival.store with steps to reproduce. Please give us a reasonable window to investigate before any public disclosure.

MusicCarnival secures the storefront, your library, and the delivery pipeline. You are responsible for keeping your password safe, reviewing devices signed in to your account, and complying with the license terms attached to each track.