Privacy and personal data
Last updated: November 9, 2026.
This page states what data Fern processes, for what purpose, for how long and with which providers. It applies to the fern.zaapee.fr website and to the Fern plugin in FL Studio. No audio file leaves your Mac.
Who is responsible for your data
The data controller is Romain Sapet, sole proprietor (entrepreneur individuel, EI) trading as Zaapee Studio, 6 rue d'Empêchy, 26250 Livron-sur-Drôme, France, SIREN 981 910 524. For any question about your data or to exercise your rights: contact@zaapee.fr.
Fern has not appointed a data protection officer: this is not mandatory for its activity.
What the plugin sends, and what it keeps on your Mac
No sound is sent. The plugin measures the audio of your tracks on your Mac and only sends numbers.
When you write to Fern, the plugin sends the following to Claude, Anthropic's model, through the Fern website:
- the text of the conversation (your messages and the previous answers);
- the measurements of your tracks: loudness, peaks, spectrum, correlation, levels per bar;
- the names of your tracks, channels, patterns, plugins and parameters, and the structure of the playlist;
- the project brief, if you wrote one.
The file of a reference track is measured in the plugin and is not sent: only its measurements are.
The following stay on your Mac and are not sent to Fern: your conversation history (saved in your FL Studio project
and in ~/Library/Application Support/Fern), the plugin's technical log and your settings.
Error reports. When the plugin encounters an error, it may send the following to the website: the error type, the technical message (with your home folder masked), the plugin version, the macOS version and the Mac's architecture. Never the content of your conversations. A given error is sent only once per session, and only if an account is connected. These reports are on by default. You can turn them off with "Send error reports" on the plugin's Account screen.
What the website stores
| Data | What it is used for |
|---|---|
| Email address | identify your account, write to you (forgotten password, subscription, new versions) |
| Password | sign in. Only its hash (Argon2) is kept, never the password itself |
| Google, Microsoft or Apple identifier | sign in with that account, if you choose to. Fern receives your email address and an identifier, not your password |
| Language | display pages and write emails in your language |
| Website and plugin sessions | keep you signed in. Only the token's hash is kept, with its last-used date and the device name (for example "Fern on MacBook Pro") |
| Subscription and access | know whether your account has active access: start, end and cancellation dates, Stripe customer and subscription identifiers |
| Credits | keep your balance: credits granted (subscription months, packs, manual additions) |
| Usage | count your credits: for each exchange with Claude, the date, the model, the number of tokens and the cost. Not the content of the exchange |
| Preference for new-version emails | stop sending them to you if you opted out |
| Plugin error reports | fix errors. They are grouped by error and are not linked to your account |
Your payment details (card number, IBAN) are entered at Stripe. Fern does not see them and does not store them.
Your IP address is used to limit repeated sign-in attempts. It is held in the server's memory for a few minutes and is not stored in the database. The server keeps no request log, and the website's error logs contain no IP address.
Why, and on what legal basis
| Processing | Legal basis (GDPR, article 6) |
|---|---|
| Create and manage your account, connect the plugin, provide the service, count credits | performance of the contract |
| Collect payment for the subscription and packs, keep the accounts | performance of the contract, legal obligation (accounting record retention) |
| Limit sign-in attempts, secure sessions | legitimate interest: protect accounts |
| Plugin error reports | legitimate interest: fix the software. Can be turned off at any time |
| Emails announcing new versions of the plugin | legitimate interest: inform users about updates to the software they use. Unsubscribe through the link in each email or from My account |
| Website audience measurement (Google Analytics) | consent, asked on the first visit and withdrawable at any time |
Fern does not sell your data and does not run advertising. Website audience measurement (Google Analytics) only runs with your consent: it counts visits and pages read, and covers neither the plugin nor the content of your account.
Which providers
| Provider | Role | Data | Where |
|---|---|---|---|
| Anthropic PBC | Claude model, which answers in the plugin | conversation, measurements, track and plugin names (see above) | United States |
| Stripe | payment, subscription, invoices | email, customer and subscription identifiers, payment details | European Union and United States |
| Brevo (Sendinblue) | sending emails | email address, email content | European Union |
| GitHub (Microsoft) | tracking error reports, in a private repository | content of error reports, with no account data | United States |
| Google, Microsoft, Apple | sign-in with their account, if you choose it | identifier and email address provided by that service | depends on the service |
| OVHcloud | hosting | all website data | France |
| Google Ireland (Google Analytics, Google Tag Manager) | audience measurement, only if you accept it | pages viewed, referrer, device and browser type, random identifier stored in a cookie | European Union and United States |
What Anthropic does with the data sent. Fern uses Anthropic's API under its commercial terms. According to Anthropic, API inputs and outputs are deleted from its servers within 30 days, unless an exchange is flagged under its usage policy, in which case it may be kept for up to 2 years (article "How long do you store my organization's data?", privacy.claude.com, updated July 1, 2026). This data is not used to train Anthropic's models without express consent ("API and data retention" documentation, platform.claude.com, accessed November 9, 2026). Fern does not give this consent.
Transfers outside the European Union. Transfers to the United States (Anthropic, Stripe, GitHub) rely on the European Commission's standard contractual clauses or on the provider's certification under the EU–US Data Privacy Framework.
How long
| Data | Retention period |
|---|---|
| Account, credits, usage | as long as the account exists. Deleted when the account is deleted |
| Sessions | 30 days on the website, 180 days in the plugin, extended on each use. An expired session no longer gives access to the account; it is deleted with the account |
| Plugin connection code | 10 minutes |
| New password link | 1 hour |
| Accounting records (invoices, payments) | 10 years, legal obligation (article L123-22 du Code de commerce, the French Commercial Code). They are kept at Stripe |
| Error reports | 2 years after the last occurrence |
| Inactive account | deletion after 3 years without sign-in or subscription, with a warning email one month before |
Cookies
Without your consent, the website only sets cookies that are necessary for it to work or for a setting you chose. They are exempt from consent.
| Cookie | Role | Duration |
|---|---|---|
fern_session |
keep you signed in | 30 days |
fern_lang |
remember your language | 1 year |
fern_theme |
remember the light or dark theme, if you chose one | 1 year |
fern_consent |
remember your answer about audience measurement | 6 months, then you are asked again |
oauth_state, oauth_next, oauth_verifier, oauth_lang |
secure sign-in with Google, Microsoft or Apple | 10 minutes |
Audience measurement. On your first visit, the website asks for your consent to Google Analytics. If you accept,
Google Tag Manager loads and Google Analytics sets _ga and _ga_<identifier> (13 months at most), which tell
visitors apart with a random identifier. If you decline, nothing is loaded. You can change your mind at any time with
the "Manage cookies" link at the bottom of every page: withdrawing your consent deletes these cookies.
The payment page is hosted by Stripe, which sets its own cookies there (see Stripe's privacy policy).
Your rights
You can request access to your data, its rectification, its deletion, its portability, the restriction of a processing operation, or object to a processing operation based on legitimate interest. Write to contact@zaapee.fr from your account's email address. Fern replies within one month.
- Delete your account: on request to contact@zaapee.fr, from your account's email address. Deletion erases the account, sessions, credits and usage history. Accounting records stay at Stripe for the legally required period.
- Correct your email address: on request, by email.
- Stop new-version emails: link at the bottom of each email, or My account.
- Stop error reports: "Send error reports" on the plugin's Account screen.
- Erase your conversation history: it is on your Mac, not at Fern. It is in the
~/Library/Application Support/Fernfolder and in each FL Studio project where you used Fern. The plugin does not yet offer a button to erase it: delete this folder, or start a new conversation and save the project.
If you believe your rights are not respected, you can file a complaint with the CNIL (Commission nationale de l'informatique et des libertés, the French data protection authority; cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).
Security
Passwords and session tokens are stored as hashes. The plugin's token is stored in the macOS Keychain. The key for accessing Claude stays on Fern's server: the plugin does not know it. Exchanges between the plugin, the website and the providers go over HTTPS.
Changes
If this page changes in substance, the date at the top of the page changes and account holders are notified by email.
This English version is a translation. The French version prevails.