BandLab

Is BandLab safe?

For making music, yes, and for teenagers it is better designed than most social apps. BandLab is a free recording studio in a phone, with a feed where people share tracks, collaborate and comment. Users under 18 cannot chat or comment, their accounts start private, and the company runs child-safety detection from Thorn. We score it 59/100, a little above Spotify (57) and SoundCloud (54).

The weaker points are the account and the paperwork. There is no two-step login, Apple's label lists identifiers used to track you, and the privacy policy was last updated in April 2023, before BandLab added most of the AI tools it now advertises.

What BandLab does to protect teenagers

BandLab's minimum age is 13, or 16 in Australia, Indonesia and Malaysia, and its terms say anyone under 18 needs a parent's or guardian's consent. Its help centre says users aged 13 to 18 "cannot send or receive messages in chat or post comments on content", with no exceptions until they turn 18. Minors' accounts are set to private by default.

On abuse material, BandLab says it has integrated Thorn's models, which match known child abuse images and videos and use AI to flag new ones, plus text detection meant to spot grooming and sextortion. Confirmed cases are removed, linked accounts terminated and reports filed with the US National Center for Missing and Exploited Children (NCMEC). A tiered content filter hides sensitive material, such as drug references or suggestive album art, from minors and blurs it for adults who choose that.

The gap is the one every app of this kind has: age is what the user types in. BandLab applies the restrictions "based on your registered age", so a 14-year-old who claims to be 19 gets adult chat. Parents should check the birth date on the account.

What the app collects

Apple's label lists identifiers as data used to track you across other companies' apps and websites. Linked to your identity are your name, email, phone number, contacts, photos, videos, audio, user ID, usage and diagnostic data. Device IDs and advertising data are collected without being linked to you, for purposes that include third-party advertising. On Android, Google Play says data is encrypted in transit and only financial information is shared with other companies.

The privacy policy is thinner than the label. Dated 20 April 2023, it says BandLab may give information to third-party advertisers "so that they can notify you of events or products", uses Google Analytics, and stores data on servers in Singapore and the United States. It says nothing specific about the voice changer, AI mixing, stem splitting or song generation added since, which process your recordings. For an app that handles teenagers' voices, an out-of-date policy is a real weakness.

Accounts and passwords

BandLab's account security page offers two tools: a list of logged-in sessions you can sign out remotely, and advice to use a strong password. We found no two-step login. BandLab's data processing addendum, updated in October 2026, does list Twilio for "2FATwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary SMS authentication", but none of its help pages tells users how to turn on a second login step. That matters more than usual because artists use BandLab to store unreleased songs and to collect distribution earnings, and the terms let BandLab withhold payouts if there is "unauthorised access" to an account. If you can, sign in with a Google account and protect it with two-step verification.

We found no reported breach of BandLab itself. Security researchers can report bugs through a form in the help centre, which mentions no reward.

Your rights and the terms

You can delete your account from Account Settings; deletion is permanent and takes your projects with it, so download tracks first. For a copy of your data, or to object to processing, you email BandLab's data protection officer.

The terms, updated on 9 September 2026, give BandLab a broad, transferable licence to use, adapt and distribute what you upload in connection with its services and business, including advertising. Outside the US, disputes go to binding arbitration at the Singapore International Arbitration Centre. US users get individual arbitration under American Arbitration Association rules with a class action waiver, and can opt out by writing to BandLab within 30 days of first registering or of the last change to the terms. Neither the terms nor the policy says whether your uploads train BandLab's AI, though the terms forbid users from training AI on its output or sound library.

How to set BandLab up for a teenager

1. Make sure the account has the child's real birth date, so chat and comments stay off.
2. Keep the profile private, and remind them that what they post publicly can be reused under BandLab's licence.
3. Use a unique password, or sign in with a Google account that has two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary.
4. Check the Sessions list in Security settings now and then and log out devices you do not recognise.
5. If anyone asks for nude images or threatens to share private material, screenshot it, report the account in the app and contact the police.

How we scored it

The regulatory record (86) is clean, though no large regulator has looked at BandLab. Scams and harmful content (70) is high for a social app because chat and comments are switched off for under-18s. Privacy (50) is held back by identifiers used for tracking and an old policy that does not cover the AI tools. Security (55) suffers most from the missing two-step login. For an open music platform with fewer teen limits, compare SoundCloud.