Suno

Is Suno safe?

Suno is safe in the narrow sense: the app does not put your phone at risk, and there is little contact with strangers. It is a weak choice for privacy, and its security record is now poor: a breach in November 2025 exposed more than 55 million accounts, and it became public through the press eight months later. Everything you upload or create can be used to train its models, Apple's label says your content and identifiers may be used to track you, and the policy offers no way to opt out of training. Then there are the lawsuits over what it learned from and what it produces. We score it 49/100, below ChatGPT and its rival Udio.

What Suno does with your songs, lyrics and voice

Suno's privacy notice, last modified on 23 June 2026, says it uses your submissions, chat with its Suno Chat assistant and other content "to train and enhance the models that power our Services". It also covers the Voices feature, which builds a model of your voice from recordings you upload. Suno says this may count as biometric data in some places, and that it uses it to develop its models as well. The notice offers no switch to keep your material out of training.

The App Store label is unusual. Most apps that track you list identifiers or usage data. Suno lists user content too, alongside identifiers, as data that may be used to track you across apps and websites owned by other companies. Your name, email, phone number, audio, search history and device IDs are linked to your identity. The notice says Suno does not sell your information, and data is stored mainly in the United States.

Account security

You cannot set a Suno password. According to its help centre, sign-in runs through single sign-on (Google, Apple, Discord or Microsoft) or a one-time code sent to your phone. That is a reasonable design: your account is as safe as the Google or Apple account behind it, so turn on two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login there. Google Play says data is encrypted in transit.

The weak point was Suno's own systems. In November 2025 an attacker took a copy of its user data, and it stayed out of public view until 404 Media reported the hack and Have I Been Pwned loaded the data on 20 July 2026. It holds 55.3 million unique email addresses, phone numbers for people who signed up by phone, and, for tens of thousands of buyers, Stripe records with names, postal addresses, purchase amounts and the card type, expiry date and last four digits. Suno says it never had full card numbers. A spokesperson confirmed the incident to TechCrunch, which reported that Suno had not published a notice or told users by then. Several class actions followed in federal court in Massachusetts and were consolidated as In re Suno Data Breach Litigation; they are allegations. Expect phishing that quotes your Suno purchases, and check your address at Have I Been Pwned.

The copyright lawsuits

In June 2024 Universal, Sony and Warner sued Suno in federal court in Massachusetts, alleging it trained on their recordings without permission. Suno argues that training is fair use. Warner settled on 25 November 2025 and became a partner: Suno agreed to launch licensed models in 2026 and retire its current ones, to require a paid account for downloads, and bought the concert site Songkick from Warner. The terms were not published.

Universal and Sony did not settle. In August 2026 the judge allowed them one amended complaint, which they filed on 25 August, and refused a second; discovery was still running in October 2026. On 18 September 2026 they filed a second suit over more recordings. Independent artists have sued since 2025, and music publishers including Round Hill and Reservoir filed their own suits from August 2026. Not every case lasted: Poseidon Wave Media, the company behind the duo The American Dollar, sued in New York in May 2026 and dropped the case with prejudice in August, and Jamendo, the Winamp group's music library, sued in June and withdrew in August without prejudice. A Texas musician, Joseph Anthony Reyna, filed a trademark suit of his own in June 2026. Suno is also using the courts itself: in October 2026 it asked a federal court in Tennessee to make the Mechanical Licensing Collective hand over years of streaming data for its defence against Universal and Sony. All of these claims are allegations; no US court has ruled on them.

In Germany a court has. On 31 July 2026 the Munich Regional Court ruled for GEMA, the German music rights society, over six songs including "Atemlos", "Daddy Cool" and "Big in Japan", finding that Suno had reproduced protected works without permission. Suno argued that its models hold only mathematical parameters, not the songs, and that US fair use applied; the court disagreed. It ordered Suno to stop and to pay damages, with the amount still open. The ruling is not final and Suno said it was considering an appeal.

Why this matters to you: Suno's terms put the responsibility for what you upload on you, and commercial use of a song is allowed only on a paid plan. If you release a track that resembles a protected song, a takedown or claim lands on you, not on Suno.

Who should be careful

• Musicians who plan to release Suno tracks on streaming services: read the plan terms and listen for close copies.
• Anyone using Voices: your voice model trains Suno's systems, and the terms forbid cloning someone else's voice.
• Teens: the app is rated 13+, but the terms include binding arbitration and a class action waiver, which limit how you can complain.

How to use Suno more safely

1. On an iPhone, deny the tracking request so your activity is not linked to other companies' apps.
2. Do not upload recordings of other people or lyrics you do not own.
3. Protect the Google, Apple or Discord account you sign in with, using two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login.
4. To delete your data, email Suno as the privacy notice describes and keep a copy of your request.

How we scored it

Security (40) is the weakest factor, after a breach of 55 million accounts that users heard about from the press. Privacy (42) and transparency and control (45) are close behind: training on all your material with no opt-out, and content used for tracking. The regulatory record (85) is high because no privacy or consumer regulator has acted; the copyright suits are counted as context, not fines. For a creative app from a different owner, compare CapCut.