> could it be any licensing problem

No more than storing your legally-archived CDs on <insert cloud storage service>, I would imagine.

IANAL, of course, but intuitively there shouldn't be any issues as long as the songs aren't made available to anyone other than the user who uploaded it.

There was a startup a while ago called mp3.com[1], their model was:

1. put your CD in your computer

2. our website recognizes the CD

3. we grant you listening access to songs on that CD (without actually ripping/uploading)

They got sued and lost:

>Judge Jed S. Rakoff, in the case UMG v. MP3.com, ruled in favor of the record labels against MP3.com and the service on the copyright law provision of "making mechanical copies for commercial use without permission from the copyright owner."

[1]: https://en.wikipedia.org/wiki/MP3.com#My.MP3.com

That's interesting, although one of the comments in this thread mentioned Capitol Records v. MP3Tunes [1], a similar case tried in the same court 10 years later.

MP3Tunes 'won' in principle but they were liable for ignoring DMCA takedown notices and seeding the service with unauthorized copies of music.

> First, it established DMCA safe harbor protection for online locker services, potentially granting them "broad immunity from copyright liability". Second, it endorsed data deduplication, which allows cloud music services to more efficiently allocate storage and reduce the amount of space needed per user.

I would be curious to know why the rulings were different. If anything it seems like MP3.com provided stronger guarantees that their users legally owned the songs by requiring them to insert a CD.

[1] https://en.wikipedia.org/wiki/Capitol_Records,_Inc._v._MP3Tu...

Thank you! The way I tried to solve this problem is by using signed URLs for the files. So every file URL should only be accessible to a user with the matching credentials. At least, that's the idea :-)

What if the user shares that URL with someone? Or the URL is only accessible if you are signed-in?

Signed URLs (or pre-signed URLs) typically expire after a short time frame. The idea is that they exist for long enough for the object in question to be retrieved in the application, and they then automatically expire. Although they don't typically have a single-use limitation, this is often the intention a developer has when using a pre-signed URL.

Yep! It's a bit of a balancing act because you want the files to be cache friendly (skipping tracks back and forth shouldn't make you download it every time) but you also don't want people to abuse (share) them. You can also restrict the signed URLs by IP address but that can cause trouble for people with dynamic IPs so I opted not to do that.