Lyricsung privacy policy

1. What we keep

• Your email address, to sign you in with one-time codes and to write to you about your account.
• What you make: the lyrics and descriptions you type, the styles and settings you choose, song titles, the songs and their files, and whether you have shared them.
• Purchases: your plan, what you bought and when, and the customer number our payment provider gives you. Card details stay with Stripe; we never see your full card number.
• Usage: which pages and buttons are used, where a visit came from (for example a search engine or an AI assistant), the country of the visit and whether songs were made. These records carry no name or email address. When you sign up, your account also notes which kind of source first brought you.
• Your IP address, to limit free use and stop abuse. We keep it only as a scrambled (hashed) key in counters that are deleted after seven days. Our hosting provider also keeps short-lived server logs, which include IP addresses.

2. Cookies and browser storage

• mp_session keeps you signed in, for 30 days.
• mp_guest lets this browser find the songs it made before you signed in, for 90 days.
• mp_tried remembers that this browser has used its first song without an account, for 30 days.
• mp_src remembers which kind of source first brought this browser, such as a search engine, for 30 days.
• song_link opens the right song when you follow a link in one of our emails, for 24 hours.
• Your browser’s own storage also keeps small things such as an unfinished draft of your lyrics and whether this visit has been counted.

There are no advertising or cross-site tracking cookies. To count page views and measure how fast pages load, we use Vercel’s analytics, which don’t use cookies.

3. Why we use it

• To run Lyricsung for you: sign-in, making and storing songs, downloads, purchases and support. In European law, this is to perform our contract with you.
• To keep it fair and safe, with free-use limits and abuse checks. These limits are counted across the services NorthBright Labs LLC runs on shared infrastructure, so a free allowance can’t be multiplied. This is our legitimate interest.
• To understand and improve Lyricsung, and to publish statistics, such as how long verses usually are, as shares or typical values that can’t identify anyone. We never publish your lyrics or songs without your permission. This is our legitimate interest.
• To email you. Sign-in codes and messages about your account and purchases always arrive; notes such as a song being ready, tips and news can be turned off from any of those emails or from your account page.
• To keep the records the law requires, such as tax records of payments.

We don’t sell your personal information, and we don’t share it for advertising.

4. Signing in with Google

If you choose Google sign-in, Google tells us your email address and that Google has verified it, together with an account number that we discard. That is all we ask Google for: not your name, picture, contacts, files or password.

We use that address only to create your account, sign you in and write to you about your account and purchases. It is stored with your account until you delete the account, is never sold or used for advertising, and is shared only with the providers listed below that we need to run Lyricsung.

You can remove Lyricsung’s access at any time on Google’s side, at myaccount.google.com/connections, and delete your Lyricsung account from your account page.

5. Who else handles your data

Only the providers we need to run Lyricsung, each receiving only what its part needs:

• Stripe, for payments;
• Google, if you sign in with Google;
• our hosting, database and file-storage providers, which hold the site, your account and your songs;
• our email provider, which delivers sign-in codes and other emails;
• the provider of the AI music model, which receives your lyrics, style and settings to make your songs.

We also disclose data when the law requires it, for example in answer to a valid court order. If NorthBright Labs LLC sells or reorganises Lyricsung, your data would move with it under this policy.

6. Where it is processed

Lyricsung’s servers and most of these providers are in the United States, so your data is processed there, including when you use Lyricsung from another country.

7. How long we keep it

• Your account, lyrics and songs: until you delete them, or the account.
• Songs made before signing in: 30 days in the browser that made them, unless you sign in and keep them.
• Sign-in codes: they work for ten minutes and are deleted with your account.
• Hashed IP addresses and abuse counters: seven days.
• Usage records: kept for statistics; they carry no name or email address.
• Payment records: kept by Stripe for as long as tax and accounting law requires.
• Backups: a weekly copy of the database is kept in private storage for eight weeks, so anything you delete is gone from the backups within eight weeks.

Deleting your account removes it together with every song, the audio files and the lyrics and descriptions you typed, and cancels a paid plan.

8. Your choices and rights

• See or get a copy of your data: write to us and we will send it.
• Correct it: change your email address on your account page, or write to us.
• Delete it: delete any song from your library, or your whole account from your account page.
• Stop the optional emails: use the link in any of them, or your account page.
• Object to or limit how we use your data, or withdraw a permission you gave: write to us.

We answer within 30 days. If you live in the EU or the UK, you can also complain to your data protection authority. If you live in California, you have the right to know, correct and delete your personal information; we don’t sell or share it, as California law defines those words, and we won’t treat you differently for using these rights.

9. Children

Lyricsung is not for anyone under 16. If we learn that an account belongs to someone younger, we delete it.

10. Security

Lyricsung runs over encrypted connections, and there are no passwords to steal: sign-in uses one-time codes. Access to stored data is limited to what running the site needs, and backups are kept in private storage. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

11. Changes to this policy

The date at the top shows when this policy last changed. We will email account holders before a change that affects how their data is used.

12. Contact

NorthBright Labs LLC (Wyoming, USA) runs Lyricsung. Write to support@lyricsung.com about anything in this policy.