Privacy Policy

Last updated October 28, 2026

1. Who is responsible

lyricbook is responsible for your personal data (the “controller”). For anything about your data, email support@lyricbook.ai.

2. What we collect, and why

Your account: your email address and, if you sign in with Google or GitHub, the basic profile those services share (such as your name and picture). We need it to give you an account (performing our contract with you).
What you submit: the Spotify and YouTube links you paste, the song titles, artists, and artwork they resolve to, audio files you upload, your options, and the lyrics we produce. Used only to make your lyrics (contract).
API use: if you use the API, your API keys, which we keep only as a one-way hash (with each key’s name, its first characters, and when it was last used); the metadata you send with a job, kept with the job; and, if you set one, your webhook URL and its signing secret. When a job made through the API finishes, we send its summary (status, the song’s title, artist, and link, options, credits, and your metadata) to that URL, and keep a log of each delivery (what was sent, your server’s response code, and the start of any error reply). Used to run the API for you (contract).
Credits and payments: your balance, a history of purchases, songs, refunds and daily credits, and the days you checked in with the time zone each was counted in (deleted with your account). Stripe handles payment and tells us whether it succeeded (contract, and our legal duty to keep accounting records).
Daily check-in: when you check in, your browser sends its time zone (such as “Europe/Paris”), so your days start at your own midnight. We keep it with the check-in (contract).
Settings: what your account’s settings hold: whether a new request starts with chords and a translation (and into which language), whether sheets open with romanization, whether failed songs show in Your songs, and auto top-up’s bundle and balance. Kept with your account so they follow you to every device (contract).
Auto top-up: if you turn it on, Stripe keeps your card. We store only a label for it (its brand and last four digits, such as “Visa ·· 4242”), Stripe’s ids for you and the card, and a record of each automatic charge (amount, credits, outcome, and why a charge failed). We give Stripe your email address to set you up as its customer (contract).
Usage and performance: pages viewed (with job ids and query strings removed), country, browser, device type, and page load times, through Vercel Web Analytics and Speed Insights, and a few events in the paste form and checkout (such as a link recognised, a song sent, or a checkout started) that carry only counts, yes-or-no flags and bundle names, never your email, a song, or a link. Neither uses cookies or identifies you. We use this to understand and improve the site (our legitimate interest).
Security records: your IP address appears in our hosting logs and, for lookups made before signing in, in a rate-limit counter. The email sign-in form, and the paste form before you sign in, run a Cloudflare Turnstile check, which reads your IP address and browser signals to tell people from automated traffic. Used to keep the Service available and stop abuse (legitimate interest).
Free-song record: when you use your free song, we store a keyed one-way hash (HMAC-SHA256) of your email address and, if you sign in with Google or GitHub, of that account’s ID. The hash can’t be turned back into your address. We check it so each person gets one free song, including after an account is deleted (legitimate interest in preventing abuse of the offer).

An email address is required to create an account; without one we can’t provide the Service. Everything else you choose to send. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects; the automation here is transcription and translation of songs.

3. What we don’t collect or do

Card details. Payments are handled entirely by Stripe, and a card saved for auto top-up is kept by Stripe, never by us.
Tracking or advertising cookies. None, and no cookie banner is needed.
Selling or sharing. We don’t sell your personal data or share it for advertising.

4. Who processes it for us

Supabase: database, sign-in, and private storage of uploaded files
Vercel: hosting, analytics, and performance measurement
Stripe: payments, and keeping the card you save for auto top-up
Resend: sending account emails (sign-up confirmation, password reset) and receiving the emails you send to our addresses
Modal: the servers that fetch and transcribe songs. The audio is sent to its GPU servers through Modal’s storage, which keeps an encrypted copy for up to 7 days before deleting it automatically. The lyrics they send back aren’t kept by Modal once they reach us. Modal also sends the API’s webhook events to the URL you set
OpenAI: translation, when you ask for it. It receives the lyrics text, the song’s title and artist (for an uploaded file, its file name or the title in its tags), and the language it’s sung in. OpenAI doesn’t train its models on this data and keeps it for up to 30 days for abuse monitoring
Anthropic: translation, only when OpenAI can’t translate a song. It receives the same lyrics text, title, artist, and language. Anthropic doesn’t train its models on this data and deletes it within 30 days
Google and GitHub: sign-in, if you choose them
Cloudflare: the Turnstile security check on the email sign-in form and on link lookups before sign-in
Spotify: looking up the songs and albums in your links
YouTube: looking up and fetching the audio of videos you link, and finding recordings of Spotify songs
LRCLIB: checking for published lyrics. It receives only a song’s title, artist, and length (and album, for Spotify songs): from the Spotify track, from a YouTube video’s title and channel name, or from an uploaded file’s title and artist tags. A file without both tags isn’t looked up, and no file name is ever sent
lyrics.ovh: checking for published lyrics LRCLIB doesn’t have. It receives only a song’s title and artist, from the same places as LRCLIB, and passes them to the lyrics sites it searches

5. Where it’s processed

lyricbook is run from the United States and these providers process data in the US and other countries. For people in the European Economic Area, the United Kingdom, and Switzerland, transfers rely on the EU-US Data Privacy Framework and its UK and Swiss extensions (Stripe, Vercel, Cloudflare) or on the European Commission’s standard contractual clauses in each provider’s data processing agreement (Supabase, Modal, OpenAI, Anthropic, Resend). Email us for a copy of these safeguards.

6. How long we keep it

Uploaded audio files: deleted from our storage as soon as they’ve been transcribed; files you add but never send are deleted within 4 hours
Audio fetched for links: only inside a temporary processing container, deleted when it finishes
The copy of a song’s audio sent for transcription (uploads and links alike): kept encrypted by Modal for up to 7 days, then deleted automatically
Lyric results: deleted from our servers 24 hours after they’re made. Copies saved in your browser (section 8) stay there until you delete them
Your list of past songs (titles, status): deleted after 90 days
Account data and settings: until you delete your account
A song you delete from its page: its sheet and its entry in your list of past songs are deleted at once (its credit history stays, as below)
The card saved for auto top-up: kept by Stripe after you turn auto top-up off, so you can turn it back on. Remove card (in your account) has Stripe remove it; deleting your account removes it at Stripe too, along with our label and Stripe ids for it
API keys (the hash, name, and first characters): until you delete your account. A revoked key stops working at once
Your webhook URL and signing secret (and the secret it replaced, which keeps working for 24 hours): until you remove the webhook or delete your account
The webhook delivery log: 7 days
Credit history: kept for accounting. When you delete your account, its entries are no longer tied to an account, but each keeps its amount, date and description (the song’s title and artist, or your file’s name), and purchases keep their Stripe payment reference, which Stripe’s records link to the email you paid with
Rate-limit counters: up to one day
Free-song record (the hash above): kept after you delete your account, for as long as we offer a free song; removed if your free song fails and is given back
Emails you send us: as long as needed to answer you and keep a record of the request
The unsent draft of the form in your browser: two hours

7. Your rights

Depending on where you live, you can ask us to:

Give you a copy of your personal data, including in a portable format
Correct inaccurate data
Delete your data (you can also delete your account yourself from the Account page)
Restrict or object to processing based on our legitimate interests

Email support@lyricbook.ai; we’ll answer within 30 days. If you’re in the EEA, the UK, or Switzerland, you can also complain to your local data protection authority.

8. Cookies and storage on your device

We use only the cookies Supabase needs to keep you signed in, and, if you look up links before signing in, a 30-minute cookie recording that you passed the security check (it holds no personal data). The paste form keeps an unsent draft (your links, options, and any file you chose before signing in) in your browser’s local storage for up to two hours so it survives signing in or checkout; it never leaves your device unless you submit it. Local storage also keeps a few preferences: how you last signed in (Google, GitHub or email, never the address), your download format, how each sheet shows its chords, and Play along’s sound. While you’re at Stripe’s checkout, that tab’s session storage keeps the bundle you’re buying until you’re back.

Unless you turn it off under This device on the Account page (“Save finished sheets on this device”), your browser also keeps a copy of each of your finished lyric sheets in its own database (IndexedDB): the lyrics, translation, romanization and timings, the song’s title, artist, artwork link and source link, and your edits to the sheet. That lets you open a sheet after our servers delete it. The copies stay on your device, are never sent to us, and are visible only when you’re signed in to the account that made them. Signing out keeps them. They’re kept until you delete them on the Account page, delete the song from its page, delete your account in that browser, or clear the browser’s site data. The setting applies to each browser separately.

9. Children

lyricbook isn’t meant for children under 13, and we don’t knowingly collect their personal data. If you think a child has given us data, email us and we’ll delete it.

10. California

You have the right to know what personal information we collect and how it’s used, and to ask us to correct or delete it. We don’t sell or share personal information, and we won’t treat you differently for using these rights.

11. Security

Data is encrypted in transit and at rest. Database access is limited per user by row-level security, uploaded files sit in a private bucket that only our servers can read, and uploads use single-use links that expire.

12. Changes

We’ll post any changes here and tell you by email or on the Service before significant ones take effect.

2. What we collect, and why

Your account: your email address and, if you sign in with Google or GitHub, the basic profile those services share (such as your name and picture). We need it to give you an account (performing our contract with you).

What you submit: the Spotify and YouTube links you paste, the song titles, artists, and artwork they resolve to, audio files you upload, your options, and the lyrics we produce. Used only to make your lyrics (contract).

API use: if you use the API, your API keys, which we keep only as a one-way hash (with each key’s name, its first characters, and when it was last used); the metadata you send with a job, kept with the job; and, if you set one, your webhook URL and its signing secret. When a job made through the API finishes, we send its summary (status, the song’s title, artist, and link, options, credits, and your metadata) to that URL, and keep a log of each delivery (what was sent, your server’s response code, and the start of any error reply). Used to run the API for you (contract).

Credits and payments: your balance, a history of purchases, songs, refunds and daily credits, and the days you checked in with the time zone each was counted in (deleted with your account). Stripe handles payment and tells us whether it succeeded (contract, and our legal duty to keep accounting records).

Daily check-in: when you check in, your browser sends its time zone (such as “Europe/Paris”), so your days start at your own midnight. We keep it with the check-in (contract).

Settings: what your account’s settings hold: whether a new request starts with chords and a translation (and into which language), whether sheets open with romanization, whether failed songs show in Your songs, and auto top-up’s bundle and balance. Kept with your account so they follow you to every device (contract).

Auto top-up: if you turn it on, Stripe keeps your card. We store only a label for it (its brand and last four digits, such as “Visa ·· 4242”), Stripe’s ids for you and the card, and a record of each automatic charge (amount, credits, outcome, and why a charge failed). We give Stripe your email address to set you up as its customer (contract).

Usage and performance: pages viewed (with job ids and query strings removed), country, browser, device type, and page load times, through Vercel Web Analytics and Speed Insights, and a few events in the paste form and checkout (such as a link recognised, a song sent, or a checkout started) that carry only counts, yes-or-no flags and bundle names, never your email, a song, or a link. Neither uses cookies or identifies you. We use this to understand and improve the site (our legitimate interest).

Security records: your IP address appears in our hosting logs and, for lookups made before signing in, in a rate-limit counter. The email sign-in form, and the paste form before you sign in, run a Cloudflare Turnstile check, which reads your IP address and browser signals to tell people from automated traffic. Used to keep the Service available and stop abuse (legitimate interest).

Free-song record: when you use your free song, we store a keyed one-way hash (HMAC-SHA256) of your email address and, if you sign in with Google or GitHub, of that account’s ID. The hash can’t be turned back into your address. We check it so each person gets one free song, including after an account is deleted (legitimate interest in preventing abuse of the offer).

4. Who processes it for us

Supabase: database, sign-in, and private storage of uploaded files

Vercel: hosting, analytics, and performance measurement

Stripe: payments, and keeping the card you save for auto top-up

Resend: sending account emails (sign-up confirmation, password reset) and receiving the emails you send to our addresses

Modal: the servers that fetch and transcribe songs. The audio is sent to its GPU servers through Modal’s storage, which keeps an encrypted copy for up to 7 days before deleting it automatically. The lyrics they send back aren’t kept by Modal once they reach us. Modal also sends the API’s webhook events to the URL you set

OpenAI: translation, when you ask for it. It receives the lyrics text, the song’s title and artist (for an uploaded file, its file name or the title in its tags), and the language it’s sung in. OpenAI doesn’t train its models on this data and keeps it for up to 30 days for abuse monitoring

Anthropic: translation, only when OpenAI can’t translate a song. It receives the same lyrics text, title, artist, and language. Anthropic doesn’t train its models on this data and deletes it within 30 days

Google and GitHub: sign-in, if you choose them

Cloudflare: the Turnstile security check on the email sign-in form and on link lookups before sign-in

Spotify: looking up the songs and albums in your links

YouTube: looking up and fetching the audio of videos you link, and finding recordings of Spotify songs

LRCLIB: checking for published lyrics. It receives only a song’s title, artist, and length (and album, for Spotify songs): from the Spotify track, from a YouTube video’s title and channel name, or from an uploaded file’s title and artist tags. A file without both tags isn’t looked up, and no file name is ever sent

lyrics.ovh: checking for published lyrics LRCLIB doesn’t have. It receives only a song’s title and artist, from the same places as LRCLIB, and passes them to the lyrics sites it searches

5. Where it’s processed

6. How long we keep it

Uploaded audio files: deleted from our storage as soon as they’ve been transcribed; files you add but never send are deleted within 4 hours

Audio fetched for links: only inside a temporary processing container, deleted when it finishes

The copy of a song’s audio sent for transcription (uploads and links alike): kept encrypted by Modal for up to 7 days, then deleted automatically

Lyric results: deleted from our servers 24 hours after they’re made. Copies saved in your browser (section 8) stay there until you delete them

Your list of past songs (titles, status): deleted after 90 days

Account data and settings: until you delete your account

A song you delete from its page: its sheet and its entry in your list of past songs are deleted at once (its credit history stays, as below)

The card saved for auto top-up: kept by Stripe after you turn auto top-up off, so you can turn it back on. Remove card (in your account) has Stripe remove it; deleting your account removes it at Stripe too, along with our label and Stripe ids for it

API keys (the hash, name, and first characters): until you delete your account. A revoked key stops working at once

Your webhook URL and signing secret (and the secret it replaced, which keeps working for 24 hours): until you remove the webhook or delete your account

The webhook delivery log: 7 days

Credit history: kept for accounting. When you delete your account, its entries are no longer tied to an account, but each keeps its amount, date and description (the song’s title and artist, or your file’s name), and purchases keep their Stripe payment reference, which Stripe’s records link to the email you paid with

Rate-limit counters: up to one day

Free-song record (the hash above): kept after you delete your account, for as long as we offer a free song; removed if your free song fails and is given back

Emails you send us: as long as needed to answer you and keep a record of the request

The unsent draft of the form in your browser: two hours

7. Your rights

Depending on where you live, you can ask us to:

Give you a copy of your personal data, including in a portable format

Correct inaccurate data

Delete your data (you can also delete your account yourself from the Account page)

Restrict or object to processing based on our legitimate interests

Email support@lyricbook.ai; we’ll answer within 30 days. If you’re in the EEA, the UK, or Switzerland, you can also complain to your local data protection authority.

8. Cookies and storage on your device