Privacy Policy

1. Summary

We believe privacy policies should be short, specific, and accurate to the code that runs the product. Here is what we do and do not do with your information:

• Audio deleted within 24 hours: Audio files you upload and audio extracted from YouTube links are stored only long enough to run chord detection and lyrics transcription, and are automatically deleted within 24 hours.
• Saved results stay in your account: We retain detected chords, beat timings, lyrics transcripts, and your song library until you delete your account or ask us to remove them.
• No card details held by us: All payments, renewals, and refunds are handled by Paddle as Merchant of Record. We never receive or store your credit card or debit card numbers.
• No advertising trackers or data brokers: We do not sell your personal data, we do not run third-party advertising networks, and we do not profile you for cross-site behavioral marketing.
• We follow privacy principles: We follow the principles of modern data protection laws, including data minimization, purpose limitation, storage limitation, and prompt compliance with user rights.

2. What we collect

The table below lists every category of personal and operational data we collect, why we need it, where our infrastructure stores it, and its retention timeframe.

3. Cookies and local storage

Chord Detector uses first-party HTTP cookies and browser storage (localStorage and sessionStorage) to maintain your login session, remember your preferences, and keep track of your active visit. We do not use third-party advertising cookies.

4. Who we share with

We work with a minimal set of third-party service providers (data processors) strictly necessary to host our application, process machine learning models, handle payments, and deliver transactional emails. We do not sell your personal information or share it with data brokers.

• Cloudflare, Inc. (Infrastructure, Storage, AI and Email): Chord Detector is hosted on Cloudflare Workers, Cloudflare D1 (database), and Cloudflare R2 (storage). Vocal separation and chord detection containers run on Cloudflare Containers infrastructure. Lyrics transcription is processed through Cloudflare Workers AI using the open Whisper Large v3 Turbo model. Transactional emails (such as verification codes and trial renewal reminders from noreply@chorddetect.com) are sent via Cloudflare Send Email service.
• Paddle.com Market Limited (Payments & Merchant of Record): All paid plans, subscriptions, and credit packs are billed through Paddle, located at Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom. Paddle acts as the Merchant of Record, processes card payments and regional payment options, calculates and remits sales taxes/VAT, issues formal receipts, and manages subscription renewals and refunds. Chord Detector never receives or stores your payment card credentials.
• Google LLC (Optional Sign-In & YouTube): If you choose to sign in using Google, Google authenticates your identity and provides your verified email address and account ID. If you submit a YouTube link for analysis, our server retrieves video metadata from YouTube's public oEmbed service and streams the audio for chord extraction. Our landing page also includes a Google Tag Manager container (GTM-WF66DV7Q) loaded from googletagmanager.com.

5. International transfers

Our service runs on Cloudflare's global edge network, which operates data centers worldwide, including within the United States and the European Union. Payment processing is managed by Paddle in the United Kingdom and globally, and optional authentication through Google operates across Google's global facilities. When personal data is transferred across international boundaries, these transfers are conducted in accordance with applicable data protection laws using standard contractual clauses (SCCs) and robust technical safeguards to ensure that your personal information receives an equivalent level of security regardless of where it is processed.

6. Your rights

We respect your privacy rights and follow the principles of modern data protection standards (including the General Data Protection Regulation and the California Consumer Privacy Act). You have the following rights regarding your personal information:

• Right of access: You can request a confirmation of whether we process your personal data and receive a copy of the data we hold about you.
• Right to correction: You can ask us to correct inaccurate or incomplete personal information associated with your account.
• Right to deletion: You can request that we permanently delete your account, your profile, your song library, and your linked subscription records. Because there is currently no automated self-serve delete button in the account dashboard, please email us to execute deletion.
• Right to data export: You can request an export of your saved chord results, song records, and account profile in a structured, commonly used format.
• Right to object or restrict processing: You can object to specific processing activities or ask us to restrict how we process your information in certain circumstances.

When an account is deleted upon request, we remove your user record from the database, invalidate all active session tokens, delete all saved song results from your library, and detach your account link from our Paddle records. Anonymized operational records that do not contain personal identifiers (such as aggregate usage counters) and statutory tax records retained directly by Paddle for legal accounting compliance cannot be altered.

7. Children

Chord Detector is not directed to children under 16 years of age. We do not knowingly solicit or collect personal information from anyone under the age of 16.

If you are under 16, you must not register an account or submit audio files or links to Chord Detector. If we learn that we have inadvertently collected personal information from an individual under 16 without verified parental consent, we will promptly delete that account, its song library, and all associated records. If you are a parent or guardian and believe your child under 16 has submitted personal information to us, please notify us immediately at contact@chorddetect.com.

8. Security

We implement technical and organizational security controls designed to protect your personal data and uploaded content against unauthorized access, loss, or misuse:

• Transport encryption: All web traffic and API communications are encrypted in transit using HTTPS (TLS 1.2 and TLS 1.3). Connections cannot be downgraded to unencrypted HTTP.
• Hashed credentials and secrets: Account passwords are protected using salted PBKDF2 hashes. Active session tokens are stored in the database exclusively as SHA-256 digests, ensuring that a database compromise cannot expose usable session cookies. Email verification codes and OAuth states are likewise stored as cryptographic hashes.
• Hardened cookie security: Authentication cookies are configured with HttpOnly (blocking JavaScript access and mitigating cross-site scripting attacks), SameSite=Lax (guarding against cross-site request forgery), and Secure attributes. State-changing POST endpoints enforce strict origin validation.
• 24-hour audio deletion: Uploaded audio files and intermediate vocal stems are held in isolated Cloudflare R2 storage only for the duration of the analysis workflow and are deleted within 24 hours.
• Private song results: Results generated from your audio (chords, timing, lyrics) are private to your account or guest session identifier and are never published to public directories or indexed by web search engines.

9. Changes to this policy

We may update this Privacy Policy from time to time to reflect improvements to Chord Detector, changes in our technical architecture, or new legal requirements. When we make changes, we will update the "Last updated" date at the top of this page.

If we introduce material changes to how we collect, store, or share your personal data, we will provide notice through a prominent banner on the website or by sending an email notification to registered account holders. Continued use of Chord Detector after the effective date of an updated policy indicates your acknowledgment of the changes.

10. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or how your personal information is handled, you can reach us at:

For more details on billing terms and refund eligibility, please review our Refund Policy and Terms of Service, or visit our Contact page.