Privacy

What we store

• Email and name — so you can sign in and we have something to call you.
• Password — never in plain text. We store a scrypt hash with its own salt. Not even we can read your password.
• The files you upload and the karaoke generated from them.
• Your scores — grade, accuracy percentage and when it happened.
• A technical processing log — file size and how long it took, to estimate the queue and find failures.

Cookies

Three, all ours — none from third parties, none for advertising:

• ss — session. This is what keeps you signed in. It is HttpOnly (page JavaScript cannot read it), Secure (it only travels over HTTPS) and SameSite=Lax. It lasts 30 days or until you sign out.
• idioma — the language you picked. It remembers whether you prefer Portuguese, English or Spanish, so we do not ask again on every page. It lasts a year.
• origem — where you came from. If you arrived through one of our campaign links, it stores that link's code for 30 days, only so we know which campaign brought a signup. It is a channel code, not an identifier for you, and it does not leave us.

None of them needs a consent banner: the first two are required for the site to work, and the third only exists if you clicked one of our own campaign links.

Who can see your files

Your library lives in a folder identified by your account number, and the server refuses any request for a file that is not yours. No other user can reach your files — not even knowing their names.

Where it lives and who processes it

Your files and library live on a private server under our control. The heavy part — separating the voice from the backing track and writing the lyrics — may run on a specialised GPU service (Modal, in the United States): your audio is sent there only to be processed, the result comes back, and it is used for nothing else. When that service is off, processing happens on our own server. Either way, no one analyses your audio for any other purpose.

Payment

If you subscribe to the paid plan, billing is handled by Stripe (United States). We never see or store your full card number — Stripe handles that. We keep only what we need to manage the subscription: whether it is active and a Stripe customer identifier.

International transfer

Since Modal and Stripe are in the United States, some data — the audio sent for processing and the billing data — may leave Brazil to those providers, always under the contracts and safeguards the LGPD requires and only for those purposes.

For how long

As long as the account exists. Delete the account and we delete the files and the library. A content-free technical log may be kept for up to 12 months.

Your rights

You can request a copy, a correction or the deletion of your data, and you can withdraw consent. Write to our contact email and we will answer. The service is operated from Brazil and follows Brazilian data protection law (LGPD).

Breaches

If an incident happens that puts you at risk, we notify you and the Brazilian data protection authority, with what is known and what we are doing about it.