Privacy policy

LyricsGift turns a story you write about someone into a personalised song. The lyrics and the music are generated by AI from the text you provide. This policy explains what information that involves and what happens to it.

Account details: your email address and display name, used for sign-in, receipts and account notices. Passwords are stored only as salted one-way hashes — we cannot read them.

The stories you submit: the text you write in the create flow — names, memories, messages. This is the raw material of your song and is stored with your account so drafts and re-generation work.

Generated content: the lyrics and audio produced for you, stored so your songs and gift pages keep working.

Technical basics: IP address and browser user-agent in security logs (sign-in, password changes), and strictly-necessary cookies only: your session, and an anonymous identifier that keeps a half-finished song draft alive — set when you start writing, not when you arrive. Our analytics sets no cookie at all. No advertising cookies, ever.

We measure how the product is used so we can fix what's broken: pages viewed, and the steps of making a song (started, lyrics written, lyrics approved, song generated, song ready, gift link shared, poster made). The processors are PostHog and Plausible.

Our analytics is cookieless and profile-free. It stores nothing on your device — no cookie, no local storage — and builds no profile of you. We do not identify you to our analytics even when you are signed in, and we cannot recognise you from one day to the next: a visit tomorrow is simply another visit. What we get are counts and the shape of the journey, not a file on a person.

To tell one visit's steps apart from another's within a day, our analytics provider derives a temporary identifier on its servers by hashing your IP address, browser user-agent and our site name together with a random value that changes every day and is then discarded. The result cannot be reversed, is not stored on your device, and stops matching you the next day.

What we never send:your story text, your lyrics, the recipient's name, your dedication, song titles, your email address or your account id. Analytics receives event names and coarse choices like genre or occasion — never the words you wrote. Session recording and automatic click-capture are switched off precisely so typed content cannot leak into them.

Cloudflare hosts the site, database and audio storage. AI providers (currently MiniMax) receive the story text and approved lyrics solely to generate your lyrics and music. Googleis involved only if you choose “Continue with Google” for sign-in. Resend delivers transactional email (verification, password reset). Stripe will process payments when checkout launches — card details will go to Stripe directly and never touch our servers.

We do not sell your data, and we do not permit your stories or songs to be used to train AI models.

Some processors named above run their services outside Australia (Cloudflare and Stripe globally, our music provider and email service in the US and Asia). When your story text or email address is processed overseas, it's under each provider's data-processing terms — we don't sell it, and no processor may use it beyond providing the service to us. This is the cross-border disclosure the Australian Privacy Principles (APP 8) ask us to tell you about plainly.

Stories, lyrics and songs stay while your account exists so your library keeps working. Unclaimed anonymous drafts expire from your browser after 14 days. Security logs are kept for a limited period for abuse prevention. Receipts are retained where tax law requires.

We take a weekly backup of our database so that a fault or a mistake on our side cannot lose your song. Those backups contain the same information as the live database — including your email address, your stories and your lyrics — and each one is kept for 90 days and then deleted automatically. Backups are stored in the same way as everything else described here and are not used for any other purpose.

You can delete your account yourself from your account page, or email us from your account address and we will do it. Either way we delete your account, stories, songs and gift pages — the files are removed from our storage, not just hidden. Gift pages you shared stop working once deleted.

One honest qualification: deletion removes your data from the live service straight away, but a copy can remain in the weekly backups described above for up to 90 days, after which those backups are deleted automatically. Backups are never used to bring a deleted account back, and nobody works from them except to recover from a fault. We keep a record that a deletion happened, with your identity removed from it, so that we can show the request was honoured.

If you think we've mishandled your information, tell us first — reply to any email we've sent you and a person will respond. (A dedicated privacy contact will be published when our domain is set up.) If you're not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au — that's your right under the Privacy Act 1988, and we'll tell you the same thing in our reply.