Akordly — Privacy Policy

Effective date: 2026-05-08 Last updated: 2026-10-17

This Privacy Policy explains what personal data we collect when you use Akordly (akordly.app), why we collect it, how we use it, who we share it with, and what rights you have. If anything's unclear, email privacy@akordly.app.

1. Who is responsible for your data

Akordly is operated by an individual based in Israel (the "operator", "we", "us"). For the purposes of the EU GDPR, the UK GDPR, and Israel's Privacy Protection Law, the operator is the data controller for your personal data. You can reach us at privacy@akordly.app for any privacy question or rights request.

• Operator legal name: Maayan Cohen
• Contact: privacy@akordly.app (a postal address is available on request)

2. What we collect and why

2.1 Account information

When you sign in with Google or email, Firebase Authentication gives us:

• your email address,
• a unique Firebase user ID,
• your display name and profile photo (Google sign-in only, and only if your Google account shares them), and
• a timestamp of when you created the account.

Purpose. To identify you, authenticate your requests, and scope your data so only you can access it. Legal basis (GDPR / UK GDPR). Performance of a contract (Art. 6(1)(b)).

2.2 Content you upload or submit

When you upload an audio file or submit a YouTube URL, we receive:

• the audio file or the audio we fetch from the URL, and
• a cryptographic hash of the audio (used to detect duplicates and to enforce copyright blocks).

Purpose. To analyze the audio and return chords and sections, to produce word timings used to line up lyrics you add (Section 2.10), and to enforce our Copyright Policy via hash-based blocking. Word timings are produced by speech recognition at ElevenLabs (see Section 4). Retention. Uploaded audio is deleted from our servers after processing succeeds, and in any case within 1 hour. The copy sent to ElevenLabs for speech recognition (Section 4) is held by ElevenLabs under its own retention policy, not this one. YouTube-fetched audio is cached server-side for up to 48 hours (configurable) to support reprocessing and then automatically purged. Vocal and instrumental tracks produced during analysis are treated differently by plan: on Free and Pro plans they exist only during processing and are discarded once the response is assembled; on Studio plans, for audio you uploaded yourself, they are persisted to Google Cloud Storage for the lifetime of the corresponding song row in your library, so the in-app mixer can replay them without rerunning the analysis. Songs opened from a link are not separated. For songs ingested from YouTube before 2026-09-11, any persisted tracks are stored under a key derived from the YouTube video ID and may be shared across users who transcribed the same video — the shared bytes contain audio only, with no identifier of the user who first transcribed it. When you delete a song or your account, tracks stored under your private key are removed immediately (subject to the storage-provider backup window described in §10); tracks stored under a shared video-keyed path are kept until a background sweep removes any that no library row still references. Legal basis. Performance of a contract (Art. 6(1)(b)).

2.3 Transcription results

The structured analysis output — chord timeline, sections, BPM, key estimate, and associated metadata (source type, audio hash, timestamps) — is stored in Firestore, scoped to your account. It also includes a machine transcript of the sung words with a timestamp for each word, which is used to line up lyrics you add with the music.

Purpose. So you can revisit songs you've previously analyzed. Retention. Until you delete the song or your account. Legal basis. Performance of a contract.

2.4 Local storage on your device

Audio you upload is saved in your browser's IndexedDB so you can play it back without re-uploading. This data never leaves your device through our collection — only your browser holds it. You can clear it anytime from the Settings page ("Clear my audio cache").

2.5 Consent records

When you tick the "I have the right to upload this audio" checkbox, we log the timestamp together with the audio hash.

Purpose. To demonstrate, if questioned, that you confirmed a specific consent before proceeding. Legal basis. Legitimate interests (Art. 6(1)(f)) — operating a Service that handles user-uploaded media responsibly.

2.6 Usage and device data

We collect standard technical information when you use the Service:

• IP address,
• browser user agent, device type, and operating system,
• pages visited within the Service and timestamps,
• Firebase App Check attestation data (to confirm requests come from our real app), and
• error logs and performance metrics.

Purpose. Security, abuse prevention, service operation, debugging, and basic usage analytics. Retention. 90 days for detailed logs; aggregated metrics longer. Legal basis. Legitimate interests (Art. 6(1)(f)) — keeping the Service secure and functional.

2.7 Billing information (Paid Plans)

If you subscribe to a Paid Plan, our payment processor handles your payment method. We receive:

• subscription status,
• the last four digits of your card or an equivalent identifier,
• billing country, and
• invoice records.

We never see or store your full payment card number or CVC.

Purpose. To bill you, send invoices, and comply with tax and accounting law. Retention. As required by applicable tax law (typically 7 years in Israel; may differ in your country). Legal basis. Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax records.

2.8 Support communications

If you email us, we keep the message and our reply so we can follow up.

Retention. 2 years from the last message, unless a dispute requires longer retention. Legal basis. Legitimate interests (Art. 6(1)(f)).

2.9 Product analytics and ad measurement (Google Analytics)

We use Google Analytics 4 to understand how the Service is used — which features people try, where they get stuck, and what we should improve. Our Analytics property's account location is Israel, so the contracting entity is Google Ireland Limited; Google LLC (US) acts as a sub-processor on Google's infrastructure.

When you have consented (see Section 9), Google Analytics collects on our behalf:

• a random Analytics client identifier stored in first-party cookies (_ga, _ga_<container-id>),
• pages viewed, events (for example, uploads, playback, errors) and session metadata,
• approximate location (city/country) derived from your IP — GA4 truncates the IP before storage by default, and
• browser/device type and language.

In the iOS app. The app uses Google Analytics for Firebase — the same Google Analytics service, through Google's iOS software kit. It is off until you answer Apple's "Allow tracking" prompt, which we show once, when you first open the app. If you tap Allow, the app collects on our behalf:

• an app-instance identifier and your Akordly account ID,
• the in-app events described above, plus the subscription you buy and its price,
• device model, iOS version and language, and approximate location (city/country) derived from your IP, and
• Apple's advertising identifier (IDFA).

If you tap Ask App Not to Track, the app sends no analytics at all. You can change your answer at any time in iOS Settings › Privacy & Security › Tracking.

Measuring our own ads. We advertise Akordly on Google Ads. Our Google Analytics property is linked to Google Ads so we can count how many app installs and subscriptions an ad led to; only conversions from iOS users who tapped Allow are sent. Apple may also send us anonymous, aggregated install reports (SKAdNetwork / AdAttributionKit) that do not identify you. Akordly shows no ads, and we do not enable Google Signals or ad personalization or use your data to target ads from other companies. On the website, nothing is shared with Google Ads.

Legal basis.

• EEA / UK / Israel. Your prior consent (GDPR / UK GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3) / PECR reg. 6; Israeli Privacy Protection Law). The Analytics tag only loads after you accept it in our cookie banner, and you can withdraw consent at any time via "Cookie preferences" in the footer — withdrawing does not affect processing done with your prior consent.
• Elsewhere. Legitimate interests (Art. 6(1)(f)) — measuring product usage to improve the Service. You can still opt out via "Cookie preferences".
• iOS app (every country). Your consent, given through Apple's tracking prompt (GDPR / UK GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3) / PECR reg. 6; Israeli Privacy Protection Law). You can withdraw it at any time in iOS Settings — withdrawing does not affect processing done with your prior consent.

Retention. Event-level data in GA4 is retained for 14 months and then deleted by Google. You can request earlier deletion by emailing privacy@akordly.app. The same 14-month retention applies to data from the iOS app.

2.10 Lyrics you add

If you paste lyrics into a song, we store the text in Firestore, scoped to your account. Only you can see them; they are never shown to other users or in Discover.

Purpose. To display them to you, timed to the music. Retention. Until you remove them or delete your account. Lyrics added to a song you uploaded are also removed when you delete that song. Lyrics may be removed in response to a valid copyright notice. Legal basis. Performance of a contract (Art. 6(1)(b)).

3. What we don't collect

• We don't collect special-category data (health, biometric, religion, etc.) — don't upload any.
• We don't show ads, and we don't use advertising cookies on the website. The iOS app measures our own ads only if you allow tracking (Section 2.9).
• We don't build behavioral profiles for marketing.
• We don't sell or rent personal data to anyone, ever.
• We don't train foundation models or sell data to AI companies for training.

4. Who we share data with

We share only what's necessary, with these categories of recipients.

Infrastructure and service providers (processors acting on our behalf):

• Google LLC / Firebase — authentication, Firestore database, App Check. Our Firebase project is in the eur3 multi-region (Europe), so account data and transcriptions are stored on European infrastructure.
• Google Ireland Limited / Google Analytics 4 — product analytics on the website and, if you allow tracking, in the iOS app (Google Analytics for Firebase). Account location is Israel; Google Ireland Limited is the contracting entity, and Google LLC (US) operates as a sub-processor on Google's infrastructure. See Section 2.9 for what's collected and Section 5 for the transfer mechanism.
• Google Ireland Limited / Google Ads — receives app-install and subscription conversions from iOS users who allowed tracking, so we can measure our own ads (Section 2.9). For this measurement Google acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms.
• Our hosting providers for compute that runs the chord model and the orchestration layer.
• Our payment processor for Paid Plans (see Section 2.7).
• ElevenLabs, Inc. — speech recognition. Receives the audio of songs you analyze and returns a word-timed transcript, which we use to line up lyrics you add. Processing is in the United States; ElevenLabs' zero-retention and EU-residency options are Enterprise-only and do not apply to our plan.

Third-party platforms you interact with:

• YouTube / Google LLC. When you submit a YouTube URL, our server fetches the audio from YouTube, and YouTube receives standard request metadata (our server's IP address, request headers). Your browser does not fetch the audio directly.

When required by law or legal process: we may disclose data to comply with valid legal obligations (court orders, subpoenas, regulatory requests), to protect our rights, to prevent fraud, or to respond to emergencies involving a risk of harm.

In a business transfer: if Akordly is sold, merged, or reorganized, personal data may be transferred to the successor, subject to this Privacy Policy.

5. International data transfers

Akordly is operated from Israel. Some of our processors and sub-processors (for example, Google LLC as the Google Analytics sub-processor) are based in or route data through the United States.

• EEA / UK residents. When personal data moves from the EEA or the UK to Israel, we rely on the European Commission's adequacy decision for Israel and the equivalent UK adequacy regulations. Transfers to US processors (Google LLC as the Google Analytics sub-processor, and ElevenLabs, Inc. for speech recognition) rely on Standard Contractual Clauses (SCCs) and the supplementary measures set out in each processor's data-processing addendum, together with the EU–US Data Privacy Framework certifications held by Google LLC and ElevenLabs Ltd. where applicable.
• Other regions. Equivalent safeguards are used where local law requires them.

6. Retention

We keep personal data only as long as we need it for the purpose it was collected:

7. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — a copy of what we have.
• Rectification — correcting inaccurate data.
• Erasure — deleting your data ("right to be forgotten").
• Restriction — telling us to stop processing while a question is resolved.
• Objection — to processing based on legitimate interests.
• Portability — receiving your data in a structured, machine-readable format.
• Withdraw consent — where we rely on consent, at any time, without affecting prior lawful processing.
• Complain to a supervisory authority — in the EEA your local Data Protection Authority, in the UK the ICO, in Israel the Privacy Protection Authority (PPA).

California residents (CCPA / CPRA). You also have rights to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. Akordly does not sell or share personal information as those terms are defined. You may exercise your rights by emailing privacy@akordly.app. We will not discriminate against you for exercising them.

Israeli residents. You have rights under the Privacy Protection Law, 5741-1981 and its regulations, including the right to review the data held about you and request corrections.

To exercise any right, email privacy@akordly.app. We'll verify your identity — usually by confirming the request from the email address on your account — and respond within 30 days, or faster where local law requires it.

8. Children

Akordly is not intended for anyone under 16. We do not knowingly collect personal data from users under 16. If you believe a child under 16 has provided us data, email privacy@akordly.app and we'll delete it.

9. Cookies and similar technologies

Strictly necessary (always active). These are required to run the Service and do not need consent under EU/UK/Israeli law.

• Firebase session cookies and ID tokens — to keep you signed in.
• Firebase App Check tokens — to confirm requests come from our real app.
• A guest-session identifier — if you use Akordly without signing in, so your pre-signup transcriptions can be migrated when you create an account.
• Cookie-preference cookie — remembers your banner choice so we don't keep asking.

Analytics (consent required in the EEA, UK, and Israel). These cookies only load after you accept them in our cookie banner, and you can change your mind at any time via the "Cookie preferences" link in the footer.

• _ga and _ga_<container-id> — set by Google Analytics 4 as first-party cookies. They contain a random client identifier used to distinguish unique browsers across pages; typical expiry is 13 months. See Section 2.9 for what we do with this data.

In the iOS app. The app does not use cookies for analytics. Google Analytics for Firebase stores an app-instance identifier on your device, and only after you tap Allow in Apple's tracking prompt (Section 2.9).

We do not use advertising cookies on the website, cross-site marketing trackers, or Google Signals. Ad measurement in the iOS app is described in Section 2.9.

10. Security

We protect your data with:

• TLS (HTTPS) for all data in transit,
• Firebase Security Rules that enforce account-scoped access at the database layer,
• Firebase App Check to prevent abuse of our backend by unofficial clients, and
• industry-standard access controls on operator devices and infrastructure.

Backup retention window. Our storage provider (Google Cloud Storage) maintains a short-lived soft-delete window for objects in operator-controlled storage buckets. When you delete content, the bytes are removed from your account's view immediately, but the storage provider retains them in a protected recovery state for up to 7 days before permanent erasure, to guard against accidental deletion. During that window the data is not accessible through the Service.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we'll notify you and the relevant regulators as required by law.

11. Automated processing and AI

The Service uses artificial-intelligence and machine-learning models to estimate chords, sections, key and BPM from the audio you submit. Speech recognition runs at ElevenLabs, Inc. (Section 4); the other models run on our own infrastructure. If we ever route your audio to another third-party AI provider, we will name it in Section 4 before doing so.

These models produce probabilistic estimates, not decisions about you. They do not produce legal or similarly significant effects about you within the meaning of GDPR Art. 22, and we do not use them to profile you, score you, or make eligibility determinations.

AI/ML outputs are inherently imperfect and can be wrong, incomplete, or fabricated. The Terms of Service describe what this means for your use of the outputs; this Policy is concerned only with how your data flows through those models — not with output quality.

12. Changes to this Policy

We may update this Privacy Policy. For material changes we'll notify you in-product or by email at least 14 days before they take effect. The "Last updated" date at the top always reflects the current version.

13. Contact

• Privacy requests: privacy@akordly.app
• General contact: support@akordly.app
• Postal address: available on request at privacy@akordly.app

Changelog

• 2026-10-17 — §2.9: Apple's tracking prompt now appears when you first open the iOS app instead of after your first song plays. What is collected, and the rule that nothing is collected unless you tap Allow, are unchanged. Pre-launch change; no users to notify.
• 2026-10-16 — §2.9 now covers analytics in the iOS app (Google Analytics for Firebase, off unless you tap Allow in Apple's tracking prompt) and how we measure our own Google Ads, including that the app may collect Apple's advertising identifier with that permission. §3 and §9 updated to match, and §4 adds Google Ads as a recipient. Adds data collected in the app (with consent) and a new recipient. Pre-launch change; no users to notify.
• 2026-09-13 — Added §2.10 (lyrics you add: stored per account, visible only to you, retention). §2.2 and §2.3 now state that the audio of songs you analyze goes through speech recognition to produce a word-timed transcript, used to line up lyrics you add. Added ElevenLabs, Inc. to the §4 processor list and to the §5 transfer paragraph, and updated §11 accordingly. Added a §6 retention row for lyrics you add. §2.2 notes that the copy sent for speech recognition is retained under that provider's own policy, §4 records that processing is in the United States, and §5 cites ElevenLabs Ltd.'s Data Privacy Framework certification alongside the SCCs. Pre-launch change; no users to notify.
• 2026-09-11 — Updated to match the removal of lyrics and audio separation as features of the Service. Removed lyric transcription from §2.2 (purpose), §2.3 (what is stored), §2.5 (consent records) and §11; removed ElevenLabs from the §4 sub-processor list and from the §5 international-transfer paragraphs, so no third-party AI provider receives your audio and §11 now states all models run on our own infrastructure. §2.2 and the §6 retention table now state that separation applies to audio you upload yourself, that songs opened from a link are not separated, and that video-keyed tracks from songs analyzed before this date are retained until the song or account is deleted. No new data is collected and no new recipient is added; this narrows both. Pre-launch change; no users to notify.
• 2026-05-16 — Corrected §2.2's stems-retention sentence to match how the Service actually stores stems on Studio plans (persisted to Google Cloud Storage for the lifetime of the song row; content-addressed and shared across users for YouTube-source songs). Added matching rows to §6's retention table for Free/Pro stems, Studio stems, and the storage-provider soft-delete window. Added §10 "Backup retention window" paragraph disclosing the 7-day storage-provider soft-delete window. Pre-launch correction; no users to notify.
• 2026-05-08 — Renamed §11 from "Automated decision-making" to "Automated processing and AI". Added explicit disclosure that some processing happens at third-party AI providers (currently ElevenLabs for lyric transcription). Reaffirmed that AI processing does not produce GDPR Art. 22 decisions about users.
• 2026-04-23 — Initial publication.