Privacy policy Draft

This policy explains how Louis Hsu ("we") collects, uses and protects personal data in the KAREOKIE app (the "App") and its account server.

1. Data we collect

We do not collect: the audio you import, your recordings, your microphone audio or the pitch you sing (on either microphone), local member names (unless you set a public nickname), lyrics and readings you edit, or the rest of your local history. Audio is processed on your computer and never uploaded to our servers. Crash reports and problem reports, described below, are cleaned of this information as far as the App can recognise it; minidumps are not cleaned (see below).

Activity and play starts are not shown publicly and do not change the public song play counts. They are based on our legitimate interest in running and improving the Service.

Shown publicly: using the leaderboards is part of the Service. Your score records always appear on them with your leaderboard name (or "Anonymous"), public nicknames, scores and dates. "Anonymous" hides your name only: other users can still see that several anonymous scores come from the same account (scores you delete, below, can't be matched this way). Scores of the members who sing on your computer are uploaded under your account too and show the member's public nickname if you set one. Runs sung with the guide vocal audible are listed but marked and never ranked or counted as a best score. Scores in the "Only my parts" scoring mode stay in your records but are not listed on the score boards. Scores from App versions before V2 are on an earlier score scale: they are kept and shown separately as "earlier scores", not ranked together with V2 scores. Song play counts and import counts are always counted anonymously and shown only as totals.

Two microphones: when two people sing a song together, the App scores both and saves each score to that singer's history on your computer. Only microphone 1's score (the main singer's) can be uploaded and appear on the leaderboards; there is no combined score. Microphone 2's score, audio and pitch stay on your computer.

Ranking titles: once a month our server works out where you stand among V2-scale scores: the average of your percentile positions on your best 10 songs that at least 20 people have sung (you need at least 5 such songs). Runs with the guide vocal, deleted or anonymised scores and test accounts don't count. The top 1 %, 5 % and 15 % get a title, whose name never contains a score, and each title also leaves a permanent badge (for example "2026 autumn gold mic") stored in your KAREOKIE account. In the App you see only your own title and badges. If you linked Discord, our bot gives you the matching role on the KAREOKIE Discord server, which other members there can see. Working out titles is part of running the leaderboards.

Earlier opt-out: version 4 of this policy let you stay off the score rankings. That option is gone. If you had chosen it, your scores stay off the leaderboards until you accept this version of the policy and version 3 of the Terms of Service in the App; from then on they are listed like everyone else's, earlier scores included.

Deleting a score: deleting a score in the App removes it from your computer. On the leaderboards it stays, shown as "Anonymous" without your name or nickname. "Anonymous" means other users can't see who sang it: we still keep the link between the score and your account, to keep the leaderboards fair (for example to investigate faked scores) and to answer your requests about your data. Only deleting your account removes that link (section 3).

Lookups from your computer

To import a song and find its lyrics, the App on your computer contacts some public services directly. These lookups do not go through our server:

• Online sources: when you search or import with a source extension, your search words or the address you enter go to the online service that extension connects to, and the App downloads the song from it (for example a video with its subtitles, description and thumbnail). Source extensions are separate projects; the service they connect to handles what it receives under its own terms and privacy policy.
• Lyrics: NetEase Cloud Music, LRCLIB and the lyrics sites searched by the open-source syncedlyrics library (Musixmatch, LRCLIB, NetEase, Megalobiz) receive searches made of the song's title and artist; LRCLIB also receives the song's length.
• Japanese readings: for Japanese songs, UtaTen (utaten.com) receives a search for the song's title, and the App reads the furigana (readings) on its lyrics page. Only the readings are used; the lyrics and their timing still come from the sources above.

Nothing about your account is sent to these services, and we do not receive what they return. Like any website you visit, they see your computer's IP address and handle it under their own privacy policies. The lyrics and readings found this way, and any you edit, stay on your computer. The App also downloads its updates and the AI components it needs (for example from GitHub, PyTorch and the Python Package Index); those services see your IP address in the same way.

Crash reports and diagnostics

• Automatic crash reports are always on. Sending them is part of using the App, and they can't be switched off. If you switched them off in an earlier version of the App, that choice applies on that computer until you accept this version of the policy and version 3 of the Terms of Service there.
• A crash report contains: the type of error, the error message and where in the program it happened (stack trace); the versions of the App and Windows, the graphics card, the CPU and the amount of memory; the App's screen, language and window size; the last few things the App did (for example "opened the stage" or "import: separating vocals"); if the App's background process stopped unexpectedly, the last 40 lines of its log; an anonymous install ID (a one-way hash of the App's device ID); and, if you are signed in, your account ID.
• Minidumps are always sent too. A minidump is a snapshot of the crashed program's memory at the moment the program itself crashed, which can contain fragments of what the App was working on. If you had not turned them on in an earlier version of the App, they are sent from when you accept this version of the policy and version 3 of the Terms of Service on that computer.
• Before a crash report or problem report is sent, the App removes the following as far as it can recognise them: email addresses, your Windows user name and computer name, the folder names of your user folder, sign-in tokens, video links and IDs, song titles, artists, member names and Chinese, Japanese or Korean text (such as lyrics). Our server repeats this cleaning. A minidump is sent as it is, without this cleaning, so it can contain fragments of such data (for example a sign-in token or a song title). Audio files and recordings are never sent.
• Report a problem: when you send a report we receive the category and the description you write, the App and Windows versions and, only if you tick the boxes, the App's log files and system information (cleaned in the same way; you can see what will be sent before sending). Your email address is stored only if you type it and allow us to contact you.
• Export diagnostics saves the same information as a zip file on your computer. Nothing is sent.
• Where and how long: reports are stored on our account server (Cloudflare); we do not use a third-party crash reporting service. Crash reports are kept for 90 days, minidumps and problem-report attachments for 30 days, and problem reports (the text) for up to 12 months. When you delete your account, your crash and problem reports are unlinked from you and a contact email address is deleted.
• Purpose: finding and fixing bugs, and checking whether an update made the App more or less stable. Crash reports and minidumps are based on our legitimate interest in finding and fixing bugs and keeping the App stable; they are part of using the App and can't be switched off in it. If you object, contact us (section 6); you can also stop using the App. Problem reports are processed on your request.

Discord

Linking Discord is optional: you start it yourself from the App (Account → Discord).

• What we receive and keep: your Discord user ID, username and display name, and whether you joined the KAREOKIE Discord server. We do not receive your Discord password, email address, messages or the list of your other servers. Discord gives us a short-lived access token only to add you to our server; we use it once, then revoke it, and never store it.
• Why: to add you to the KAREOKIE Discord server with the "Newcomer" role in one step, to remember on your account that you joined (so the App stops inviting you on every device), to give linked users their benefits there (for example the beta channel, feature voting and priority support), and to give you the role of your ranking title there. The legal basis is your request (you choose to link).
• Shown on Discord only: your Discord name is not shown on the leaderboards or anywhere else in KAREOKIE; it is shown only to you, on your Account page. Linking does make your ranking title public on the KAREOKIE Discord server: it is a role that the other members there can see.
• How to remove it: choose *Unlink* under Account → Discord, or delete your KAREOKIE account; either deletes the Discord ID and names from our server at once and removes your ranking title role. Being a member of the KAREOKIE Discord server is between you and Discord: unlinking does not remove you from it, and you can leave the server in Discord at any time. You can also remove KAREOKIE under Discord → User Settings → Authorized Apps.
• What you post on the KAREOKIE Discord server is handled by Discord under its own terms and privacy policy (https://discord.com/privacy).

2. How we use it

Only to provide sign-in and account features, check your entitlement and App version, manage devices, run the leaderboards, find and fix bugs, understand how the App is used, send service announcements, handle paid plans (later), prevent abuse and keep the service secure, and comply with the law. We do not sell personal data or use it for advertising.

3. Retention and deletion

• Account data is kept until you delete your account. You can delete your account at any time from the App's Account page: your account, devices, plan records, leaderboard name, ranking titles, badges and Discord link are deleted from the server and every device is signed out at once; personal identifiers in audit records are removed; your play starts are deleted or unlinked from you; your score records and import records are unlinked from you (anonymised), remain only in the anonymous play and import counts, and your scores disappear from the leaderboards.
• Ranking titles and badges: your title is replaced at each monthly update; badges are kept until you delete your account.
• Discord link: kept until you unlink it or delete your account, then deleted from the server at once (section 1, "Discord").
• Phone remote: the commands, the song list (titles, artists and cover pictures), the members (names, colours, avatars and favourite songs), the reserved list with the singers' names (the member names on your computer and the names typed on phones), the name you give on your phone and the playback state (including the score) pass through our server between your computer and your phone. They are kept in memory only for the session and not stored; the 6-digit PIN is stored for at most 10 minutes. No audio is sent.
• Install count: the server keeps a one-way hash of the App's device ID (not the ID itself) and the date it first connected, only to show the public number of installs. It is not linked to your account and stays after you sign out or delete your account. The website and the App show only totals (installs, people online now), never anything about a single person or device.
• Activity status: the server keeps only each device's latest status. Every 10 minutes it is counted into totals (open, active, singing) that contain no account or device; the totals are kept for 400 days.
• Play starts: 400 days, unless you delete your account first (see above).
• Server logs (including IP addresses) are normally kept for no more than 30 days.
• Crash reports: 90 days. Minidumps and problem-report attachments: 30 days. Problem reports: up to 12 months. Crash and problem reports do not store your IP address.
• Payment records may be kept by the payment provider where tax law requires it.

3a. Consent records

When you accept the rights acknowledgement, these Terms or this Privacy Policy, we store a consent record: a random record ID, your account ID, which statement or document you agreed to with its version and language, a SHA-256 fingerprint of the exact text shown, the purpose (first sign-in, statement update, first use of an import source, terms, privacy), the import source where relevant (for example local-files or a source extension's ID), the App version, a one-way hash of the App's device ID, the country derived from your connection (not the IP address itself) and the time. A copy is kept on your computer (consents.jsonl in the App's data folder) until it has been sent.

• Why: to show that you gave the acknowledgement before using the features that need it, and to handle rights holders' complaints and disputes (our legitimate interest in defending legal claims).
• How long: as long as your account exists. When you delete your account, the records are not deleted but pseudonymised: your account ID is replaced by a one-way hash, and the records are deleted 10 years after they were made (the outer limitation period for damage claims). Consent records are never changed after they are made.
• You can ask us for a copy of your records at any time (contact below).

4. Third-party processors

• Google: sign-in (Google Privacy Policy: https://policies.google.com/privacy).
• Cloudflare: hosts the account server and database (data may be processed outside your country).
• Discord: only if you link your Discord account (Discord Privacy Policy: https://discord.com/privacy).
• Payment provider (later, e.g. Paddle or Lemon Squeezy): payments, tax and invoices.

The services the App contacts from your computer (section 1, "Lookups from your computer") are not our processors: we send them nothing about you.

5. Security

All connections are encrypted (HTTPS / WSS). Sign-in uses PKCE. Refresh tokens are stored only as hashes on the server and protected with the operating system's encryption on your computer. The App contains no secret keys.

6. Your rights

You may request access to, correction, export or deletion of your personal data, or withdraw consent (deleting your account stops all processing). You can also remove KAREOKIE's access in your Google account settings (https://myaccount.google.com/permissions) and, if you linked Discord, under Discord → User Settings → Authorized Apps. Depending on where you live (for example under the GDPR) you may have further rights. Contact: [email protected].

7. Children

The service is not directed at children under 13. Minors should use it with the consent of a parent or guardian.

8. Changes

We will update the date on this page when the policy changes and announce significant changes in the App. When a change affects what you agreed to, the App asks you to accept the new version.

9. Contact

Louis Hsu · Postal address available on request · [email protected]