Privacy policy
This policy explains how Starlight (legal entity name to be added) (“we”, “us”) handles personal information in the Starlight app, on this website and in the Starlight Lyric Studio. We try to collect as little as we can: recording, mixing, lyrics and export all work on your device, and we only receive audio when you choose to post it.
The short version
- Your recordings stay on your phone unless you post a take. We never listen to your microphone in the background.
- We don’t show ads, we don’t sell your data, and we don’t track you across other apps or websites.
- You can delete your account and its content at any time, in the app (Me → Delete account) or at /delete-account.
What we collect
Information you give us
| Data | Why | When |
|---|---|---|
| Email address and password (stored only as a salted hash) | Create your account, sign you in, contact you about your account | When you register |
| Handle, display name, bio, avatar | Your public profile | When you create or edit your profile |
| Posted takes (vocal-only audio), captions, comments, likes, duets | Show your content to others, as you set its visibility | Only when you post or interact |
| Who you follow, block and mute; follow requests | Run your feeds and privacy settings | When you use those features |
| Saved lyric sheets (text and timings) | Let you move synced lyrics from the Lyric Studio to your phone. They are private to you. | Only when you choose “Save to my account” |
| Creator packs (song titles and line timings) and ratings you give | Publish and rank packs in the catalog | If you become a creator or rate a pack |
| Reports and copyright notices you file | Review content and enforce our rules | When you submit one |
Information collected automatically
- Device identifier for points. When you sing a creator’s pack, the app sends a random per-install ID. We store only a keyed hash of it, together with how much of the song you completed, to stop fraud and count creator points.
- Push notification token (Android), so we can notify you about follows, likes, comments and duets. You can turn notifications off in your system settings.
- Server logs and security data such as IP address, request time and device/browser type, kept for security, rate limiting and debugging.
- Crash and error reports (see “Service providers”): app version, device model, operating system, and a technical description of what went wrong. We configure this to leave out your email, your audio and your lyrics, and an anonymous account ID may be attached so we can tell how many people a problem affects.
Microphone
The app asks for microphone access so you can record. It only listens while you are recording or running the mic test or latency calibration, and recordings are saved on your device. They leave your device only if you post a take (we upload the vocal track, never the backing track you sang over) or share an export yourself.
Backing tracks
Backing tracks you import stay on your device. The Lyric Studio decodes audio inside your browser and does not upload it.
How we use information
- To provide the app: accounts, posting, feeds, duets, notifications, the creator catalog.
- To keep people safe: moderation, handling reports, copyright notices and repeat-infringer enforcement, fraud prevention.
- To maintain and improve reliability, using crash reports and logs.
- To respond to your messages and requests, and to meet legal obligations.
If the GDPR or UK GDPR applies to you, our legal bases are: performing our contract with you (running your account), legitimate interests (security, fraud prevention, reliability, moderation), compliance with law (copyright notices and legal requests), and consent where we ask for it (for example notifications and microphone access).
Who sees your content
Public takes, comments and profile details can be seen by anyone using Starlight. Choose “Followers” when posting, or make your account private, to limit who sees them. Blocking someone hides your profile and takes from them. Saved lyric sheets are never shown to anyone else.
Service providers
We use these providers to run Starlight. They process data only on our behalf.
| Provider | Purpose |
|---|---|
| Cloud hosting and object storage (S3-compatible) | Runs our servers and stores uploaded takes and avatars |
| Google Firebase Cloud Messaging | Delivers push notifications to Android devices |
| Sentry | Error and crash monitoring for the app, website and servers |
We don’t sell personal information or share it for advertising. We may disclose information if the law requires it, to respond to valid legal process, to protect people’s safety, or in connection with a business transfer (you would be notified).
How long we keep it
| Data | Retention |
|---|---|
| Takes you delete | Hidden immediately; the audio and post are permanently erased within 24 hours |
| Everything tied to your account | Erased when you delete your account (profile, takes and their audio, comments, likes, follows, saved lyrics, device tokens, creator packs) |
| Backups | Deleted data can remain in encrypted backups for up to [30] days before it is overwritten |
| Points ledger | Kept without your name or email (only random IDs and a hashed device value) to keep creator totals and fraud checks accurate |
| Copyright notices and strike records | Kept as long as needed to meet our legal obligations and enforce our repeat-infringer policy |
| Server logs and crash reports | Kept for a limited period, normally no more than [90] days |
Your rights and choices
You can edit your profile and privacy settings in the app, delete takes and comments, and delete your account. Depending on where you live (for example under the GDPR, UK GDPR, or the California Consumer Privacy Act) you may also have the right to access or receive a copy of your information, correct it, object to or restrict some processing, withdraw consent, and complain to your data protection authority. We do not discriminate against anyone for exercising these rights. To make a request, email [email protected] from the address on your account. We may need to verify it’s you.
Children
Starlight is not for children under 13 (or the higher minimum age in your country, such as 16 in parts of the EU). We do not knowingly collect information from them. If you believe a child has created an account, contact us and we’ll delete it.
International transfers and security
Our providers may process data in countries other than yours. Where required we use safeguards such as standard contractual clauses. We protect data with encryption in transit, hashed passwords, short-lived access tokens, rate limiting and access controls. No system is perfectly secure, so please use a strong, unique password.
Changes and contact
If we make material changes we’ll tell you in the app or by email before they take effect. Questions about this policy: [email protected], Starlight (legal entity name to be added), Postal address to be added.