Privacy Policy
Effective 17 July 2026
SongCipher (“we”, “us”) is a music-trivia game where you decode paraphrased
lyrics to guess the song and artist. This policy explains what we collect, why,
and the choices you have. Questions: hello@songcipher.com.
Information we collect
- Account info — email, name / display name, and an optional username, so you can sign in and appear on leaderboards.
- Gameplay data — scores, streaks, ELO rating, achievements, and match history, to run the game and its leaderboards.
- Contacts (optional, off by default) — if you turn on “find friends by phone,” phone numbers are hashed on your device (SHA-256) before being sent; we never store raw phone numbers. You can disable this any time, which deletes the stored hash.
- Push token — if you enable notifications, a Firebase Cloud Messaging token so we can send game alerts.
- Advertising identifiers — Google AdMob uses device identifiers to serve and measure ads (rewarded and interstitial).
- Purchases — if you buy the ad-free upgrade, the transaction is handled by the app store and (when enabled) RevenueCat. We receive an entitlement status, never your card details.
Gameplay is stored locally on your device (SQLite) and synced to our servers so your progress follows you across devices.
How we use it
- Provide and sync the game, leaderboards, friends and multiplayer.
- Show ads (the free tier) and process the optional ad-free purchase.
- Send notifications you’ve opted into, and respond to support requests.
- Detect abuse and keep the service secure.
Third-party services
We share limited data with providers that power features of the app:
- Google AdMob — advertising (device ad identifiers).
- RevenueCat & the Apple App Store / Google Play — purchases.
- Genius — official lyrics are shown inside an embedded web view from Genius; their site is governed by their own terms and privacy policy. We do not store lyrics.
- Apple Music / iTunes — 30-second song previews.
- Spotify — song metadata.
Your choices & rights
- Delete your account in the app: Settings → Delete Account (revokes access and deletes your account and personal data server-side), or email us. See Account & Data Deletion.
- Turn contact discovery and notifications on/off any time in Settings.
- Reset your advertising identifier in your device settings.
GDPR / UK (EEA & UK users): our legal bases are performance of
our agreement with you (running the game), your consent (contacts, notifications,
personalized ads), and legitimate interests (security, improving the game). You
have the right to access, correct, delete, restrict, object to processing, and
data portability. Contact us to exercise these; you may also complain to your
local data-protection authority.
California (CCPA/CPRA): we do not sell your personal
information. You have the right to know what we collect, to delete it, and to not
be discriminated against for exercising these rights.
Children
SongCipher is for general audiences (rated 12+ / Teen) and is not directed at
children under 13. We do not knowingly collect personal information from children
under 13; if you believe a child has provided us data, contact us and we’ll delete it.
Data retention & security
We keep your data while your account is active. When you delete your account we
remove your account and personal data within 30 days; anonymized aggregate stats
(which don’t identify you) may remain. We use industry-standard safeguards
including encryption in transit.
Changes
We’ll update this page and revise the “Effective” date when this policy changes.
Contact
hello@songcipher.com