Privacy Policy

This Privacy Policy describes how BARS ("we", "us") collects, uses, and protects your information when you use the BARS Android app or progressive web app at bars.manta-web.com. We collect only what we need to operate the app and never sell your data.

Information we collect

Account information

• Email address - required for account creation, both for direct registration and Google Sign-In.
• Name and display name - shown to other members in shared rooms.
• Profile picture URL - pulled from your Google account if you sign in with Google.
• Authentication identifier - when you use Google Sign-In, we store the unique Google identifier (the sub claim) to recognize you on subsequent logins.

App activity

• Songs you import and lines you decode - stored as part of your personal history so you can return to them.
• Notes you write on specific lines - visible to you and to members of any room you've joined.
• Recent search queries - your last 5 unique searches, surfaced as suggestions when you open the search screen.
• Subscription state - when you subscribe via Google Play, we store the purchase token and the current entitlement state (active, expired, etc).

Technical

• Crash reports and error logs via Sentry. Personal identifiers and lyric text are stripped before upload.
• API usage logs for cost accounting (which user analyzed how many lines).

Audio (voice features only - v0.3.0)

• Voice search uses your device's built-in speech-to-text engine (Android SpeechRecognizer / iOS Speech / browser Web Speech API). The audio is processed on-device or by your platform vendor; BARS never receives the raw audio - only the resulting text transcript when you submit a search.
• Voice identify ("What's playing?") records ~12 seconds of ambient audio and forwards the bytes to our partner ACRCloud for music recognition. We do not retain the audio after the request completes; ACRCloud does not store it for training under their commercial terms. The recording is used only for matching against their music database. Microphone access is requested at first tap and can be revoked at any time from your device settings.

How we use this information

• To provide the app's core function (importing songs, generating analyses, saving your history).
• To send the line you tap, the song's title and artist, and a few lines of surrounding context to Anthropic's Claude API for analysis. Anthropic's API processing is governed by their Commercial Terms - they do not train models on this data.
• To verify your Google Play subscription with Google's billing API.
• To fix crashes and bugs (via Sentry).
• To enforce free-tier daily limits and prevent abuse.

Who we share with

We do not sell your data. We do not share your data with advertising networks. We do not use your data for ad targeting.

We share narrowly with these third parties only as required to operate the service:

• Anthropic (Claude API) - receives the lyric line plus context, song title, and artist for analysis. Does not receive your name, email, or device identifier.
• Google (Sign-In + Play Billing) - when you sign in with Google or subscribe, Google receives the data needed for those flows.
• LRCLIB (lrclib.net) - the primary source for song lyrics. LRCLIB is a free, MIT-licensed, community-contributed lyrics database operated as a not-for-profit by volunteer contributors. The song title and artist name are sent to them when you import a song. LRCLIB does not require an account and does not track individual users.
• Genius - used to find song metadata (artwork, release year, canonical URL) and as a fallback for lyrics when LRCLIB doesn't have a track in its catalog. The search query and song title/artist are sent to them.
• Apple iTunes Search API - used to find a 30-second audio preview for the song. Title and artist are sent.
• YouTube Data API - used to find a music video. Title and artist are sent.
• Sentry - receives crash logs and error metadata. Lyric content and email addresses are stripped before transmission.
• ACRCloud (audio recognition) - when you use the "What's playing?" feature, the ~12-second audio sample is forwarded to ACRCloud for matching. ACRCloud does not retain the audio and does not receive your name, email, or device identifier.
• Firebase Cloud Messaging (Google) - your device's push notification token is registered with Firebase so we can deliver notifications about new features, important updates, or activity in rooms you've joined. Notifications can be disabled in your device settings at any time, which also stops any data from being sent.

Your rights

You can:

• Access and export all your personal data - open the app, go to Profile, tap "Export my data". You'll receive a JSON file.
• Delete your account - open the app, go to Profile, tap "Delete account". This removes your user record, history, notes, search history, and room memberships immediately. Rooms you owned are transferred to the next-oldest member, or deleted if you were the only member.
• Request data correction - email us.

If you live in the EU/UK, you have rights under GDPR including the right to data portability, the right to erasure, and the right to lodge a complaint with your local data protection authority.

If you live in California, you have rights under CCPA including the right to know what personal information we collect and the right to deletion.

Data retention

When you delete your account, your personal data is removed from our active database immediately. Encrypted off-server backups are purged within 30 days. Server logs (which do not contain personal content) are rotated within 90 days.

Cached lyric analyses are not personal data - they're shared across all users to reduce API costs. Deleting your account does not invalidate the cache for other users who analyzed the same lines.

Security

All API traffic uses HTTPS. Authentication tokens are stored in Android Keystore on Android devices and in encrypted browser storage on the PWA. We hash passwords with bcrypt. Service-account credentials and API keys live server-side only and never appear in the mobile app.

Children

BARS is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, email us and we'll delete it.

Changes to this policy

We may update this policy as the app evolves. Material changes will be announced in the app and at bars.manta-web.com/privacy. The "Effective" date at the top reflects the current version.

Contact

For privacy questions, data requests, or anything else: bars@manta-web.com.