Privacy

• Videos already analyzed can be viewed with no account. Analyzing a new one needs a free account (Google or email).
• No audio or video is kept.
• Your IP address is never stored as such: only a fingerprint of it is used to limit abuse.
• Audience measurement and advertising cookies only if you accept them; declining is as easy as accepting.

The link itself is not kept. We only extract the platform and the public ID of the video (for example “tiktok-7694001007843347719”), which become the address of the result page. The public link is passed to our recognition engine, ACRCloud, which listens to the video and then deletes its file once the analysis is done.

We keep the result: title and length of the video, recognized songs, timestamps. This result is public, acts as a cache (a video already analyzed shows up instantly for everyone) and contains no data about you.

If a link doesn’t work, you can choose the video file. Your browser extracts only the audio, reduced to the minimum needed for recognition (mono, 8 kHz). This audio passes through our servers to ACRCloud without being stored, and ACRCloud deletes it after the analysis. The video itself never leaves your device.

Every analysis has a cost. To prevent abuse, we limit the number of requests per visitor: the IP address is turned into an irreversible encrypted fingerprint (with a secret salt), and only this fingerprint is kept along with a counter. The address itself is not stored.

An invisible anti-bot check, Cloudflare Turnstile, looks at technical signals from your browser when you submit, only to tell a human from a bot. This processing is governed by Cloudflare’s Turnstile Privacy Addendum.

Our hosts (Vercel, Convex and Cloudflare, which serves their networks) keep technical logs that contain IP addresses, for security and for the service to work properly, according to their own retention periods.

If you write to us, we keep your message and, if you give it, your email address to reply. These messages are deleted at the latest 12 months after they are sent.

The account is used to start a new analysis (3 a day) and to use credits. With Google (Google Ireland Limited), we receive your name, email address, profile picture and a Google ID, nothing else (no contacts, no password). With your email, we keep your address and your password in hashed form (scrypt: nobody can read it back); a 6-digit code is sent to you by Resend to confirm the address or change your password. This data is used to recognize your account and to send invoices; never for marketing. Your session is kept in your browser’s local storage (strictly necessary, no consent needed) and deleted when you sign out.

Payment goes through Stripe (Stripe Payments Europe Ltd, Ireland): we never see your card. Stripe sends us the subscription status (plan, dates, active or cancelled), a customer ID and the email address you give it for receipts. Stripe applies its own privacy policy and sets cookies on its payment page that are needed for security and fraud prevention.

For the history (shown to subscribers), we keep the list of videos requested while signed in (public video ID and date), as long as the account exists. Usage counters (analyses of the day, minutes of long videos) are tied to the account and erased at the end of their period.

Release alerts: if you click “Let me know when it’s out”, we keep the video, the track (title, artist, ISRC code if any) and the page language, tied to your account. Every day, for 6 months at most, we look for that track on Deezer and Apple Music (public search, with no data about you). When it is available, Resend sends you a single email at your account address. Legal basis: your consent, given by that click; you withdraw it with “Cancel the alert” on the page or the “Stop all my alerts” link in the email. The alert is kept as long as the account exists, so we never email you twice.

You can ask for the deletion of the account and its history at any time through the contact form. Invoices are kept by Stripe and by us for 10 years, as required by French commercial law.

Your choice is asked by Google’s banner (“Privacy & messaging”, an IAB TCF certified platform), where “Do not consent” is offered at the same level as “Consent”. Until you choose, or if you decline, no measurement or advertising cookie is set (Google consent mode set to “denied” by default). You can change your mind at any time with the “Manage cookies” link at the bottom of the page. Your choice is kept for 13 months at most.

If that banner isn’t available (for example while Google is reviewing the site, or if a blocker prevents it from showing), a VideoSongFinder banner asks for your consent to audience measurement only, with “Decline” and “Accept” at the same level. Your choice is then kept for 6 months in your browser’s local storage; if you withdraw consent, the Google Analytics cookies already set are erased.

Advertising: Google AdSense (Google Ireland Limited) shows ads below results and at the bottom of pages, never before the answer. They are personalized only if you accept; otherwise Google only shows non-personalized or limited ads (how Google ads work).

Audience measurement: Google Analytics 4 (Google Ireland Limited), loaded only after your consent, to count visits and page views. “_ga” cookies (13 months at most); IP address not kept by Google Analytics 4; data kept for 2 months.

Language: a “vsf_lang” cookie remembers the language you chose or that was picked on your first visit (French or English) for 12 months. It is only used to show the site in your language, so it doesn’t require consent.

Click maps and session recordings: Microsoft Clarity (Microsoft Ireland Operations Limited) observes clicks, scrolling and page views to find what gets in the way on the site. Input fields are masked. Without your consent, Clarity sets no cookie and each visit stays separate; with your consent to audience measurement, its “_clck” and “_clsk” cookies (12 months at most) link your visits together.

Cookieless visit statistics: Vercel Web Analytics counts page views and where they come from anonymously, for overall figures only. Nothing is stored on your device; a visit is recognized by a fingerprint computed from the request, which cannot identify you and is erased after 24 hours.

• Vercel Inc. (United States): website hosting and cookieless visit statistics.
• Convex, Inc.: database and processing, servers in Ireland.
• ACRCloud PTE. LTD. (Singapore): music recognition (its policy).
• Cloudflare, Inc.: network and anti-bot check.
• Resend, Inc. (United States): sending confirmation codes for accounts created with an email, and release alerts.
• Stripe Payments Europe Ltd (Ireland): payment of credits.
• Google Ireland Limited: account sign-in (“Continue with Google”) and, only with your consent, advertising (AdSense) and audience measurement (Google Analytics).

On a video page, the preview comes from the original platform: thumbnail loaded from YouTube (i.ytimg.com) or TikTok (tiktok.com and its image network), without cookies. The TikTok, YouTube (privacy-enhanced mode) or Instagram player only loads if you press play; the platform may then set its own cookies, under its privacy policy.

For cover art and listening links, our servers query Deezer, Apple (iTunes) and YouTube with the song title and artist: no data about you is sent to them. Transfers outside the European Union rely on the safeguards offered by these providers (European Commission standard contractual clauses or the Data Privacy Framework).

Providing the service you ask for and protecting it against abuse are our legitimate interest. So is replying to your messages. The account, payment and history are necessary to perform the service you request; keeping invoices is a legal obligation.

Data controller: Robin Carivenc, sole proprietor (see the legal notice).

You can ask for access to, correction or erasure of the data about you, or object to its processing, through the contact form. You can also file a complaint with the French data protection authority, the CNIL (cnil.fr).