Privacy Policy

Effective date: October 13, 2026

This Privacy Policy explains how ClipMelody collects, uses, shares, and protects information when you use our website and services.

Who we are

ClipMelody ("ClipMelody", "we", "us") is an independent project run by a solo developer. It is not affiliated with TikTok, ByteDance, Instagram, Meta, YouTube, Google, Shazam or Apple. For the purposes of applicable data protection laws, we are the controller of personal information processed through the service. You can reach us about any privacy matter at hello@clipmelody.com.

Information we collect

• Account details when you sign up: your email address, name and, if you sign in with Google, your Google profile picture.
• Billing information when you buy credits or a plan. Card details are handled by our payment provider; we never see them.
• What you ask us to identify: the link you paste, or the audio or video file you upload or record.
• Support messages you send us.
• Usage and device information collected automatically, including log data, browser type, IP address, pages viewed, referral URLs, and approximate location derived from technical signals.

How we use information

We use information to:

• Identify the song in the media you give us and show you the result.
• Create and manage accounts, credit balances, subscriptions and your song history.
• Limit free use (we count free recognitions per IP address) and prevent fraud and abuse.
• Process payments, credits and refunds.
• Communicate service updates, support responses and administrative notices.
• Analyze usage trends and improve the service.

Links, files and recordings

Links. To identify the song in a TikTok, Instagram or YouTube video, we send the link or video ID to a data provider that returns the public video or audio stream behind it. We then cut a 12-second clip of its soundtrack.

Uploads and recordings. A file you upload, or a recording you make with your microphone, is stored in private object storage only so that our processing service can read it. It is deleted automatically within one day. We never publish it.

Recognition. The 12-second clip is turned into an audio fingerprint, and the fingerprint — not the audio itself — is sent to Shazam's recognition service to look up the song. If that service is unavailable, the clip itself may be sent to AudD, a second recognition provider. Neither receives your name or account details from us.

Results are shared by media, not by person. The answer for a given video (its title, author, and the song we found) is stored once and shown on a result page that anyone with the link can open, so that a popular video is only identified once. Result pages for public videos may be indexed by search engines. Result pages for uploads and recordings are not linked from anywhere and are marked so search engines do not index them, but anyone you share the link with can open them. Which results you looked up is private: your history is tied to your account and is visible only to you.

No AI training on your activity

We do not sell your personal information, and we do not use your uploads, recordings or history to train machine-learning models.

Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies, we process personal information on one or more of these legal bases: performance of our contract with you, your consent, our legitimate interests in operating and securing the service, and compliance with legal obligations. Where we rely on consent, you may withdraw it at any time without affecting prior processing.

Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, secure the service, measure usage, and support payment and analytics integrations. Your recent results may also be kept in your browser's local storage so you can find them again without an account. See our Cookie Policy for more information.

How we share information

We rely on the following providers to run the service. Each processes only what its job requires, under its own privacy terms:

• Cloudflare — hosting, edge caching, object storage for uploads, and the Turnstile check that runs before a recognition.
• Amazon Web Services — the processing service that cuts the audio clip and asks the recognition provider.
• Turso — the database holding accounts, credit balances, results and billing records.
• TikHub — retrieves public TikTok and Instagram videos from the link you paste.
• RapidAPI (YT-API) — retrieves the public audio stream of a YouTube video from its ID.
• Shazam (Apple) — receives the audio fingerprint of the clip and returns the matching song.
• AudD — a fallback recognition provider that may receive the 12-second clip when Shazam is unavailable.
• Waffo — payment processing and subscriptions.
• Google — sign-in, if you choose to sign in with a Google account.
• Resend or Cloudflare Email — transactional email such as sign-in codes and receipts.
• Google Analytics, Plausible, Microsoft Clarity and Google Ads — usage and campaign measurement, where enabled.

We may also disclose information when required by law, to protect rights and safety, to enforce our terms, or as part of a merger, acquisition, financing, or sale of assets.

Data retention

• Uploads and recordings: deleted within one day.
• Cached video data from our providers: expires within hours.
• Song results for a media item: kept so the result page keeps working.
• Your history and billing records: kept while your account exists, and billing records for as long as accounting and tax rules require.

Security

We use reasonable technical and organizational measures to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your choices and privacy rights

You may update account information, clear the recent results stored in your browser, delete your account from Settings, or ask us to delete certain information. Some information may be retained when required for legal, security, fraud prevention, or accounting purposes.

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. Where the GDPR or UK GDPR applies, you also have the right to lodge a complaint with your local supervisory authority.

If you are a California resident, you may exercise rights under the CCPA/CPRA, including the right to know, delete, and correct personal information, and the right to opt out of the "sale" or "sharing" of personal information. We do not sell personal information for money. To the extent any analytics or marketing measurement constitutes "sharing" under California law, you may opt out by contacting us at hello@clipmelody.com or using available cookie controls.

To exercise any of these rights, contact us at hello@clipmelody.com. We will not discriminate against you for exercising them, and we may need to verify your identity before responding.

Children's privacy

The service is not intended for children under 13 (or under 16 in the EEA and UK, where a higher age applies), and we do not knowingly collect personal information from children below the applicable age. If you believe a child has provided us personal information, contact us at hello@clipmelody.com so we can delete it.

International use

Your information may be processed in countries other than where you live. Those countries may have data protection laws that differ from the laws in your jurisdiction.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify users or update the effective date above.

Contact

If you have questions about this Privacy Policy, contact us at hello@clipmelody.com.