VocalScope
Privacy Policy
This policy explains how VocalScope ("we", "us") handles personal information when you (a) apply for or use the VocalScope web app at https://app.vocalscope.app and https://vocalscope.app, and (b) interact with VocalScope's official social media accounts, which we manage with an internal tool that uses the TikTok and YouTube APIs.
Operator: VocalScope operator, Republic of Korea. Contact (including privacy requests): [email protected].
Part A — The VocalScope web app
A1. What we collect
| Category | What exactly | When |
|---|---|---|
| Beta application | Nickname, email address, country, device type, singing level, what you want to use VocalScope for, form language, time of submission, the versions of the notices you agreed to, and a short hash of your IP address (to limit abuse) | When you submit the form at /apply |
| Access data | A one-way hash of your invitation token; device and session cookies that keep you signed in; for team members on our private network, a hash of their network login | When you open your invitation link and use the app |
| Your content | Songs, backing tracks and stems you upload; lyrics and notes you enter; the mixes, analyses and practice data the app creates | When you use the app |
| Voice analysis | For the voice-range and vowel features your recording is analysed and then deleted right away; only the numbers (for example pitch range) are kept — unless you turn on data contribution with audio (A3) | When you use those features |
| Studio mixes | Vocals you upload to the mixing studio are processed and stored only in your own space on our server in Korea and never leave it. They are deleted when you delete the mixing session; a vocal left in an unclosed session is deleted at the server's next clean-up after it is 24 hours old (clean-up runs when the studio starts or is used). The finished mix is deleted the same way after 24 hours | When you use the studio render |
| Usage events | Which screen you used, what kind of action, and for how long (no content) | While you use the app |
| Server logs | Time, request path (without query), result code, size, duration, a short hash of your user ID and of your IP address. No browser user-agent, tokens or cookie values | Every request |
| Messages you send us and the welcome email we send you | When you write to us / when you are approved |
We do not use passwords, third-party sign-in, advertising identifiers, or analytics or tracking services. We do not collect payment information; the beta is free.
IP hashes: we store a shortened SHA-256 hash of IP addresses, not the address itself. Because such a hash can in principle be reversed by trying every address, we treat it as personal information.
A2. Why we use it
- To review your beta application and send you an invitation (your consent on the form).
- To operate the app: store, process and play back your content, keep you signed in, and keep the service secure.
- To understand which features are used, from usage events without content, so we can improve them.
- To improve VocalScope's engine with data contribution, as described in A3.
- To answer your messages and handle deletion and other rights requests.
We do not sell personal information, use your content for advertising, or post your content on social media.
A3. Data contribution (research to improve the engine)
The app shows a "Data contribution" notice the first time. To make VocalScope more accurate, we use your vowel-training numbers and the songs and lyrics you upload (including your corrections) for research, only on this server. Audio files only if you agree separately. Never published or shared. We keep it until you turn this off or delete it.
- It is on by default, but only after you have seen the notice; nothing is kept before that. You can choose "Turn off" on the notice, or change it any time in Settings → Data contribution.
- Vowel training: numeric features only (pitch, harmonic levels, resonance/formants), timing and the mic type (for example iPhone or USB). The audio of a take is kept only if you separately turn on "Include the recorded audio too".
- Songs and lyrics: the lyrics you enter and your corrections (text, syllable placement, timing, pitch) and pointers to the song (length, language, analysis version). Audio files are not copied. Trial songs are excluded.
- No names or device names are kept. Nothing leaves this server, and it is not sent to any AI provider.
- When you turn it off, nothing new is kept and the research copy drops your records at the next cleanup. To delete everything you contributed so far, use "Also delete what I contributed so far" in the same setting.
A4. Where it is processed and who receives it
- All app data is stored and processed on a computer we own and operate in the Republic of Korea. Lyrics transcription and audio processing run locally on that computer.
- Cloudflare, Inc. carries traffic between your browser and our computer (Cloudflare Tunnel, TLS encrypted) and processes connection data such as your IP address. Tailscale Inc. provides an alternative connection path (Tailscale Funnel) for some invitations.
- Google LLC (Gmail) is used to send and receive email with [email protected].
- AI coach features that could send measurement data (not audio) to an AI provider are turned off in the public beta. If we turn them on, we will update this policy first.
- We may disclose information if required by law or to protect rights and safety.
Overseas transfer: Cloudflare (United States, network transit), Tailscale (United States / Canada, network transit, Funnel invitations only), Google (United States, email).
A5. How long we keep it
| Data | Retention |
|---|---|
| Beta application | Until the beta ends or until you ask us to delete it |
| Your content | Until you delete it or your account is deleted. Deleted songs go to a trash folder and are permanently removed after 30 days (memos after 7 days) |
| Data contribution | Until you turn it off or delete it (A3) |
| Voice-analysis recordings | Deleted immediately after analysis; numeric results are kept with your account |
| Studio uploads / mixes | Uploaded vocals: until you delete the session, or at the next clean-up after 24 hours; mixes: at the next clean-up after 24 hours |
| Server logs | Rotated by size (about 64 MB in total), so older lines are overwritten |
| Usage events | Monthly files on our computer |
| Backups | Nightly local backups kept 7 days (daily) and 4 weeks (weekly), only on our own computer. Deleted data can remain in backups for up to about 5 weeks |
A6. Deleting your data and your rights
- You can delete songs and other items in the app (they leave the trash after 30 days).
- To delete your whole account, email [email protected] from the address you applied with. We delete your account data within 7 days and confirm by email. Backup copies expire within about 5 weeks.
- You may ask to access, correct, suspend processing of, or receive a copy of your information, and withdraw consent at any time.
- If you are unhappy with our answer you can contact the Korea Internet & Security Agency privacy center (privacy.kisa.or.kr, 118) or your local data protection authority.
A7. Cookies and local storage
| Name | Purpose | Lifetime |
|---|---|---|
| __Host-vs_gate | Keeps you signed in | 7 days |
| __Host-vs_dev | Binds your invitation to your device | 30 days |
| __Host-vs_join, __Host-vs_transfer | One-time security values during sign-in / device transfer | 10 minutes |
| __Host-vs_apply | Protects the application form from abuse | 1 hour |
| vs_lang | Remembers your language | 1 year |
| Local storage vs.* | App settings on your device | Until you clear it |
All are strictly necessary or preference cookies. We use no advertising or analytics cookies.
A8. Children
The beta is for people aged 13+ in the United States and 14+ elsewhere. We do not knowingly collect data from younger children; if you believe a child has applied, contact us and we will delete it.
A9. Security
Access is invitation-only; tokens are stored only as one-way hashes; cookies are HttpOnly and Secure; data files are readable only by the operating-system account that runs the service; connections use TLS. No system is perfectly secure; we will notify affected users and authorities of a breach as the law requires.
Part B — Our social media accounts and the TikTok / YouTube APIs
VocalScope uses an internal publishing tool to post short promotional clips to VocalScope's own TikTok account and YouTube channel. Only our team uses it; nobody else can connect an account to it.
B1. What data we access, and why
| Platform | Data accessed | Purpose |
|---|---|---|
| TikTok (Login Kit, Content Posting API) | For our own account only: account identifier (open_id), basic profile (display name, avatar), the creator settings TikTok returns before posting (allowed privacy levels, interaction settings, maximum video length), the status of our uploads, and view / like / comment / share counts of our own videos | To post our clips with the privacy setting a team member chooses, confirm they were published, and measure how our own posts perform |
| YouTube (YouTube Data API v3) | For our own channel only: upload and privacy status of our videos, view / like / comment counts, our subscriber count, and the text of public comments on our own recent videos | To upload our Shorts, check they were processed, measure performance, and alert a team member when a comment needs a personal answer (for example a copyright or privacy concern) |
Every TikTok post is reviewed by a team member on a confirmation screen that shows our TikTok account, the privacy setting and interaction settings they choose, the music usage confirmation and a preview of the video. Nothing is posted to TikTok without that approval.
We do not access other users' accounts, private messages, contact lists, or data from accounts other than our own. We do not post replies, likes or follows automatically. Our clips are never made from our app users' recordings.
Comments on our YouTube videos are public content written by other people. We read them only on our own videos from the last 14 days, keep only the comment ID (to avoid alerting twice) and, when a comment needs attention, its first 80 characters in an internal message to our team.
B2. Storage, retention and deletion of platform data
- OAuth tokens are stored only on our own computer in a file readable solely by the account that runs the tool. They are never printed, logged or shared, and are deleted when we disconnect the account or access is revoked.
- Post records (platform video ID, URL, time, status) are kept while the post exists, so we can manage it.
- Statistics received from the YouTube API are deleted automatically after 30 days.
- Comment IDs: only the most recent 5,000 are kept; older ones are discarded automatically. Alert messages with comment excerpts stay in an internal log on our computer.
- Captions for our posts are written with the help of an AI service (Anthropic) using only song information (title, artist, language, clip length). No TikTok or YouTube user data is sent to it.
B3. Revoking access
Anyone who has connected a Google account to an application can revoke it at https://myaccount.google.com/permissions. TikTok authorizations can be removed in the TikTok app under Settings and privacy → Security → Manage app permissions. When access is revoked we delete the stored tokens, the tool stops, and the remaining YouTube statistics are deleted within 30 days.
B4. YouTube API Services
Our tool uses YouTube API Services. By interacting with our YouTube content you are also subject to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy). We follow the YouTube API Services Terms of Service and Developer Policies, including deleting stored API data within 30 days.
B5. Google API Services User Data Policy — Limited Use
VocalScope's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We use Google user data only to provide and improve the publishing features above; we do not use it for advertising or sell it; and no human reads it except our own team for the comment alerts in B1, for security, or to comply with law.
B6. TikTok
Our use of TikTok's developer products follows the TikTok Developer Terms of Service and the Content Posting API guidelines. TikTok's own processing is described in TikTok's Privacy Policy (https://www.tiktok.com/legal/privacy-policy).
Changes and contact
We will post changes here with a new effective date and, for significant changes, tell active users in the app or by email.
Person responsible for personal information: VocalScope operator, [email protected].
Contact: [email protected]