Privacy Policy

Last updated 10 September 2026 · Applies to KaraokeList for iPhone and Android

1. Who this is from

KaraokeList is an iPhone and Android app made by Michael Jones, an independent developer. For anything in this policy, including a request to see or delete your data, write to dev.michael.jones@gmail.com. I read that address myself.

This policy covers the KaraokeList apps for iPhone and Android, and this website. It does not cover anywhere else you might end up — if you tap a link to a venue's website or search for lyrics, you have left KaraokeList and that site's own policy applies.

2. What stays on your phone

KaraokeList is built local-first. Your songs and your logged nights are written to a database on the device, and reading them, searching them, adding to them and logging a sing all work with the network switched off.

Stored on the device:

• Your setlist — song titles, artists, the Skill and Fun tags, your star rating, notes, and the "Not again" flag.
• Your sings — what you sang, when, where, how you rated it, and whether it sat too high, just right, or too low in your voice.
• Your profile answers — the ones you gave when you set the app up, all of them skippable.
• Venue coordinates — the map position of a bar you logged a sing at. These never leave the device. They are excluded from every sync, by design, because they were gathered to fill in a text field and publishing them would be a different purpose.
• Your last batch of suggestions, so it is still readable offline.

3. Your account, and what syncs

KaraokeList opens with no account, and most of it never asks for one. Your setlist, your logged nights and the karaoke map all work signed out. An account is for the parts that cannot work without one: syncing so your setlist survives a lost phone, the public @handle, the AI features, contributing to the map, Apple Music playlist sync on iPhone, and buying a subscription. Sync is free in both directions.

You can sign in with Sign in with Apple, with Google, or with an email address and password. Accounts are handled by an outside authentication provider. What is held depends on which you pick: an account identifier always, an email address if you gave one, and whatever Sign in with Apple chose to return — if you used Apple's Hide My Email, I only ever see the relay address, never your real one.

Once you are signed in, your setlist, your sings and your nights out, your profile answers, and your public @handle are copied to a cloud database and attached to your account. Venue coordinates and private places are not. This is a backup of your own data for your own use — it is not published, not pooled, and not visible to anyone else.

4. What is sent to other companies

KaraokeList has no machine of its own sitting somewhere. Its backend is a handful of small functions run on Google's infrastructure, and beyond those it relies on a small number of outside providers, each doing one job. They act as processors on my instructions: they may use what they receive to deliver that service to me, and not for their own purposes.

The categories, and what each one receives

Account and sign-in	Your sign-in credential and account identifier, plus your email address if you signed in with one.
Cloud database and hosting	The synced copy of your setlist, sings, profile answers and public handle, described in section 3.
Large language model	A summary of your setlist, sent to an LLM to produce suggestions, name a song you described, or write your singer read. Exactly what is sent is set out below.
Abuse prevention	A signal confirming the request came from a genuine copy of the app, so nobody else can run up the bill on your behalf. It identifies the app, not you.
Product analytics	A count of how often each AI feature is used, tied to your account identifier. See section 8.
Music recognition and catalog	An acoustic fingerprint when you identify a song, and your search text when you look one up.
Maps and place search	The name you type when you are naming a bar, so real places can be offered back.
Subscriptions	Your account identifier, the purchase itself, and — sent by the billing SDK with every request — a device-level identifier, your device model, your language and your store country. That is what lets one subscription work on both an iPhone and an Android phone. No email address, no setlist, no ratings, and no advertising identifier.
Crash and error reports	The device model, the operating system version, the app version, and the fault — its type, its message and where in the code it happened. On Android, also whether somebody was signed in, never who. See section 8.

What actually goes to the model

When you ask for suggestions, ask "what's that song?", or open your singer read, the app sends the language model a summary of the material it needs to answer: song titles and artists from your setlist, your ratings, your Skill and Fun tags, your too-high/just-right/too-low answers, your profile answers, and the songs you have flagged Not again so it does not suggest one back to you.

It does not send your name, your email address, your account identifier, your location, the names of venues, or the contents of your notes. The result comes back and is saved on your device. Nothing of what was sent or what came back is stored by me — only that a call happened, how big it was and what it cost, which is section 8. Your setlist is not used to train anybody's model.

Two that are worth spelling out

• Identifying a song by listening — a digital signature of the audio is sent to be matched. It is a fingerprint, not a recording, and no audio is stored by the app or by the service.
• Searching the music catalog — on both phones this is Apple's public search. It needs no account, no key and no permission, and it is also where cover art comes from, so Apple sees which songs you look up and which artwork the app loads.
• Apple Music playlist sync (iPhone only, and only if you turn it on) — this is the one that asks permission, because it writes into your own Apple Music library. Turning it on looks each of your songs up in Apple's catalog and sends the catalog identifiers to Apple Music, so a playlist can be built in your own library and kept in step with your list. It is off until you switch it on, needs an account, and the rest of the app is unaffected by declining.

5. Location

KaraokeList reads your location in two places, both of them while you are looking at them: when you tap the venue field while logging a sing, and when you open the Places tab, so the map can start where you are. It never reads your location in the background, and it keeps no trail.

While the Places map is on screen it shows your position as a dot, which means it is following you for as long as you are watching it. Closing the app ends it.

It asks for a precise fix, because the question it is answering is "which of these bars are you standing in," and a vague answer cannot answer it. But the precision is yours to give:

• Precise — the app lists the bars right around you.
• Approximate — it lists the neighbourhood, with a wider net, and says so.
• Denied — nothing is lost. The search still runs, ranked from a venue you have already logged, and whatever you type always saves.

The reading is sent with the search it is ranking, as the patch of the world to look in: to Apple on an iPhone, and on Android to the shared venue index. On the Places tab the map itself sees it too — Apple's on an iPhone, Google's on Android. It is not sent to the language model, not attached to your account, and not stored as a trail. The only coordinate ever written down is the one belonging to a venue you picked — and, as above, that stays on the device.

6. Microphone

The microphone is used only while the identify screen is open and listening, and only to produce the acoustic fingerprint the recognition service matches against. Audio is not recorded, not saved, and not sent anywhere else. Closing the screen ends it. The app cannot listen when it is not in front of you.

7. Places, and the only thing other people see

KaraokeList has a shared map of bars that host karaoke, built from what singers contribute. Contributing is always a deliberate act — adding a venue, correcting one, confirming one, or reporting that it has stopped doing karaoke.

When you do contribute, what becomes public is the venue information itself — its name, address, and which nights it runs — alongside the public @handle you chose. Your handle is the only thing about you that another user of this app can ever see. Your email address, your real name, your setlist, your ratings, and your sings are never visible to anyone but you.

Nothing about a venue is published as a side effect of using the app. Logging that you sang somewhere does not put it on the map. Your habits are not mined into a listing, and a place you flagged as private can never become one however often you go.

8. Analytics, and reports when something breaks

The iPhone app records an event each time you use an AI feature — a suggestion, a recall, a singer read — through Firebase Analytics, tagged with your account identifier, along with what that one call cost to run. It exists so I can tell whether the features people asked for are the features people use, and whether they are affordable. The Android app sends none of these; the same figures are logged on the server instead, against your account identifier, when it answers the request.

Firebase Analytics also collects what it collects by default on both phones: that the app was opened, that a session started, the device model and operating system, and the country your connection appears to be in. There is no advertising identifier in either app.

When something goes wrong

Crashes, on both phones. If the app dies, a crash report goes to Firebase Crashlytics: the device model, the operating system version, the app version, and where in the code it stopped. On Android the same report also reaches me directly on the next launch, by the route below.

Errors the app caught, on Android only. These are the ones that turn into "Couldn't listen just now" rather than a crash — invisible to me until recently, which is how a broken Identify screen shipped twice. On Android they are sent to me, carrying the same device facts, the fault and its message, whether somebody was signed in, and whether the app could prove it was a genuine copy of itself. The iPhone app does not do this at all, and if it gains it, this section changes first.

What a report is designed never to contain: your name, your email address, your account identifier, your setlist, your ratings, your notes, your location, or a venue name. The fields it may carry are a fixed list, enforced by a test, and none of them is about a person. Error messages are the one part that is not structurally safe — they come from somebody else's code and are free to say anything — so they are scrubbed of email addresses, long identifiers and the query part of any web address before they are sent. That scrub is a second line of defence rather than a guarantee.

There is one exception, and it is one you make yourself: "Message the developer", in the iPhone app's profile screen, sends what you typed along with your @handle and email address, so I can write back. Nothing is sent unless you tap send.

There is no advertising identifier, no IDFA, no ad network, no attribution SDK, no session recording, and no heatmapping. The iPhone app's privacy manifest declares no tracking, and the Android app strips the advertising identifier out of the build entirely. There is nothing in either binary that could track you across other apps or websites.

This website is measured too, and separately. The pages on karaokelist.app use Google Analytics, which sets a cookie and records that a page was viewed — which page, roughly where in the world the reader was, and which site they came from. It exists to answer one question: whether the city guides are worth writing. It is not connected to your KaraokeList account, and nothing you do in the app appears in it.

None of it is used to build a profile of you or to follow you to other websites, and it is not joined to your KaraokeList account. If you would rather not be counted at all, any browser content blocker will stop it, and the pages work exactly the same without it.

9. What KaraokeList never does

• No selling or sharing of personal information, as those words are defined by California law or any other. There is no arrangement under which anyone could buy this data, and there never will be.
• No advertising, and no ad networks or data brokers in the app.
• No tracking you across other apps or websites. The website's page-view counter (§8) is confined to karaokelist.app and is not joined to any advertising profile.
• No profile sold to a label, a venue, or a music service.
• No lyrics. Lyrics are licensed by publishers, so the app stores none and shows none. It links out to your browser, where the licensed text is on the publisher's own page.
• No publishing anything you wrote without you doing it yourself.

10. How long it is kept, and deleting it

Your synced data is kept for as long as your account exists. It is your setlist — the point is that it is still there in two years.

You can delete your account from inside the app, in the profile screen. Deleting it removes your account, the synced copy of your setlist, sings and profile, and releases your @handle for someone else to take. It happens straight away and it cannot be undone.

Deleting your account also clears the copy on that phone, at the same moment — the app does not leave a setlist behind for whoever picks the phone up next. Four things do survive, and you should know which:

• A subscription is not cancelled by deleting your account. It belongs to your App Store or Google Play account, not to your KaraokeList one, and only that store can stop it — so cancel it there first, or you will keep being billed for an account that no longer exists. I cannot cancel it for you and neither can the app.
• Diagnostics — crash reports, the usage counts in section 8, and the server's own record of having answered your requests are not removed with the account. None of them contains your setlist, your songs or anything you wrote. If you want the usage counts cleared too, ask me and I will.
• Venue information you contributed to the shared map stays on the map, because other people are relying on it — but it stops being connected to you, since the handle it was filed under is gone. This is the same principle any shared map runs on: the bar's Thursday karaoke night is a fact about the bar, not about you.
• A request made on the deletion page is itself recorded — the email address you typed, which of the two you asked for, and any note — so it can be acted on and so there is a record that it was. It is marked done rather than deleted, because a record of having honoured a deletion request is the thing that proves it happened.

You can also ask for your data to be cleared without closing your account — the same setlist, sings, nights and profile answers go, but your sign-in and your @handle stay and you carry on from an empty list. That one is not a button in the app; ask for it on the deletion page, which also handles account deletion for anyone who has already uninstalled. Either request works by email too, at the address in section 1.

11. Children

KaraokeList is made for adults who go to bars, and it is not directed at children. It is not intended for anyone under 13, and I do not knowingly collect anything from a child under 13. If you believe a child has created an account, write to me and I will delete it.

12. Your rights

Wherever you live, you can ask me for a copy of what is held about you, ask me to correct it, or ask me to delete it. Most of that is a button in the app already, and I would rather you used it — but the email address works too, and I will answer within 30 days.

If you are in the EU or the UK

Under the GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection. The legal bases I rely on are: performance of a contract for your account and the syncing of your own data, since that is the service you signed up for; legitimate interests for the small AI-usage count and for the abuse-prevention check, which keep the app working and affordable; and consent for your location, your microphone, and your music account, each of which the system asks you for separately and each of which you can withdraw in iOS Settings at any time. You may complain to your local supervisory authority.

If you are in California

Under the CCPA and CPRA you have the right to know what is collected, to delete it, to correct it, and to opt out of sale or sharing. There is nothing to opt out of: KaraokeList does not sell or share personal information, and has not in the preceding twelve months. The categories collected are identifiers (an account identifier, and an email address if you gave one), your own user-generated content (your setlist and sings), coarse product-usage data, and — momentarily and only when you allow it — geolocation. I will not discriminate against you for exercising any of these rights.

13. Where it is held, and security

Your synced data is stored in the United States — the database and the functions that serve it are pinned to US regions. The language model is the exception: it is called on a global endpoint, which means the request may be answered from a data centre anywhere the provider runs one. What is sent there is the setlist summary described in section 4, and nothing that identifies you.

If you are outside the US, using the app involves that transfer. Those providers' terms carry the standard contractual clauses that cover it.

Everything is encrypted in transit and encrypted at rest by the hosting provider. Access is governed by server-side security rules that allow each account to read and write only its own documents, deployed and enforced on the server rather than trusted to the app. No method is perfect, and I am not going to pretend otherwise — but there is no advertising pipeline, no data warehouse, and nothing here of interest to anyone but you.

14. Changes

If this policy changes, the date at the top changes with it. If a change is a material one — a new kind of data, a new company involved, a new purpose — you will be told inside the app before it takes effect, not left to find it here.

15. Contact

Michael Jones · dev.michael.jones@gmail.com

Questions about this policy, requests about your data, or a correction to something above — all to the same address.