Privacy Policy

Your privacy, in plain terms

Effective October 24, 2026

On sungto.com you can write song lyrics now; hearing a finished song and buying songs there is coming soon. Today, finished songs are made and bought in the Sungto iPhone app. Web accounts, sign-in and lyrics drafts work as described below; the sections about website purchases and refunds describe how buying will work once it opens, and until then they do not apply to anyone.

Sungto ("we," "us") makes an app and website that turn a few details about someone you love into a personalized song. This page explains what we collect, why, and what you can do about it. We've kept it short on purpose — if anything here isn't clear, email us and we'll explain.

Who we are

Sungto is operated by WeThank Technologies FZE, which is responsible for the personal data described here. This policy covers the Sungto iOS app and the sungto.com website, including the web accounts described below. Our registered company details are in the Terms of Service.

The iPhone app doesn't need an account

The Sungto iPhone app works without a sign-up screen. On first launch, the app creates an anonymous identifier for your device so we can track your free song and any packs you buy — no name, email, or password required or requested.

The song maker on our website is different: it asks you to sign in with Google or Apple before it writes any lyrics. What that involves is set out under Web accounts below.

What we collect

The details you type in

To write and generate a song, we collect what you enter in the app or in the song maker on our website: the recipient's name, your relationship to them (optional), an occasion (optional), and whatever highlights or details you add. This is sent to the AI services that write the lyrics and compose the music (listed below) — it's the whole reason the song can be personal, and we don't use it for anything beyond making that one song.

Device & account identifiers in the iPhone app

• An anonymous account ID, created automatically — this is how your songs and purchases stay attached to you across app launches.
• Apple DeviceCheck — a signal from Apple confirming your device hasn't already claimed the free song, so that offer stays one-per-device rather than something people can repeat endlessly. We never see anything else about your device through this.
• Your iCloud account, if signed in — used only as a recovery key. If you delete and reinstall Sungto, we use it to find your existing account and hand your songs and credits back to you, instead of starting you over. We store only a pointer from that iCloud identifier to your account — never anything else about your iCloud account or its contents.

Purchases

In the iPhone app, song packs are bought through Apple's In-App Purchase — we never see or handle your card details. Apple tells us which pack you bought so we can add the credits to your account.

On our website, song packs are sold by our online reseller, Paddle.com, which takes the payment — we never see or handle your card details there either. Paddle tells us that an order was paid, refunded or disputed, so that we can add songs to your web account or take them back. What that involves is set out under Buying songs on the website below.

Usage & crash data

We use privacy-focused analytics (TelemetryDeck) to see which parts of the app are used, and crash reports (Firebase Crashlytics) to fix bugs. Both are tied to your anonymous account ID, not to you personally.

Web accounts

The song maker on our website asks you to sign in with Google or Apple before it writes any lyrics. Signing in creates a web account. Until you sign in and ask for the lyrics, what you type into the song maker's form stays in your browser and isn't sent to us.

Separate from the iPhone app

A web account and the iPhone app are kept apart. Songs and credits in the app don't appear on the website, and nothing made on the website appears in the app — even if you sign in on the website with the same Apple Account your iPhone uses. We don't link the two.

What signing in gives us

Sign-in is handled by Firebase Authentication, a Google service, which keeps a sign-in record for your account. That record holds:

• Your email address. If you sign in with Apple and choose Hide My Email, we receive the private relay address Apple creates for you instead of your real one.
• Your name and profile photo, if Google or Apple shares them with us.
• The identifier Google or Apple uses for your account, and when you created the web account and last signed in.

If you sign in with Google, that list is all the Google user data we receive: your name, email address, profile photo and Google account identifier. We don't ask for access to anything else in your Google Account — not your contacts, files, mail or calendar. We never see your Google or Apple password.

We use this information only to sign you in, to show you which account you're signed in with, to find your account when you ask us for help or to delete it, and — when the account is created, or later if its free lyric drafts were held back at first — to apply the limits on free lyric drafts described below. We don't sell it, we don't use it for advertising or marketing, and we don't share it with anyone other than the Google service that stores it. It is never sent to the AI services that write the lyrics or compose the music.

What our own database holds

Your email address, name and photo stay in that sign-in record; we don't copy them into our own database. For a web account, our database holds only:

• An account ID — a random identifier that your lyrics drafts and songs are attached to.
• Your balance — how many songs and lyric drafts the account has left, the usage counts that go with them, and when the account was created.
• A scrambled copy of your Google or Apple account identifier (a keyed hash), with two dates: when that Google or Apple account first signed in, and when it was given its free lyric drafts. If a purchase made with that sign-in is refunded or disputed, a count of the refunds and a mark for the dispute are kept with it. It lets us recognise that the same Google or Apple account has signed in before, without keeping the identifier itself in our database. It can't be turned back into the identifier, and it can't be matched to a Google or Apple account without a secret key that we keep outside the database.
• Short-lived counters and markers. When a web account is given its free lyric drafts, we add one to that day's count for the email domain and for the network it signed in from (taken from the first part of the IP address), so that free drafts can't be collected in bulk. We also count, each day, how many times a sign-in asks the song maker to set up its account or to start a lyrics draft, so that automated misuse stands out. These counts are filed under scrambled labels (hashes that change every day) — the domain, the network address and your account identifier themselves are not written with them — and they expire after two days. Each request to start a lyrics draft also leaves a marker, filed under a scrambled label, that stops a double click from starting two; it expires after one day.
• Purchase records, if you buy songs on the website — described under Buying songs on the website below.

Website analytics (sungto.com only)

On the sungto.com pages that describe Sungto — the home page, examples, pricing, guides and similar — we would like to count visits and see which pages and buttons get used, so we can improve them. We use Google Analytics 4 for this, and only if you choose Accept in the banner at the bottom of the page. Until then nothing is sent to Google Analytics and no analytics cookies are set. Decline, or ignoring the banner, leaves it off, and so does a Global Privacy Control signal from your browser.

If you accept, Google receives the address of the page you are on, the page you came from, your browser and device type, an approximate location worked out from your IP address, and which buttons you press on that page (for example the App Store button or a play button). It sets cookies named _ga and _ga_… that expire after about 13 months. These pages do not collect anything you type. We turn off Google's advertising features and signals, so this data is not used for ads. Google acts as our service provider for this.

Your choice is stored in your browser and we ask again after 12 months. To change your mind at any time, use Cookie settings in the footer of the home page or of any other sungto.com page that describes Sungto; declining removes the analytics cookies. Analytics does not run in the song maker, on song share pages, on this page or the other legal pages, or in the iPhone app.

The details you type into the song maker — the recipient's name, your relationship, the occasion, your highlights — and the lyrics written from them are handled as described under "The details you type in" above.

reCAPTCHA

The song maker is protected by Google reCAPTCHA, which checks that requests come from a real browser rather than an automated script. It loads when you reach the sign-in step and runs while you use the song maker; it isn't loaded on the rest of sungto.com and isn't used in the iPhone app. To do its job, reCAPTCHA collects information about your device and browser and about how the page is being used, sets a cookie it needs in order to work (_GRECAPTCHA), and sends this to Google. Google analyses it on our behalf and tells us only whether the request passed. We use reCAPTCHA for security and to prevent abuse — never for advertising, and never to build a profile of you.

What's kept in your browser

The song maker stores your sign-in in the browser so that you stay signed in while you use it — for that browser session only, unless you tick "Stay signed in on this device". It also keeps a copy of the form as you've typed it, in that tab only, so that the sign-in step or a reload doesn't lose it; that copy is removed when the lyrics are requested or when you sign out. Apart from reCAPTCHA, the song maker sets no cookies of its own and loads no advertising or analytics scripts.

Buying songs on the website

Songs for the song maker are sold by our online reseller, Paddle.com, which is the Merchant of Record for those orders: you pay Paddle, and Paddle sends your receipt.

When you choose a pack, your browser leaves the song maker for a separate checkout page on sungto.com, where Paddle's payment form opens. That page holds none of your Sungto sign-in. We don't send Paddle your name, your email address, your account ID, or anything you typed into the song maker: all that is passed is an order reference, which Paddle created for the pack you chose.

What you enter in the payment form — your email address, your country and postal code, and your card or other payment details — goes to Paddle, not to us. Paddle also collects what it needs to prevent fraud and to work out tax, such as your IP address and information about your device, and its payment form may set cookies that it needs in order to work. Paddle is responsible for that information under its own privacy policy, and it keeps its own records of the sale.

Paddle tells us only that the order was paid, or later refunded or disputed. We match that to your web account using our own record of the checkout, which holds:

• The order reference Paddle gave the purchase, which pack it was for, when the checkout was started and when it was paid.
• Your account ID and the scrambled copy of your Google or Apple account identifier described above — so that a refund or a dispute months later still finds the right account, and still counts if that account has been deleted in the meantime.
• What happened to it — a short entry each time the order is paid, a refund is asked for, or it is refunded or disputed, with the time.

These records hold no card details, no billing address and no email address. Your web account also keeps a count of your purchases and, where it applies, a mark that purchases are no longer offered to it; our Refund Policy explains when that happens. A checkout that you start and don't pay is removed after about three months.

When you come back from the checkout, the order reference is in the page address for a moment. The song maker removes it straight away and doesn't store it in your browser.

Where it's kept

Sign-in records are held by Google's sign-in service in the United States. Our own database — account records, lyrics and song details — is held in Google data centres in the European Union. Song audio and artwork files are held in Google data centres in the United States.

Payment information is held by Paddle, in the countries its own privacy policy sets out.

As with any website, the Google services that host our site and handle sign-in log the IP address and browser type of each request, for security and to prevent abuse. Google keeps those logs for a limited time — from a few weeks to a few months, depending on the service.

Deleting a web account, or one draft

You can delete your web account yourself: open the account menu in the song maker and choose Delete account. You may be asked to sign in again first, and if lyrics or a song are being written at that moment, you'll be asked to wait until they finish. You can also email support@sungto.com and we'll do it for you. Deleting the account removes the following, straight away:

• every lyrics draft and song made with the account, with its audio, artwork and share link;
• the account record and its balance, including any songs you bought and haven't used;
• the sign-in record — your email address, name and photo.

To remove a single song instead of the whole account, open it from My songs in the song maker and choose Delete. To remove a single lyrics draft, email us and tell us which one.

Three things are kept after deletion. The first is the scrambled copy of your Google or Apple account identifier described above, with its dates and any refund or dispute marks. We keep it so that deleting an account and signing in again doesn't hand out a second set of free lyric drafts, and so that refund and dispute history stays with the sign-in it belongs to. It holds no email address, name, song or lyric, and without our secret key it can't be linked back to your Google or Apple account.

The second is the record of each completed purchase described under Buying songs on the website: the order reference, the pack, the dates, the deleted account's ID and the scrambled identifier. We keep these as payment records — to handle a refund or a dispute that arrives later, and to meet our accounting duties. They hold no email address, name, card details, song or lyric. Paddle keeps its own records of the sale, which deleting your Sungto account doesn't remove.

The third is a cost record for each song that was finished: the deleted account's ID, the date, which music service made the song, how long the song was and what it cost us to make. We keep these to know what our songs cost us. They hold no email address, name, song, lyric or anything you typed.

If you sign in again later, you get a new, empty web account. The short-lived counters and markers described above are not removed by hand: they hold no email address, name, song or lyric either, and they expire on their own within a few days. Nor is the record of a checkout you started and didn't pay; that one is removed after about three months.

We keep a web account until you delete it or ask us to. Deleted records can remain in routine backups for a limited time before those expire: about a week in our own systems, and up to 180 days in Google's sign-in service.

Who we share it with

We don't sell your data, and we don't share it for advertising. The information above goes only to the companies that make Sungto work: Anthropic, Google, ElevenLabs, Apple, TelemetryDeck, and — for purchases on our website — Paddle.

Google also receives website analytics data from sungto.com, but only if you accept it — see Website analytics.

Each only receives what it needs to do its one job — none of them gets the full picture of you.

Sharing a song

Every finished song gets a private link so you can send it to someone outside the app. That link is a long, random address — it isn't listed anywhere, isn't indexed by search engines, and isn't guessable. Anyone you send it to can listen; we don't track who they are. You're in control of who gets the link.

How long we keep it

A song and its details stay in our systems for 30 days after it's created, then they're automatically deleted. A share link you already sent may keep working a little past that if someone saved it, but the underlying song data is gone from our side. If you'd like something removed sooner, email us.

A web account itself is kept until you delete it, not for a fixed period, and records of completed purchases are kept after that — see Web accounts.

Your choices

• You never have to create an account or give us your name, email, or any contact detail to use the Sungto iPhone app. The song maker on our website does ask you to sign in, which gives us an email address — see Web accounts.
• To delete a song yourself, open it in the app and tap Delete. That removes its audio, its share link, and its details from our systems straight away.
• To have any other data deleted, email support@sungto.com with the device or song details you remember — we'll confirm once it's done.
• To delete a web account, use the account menu in the song maker, or email support@sungto.com. To delete a single song made with one, open it there and choose Delete. What we delete, and what we keep, is set out under Web accounts.
• Nothing here is used for third-party advertising, so there's no ad-tracking opt-out to offer.

Children

Sungto isn't directed at children, and we don't knowingly collect information from anyone under 13. If you believe a child has used the app to submit personal details about someone, contact us and we'll remove it.

Security

Data moves over encrypted connections, our backend verifies every request before acting on it, and access is limited to what each part of the system actually needs. No method of storing or transmitting data is perfectly secure, but we treat what you share with us — especially details about someone you love — with real care.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top. Continuing to use Sungto after a change means you're okay with the update.

Contact

Questions, requests, or concerns: support@sungto.com
WeThank Technologies FZE · Company details