Privacy Policy

Melofy detects the song you're listening to and shows beautifully synced, AI-translated lyrics in your language. This policy covers both the Melofy web app (at this site) and the Melofy browser extension for YouTube Music.

• Track & lyrics data. The artist and title of the currently playing song are sent to LRCLIB to look up lyrics, and to our translation provider to translate them. Translated lyrics are cached so repeat plays are faster and cheaper.
• Spotify connection (optional). If you connect Spotify, we request permission to read your profile and playback state and to control playback. The resulting access and refresh tokens are stored in your own browser (localStorage) — they are not saved on our servers. Token refreshes pass through our API but are not retained. Disconnect any time by clearing your browser data.
• Your own API key (BYOK). If you choose to use your own Google Gemini or OpenRouter key, it is encrypted in your browser with our public key (RSA-OAEP) before being sent, used only to serve your request, and never written to storage on our side.
• Rate-limiting & technical data. To prevent abuse of the free translation quota, we derive an identifier from your IP address. We never store your raw IP — it is salted and hashed, and only that hash (plus a daily counter) is kept.
• Anonymous usage analytics. We may record basic product events (e.g. a translation was requested) via PostHog to understand and improve the product. These events are tied only to the anonymous hashed-IP identifier above — not to a name, email, or account.
• Extension local storage. The extension stores your preferences (target language, widget on/off) and a per-track translation cache on your device. It reads the now-playing track on music.youtube.com to know what to translate.

• No user accounts, passwords, or profiles.
• We do not sell or rent your data, and we do not show ads.
• We do not track you across other websites.
• The extension contains no remote code — everything is bundled and reviewed.

To provide the service, data is shared with these providers only as needed:

• LRCLIB — community lyrics lookup (receives the track's artist/title).
• OpenRouter and its underlying model providers (e.g. Google) — perform the lyric translation.
• Spotify — only if you connect it, for playback detection and control.
• PostHog — anonymous product analytics.
• Our hosting provider — runs the app and its cache database.

Lyrics are sourced from LRCLIB for personal, non-commercial listening. Melofy is not affiliated with, endorsed by, or sponsored by YouTube, Google, or Spotify.

We use your browser's local storage for essential preferences (theme, target language, Spotify tokens, and translation caches). Analytics may set a cookie or use local storage to count usage anonymously. We do not use advertising cookies.

• Cached translations are kept to speed up future plays and may be cleared periodically.
• Rate-limiting counters reset daily; the salted-IP hash is not linked to any identity.
• Anything stored in your browser (preferences, Spotify tokens, caches) stays until you clear your browser data or remove the extension.

Melofy is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data.

Because Melofy holds no account and stores no personal identifiers, most of "your data" lives on your own device and is fully within your control — clear your browser storage or uninstall the extension to remove it. If you have questions about the anonymized cache or believe we hold data about you, contact us and we'll help. Depending on where you live (e.g. the EEA or California), you may have rights to access or delete personal data.

We may update this policy as the product evolves. Material changes will be reflected by the "Last updated" date above.

Questions about privacy? Email salaudeen.t@gmail.com.