01Who we are
kords.in listens to a song you upload and works out its chords, key and tempo so you can play along. The service is operated by Web Accuracy.
For questions about your data, write to support@kords.in.
02What we collect
Only what the service needs to work. There is no advertising on kords.in and we do not sell or share your information with data brokers.
| What | Why we have it |
|---|---|
| Email address | To identify your account, let you sign in, and send password resets. |
| Name | Optional. Only used to greet you. |
| Password | Never stored. We keep a one-way cryptographic hash with a per-account random salt, which cannot be reversed back into your password. |
| Google account identifier | Only if you choose to sign in with Google. We receive your email, name and a Google account ID. We never receive your Google password. |
| Audio you upload | To analyse it, and to play it back to you afterwards. See retention below. |
| Analysis results | The chords, key, tempo and beat positions we detected, so your history still works after the audio is gone. |
| Song count | How many songs you analysed this month, to apply your plan's allowance. |
| Sign-in times | Last sign-in, and short-lived records of failed attempts, to stop people guessing passwords. |
We do not use analytics or tracking. There is no Google Analytics, no advertising pixel, no third-party tracker, and no profile built about you. We do not track you across other websites.
03How long we keep it
Audio takes real space, so we delete it on a schedule that depends on your plan. The chords we detected are tiny by comparison and are kept so your history stays useful.
| Plan | Your uploaded audio |
|---|---|
| Free | Cleared when you sign out, and in any case within 24 hours. Your chord history stays — you can see what you analysed, you just re-upload the file to play it again. |
| Pro monthly | Kept while your plan is running, plus seven days' grace after it ends. |
| Pro yearly | Kept while your plan is running, plus seven days' grace after it ends. |
Chord analysis results are kept until you delete the song or close your account.
Your account is kept until you ask us to delete it. When you do, we remove your account, your history and any audio still stored.
04Who else can see it
Very few parties, and none of them receive your audio.
- Google — only if you use Google sign-in, and only to confirm who you are. We tell Google nothing about what you analyse.
- Google Fonts — our pages load fonts from Google's servers, which means Google can see your IP address when a page loads.
- LRCLIB — when you ask for lyrics, we send the song title and artist to lrclib.net to look them up. We do not send your audio or anything identifying you.
- Our hosting provider — Contabo GmbH, whose datacentre physically holds the server.
Nobody else. Your audio never leaves our server, and it is never sent to any third-party service for processing.
05Cookies
One cookie, and it is strictly necessary: a signed session cookie that keeps you logged in. It is HttpOnly (scripts cannot read it), Secure (only sent over HTTPS) and SameSite=Lax. It expires after 30 days, or immediately when you sign out.
We set no advertising, analytics or tracking cookies, which is why you are not being shown a cookie banner.
Your instrument, transpose and volume preferences are saved in your own browser's local storage. They never reach our server.
06Where your data is stored
On a single server in Lauterbourg, France, inside the European Union. Everything travels over HTTPS. The database holding accounts and history is not reachable from the web, and the service runs under a restricted account that cannot read anything else on the machine.
07Your rights
Whatever your country, we will honour these:
- See your data — your history is on your dashboard; ask us and we will send you everything else we hold.
- Correct it — change your name or email from your account.
- Delete it — remove individual songs yourself, or ask us to delete your whole account.
- Take it with you — ask and we will export your data in a machine-readable format.
- Object or withdraw consent — stop using the service and ask us to delete your account.
Write to support@kords.in. We aim to reply within 30 days. If you are in the EU or UK and are unhappy with our response, you may complain to your local data protection authority.
08Security
Passwords are hashed with a slow, salted algorithm designed to resist brute force. Traffic is encrypted with HTTPS. Sessions are cryptographically signed so they cannot be forged. The service runs isolated from everything else on the machine, and the database and stored audio are not reachable from the web.
No system is perfect. If you find a security problem, please tell us at support@kords.in before disclosing it publicly, and we will fix it as quickly as we can.
09Children
kords.in is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has created an account, tell us and we will remove it.
10Changes to this policy
If we change something that matters, we will update the date at the top and, for significant changes, tell account holders by email. Continuing to use kords.in after a change means you accept the updated policy.
11Contact
Questions, requests or complaints: support@kords.in.
See also our Terms of Service.