Privacy Policy
Last updated 30 August 2026
KaraokeRank is operated by Nihey Takizawa. This policy describes exactly what the service collects, why it collects it, where it is stored, and how to have it removed. It describes the service as it actually works today.
Who is responsible
The data controller is Nihey Takizawa, an individual operating KaraokeRank at karaokerank.lol. Contact: contact@karaokerank.lol.
What we collect
When you sign in
Signing in is the only way we obtain personal data directly from you.
| Data | Source | Why |
|---|---|---|
| Email address | You, or your Google account | Identifies your account and delivers sign-in links |
| Display name | Your Google profile, or derived from your email | Shown publicly next to your performances |
| Profile picture URL | Your Google profile | Shown publicly on your profile |
| Google account identifier | Links your Google login to your existing account | |
| Handle | Generated from your display name | Your public URL, e.g. /u/yourname |
Automatically
- Your IP address, held only in memory for up to one hour, solely to rate-limit sign-in requests so the service cannot be used to send unsolicited email. It is not written to the database, not linked to your account, and not used for analytics or profiling.
- Session tokens. A short-lived access token stored by your browser, and a refresh token in a cookie that JavaScript cannot read. Sign-in links and refresh tokens are stored only as irreversible hashes, so we cannot recover the original value.
When you sing
Recording and scoring are live. If you record a take, we store the audio (and optional video) of that take long enough to score it. A take is private until you choose Publish. Published takes, their scores, and upvote counts are public. Discarded takes are hidden from the board and from other users. Practice takes that you neither publish nor discard stay off the leaderboard.
In a live room we also store the room’s queue, presence heartbeats, cheers, and in-room votes. Room votes do not move the public leaderboard. If LiveKit is configured, real-time audio in a room is carried by that provider for the duration of the session and is not stored by KaraokeRank.
We do not use voice recordings to identify you biometrically, and we do not derive biometric templates from them. Scores are computed from pitch, timing, and a transcription of the take compared to the song’s lyrics.
Google user data
If you sign in with Google, we request only the email and profile scopes. We receive your email address, name and profile picture. We do not request, receive or store access to your Gmail, Drive, Contacts, Calendar or any other Google service.
KaraokeRank’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to create and operate your KaraokeRank account, we do not sell it, we do not transfer it to third parties except as described below, we do not use it for advertising, and we do not allow humans to read it except with your explicit consent, to comply with law, or for security purposes.
We only accept a Google account whose email address Google reports as verified. You can revoke KaraokeRank’s access at any time from your Google account permissions page. Revoking access stops future Google sign-ins; it does not delete your KaraokeRank account, which you can request separately below.
Why we are allowed to hold it
Under the GDPR and the Brazilian LGPD, we rely on performance of a contract for the data needed to operate your account, and on legitimate interests for the IP-based rate limiting that keeps the service from being abused as a spam relay. We do not rely on consent for anything except optional features you explicitly opt into, and we run no advertising or tracking.
Where your data is stored
- Database and application — Hetzner Online GmbH, Nuremberg, Germany (European Union).
- Website delivery — Vercel Inc., served from a global content network.
- Email delivery — a mail server we operate at Contabo Inc., St. Louis, Missouri, United States. Sign-in emails therefore leave the EU. Your email address and the sign-in link are transferred to the United States for the sole purpose of delivering that message.
We do not use third-party analytics, advertising networks, or tracking pixels. The site sets no cookies other than the sign-in session cookie described above.
How long we keep it
- Account data — until you ask us to delete it.
- IP rate-limit counters — one hour, then automatically discarded.
- Sign-in links — 15 minutes, single use, stored only as a hash.
- Session refresh tokens — up to 30 days, revoked when you sign out.
- Unpublished takes — until you publish or discard them, or ask us to delete the account.
- Published performances — until you ask us to delete the account or we remove them on a valid takedown.
- Room presence / cheers — ephemeral; cheers older than a few minutes are only kept as a count.
Your rights
You may request access to your data, correction, deletion, a portable copy, or restriction of processing, and you may object to processing based on legitimate interests. Email contact@karaokerank.lol and we will respond within 30 days. Deleting your account removes your account record, your sessions and any performances you published.
If you are in the EU or UK you may complain to your national data protection authority. If you are in Brazil you may complain to the ANPD.
Age
KaraokeRank is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has created an account, email us and we will remove it.
Security
All traffic is encrypted in transit. Sign-in links and session refresh tokens are stored only as SHA-256 hashes and are single-use; presenting a session token that has already been used invalidates every session for that account, on the assumption it was stolen. We never store passwords, because the service has none.
No system is perfectly secure. If you find a vulnerability, please email contact@karaokerank.lol rather than disclosing it publicly, and we will work with you.
Changes
We will update this page when the service changes, and change the date at the top. For changes that materially affect your rights — in particular the introduction of performance recordings — we will notify signed-in users by email before they take effect.