Songr Privacy Policy
Last updated: 5 October 2026
This Privacy Policy explains how Appresio Ltd (“we”, “us”, “our”) collects, uses, shares and protects personal data when you use:
- Songr, our app for iPhone and iPad (the “App”); and
- our website songr.app, including its free lyrics generator (the “Website”),
together, the “Service”. This one policy covers both. It replaces the earlier Songr app policy at mrzv.app/songr-privacy-policy and the earlier website-only policy on this page.
Please also read our Terms of Use.
At a glance
- No sign-up, but your library lives on our servers. Songr has no username or password. The App links your profile to a random secret kept in your iCloud Keychain, so your library comes back after you reinstall the App or, if iCloud Keychain is on, move to a new iPhone with the same Apple ID.
- AI services make your songs. To write lyrics and to make songs, cover art and music videos, we send what you enter, and any photo you choose, to third-party AI services. The App asks for your permission first.
- What you create is kept until you ask us to delete it. Songs, cover art, lyrics and music videos are not deleted automatically. Deleting a song in the App hides it but does not erase it. To erase your data, email us (Section 12).
- What you upload is kept for 7 days. Photos and screenshots you upload, and your answers in Song Ideas forms, are deleted automatically after 7 days. A music video, and the still image and audio clip it is made from, stay with your library.
- No ads, but we measure our marketing. The App shows no ads. We use AppsFlyer to learn which of our campaigns brought you to the App. It uses your advertising identifier only if you allow tracking.
- We do not sell your personal data.
- The Website sets no cookies of its own and runs no analytics. Its lyrics generator does not store what you type.
1. Who we are
The controller responsible for your personal data is:
Appresio Ltd
Registered in England and Wales, company number 16738606
86–90 Paul Street, London EC2A 4NE, United Kingdom
Email: [email protected]
Contact form: appres.io/contact
We have not appointed a Data Protection Officer, because we are not required to. Send any privacy question to the email address above.
2. Information we collect
2.1 What you give us in the App
| What | Examples |
|---|---|
| Ideas and lyrics | Prompts and song ideas; lyrics you write, edit or save; song titles; the style, mood and voice you choose |
| Song Ideas answers | What you type into Song Ideas forms, for example a name, an occasion, a shared memory, how you feel, a pet’s name |
| Photos and screenshots | A photo or screenshot you pick for a Song Ideas form (for example Song by Photo, Moment, My Pet, or a dating-profile screenshot for Match Song), and a photo you pick for a music video |
| Messages to us | Your email address, your message and attachments, and the details the App adds to a support email: App version, your User ID and your Apphud user ID |
The App uses Apple’s photo picker, so only the photo you pick reaches the App. The App cannot see the rest of your photo library, and it does not use your camera or microphone. The App reduces the size of a photo before uploading it.
2.2 What the Service creates for you
Songs (each request makes two versions), cover art, lyrics and titles written by AI, an AI-written description of each photo or screenshot you upload in a Song Ideas form, music videos, and the still image and 15-second audio clip each video is made from.
2.3 Collected automatically by the App
| What | Examples |
|---|---|
| Identifiers | Your Songr User ID; a random device secret, of which we store only a one-way hash; the user ID given to you by Apphud, our subscription provider; Apple’s identifier for vendors (IDFV); AppsFlyer and Amplitude IDs; your push notification token, if you allow notifications; your advertising identifier (IDFA), only if you allow tracking |
| Device and App data | Device model, iOS version, App version, language, time zone, mobile carrier, IP address and the approximate location (country, region and city) derived from it |
| Usage | Screens you open, features you use, generations started, completed or failed, paywalls shown |
| Purchases | Which subscription or song pack you bought, trial and offer status, renewals, cancellations and refunds, price and currency, and App Store transaction IDs. Apple processes payments, and we never receive your card details. |
2.4 Collected on the Website
- Server logs. When you visit, our web server records your IP address, the page you requested, the time, the referring page and your browser’s user agent.
- Lyrics generator. What you type is sent to an AI language model, which writes the lyrics (Section 5). We do not store your request or the answer, and we do not write them to our logs. To prevent abuse, we count requests per IP address and per browser session. These counters are kept only in server memory.
- A session identifier in your browser. The first time you use the lyrics generator, the Website saves a random identifier in your browser’s local storage. It is used only for the request limit and stays until you clear the site’s data in your browser.
- No cookies, analytics or forms of our own. Our code sets no cookies and loads no analytics or advertising scripts. The Website has no accounts, contact forms or newsletter. Cloudflare, which delivers the Website, may set strictly necessary security cookies (Section 15).
2.5 What we do not collect
We do not ask for your name, postal address or phone number. We do not collect your precise location, your contacts or audio from your microphone. We do not use photos to recognise or identify anyone.
Please do not put sensitive information about yourself or others, for example about health, religion or sexuality, into prompts, lyrics, forms or photos.
3. Your profile and where your data is stored
-
No sign-up. On first launch, our server issues a random device secret, and the App saves it in your iCloud Keychain. The server keeps only a one-way hash of the secret and links it to your Songr profile. If iCloud Keychain is on, the secret syncs to your other Apple devices. Your profile, library and credits then come back after a reinstall, or on a new device signed in to the same Apple ID.
-
Your User ID. Your profile has a User ID. You can see it in the App under Settings → User ID; tap it to copy.
-
On our servers. Your profile, lyrics, titles, styles and the details of each request are kept in our database on servers in Germany. Songs, cover art, music videos and uploaded photos are kept as files in Cloudflare R2 cloud storage. Your library in the App is loaded from our servers.
-
On your device. The App keeps a copy of your library, saved lyrics and settings, and the songs and videos it has downloaded. Deleting the App removes this copy. It does not delete your data on our servers, and it does not cancel a subscription.
-
Deleting in the App:
- a song disappears from your library and from Explore, but stays on our servers;
- saved lyrics disappear from your list, but stay on our servers;
- a music video is removed from your device only. It stays on our servers and reappears in the App the next time your library syncs.
To erase data from our servers, send us a deletion request (Section 12).
-
Older versions of the App. Versions before 3.0 do not use a device secret. Their library does not survive a reinstall, and the ID they show in Settings is your Apphud user ID.
4. Song Ideas, photos and music videos
- Song Ideas. Your answers are used to write lyrics and a style for your song. If the form takes a photo or screenshot, an AI model describes it, and the description is used in the same way. We keep the answers, the photo description and the resulting lyrics in a log for 7 days, to investigate complaints and errors, and then delete them. Lyrics you save, or turn into a song, are kept with your library.
- Photos and screenshots you upload are stored for 7 days and then deleted automatically, together with our record of the upload. A photo still in use by a request in progress is deleted once the request finishes. Photos uploaded from older versions of the App are deleted after 24 hours.
- Music videos. An AI model places the person from your photo into the scene you choose. A second AI model then animates that still image so that the person appears to sing a 15-second clip of your song. The video model processes the face in the photo in order to animate it. We do not use it to recognise or identify anyone. The finished video, the still image and the audio clip are kept with your library. The photo itself is deleted after 7 days.
5. AI processing and third-party AI services
Songr makes songs with artificial intelligence. To produce what you ask for, we send some of your data to third-party AI services. They process it to return the result to us.
We ask first. Before the App sends your content to a third-party AI service for the first time, it asks for your permission. If you do not give it, the AI features do not work. Photos and screenshots you choose for Song Ideas or a music video are sent to AI services when you tap to generate, as described below. The App does not yet have a setting to withdraw this permission. You can withdraw it by no longer using the AI features, or by deleting and reinstalling the App, which resets the question. Withdrawing does not affect processing that has already happened.
On the Website, your text goes to an AI service only when you press the button to generate lyrics.
We use third-party AI services in three roles.
Text and vision models, reached through an AI model gateway. They write and edit lyrics, titles and style descriptions, describe the photos and screenshots you upload, and write lyrics in the Website’s lyrics generator.
- They receive: your prompt, Song Ideas answers, lyrics, style and language, and the photo or screenshot itself.
- Processed in: the United States and the European Union. For the Website’s lyrics generator: Singapore and China, or the United States and the European Union if that model is unavailable.
Music models (Suno-based), reached through intermediary API providers. They make songs with vocals or instrumentals, and the cover art for each song.
- They receive: lyrics, title, style description and whether the song is instrumental.
- Processed in: the United States, and possibly other countries where these providers or the model makers operate.
Image and video models, reached through intermediary API providers or directly. They place the person from your photo into the scene you chose and animate the result into a music video.
- They receive: your photo, the chosen scene, the still image made from them and a 15-second clip of your song.
- Processed in: the United States and Singapore, and possibly other countries where these providers or the model makers operate.
What we send and what we do not. We do not send AI services your email address, purchase history or advertising identifiers. Anything you type into a prompt or a form, including names, is sent as you typed it. Image and video services receive links to your files. These links contain your random Songr User ID and our request number, which do not tell the service who you are.
How AI services use the data. These services process the data to produce the result and return it to us. Under their own terms, some of them keep it for a limited time afterwards, for example to deliver results or to monitor abuse. The AI model gateway does not store prompts or images by default. The text and vision model providers behind it do not use our requests to train their models, and some keep them for up to 55 days. The music and video services keep generated files for about two weeks and their request logs for up to two months. One video service keeps requests for 30 days and does not use them for training. Not every service commits in its terms not to use the data to improve its own service.
We do not train AI models on your content.
Photos of other people. If you upload a photo or screenshot of someone else, you must be entitled to do so and, for music videos, you must have their permission. See our Terms of Use, Section 9.
6. How we use your data and our legal bases
If you are in the United Kingdom, the European Economic Area or Switzerland, we rely on these legal bases under the UK GDPR and the EU GDPR:
| Purpose | Legal basis |
|---|---|
| Creating and keeping your profile, library and credits, and restoring them after a reinstall | Contract (Art. 6(1)(b)) |
| Writing lyrics and making songs, cover art and videos; storing and delivering them | Contract (Art. 6(1)(b)). Sending your content to third-party AI services: your consent (Art. 6(1)(a)) |
| Selling and managing subscriptions and song packs; counting generations | Contract (Art. 6(1)(b)) |
| Showing songs in Explore and in our marketing (Section 11) | Legitimate interests (Art. 6(1)(f)) in showing what Songr can do |
| Product analytics; finding and fixing errors | Legitimate interests (Art. 6(1)(f)) in understanding and improving the Service |
| Measuring our marketing campaigns | Your consent through Apple’s tracking prompt, where your advertising identifier is used (Art. 6(1)(a)); otherwise legitimate interests (Art. 6(1)(f)) in measuring campaigns |
| Push notifications | Your consent through the iOS notification permission (Art. 6(1)(a)) |
| Preventing fraud and abuse; keeping the Service secure; enforcing our Terms | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) where applicable |
| Answering support and privacy requests | Contract or legitimate interests (Art. 6(1)(b), (f)); legal obligation (Art. 6(1)(c)) for rights requests |
| Running the Website and its lyrics generator, and limiting abuse of it | Contract (Art. 6(1)(b)) for the lyrics you ask for; legitimate interests (Art. 6(1)(f)) in keeping the Website available and secure |
| Accounting and tax; establishing or defending legal claims | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, you can object (Section 12). Where we rely on consent, you can withdraw it at any time.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
7. Tracking, attribution, analytics and notifications
- Apple’s tracking prompt. After onboarding, the App shows Apple’s App Tracking Transparency prompt. If you tap Allow, AppsFlyer may read your device’s advertising identifier (IDFA) to attribute your install to an ad campaign. If you tap Ask App Not to Track, the IDFA is not read. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking.
- AppsFlyer (attribution). The AppsFlyer SDK waits up to a minute for your answer. If you have not answered by then, it sends data without the IDFA. It receives App installs and launches; trial starts and purchases with product, price and currency; renewals; device and network data, including your IP address; and your Apphud user ID. Choosing Ask App Not to Track stops your IDFA being shared, but AppsFlyer still receives these events without it.
- Apple Search Ads. The App asks Apple’s AdServices framework for an attribution token and gives it to Apphud, so that we can tell whether an install came from an Apple Search Ads campaign. Apple designed this to work without tracking.
- Amplitude (analytics). Amplitude receives events about how the App is used. Each event carries your IDFV as a device ID, your Apphud user ID, the App version, the install date and whether you have a subscription. Amplitude derives an approximate location from your IP address. Apphud also sends Amplitude our purchase, trial, renewal, cancellation and refund events, with revenue and store country. Amplitude does not receive your prompts, lyrics or photos.
- Purchase notifications to our team. Apphud sends notifications about trials, purchases, renewals and refunds to a private Telegram chat used by our team.
- Notifications. If you allow notifications, your push token goes to Apphud, which we use to send notifications, for example about offers. You can turn them off in iOS Settings → Notifications → Songr. You can also turn off the App’s “Song Ready” and “Ideas to Try” notifications in the App’s Settings.
- No ads. The App shows no third-party advertising, and we do not let advertising networks target you inside the App.
8. Who we share data with
8.1 Service providers
These providers process personal data on our behalf, on our instructions.
| Provider | What it does for us | Location |
|---|---|---|
| Hetzner Online GmbH | Hosts our servers and database | Germany |
| Cloudflare, Inc. | Stores files in R2; delivers and protects the Website and our media | United States and Cloudflare’s global network |
| Apphud Inc. | Manages subscriptions, checks App Store receipts, sends push notifications | United States |
| Amplitude, Inc. | Product analytics | United States |
| AppsFlyer Ltd. | Attribution of our marketing campaigns | Israel and the United States |
| Zoho Corporation B.V. | Hosts our email at [email protected] | European Union |
| Telegram | Delivers purchase notifications to our team’s private chat | Netherlands, and other countries where Telegram operates |
| AI services (Section 5) | Write lyrics; make songs, cover art and videos | As listed in Section 5 |
8.2 Other recipients
- Apple processes your App Store purchases, iCloud Keychain, push notifications, and the tracking prompt and AdServices token under its own privacy policy, as an independent controller.
- People who use Explore can hear and read songs we feature there (Section 11). We do not show who made a song.
- Authorities and others, where the law requires it, or where it is needed to establish, exercise or defend legal claims, or to protect the safety of our users or the public.
- A buyer or successor, if we are involved in a merger, acquisition or sale of assets. We will give notice before your data becomes subject to a different privacy policy.
We do not sell personal data, and we do not share it with data brokers.
9. International transfers
We are based in the United Kingdom. Our servers are in Germany. Some providers process personal data outside the UK and the European Economic Area, in particular in:
- the United States: analytics, file storage and delivery, the AI model gateway and models, subscription management, attribution, and the music and video services, which may also use other countries;
- Singapore: one of the video services, and the language model behind the Website’s lyrics generator;
- China: the same language model for the Website’s lyrics generator may also run in data centres in China;
- Israel: AppsFlyer, our attribution provider. The UK and the EU recognise Israel as providing adequate protection.
The UK recognises the European Economic Area as providing adequate protection. For other countries, we rely on the safeguards recognised under the UK GDPR and the EU GDPR. These are the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum to those Clauses, or a US recipient’s certification under the EU–US Data Privacy Framework and its UK Extension.
You can ask us for more information about these safeguards at [email protected].
10. How long we keep data
| Data | How long |
|---|---|
| Songs, cover art, music videos, and the still images and audio clips videos are made from | Until you ask us to delete them, or we remove them under our Terms. They are not deleted automatically. |
| Lyrics, titles, styles and the details of each request | Until you ask us to delete them. Songs and lyrics you delete in the App are hidden, not erased (Section 3). |
| Photos and screenshots you upload | 7 days, then deleted automatically (24 hours for photos from older versions of the App) |
| Song Ideas answers and photo descriptions | 7 days, then deleted automatically |
| Your profile, identifiers and credit balance | As long as your profile exists |
| Purchase records | As long as your profile exists, and afterwards as long as tax and accounting law requires (in the UK, generally six years) |
| Records of failed requests: time, path, error and User ID and, for requests our server rejects as invalid, part of what was sent | Currently without a time limit, including after your profile is deleted |
| Database backups | A copy is made every 3 days; only the two most recent copies are kept, so deleted data leaves our backups within about a week |
| Web server logs (IP addresses) | 14 days |
| Application logs on our servers, which include the IP address and path of each request from the App | No fixed time limit; the oldest entries are deleted as log storage fills up |
| Analytics and attribution data at Amplitude and AppsFlyer | For the duration of our agreement with each provider, unless deleted earlier |
| Data held by AI services | As described in Section 5 |
| Website lyrics generator requests | Not stored. The request counters live in server memory and are cleared on restart. |
| Emails to us | Until your request is resolved, and for a reasonable period afterwards |
When we no longer need data, we delete or anonymise it.
11. Explore
Explore is a showcase of songs made with Songr, in the App. We choose which songs to feature, and we may feature any song made with the Service. Explore shows a song’s audio, title, style, lyrics and cover art. It does not display who made the song or any other information about them. The links to a song’s files contain the random User ID of the profile that made it, which does not reveal who that person is. Songs in Explore can be heard by anyone using the App, and we may use them in our marketing (see our Terms of Use, Section 11).
To take your song out of Explore, delete it in the App, which removes it from Explore too, or email us with your User ID and the song’s title. Copies that others have already shared outside the Service may remain.
Please do not put personal information about yourself or others into lyrics or titles you would not want others to read.
12. Your rights and how to use them
12.1 Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- delete your data;
- restrict how we use it;
- object to processing based on legitimate interests;
- port data you gave us, in a structured, machine-readable format;
- withdraw consent at any time, without affecting earlier processing; and
- complain to a data protection authority. In the UK, this is the Information Commissioner’s Office (ico.org.uk). In the EEA, it is the authority where you live.
US residents have the additional rights described in Section 13.
12.2 How to make a request
Email [email protected] with the subject “Privacy request”, or use appres.io/contact, and tell us what you want us to do.
Songr has no login, so we need your User ID to find your data. You can copy it in the App under Settings → User ID. If you write from Settings → Contact Us, the App adds your User ID to the email for you. In versions of the App before 3.0, send the ID shown in Settings. If you no longer have the App, tell us roughly when you used it and what you bought, and we will try to find your data.
Without an identifier, we may not be able to find your data. We may ask for more information to confirm that the request comes from you, so that nobody can get or delete your data in your name.
The App has no button to delete your data. Send deletion requests by email; we handle them manually. When we act on one, we delete your profile and the songs, cover art, lyrics, videos and other content linked to it, including the stored files. We also ask our providers to delete what they hold, where they hold it. Records of your purchases remain with Apple and Apphud, and we keep what the law requires us to keep.
Deleting the App does not delete your data on our servers and does not cancel your subscription. To cancel a subscription, see our Terms of Use, Section 5.
We respond within one month. For complex requests we may extend this by two further months, in which case we will tell you. For US residents we respond within 45 days, which may be extended where the law allows.
13. US state privacy notice
This section applies to residents of California under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), and to residents of other US states with comparable laws.
13.1 Categories of personal information
In the past 12 months we collected the categories below. The sources, purposes and recipients are described in Sections 2, 5, 6 and 8, and how long we keep each category in Section 10.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | User ID, Apphud, Amplitude and AppsFlyer IDs, IDFV, IDFA (only if you allow tracking), IP address, email address if you contact us | Yes |
| B. Customer records | Name, signature, financial account details | No |
| C. Protected characteristics | Age, gender, race, religion, disability | No |
| D. Commercial information | Subscriptions and song packs bought, trials and offers used | Yes |
| E. Biometric information | Fingerprints, voiceprints, faceprints used to identify you | No |
| F. Internet or network activity | Usage events in the App, pages visited on the Website | Yes |
| G. Geolocation | Approximate location (country, region, city) derived from your IP address only | Yes (approximate) |
| H. Audio, visual or similar information | Photos and screenshots you upload; songs, cover art and videos made for you | Yes |
| I. Professional or employment information | Employer, job title | No |
| J. Education information | Student records | No |
| K. Inferences | Usage patterns derived from your activity in the App | Yes |
Sensitive personal information. We do not collect sensitive personal information as defined by the CCPA in order to infer characteristics about you. We do not use photos to identify anyone.
13.2 Sale and sharing
We do not sell personal information. If you allow tracking through Apple’s prompt, we disclose your advertising identifier and App events to AppsFlyer to measure our ad campaigns. Under the CCPA, this may count as “sharing” for cross-context behavioural advertising. To opt out:
- tap Ask App Not to Track in the prompt, or turn tracking off for Songr in iOS Settings → Privacy & Security → Tracking. This stops your IDFA being shared; AppsFlyer still receives install and purchase events without it, to measure our campaigns; or
- email us with “Do Not Sell or Share My Personal Information” and your User ID, and we will also ask AppsFlyer to delete the data it holds about your device.
We do not knowingly sell or share the personal information of consumers under 16.
13.3 Your rights
Subject to your state’s law, you can ask to know and access the personal information we hold about you, and to correct or delete it. You can also opt out of sale, sharing and targeted advertising. We will not discriminate against you for using these rights. You may use an authorised agent; we may ask for proof of authorisation and verify your identity. Where your state gives you a right to appeal our decision, reply to our answer with “Appeal” and we will review it. To make a request, follow Section 12.2.
14. Children
The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you are under 18, you may use the Service only with the permission of a parent or guardian. Our Terms of Use do not allow photos of anyone under 18 to be used for music videos.
If we learn that we have collected personal data from a child under 13, or that a photo of a child has been used for a music video, we will delete it. Parents can contact us at [email protected].
15. Cookies, Do Not Track and Global Privacy Control
- Cookies. The Website’s own code sets no cookies. Cloudflare, which delivers and protects the Website, may set strictly necessary cookies to tell people apart from bots. Your browser settings let you control cookies.
- Local storage. The lyrics generator keeps one random session identifier in your browser (Section 2.4).
- Do Not Track. There is no common standard for Do Not Track signals, and we do not respond to them. The Website does not track you across other websites.
- Global Privacy Control. We treat a Global Privacy Control signal from your browser as a valid request to opt out of the sale or sharing of personal information linked to that browser.
- Links. The Website links to the App Store and to other sites we do not control. Their own privacy policies apply.
16. Security
We protect personal data with technical and organisational measures suited to the risk. These include encryption in transit (HTTPS), access controls, keeping only a one-way hash of your device secret, and storing files under random, hard-to-guess names. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Keeping your Apple ID and iCloud Keychain secure helps protect access to your Songr profile.
17. Changes to this policy
We may update this policy, for example when we add features or providers. We will change the “Last updated” date at the top. If a change materially affects how we handle your data, we will tell you in the App or on the Website before it takes effect.
The English version is authoritative. Where a translation differs, the English text prevails.
18. Contact us
Appresio Ltd
86–90 Paul Street, London EC2A 4NE, United Kingdom
Email: [email protected]
Contact form: appres.io/contact
Website: songr.app