Privacy Policy

Last updated: 2026-10-31

This Privacy Policy explains what data LyricHunt ("we", "us", "the App") collects, why, and how you can control it. LyricHunt is operated by Maksym Romanovych Horak, a registered private entrepreneur (FOP) under Ukrainian law — ФОП Горак Максим Романович, state registration record № 2010350000000578131 — Lviv, Ukraine ("the Operator", "data controller").

Contact for privacy requests: [email protected]

1. Data we collect

Guest play (no account)

If you play as a guest, we store:

• an anonymous device identifier (a random ID generated on your device, not tied to your name or email), used to track your energy/progress and prevent abuse of free-play limits.

We do not collect your IP address in our application database.

If you create an account (Google Sign-In or email)

If you choose to sign in with Google, we additionally store:

• your email address, as provided by Google Sign-In;
• your Google account identifier, used to recognize your account on future sign-ins;
• your display name, initially set to the name on your Google account (you can change it at any time in Settings — changing it does not affect your actual Google account);
• your profile picture URL, as provided by your Google account, to show your avatar in the App;
• your device time zone, used to calculate daily challenges and streaks correctly for your local day;
• gameplay data tied to your account: XP, levels, streaks, achievements, daily challenge history;
• if you allow notifications, a push-notification token for each phone you use (see "Friend requests and invitations (push notifications)" below).

If you choose to sign in with email (a one-time code, no password), we store:

• your email address;
• a display name, which defaults to a generic placeholder ("Player") and is not derived from your email address — you can set your own display name at any time in Settings;
• your device time zone and account-linked gameplay data, as above.

Signing in merges any progress you made as a guest into your new account.

Leaderboards (signed-in players only)

If you have an account, you appear on the artist leaderboards inside the App, which rank players by the points they have earned on that artist. What other players can see about you is limited to:

• a public handle — a nickname the App generates for you (for example "SwiftFox4821") that you can change at any time in Settings. It is separate from your display name and is never your real name or your Google account name;
• your level and the points and number of wins you have earned on that artist.

Leaderboards never show your real name, email address, profile picture, Google account, or any account identifier. Guests do not appear on leaderboards. (In a room your Google profile photo is shown to the other players of that room, and to your friends, unless you switch it off — see "Playing with friends" below.)

You can hide yourself from all leaderboards at any time in Settings; you keep your points, and turning it off puts you back. Handles are checked against basic naming rules (for example, no links, contact details or offensive words), and you must not choose a handle that impersonates someone else.

Playing with friends (rooms and friends)

You can play with other people in a room (by sharing a room code or by invitation) and add friends. What other players can see:

• in a room: your nickname (your public handle if you have an account, or a name you choose in the room if you play as a guest), your colour, your energy level and whether you are a Premium player (the room needs this to start a game), how you are doing in the game (words you revealed, who revealed what, your place), and the Artist Points you earned in that game;
• in a room, your Google profile photo if your account has one — it is shown next to your nickname to the players of that room only. You can switch this off at any time in Settings (Privacy → "Show my photo to other players"); the setting applies from the next room you join, and then the other players see your coloured initial instead;
• as a friend: your public handle, level, whether you are a Premium player and your Google profile photo if your account has one and you have not switched it off with the same Settings option (never your email or real name). A friend request that has not been accepted yet shows only your handle and level;

What we store about this, and for how long:

• Friends, friend requests and blocks you make, until you remove them or delete your account.
• Room game history: for each room game you finished, a record of the song and artist, the mode, your result and place, your counts (words, wrong guesses, superpowers used), which positions of the board you revealed and when (as numbers — never the lyrics or your board), and the other players of that game with the nickname each of them had then. You see this in History and Stats. If another player deletes their account, they stay in your history as "Deleted player" with no personal data, so your own results and places do not change. The profile photo you showed in a game is kept on your seat in that game only while the game record exists, is not shown in History, and is removed when you delete your account.
• Rewards from room games (XP, loot, Artist Points), kept with your account.

Rooms have no chat and no free text between players: the only text another player can put in front of you is a nickname.

Reports and moderation

If another player behaves badly (an offensive nickname, cheating, harassment), you can report them from the room. We store:

• who reported, who was reported, the room code, the reason you chose, an optional note of up to 200 characters you write, the reported player's nickname at that moment, and the time.

Reports are read only by us, to keep rooms safe; they are never shown to the reported player or to anyone in the room. We may use them to restrict a player's access to rooms (a room ban); solo play is not affected. Reports are deleted after 12 months, or earlier if either account is deleted. You can also block a player from a room: they can then no longer join rooms you are in, or send you friend requests, and you cannot join theirs.

Advertising (free tier)

Free-tier players see ads served by Google AdMob. AdMob may use the Android advertising ID and device information to choose and measure ads; ads can be personalised. We do not give AdMob your account data. You can reset or delete your advertising ID, or opt out of ad personalisation, in your phone's Google settings (Settings → Google → Ads). Premium removes ads.

If you are in the European Economic Area, the United Kingdom or Switzerland, the App asks for your consent through Google's consent form before any ad is requested, and no ad is requested until you have answered. You can review or withdraw your choice at any time in Settings → Ad privacy.

If you purchase premium

If you buy a premium subscription or item, we store:

• a Google Play purchase token, used to verify your entitlement with Google Play and to detect refunds or cancellations. We do not receive or store your payment card details — those are handled entirely by Google Play.

Analytics

We use Google Firebase Analytics to understand how players use the App and to improve it. Firebase Analytics collects:

• automatic screen views (which screens you visit);
• gameplay events: game started, game ended, and per-guess outcomes (correct/incorrect, word length, how many letters were newly revealed — never the word or lyric text itself);
• purchase funnel events (paywall viewed, purchase completed) tagged with which part of the App linked to the purchase screen;
• reminder events: where in the App you were asked about reminders, whether you accepted, which frequency you chose, and which kind of reminder you tapped (streak, energy, daily challenge, other nudges) — no personal content;
• user properties: whether you're a premium subscriber, your level, and your streak length.

Firebase Analytics is provided by Google. Google acts as our data processor for this data and may process it in accordance with its own privacy terms — see Google's Privacy Policy and Google Analytics for Firebase's terms. Analytics collection is currently on by default, based on the notice you see and agree to on the App's welcome screen; a more granular in-app consent control is planned for a future update.

Crash reports and diagnostics

We use Google Firebase Crashlytics to find and fix crashes and errors. When the App crashes, or hits an error it could not recover from, it sends a report to Crashlytics. A report contains:

• the technical error details: what failed and where in the App's code (a stack trace), and for an error the App handled itself, a short technical description of the step that failed (for example a purchase or sign-in step);
• device and app information: the phone model, Android version and App version, and the state of the device at that moment (for example free memory and storage, and screen orientation);
• a Firebase installation ID, a random identifier for the App on your phone, which lets Crashlytics count how many players a problem affects. It is not your name, email address or account;
• if Analytics (above) is on, the last few Analytics events before the crash (for example the screens you opened), so we can see what led to it.

We do not put song lyrics, the words you guessed, your email address, your name, your display name or your public handle into these reports, and we do not attach your account to them.

Crashlytics is provided by Google. Google acts as our data processor for this data; see Google's Privacy Policy and Firebase's privacy and security information. Crash reporting follows the same setting as Analytics: it is on by default, based on the notice you see on the App's welcome screen, and a more granular in-app control is planned for a future update.

Reminders (notifications)

If you turn on reminders (streak, energy restored, daily challenge, and other occasional nudges), they are scheduled on your device from your own game state. We do not send them from our servers, and they need no push-notification token or other additional identifier. Notification permission is requested only when you choose to turn reminders on; you can change how often they arrive, switch individual kinds off, or turn them off entirely in Settings → Notifications, or in your phone's system settings.

Friend requests and invitations (push notifications)

If you have an account and allow notifications, we can tell you when a friend request or a room invitation reaches you while the App is closed. These are the only notifications our servers send. To do this:

• the App asks Google Firebase Cloud Messaging (FCM) for a push token, a random identifier for the App on your phone, and sends it to us together with your app language and app version; we store it against your account;
• when someone sends you a request or invitation, our server sends Google a short message for your token. It contains the other player's public handle and, for an invitation, the room mode (for example "Together"). It never contains your real name or email, a song title or any lyrics;
• we send nothing while you have the App open (it already shows the request or invitation), nothing from a player you have blocked, and at most one message from the same player of the same kind every 30 seconds. An invitation is withdrawn from Google's queue when its ten minutes are up.

You choose: the notification permission is asked only after a friend request or invitation (or from Settings → Notifications), you can switch friend requests and game invitations off separately there, and you can turn notifications off in your phone's system settings at any time. On Android 12 and older, notifications are allowed by default and the App does not ask, so the token is registered when you sign in; the same switches and system setting turn it off. A guest, who has no friends or invitations, never gets a push token.

Your token is removed when you sign out, when Google tells us it is no longer valid (for example you uninstalled the App), and when you delete your account.

2. What we never collect or store client-side

Consistent with the design of the game itself, LyricHunt never sends full, unmasked song lyrics to your device outside of an active, in-progress guessing round, and never logs full lyric text on our servers in a form accessible via the App's API.

3. Why we process this data (legal basis)

• Guest device ID, gameplay data: necessary to provide the game (contractual necessity / legitimate interest in operating the service).
• Email, Google account data: necessary to provide account features you requested (contractual necessity).
• Purchase token: necessary to fulfil and verify a purchase you made (contractual necessity).
• Rooms, friends and room history (nickname, results, the other players' nicknames): part of the multiplayer game features you use (contractual necessity).
• Reports and room bans: our legitimate interest in keeping rooms safe for everyone; the data is limited to what is listed above and deleted after 12 months.
• Push token (friend requests and invitations): your consent, given by allowing notifications, and necessary to deliver the notifications you asked for. You can withdraw it at any time in Settings → Notifications or in your phone's system settings.
• Advertising (free tier): legitimate interest in funding the free game with ads served by Google AdMob; see the Advertising section for your controls.
• Leaderboards (public handle, level, points): part of the game features you use as a signed-in player (contractual necessity), limited to the pseudonymous data described above. You can object to this at any time by hiding yourself from leaderboards in Settings.
• Crash reports and diagnostics: legitimate interest in keeping the App stable and fixing errors that stop you from playing. The data is limited to what is listed in the Crash reports section above.
• Analytics: legitimate interest in understanding and improving the App, based on the consent notice shown before you start playing. Where applicable law requires opt-in consent for analytics, we rely on that notice as the consent mechanism until a more granular control ships.

4. Third parties we share data with

Purpose	Third party	What they receive
Sign-in (Google)	Google (Google Sign-In)	Your Google ID token, used to verify identity
Sign-in (email)	Google (Gmail, for outbound delivery)	Your email address and one-time sign-in code, to deliver the code to you
Payments	Google Play Billing	Purchase/subscription data (handled by Google; we receive only a purchase token)
Analytics	Google (Firebase Analytics)	Events and properties listed in §1
Crash reports	Google (Firebase Crashlytics)	Crash and error reports, device and app information, and a Firebase installation ID, as listed in §1
Push notifications	Google (Firebase Cloud Messaging)	Your push token, and the text of the notification (the other player's public handle and, for an invitation, the room mode)
Advertising (free tier)	Google (AdMob)	Ad requests, the advertising ID and device information, as described in §1
Song metadata	Third-party music catalog APIs	Search queries (artist/song names) — no personal data
Lyric fragments	Third-party public lyrics APIs	Song title/artist to look up lyric text server-side — no personal data

We do not sell your personal data to anyone.

5. Data retention

• Guest device data is retained while your device continues to play; you can reset it by reinstalling the App or clearing app data, which starts a new guest identity.
• Account data is retained until you delete your account. Deleting your account also removes your leaderboard entries and your public handle.
• Friends, friend requests and blocks are deleted with your account.
• Room game history is kept on your account until you delete it; on the other players' side, you appear as "Deleted player" with no personal data after deletion.
• Reports are deleted after 12 months, or when either account is deleted.
• Push tokens are kept while you are signed in on that phone and are deleted when you sign out, when Google reports them invalid, or when you delete your account.
• Crash reports are kept by Crashlytics for up to 90 days, and are not linked to your account, so deleting your account does not change them.
• Purchase tokens are retained as long as needed to verify entitlements and respond to Google Play refund/chargeback notifications.

6. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing (for example, under the EU/UK GDPR).

• Delete your account and data: in-app, via Settings → Account → Delete Account. This removes your account record and account-linked gameplay data from our active systems.
• Leaderboards: change your public handle, or hide yourself from all leaderboards, in Settings at any time.
• Rooms: report or block another player from their card in the room.
• Access or export your data: contact us at [email protected].
• Opt out of analytics and crash reports: a granular in-app control is planned; until it ships, contact us and we will disable analytics and crash report collection for your account/device on request.

You also have the right to lodge a complaint with your local data protection authority.

7. Children's privacy

LyricHunt is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us at [email protected] and we will delete it.

8. International data transfers

Our service providers (including Google) may process data outside your country of residence, including in the United States. Where required, such transfers rely on the provider's own applicable safeguards (for example, Google's Standard Contractual Clauses for EU data transfers).

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact

Privacy questions or requests: [email protected]