Who we are
Tone (tone.tr) is a website for reading song lyrics and sharing them as cards. You can reach us about anything in this policy at [email protected].
What we collect
You can read Tone without an account. What we keep depends on what you do:
- When you sign in with Google: your name, e-mail address, profile photo and Google account ID, as Google shares them with us. We make a username from your name; you can change it in Settings.
- When you use your account: the songs in your library (and which you hid), your ratings, what you share on your profile, the lyric cards you make (the lines, format and look), and whether your profile is hidden.
- While you are signed in: a session, with the IP address and browser (user agent) it was opened from, so we can keep you signed in and spot misuse.
- When you make a card without an account: a one-way, salted fingerprint of your IP address, so the card can be updated while you edit it. We cannot turn it back into the address. Cards nobody shares are deleted after a day.
- When you visit: the pages viewed each day, with your country, the site that linked to you, the language your browser asks for first (only its code, such as “tr” or “en”) and a one-way fingerprint of your IP address and browser, so that each visitor is counted once a day. The fingerprint is made with a random key that changes every day and is deleted once the day is over: it cannot be turned back into your address or matched with another day’s. No cookie is used for this, and your IP address and browser details are not stored.
- Your country: your IP address is looked up in a database on our own server (IP geolocation by DB-IP (opens in a new tab)) to show the home page for your country. The address is not stored for this.
- Searches: the text of searches the catalog could not answer, with how often they were made, so we can look them up. Not linked to you.
- When something breaks: the page, the error message and your browser (user agent), in our server logs.
- Web server logs: your IP address, the page asked for, the time and your browser, as every web server records them.
We do not ask for or keep payment details, and we do not use advertising or tracking services.
Why, and on what legal basis
- To provide your account and its features (library, ratings, profile, cards): it is needed to provide the service you asked for (GDPR art. 6(1)(b); KVKK art. 5(2)(c)).
- To keep the site secure, prevent abuse and fix errors: our legitimate interest in running a safe service (GDPR art. 6(1)(f); KVKK art. 5(2)(f)).
- To understand which pages are used and by how many visitors, from counts made without cookies (see “What we collect”): our legitimate interest in improving the site.
- To meet legal obligations, such as answering a court or authority: GDPR art. 6(1)(c); KVKK art. 5(2)(ç).
We collect this data electronically: from your browser when you use the site, and from Google when you sign in with it.
Transfers abroad
Signing in with Google, and some of our providers, may involve processing outside your country, including in the United States. Where the law requires it, these transfers rely on the safeguards it provides, such as standard contractual clauses (GDPR art. 46; KVKK art. 9).
How long we keep it
- Your account and everything in it: until you delete your account. Deleting it in Settings removes it at once, with your library, ratings, cards and profile.
- Copies in backups: nightly backups are kept for 7 days on our server and 30 days in off-site storage, after which deleted data is gone from them too.
- Sessions: 30 days at most.
- Cards made without an account and never shared: 1 day.
- Server logs: up to 14 days.
- Page view counts: kept, as they hold nothing about any person.
Your rights
You can ask us to tell you whether we process your data and what it is; to correct it; to delete it; to restrict or object to its processing; to receive it in a portable form; and to know who it was shared with. Under KVKK art. 11 you can also ask what it is used for, which parties in Türkiye or abroad received it, and claim compensation for damage caused by unlawful processing.
Most of this you can do yourself: change your username or hide your profile in Settings, or delete your account there. For anything else, write to [email protected] from the e-mail address of your account. We answer within 30 days. You can also complain to your data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK).
Children
Tone is not meant for children under 13, and they should not create an account. If you think a child has, write to us and we will delete it.
Security
The site is served only over HTTPS. The database is not reachable from the internet, each part of the service has only the access it needs, and sessions are signed. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires.
Changes
If we change this policy, we will update the date at the top. If the change is significant, we will say so on the site before it takes effect.