Overview
Lyria runs Lyria, a service that serves lyrics, artwork and song metadata from its own library. We collect as little as possible: only what is needed to sign you in, protect the service and answer your messages. We do not sell personal data, show ads or use analytics or tracking tools.
What we collect
- Account data: your username, a one-way hash of your password, your role and your rate-limit settings.
- Sessions: for each sign-in we store a session id, the time it was created and last used, its expiry, your IP address and your browser's user-agent, so you can see and end your active sessions.
- API tokens: a name, a short prefix and a SHA-256 hash of each token. The full token is shown once and never stored.
- API usage: for each API request we record the endpoint, response status, response time, the token used and the song that was returned. This powers your usage statistics, rate limits and abuse prevention.
- Email: if you email us, we keep your address and the conversation for as long as needed to handle your request.
- Rate-limit counters: short-lived counters keyed by a hash of your IP address or token, deleted automatically when their time window ends.
Cookies and storage
We only use strictly necessary cookies. None of them are used for advertising or tracking, and we do not write anything to your browser's local or session storage.
lyria_session: a signed token (JWT) that keeps you signed in. It is HttpOnly, so scripts cannot read it, and it expires after 8 hours, or 30 days if you choose to stay signed in.lyria_csrf: a random value that protects forms before you sign in. It is deleted when you close your browser.lyria_flash: carries a one-time status message across a page redirect and expires within a minute.
Third-party services
Pages load styling, icons and interface scripts from public content delivery networks (cdn.tailwindcss.com and cdn.jsdelivr.net). Like any website, these providers receive your IP address and browser details when the files are requested. The API itself does not contact any third party: every response comes from our own database.
How we use data
- To provide the service: sign-in, API access, usage statistics and the song library.
- To keep it safe: rate limiting, spotting abuse and investigating errors.
- To reply to you when you contact us.
Retention
Account data is kept until the account is deleted. Ended sessions and revoked tokens can be removed at any time from your dashboard. API usage records and emails are kept only as long as they are needed for the purposes above. When an administrator deletes an account, its sessions and tokens are deleted with it.
Your rights
You can ask for a copy of your data, its correction or deletion, or object to how it is used. Depending on where you live, laws such as the GDPR or KVKK may give you further rights. To make a request, email contact@soket.in or see the contact page.
Security
Passwords and tokens are only stored as hashes. Sessions can be revoked on the server, forms are protected against cross-site requests, and the API enforces per-token and per-IP limits. No system is perfectly secure, but we work to protect your data.
Changes
If this policy changes, we will update the date at the top of this page. Significant changes will be announced in the dashboard.