Privacy Policy | I Love That Track
I Love That Track

Privacy Policy

Last updated: October 28, 2026

1. Introduction

I Love That Track ("we", "our", "us") operates the website ilovethattrack.app. This Privacy Policy explains how we handle information when you use our services: Similar Song Finder, Lyrics Finder, Similar Artists, Genre Finder, Discover and AI Pro, as well as your account and the Pro subscription.

2. Information We Collect

You can search without an account. You need one for favorites, search history and the Pro subscription. Depending on what you use, we process the following data:

  • Your searches: what you enter (a link to a track on Spotify, Apple Music, YouTube Music, Amazon Music or Yandex Music, song lyrics, an artist or track name, or a description of the music you want) is sent to the services listed in section 3 to find results. While you type an artist or track name, the text is also sent to Deezer and iTunes for suggestions.
  • Result pages: when a search finds something, we save the result as a page with a short link (/share/…) so that you can return to it or send it to someone. The page shows the music found and, for lyrics searches and AI requests, the text you entered. We also store the link you submitted and, if you are signed in, which account ran the search. The page shows neither of them. Anyone with the link can open the page, and we ask search engines not to index such pages. We count how many times a page is opened and when it was last opened.
  • Account: you can sign in with Google, using the button or the One Tap prompt, or with your email address. In that case we send you a one-time 6-digit code and a sign-in link, both valid for 10 minutes, and create the account only after you confirm the address. We store your email address; if you use Google, your name, profile picture and Google account ID; your language, which we use for our emails and which you can change in your profile; your country, which Cloudflare determines from your connection (if it cannot, we infer the country from the site language); your newsletter choice; and the dates of registration and of your last activity. Language and country are set when the account is created and again when you first sign in to it with Google. Accounts created before we switched to password-free sign-in may still hold a hashed password, which is no longer used.
  • Newsletter about new features: when you create an account with your email address, you give consent with the "Send me updates about new features" checkbox in the sign-in form. It is ticked by default, and you can untick it. Signing in later does not change your choice. When you register with Google, consent is set automatically. You can opt out at any time in your profile or by writing to us. Regardless of this choice, we send the emails your account needs: sign-in codes and links, a notice when Google sign-in is added to your account, and account deletion confirmations.
  • Search history and favorites: when you are signed in, we save your searches (what you searched for, when, and a link to the results) and the tracks you add to favorites (artist, title, cover and the section of the site where you found them). You can see them in your profile.
  • Payments: the Pro subscription is sold by Lemon Squeezy, which acts as the merchant of record: it takes the payment, charges taxes and issues receipts. We pass Lemon Squeezy your email address and our internal account number so that the payment is linked to your account. From Lemon Squeezy we keep the status and plan of your subscription, its renewal and end dates, your Lemon Squeezy customer number, a link to the page where you manage the subscription, and invoice details: amount, currency, billing country and card type (for example, Visa). We never receive your card number.
  • AI features: when you use AI Pro or the AI search on the Discover page, your request and its context (the track title and artist, and the tracks already found) are sent to an AI service provider, which generates the answer. We do not send your name, email address or IP address. AI results are saved as a result page, like other searches.
  • Chat with the team: signed-in users can talk on the site with Alex, the team's AI assistant: for example, when we invite you to a short interview about the site or when you message the team from your profile. Alex can make mistakes; its replies are not promises or terms of service, and questions about payments and refunds are handled by the team. We store the messages linked to your account, together with a short summary of the conversation. We use them to improve the service, to deal with the problems you report and to analyze the answers, including with the help of an AI service provider. To generate Alex's replies, the messages are processed by an AI service provider; we do not send it your name, email address or IP address. You can turn off the invitations, end a conversation at any time and delete all your conversations in your profile.
  • Usage statistics: we count searches, ratings of results, clicks on music platform links and on the Share button, and steps towards a subscription (for example, that you reached a limit, saw a Pro offer or opened checkout). These records are linked to your account or, if you are not signed in, to the guest identifier described in section 4. Some of them also include your country.
  • Abuse prevention: we count guest searches both by the guest cookie and by a hashed IP address, so clearing cookies does not reset the daily limit. When a new account is created, we keep its email address together with a hashed IP address and a hashed cookie identifier for up to two days to stop mass registrations. When a sign-in code is requested, we keep the email address and IP address in hashed form for a few days to stop mass mailing.
  • API access requests: if you request access to our API through the form, we store your email address, your description of the project, the language, your browser details (User-Agent) and a hashed IP address so that we can reply.

3. Third-Party Services

We use the following services. When our server contacts music and lyrics services, it sends only what the search needs: an artist and track name, or the link or lyrics you entered. Your IP address, name and email address are not sent to them.

  • Google: sign-in with Google and Google Analytics. If you are not signed in, our pages load Google's sign-in script, which can show the One Tap prompt.
  • Yandex Metrica: visit statistics and Webvisor session recordings (see section 4).
  • Cloudflare: delivers our pages and protects the site from attacks and abuse. Requests to the site pass through Cloudflare, which also tells us which country a request comes from.
  • Lemon Squeezy: payment for the Pro subscription (see section 2). Our pages load the Lemon Squeezy script so that checkout opens on top of the page.
  • AI service provider: AI features and the chat with the team (see section 2).
  • Music data sources: Spotify, Apple Music, YouTube Music, Amazon Music and Yandex Music identify the track from the link you submit, and Yandex Music also suggests similar tracks. Last.fm, Deezer, iTunes, MusicBrainz and Discogs provide similar tracks and artists, covers, genres and search suggestions.
  • Lyrics sources: Genius, to find songs by the lyrics you enter; LRCLIB, for the lyrics of the song found.
  • Covers and photos: your browser loads album covers and artist photos directly from the servers of Apple, Deezer, Spotify and Genius, and your Google profile picture from Google, so these services see your IP address and standard browser data.
  • Apple (track previews): When you press a preview button, your browser sends the artist name and track title (or the track's ID in the Apple catalog) directly to Apple Inc., bypassing our server, and then plays a clip from Apple's servers. In the process, Apple receives your IP address, standard browser data (User-Agent, language), and our website's address without the page path, and processes them under its own privacy policy. No preview requests are sent to Apple before you press the button. We do not receive or store this data.
  • Hosting: our servers, database backups and email delivery are run by hosting providers, which process data only on our behalf.

Each third-party service has its own privacy policy. We encourage you to review their policies.

4. Cookies and Session Data

We set the following cookies:

  • PHPSESSID: the session. It keeps you signed in during a visit and holds temporary data such as request counters. Deleted when you close the browser.
  • _rfp: a random security identifier, kept for up to 12 months. It protects sign-in with Google from forged requests and helps limit mass registrations. It also keeps you signed in: when you sign in, our server links this cookie to your account for 30 days, so you do not have to sign in again in this browser. Signing out, or signing in to the same account in another browser, removes the link.
  • _auth: a "signed in" mark without personal data, so that a page served from cache shows the right menu. Deleted when you close the browser.
  • lang_pref: the language you chose manually, so that we do not switch you to your browser's language. Kept for 12 months.
  • _gfp: a guest identifier. While you are not signed in, we use it for the free daily search limit and for usage statistics. Kept for 12 months.

We also keep short technical notes in your browser's storage. One lets you finish a search or add a favorite after you sign in and is deleted when you close the tab. Another, set after you delete your account, pauses the Google One Tap prompt for 30 minutes. A third prevents repeated page reloads and is also deleted when you close the tab.

Analytics. We use Google Analytics and Yandex Metrica to understand how visitors use the site: which pages they open, what they click, their device and browser type, and their approximate location. Page addresses and titles, which may include what you searched for, are sent to these services too. These services set their own cookies, such as _ga (up to 2 years) and _ym_uid (1 year). Webvisor, part of Yandex Metrica, records sessions (mouse movements, clicks, scrolling and the content of the pages) so that we can see where the site is inconvenient. What you type into input fields is masked with asterisks, and your email address and name are hidden from recordings. Google and Yandex process this data under their own privacy policies.

Google's sign-in script and the Lemon Squeezy script may use their own cookies, and Cloudflare may set technical security cookies.

You can delete cookies in your browser settings. Without our own cookies, signing in will not work.

5. Data Retention and Account Deletion

  • Account: until you delete it.
  • Search history: about 200 of your most recent searches. Older entries are deleted automatically.
  • Favorites: until you remove them or delete your account.
  • Chat with the team: messages are kept for 12 months after the last message of the conversation, or until you delete your conversations or your account. After that, only anonymized conclusions remain (for example, which features were requested), without the messages and without a link to your account.
  • Result pages: kept while they are in use. A page is deleted only when all of these are true: it was created more than 90 days ago, nobody has opened it for 180 days, it is not in the search history of any account, and nobody has shared it with the Share button in the past 365 days. After that, its link shows "page not found".
  • Sign-in codes and links: stop working after 10 minutes (the account deletion link after 1 hour). Expired ones are deleted within about a week.
  • Search counters: daily counters of guests are kept for 90 days, after which only anonymous daily totals remain. Counters of an account are kept until the account is deleted.
  • Other records (usage statistics, API access requests) are kept for as long as we need them for the purposes described above.
  • Backups: regular database backups are overwritten within about a week, so deleted data disappears from them within that time. Before major updates of the site we also keep an extra copy, stored separately; such copies may be kept longer.

How to delete your account. Open your profile and click "Delete account". We will send a confirmation link to your email. It works for 1 hour. Open it and press "Delete my account permanently". If you have a Pro subscription, we first cancel its renewal with Lemon Squeezy, so you will not be charged again. If the cancellation fails, the account is not deleted. Instead, you will see a link to the Lemon Squeezy billing portal, where you can cancel the subscription yourself.

What is deleted: your name, profile picture, the link to your Google account and the old password, if you had one; your search history, favorites, search counters, conversations with Alex and saved sign-ins. The newsletter is turned off, and you are signed out on all devices.

What remains:

  • The record of the deleted account: your email address, language, country and account dates. If you sign in with this address again, this account is restored without your name, history and favorites.
  • Records of past subscriptions and payments, and usage statistics. They stay linked to the record of the deleted account and are linked to your account again if you sign in later. A subscription that is already paid for then works until the end of the paid period.
  • The result pages you created. They stay available at their links, without showing any account details, until they are deleted under the rule above.

6. Data Security

Our site is served over HTTPS. Our servers are protected by Cloudflare's security infrastructure. We store the sign-in codes and links we email you only in hashed form, and we never receive your card number.

7. Children's Privacy

Our services are not directed at children under the age of 13. We do not knowingly collect information from children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date.

9. Contact

If you have questions about this Privacy Policy, please contact us through our website at hi [at] ilovethattrack [dot] app.