What we collect, what we don't.

What we store

We store record metadata: cryptographic fingerprints, Lyricsmit recorded times, RFC 3161 timestamp tokens when issuance succeeds, and the details you provide (such as title, creator name, creative field, location, and AI or collaborator declarations). Account holders also have an email address and hashed password stored.

The file

The file transits Lyricsmit so a SHA-256 fingerprint can be computed, then it is discarded. Lyricsmit does not retain the file. Fingerprint, timestamps, and the details you provide are stored as the record.

Your browser computes SHA-256 before upload. Lyricsmit recomputes the same hash on the server and rejects a mismatch. The file still transits Lyricsmit; this is not a no-upload architecture.

Files are not published, sold, or kept as a library of your work. A copy of the file bytes is in memory on Lyricsmit's servers during hashing. That is not the same as "the file never touches our servers."

Use of data

Data is used to provide and operate the Lyricsmit service, including verification pages, account access, transactional email, and payments. We do not sell, license, or share your data with third parties for marketing purposes.

Infrastructure providers

Lyricsmit currently uses these providers to operate the live service. They process data only as needed to deliver that role.

• Vercel — application hosting
• Neon — PostgreSQL database
• Stripe — payments
• Resend — transactional email
• FreeTSA.org — RFC 3161 timestamp authority

Replit is not the production host. The public site is served from Vercel at www.lyricsmit.com.

Retention

Saved records are kept while your account and the service remain active. That is not a guarantee of indefinite availability. Temporary upload previews expire after 24 hours. Account data is retained until you request deletion. RFC 3161 tokens can be checked independently of Lyricsmit if you have downloaded them (see the Evidence Pack).

Your rights

You may request access to, correction of, or deletion of your account data at any time by contacting hello@lyricsmit.com. We will respond within a reasonable timeframe.

Security

The file is discarded after hashing, so Lyricsmit does not keep a copy of your work to leak later. What we do hold — account email, hashed password, fingerprints, timestamp tokens, and record metadata — is stored with encrypted connections. Passwords are one-way hashed.