Privacy Policy

Last updated: February 26, 2026

1. Information We Collect

When you create an account on OkiLingo, we collect:

  • Account information: your name, email address, and a hashed version of your password (if you register with email/password).
  • Google account data: if you sign in with Google, we receive your Google user ID, name, and email address from Google's OAuth service. We do not receive or store your Google password.
  • Uploaded content: audio files and transcription data you upload to the platform.
  • Session data: a session token stored in a secure, HTTP-only cookie to keep you signed in.

2. How We Use Your Information

We use your information to:

  • Provide and maintain the OkiLingo service.
  • Authenticate your identity and manage your account.
  • Associate uploaded songs with your account.
  • Improve and develop the platform.

3. Data Storage and Security

Your data is stored using Cloudflare's infrastructure:

  • Account and session data are stored in Cloudflare D1 (a distributed SQL database).
  • Uploaded audio and transcription files are stored in Cloudflare R2 (object storage).
  • Passwords are hashed using PBKDF2-SHA256 with 100,000 iterations. We never store plaintext passwords.
  • Session tokens are hashed with SHA-256 before storage. Only the hash is stored in our database.

4. Cookies

We use the following cookies:

  • session: an HTTP-only, secure cookie that stores your session token. It expires after 30 days.
  • theme: a localStorage value (not a cookie) that stores your light/dark theme preference.
  • Temporary OAuth cookies: during Google sign-in, we briefly store state and code verifier values in cookies. These are deleted after the sign-in flow completes.

We do not use any third-party tracking cookies or analytics.

5. Third-Party Services

We use the following third-party services:

  • Google OAuth: for optional sign-in with Google. Google's privacy policy applies to data processed by Google during authentication.
  • Cloudflare: for hosting, storage, and content delivery. Cloudflare's privacy policy applies to infrastructure-level data processing.

6. Data Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties. We may share data only if required by law or to protect our rights.

7. Your Rights

You have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your account and associated data.
  • Withdraw consent for data processing at any time by deleting your account.

8. Data Retention

We retain your account data for as long as your account is active. Uploaded content remains stored until you delete it or request account deletion. Session records are automatically removed when they expire.

9. Children's Privacy

OkiLingo is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us so we can delete it.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date.