سیاست حریم خصوصی

PersianChords.com ("we", "the site") is a free Persian chords bank. You can read, search and play every song without an account.

• We collect as little as we need.
• We use analytics only to understand how the site is used and to improve it.
• We don't sell personal data and we don't show ads. If that ever changes, we will update this policy before it does.

1. Summary

• Reading needs no account and no personal data.
• Analytics:
  • We measure how the site is used with Google Analytics, loaded through Google Tag Manager, and its advertising features are off.
  • In the European Economic Area, the United Kingdom and Switzerland, analytics run only after you agree.
  • Elsewhere you can turn them off at any time (section 2).
• We record searches without IP addresses, so we can find missing songs.
• To stop abuse we keep a salted, one-way hash of your IP address for about a day.
• Error reports need no account.
• Contributing needs an account.
  • Accounts use Google or an emailed sign-in link. We store no passwords.
  • Your email is never shown.
• You also need an account to save songs or request songs.
• Your display name is public wherever you post or are credited. Choose one that doesn't reveal who you are if you prefer.

2. If you only read the site

• Reader settings stay in your browser's local storage: font size, autoscroll speed, theme, the transpose and capo choices for each song, and similar display choices. They never reach our servers.
• Saved songs.
  • Saving now needs an account. Songs saved on this device before you sign in are moved into your account the first time you sign in.
• Searches.
  • We store the search text in a normalized form, the filters you chose, and how many results came back.
  • Search records carry no IP address and no account.
  • To count one visit's searches together, your browser makes a random identifier for the tab (session storage, erased when the tab closes). We store only a one-way hash of it.
• Analytics (Google Analytics through Google Tag Manager).
  • Google receives your IP address, browser details and the page address when the tags load. Google Analytics does not store IP addresses.
  • It records pages viewed, how you arrived, approximate location (city or country), device and browser, using a random identifier in a cookie.
  • The site also sends page-speed measurements (how long a page took to load and respond, and how much its layout shifted), labelled by page type.
  • We use these reports only in aggregate.
  • Google signals, advertising features and data sharing for ads are off. The site's security settings block other tracking services.
  • In the EEA, the UK and Switzerland, analytics cookies are set only after you choose «موافقم» ("I agree") in the notice the site shows. Until then Google receives no identifier.
  • Everywhere, you can turn analytics off on this page («آمار را خاموش کن») or with a content blocker. No site feature depends on analytics.
• Hosting. Our host, Vercel, receives your IP address and browser details to deliver pages and protect the site. The application logs we can see are kept for about an hour.
• Error records. When a page fails on our side, we record:
  • the page type (not the exact address);
  • the error message, with emails and secrets removed;
  • the time.

  No IP address is recorded.

3. What you send without an account

• Error reports on a song store the song, the type of problem and your description. They ask for no contact details.
• Spam protection.
  • For each report we store a salted, shortened one-way hash of your IP address with a counter, to limit how many come from one connection.
  • The hash cannot be turned back into your IP address.
  • The counters are deleted when they are a day old.

4. Accounts

Accounts are only for people aged 16 or older. Reading never requires one.

Anyone aged 16 or older can create an account to save and request songs and to contribute.

Signing in

• Google. Google tells us your Google account ID, your verified email address and the name on your Google account.
  • The name is only a starting display name, which you replace or keep when you set up your account.
  • We never see your Google password or any other Google data.
• Email link.
  • We send a one-time link that works once and expires after 15 minutes.
  • Our email provider, Resend, sends it.
  • Sign-in emails are the only emails the site sends: no newsletters, no marketing, no notification emails.
• The same verified email used with both methods leads to the same account. There are no passwords; the email link also recovers your account.

What we store, and who can see it

• How we protect it:
  • Sign-in links and session tokens are stored only as one-way hashes.
  • Sign-in requests are rate-limited per IP address and per email address. Both are stored only as salted hashes.
  • Before a sign-in link is sent, our host's protection against automated traffic (Vercel BotID) checks that the request came from a browser and not a bot. For this, a script on the sign-in form reads characteristics of your browser. It sets no cookie.
  • New accounts are limited per IP address the same way.
  • Song requests are counted per account, with a salted one-way hash and no IP address, to limit how many one account sends.
• Moderator actions on accounts and content are recorded in an internal audit log.

5. Cookies and browser storage

We use no advertising cookies.

6. Service providers and where data is processed

• Each provider processes data only to provide its service to us.
• Our servers are in the United States, so your data is processed there wherever you live.
• For people in the EEA, the UK and Switzerland, transfers rely on the safeguards these providers offer, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider takes part in it.

7. Why we may use data (legal bases)

For people in places with laws such as the GDPR:

• To provide what you ask for (an account, saved songs, votes, comments, requests, contributions): necessary for our agreement with you (the terms at /terms).
• To keep the site safe and working (rate limits, abuse prevention, moderation, error records, search improvement): our legitimate interest in running a safe, useful, free service.
• Analytics in the EEA, the UK and Switzerland: your consent, which you can withdraw at any time on this page.
• Responding to valid legal requests: a legal obligation.

8. How long we keep data

Deleted data can remain in backups until those backups expire. We may keep specific data longer where we need it to comply with the law, to establish or defend legal claims, to prevent abuse, or to enforce our terms.

9. Security

• All traffic uses HTTPS.
• IP addresses used for rate limits are stored only as salted hashes.
• The public site connects to the database with a restricted account that cannot change the catalog or read the site's private rights and review records.
• The admin console requires a second factor (an authenticator-app code).
• There are no passwords. Sign-in links and session tokens are stored only as hashes, and you can sign out of every device.

No system is perfectly secure, and we cannot guarantee the security of your data. If a breach occurs, we will notify the people affected and the authorities where, and as, the law requires.

10. Sharing and disclosure

• No sale. We don't sell, rent or trade personal data, and we don't share it for advertising. We don't sell or share personal information as California law defines those terms.
• Service providers. The providers in section 6 process data for us.
• Other disclosures. We may also disclose personal data:
  • when we believe in good faith that the law, a court order or a valid legal request requires it;
  • to protect the rights, property or safety of PersianChords.com, its owner, its users or others, including to investigate abuse and to enforce our terms;
  • to a successor, if the site is transferred, for example to a non-profit. This policy, or one at least as protective, continues to apply to the data.
• Aggregates. We may share or publish aggregate statistics that identify no one, for example popular songs or total votes.

11. Your choices and rights

Everyone can:

• use the whole site without giving us personal data;
• turn analytics off on this page, or withdraw your consent if you gave it;
• clear what is on your device by clearing this site's data in your browser.

Depending on where you live, the law may give you rights to see, correct or delete personal data we hold about you, to restrict or object to how we use it, or to get a copy. These rights are subject to the exceptions the law allows. To use them, write to us (section 14).

With an account, your account page also lets you:

• download your data: everything the site holds about your account, as a file;
• change your display name and credit setting;
• sign out everywhere;
• delete your account.

What account deletion removes: your email, sign-in methods, sessions, saved songs and notifications, and any votes, feedback, request votes and setlists.

What it keeps:

• Song requests you made stay, without your account, as section 8 says.
• A record of role and moderation decisions on the account (what was decided, when and why) stays in the site's internal log, under the account's internal number rather than your email.
• Published contributions stay on the site without your name (see the terms at /terms).

How we handle requests:

• We answer within the time the law requires.
• We may ask you to confirm your identity, for example from the email address on the account.
• We may refuse requests that the law allows us to refuse, such as repeated, excessive or unfounded requests.
• If you are in the EEA or the UK, you may also complain to your local data protection authority.

12. Children

• Reading the site requires no personal data at any age.
• Accounts are only for people aged 16 or older. If we learn that an account belongs to someone younger, we delete it.

13. Changes to this policy

We may change this policy at any time. We post the new version with its version number and date, and it applies from then unless the law requires otherwise. We may also point out significant changes on the site.

We may also point them out in account notifications.

14. Contact

Privacy questions and requests: contact@persianchords.com

PersianChords.com is run by its owner, who is the data controller for the purposes of this policy.