Privacy & cookies
Sparrowlight keeps as little personal data as it can. Nothing is used for advertising, sold, or used to track you across other sites.
Who we are
Sparrowlight runs this website at sparrowlight.com and is the data controller for the personal data described here. To ask about your data or use any of your rights, use the contact form. You'll get a confirmation by email straight away.
What we collect and why
You can use Song Chart Maker, the chord pages and the transposer without an account. An account is optional and is only needed to save songs and settings to use on any device.
| Data | Why | Legal basis (GDPR Art. 6) | How long |
|---|---|---|---|
| Messages you send us through the contact form: your name, email address and message, with the time and your IP address. | To read and answer your message. | Legitimate interests: answering the people who write to us; for privacy requests, our legal obligation to respond. | Up to 2 years, or until your request is settled. |
| Your account: name, email address, profile picture (if you add one or sign in with Google), passkeys (a public key and device name), your Google account ID if you sign in with Google, and when you last used the site. | To create and run your account and let you sign in. | Contract: it's needed to provide the service you signed up for. | Until you delete your account. |
| Your saved work: songs, and settings such as playback, diagrams, copy format, theme and last instrument. | To keep your songs and settings and show them on any device. | Contract. | Until you delete them or your account. |
| Public songs: a song you choose to make public, with your first name and last initial. | So anyone with the link can view it, as you asked. | Contract: you choose to share it, and can make it private again at any time. | Until you make it private, or delete it or your account. |
| Sign-in codes and sign-in history: one-time codes sent to your email, and the time and method of each sign-in. | To sign you in securely and to count sign-ins. | Contract, and our legitimate interest in keeping accounts secure. | Codes expire within minutes. Sign-in history is kept until you delete your account. |
| Security logs: for each request to the site's API, your IP address, the address requested, the time, the result, and your account if signed in. | To limit abuse (rate limiting), detect automated misuse and keep the site secure. | Legitimate interests: protecting the site and its users. | 30 days. |
| Usage statistics: each page visited, when, and whether the visitor looks like a bot. Visitors who aren't signed in are counted by a one-way, salted code made from their IP address and browser description, not the address itself; signed-in visitors by their account. | To see which pages are used and keep the site working well. | Legitimate interests: understanding and improving the site. No advertising or profiling. | About 13 months (400 days). |
| Web server logs: technical records of requests, including IP addresses. | To diagnose problems. | Legitimate interests: running the site. | Briefly, then overwritten. |
| Preferences on your device (when not signed in): settings, theme, last instrument and an unsaved song. | To remember your choices between visits. | Your consent, which you can withdraw at any time. | 12 months, or until you decline. |
Your email address is needed to create an account; without it we can't sign you in. Everything else you add is up to you.
Who else handles your data
We don't sell your personal data or share it for advertising. These providers help run the site. DigitalOcean, Cloudflare and Resend process data only on our behalf, under data processing agreements:
| Provider | What they do | Where |
|---|---|---|
| DigitalOcean | Hosts the site's servers and database. | New York, United States |
| Cloudflare | Delivers and protects the site's traffic (every visit passes through it, including your IP address). | Worldwide network |
| Resend | Sends sign-in codes by email (your email address and the code). | United States |
| Only if you choose Sign in with Google: Google confirms who you are and shares your name, email address, picture and Google account ID with us. Google handles its part as a separate controller, under its own privacy policy. | Worldwide |
We may also disclose data if the law requires it.
International transfers
Sparrowlight's servers are in the United States. If you're in the European Economic Area, the UK or Switzerland, your data is transferred there. These transfers rely on the EU–U.S. Data Privacy Framework where a provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses included in our providers' data processing agreements.
Cookies and storage
Some cookies are needed for the site to work, such as staying signed in. Everything else is a preference, and is stored on your device only if you agree. You're asked the first time there's something to remember, such as a setting you change or a song you start. Until then, and if you decline, your choices last only until you close the tab. If you're signed in, your settings are kept in your account instead. We use no analytics, advertising or third-party cookies.
| Name | Type | What it's for | How long | When |
|---|---|---|---|---|
sl_session | Cookie | Keeps you signed in. | Until you sign out, or 30 days | Strictly necessary |
sl_oauth | Cookie | Protects a sign-in with Google while it's in progress. | 10 minutes | Strictly necessary |
sl_consent | Cookie | Remembers whether you accepted or declined preference storage. | 12 months if accepted, 6 months if declined | Strictly necessary |
sl_prefs | Cookie | Your settings (playback, diagrams, copy format, Suggest), color theme, text size, and the instrument, tuning and capo you last chose. | 12 months | Only with your consent |
sl_draft | Browser storage | The song you're working on in Song Chart Maker while signed out, so it's still there next time. | Until you clear it or decline | Only with your consent |
sl_prefs | Tab storage | Your settings for this browser tab only, before you've chosen or after you decline. | Until the tab closes | Not kept after the tab closes |
Your rights
Under the GDPR and similar laws you have these rights. Several you can use yourself, straight away:
- Access and portability: download your account details, settings and every saved song as a file with Export all on My Workbench.
- Correction: change your name and picture under Account & passkeys in the profile menu, and edit your songs and settings any time.
- Erasure: delete your account and everything tied to it under Account & passkeys, then Delete account. It takes effect at once.
- Withdraw consent: change your cookie choice with Cookie settings in the footer. Declining deletes the preferences stored on your device.
- Restriction and objection: you can ask us to limit or stop processing based on our legitimate interests, such as usage statistics.
- Complaint: you can complain to the data protection authority where you live or work. We'd appreciate the chance to help first.
For anything you can't do yourself, send a privacy request. We'll reply within one month.
Other details
Automated checks. Accounts that behave like automated bots, for example by making very many requests, are flagged automatically for an administrator to review. No decision with legal or similarly significant effect is made automatically.
Children. Sparrowlight isn't intended for children under 16, and we don't knowingly create accounts for them. If you believe a child has an account, let us know and we'll delete it.
Security. All traffic is encrypted (HTTPS). Sign-in uses one-time email codes, passkeys or Google, so we never store a password.
Changes. This notice describes what Sparrowlight does today. If that changes in a way that matters, for example if we ever add analytics or advertising, we'll update this notice first, show the new date at the top, and ask for your consent before any new cookies are set.