Last updated October 31, 2026
Lyrx listens for music playing around you and shows synced lyrics. This page explains, plainly, what data that requires, where it goes, how long it is kept, and how you can remove it.
Lyrx (lyrx.fm) is developed and operated by Arda Karabel, who is the data controller for the processing described here. For any privacy question or request, write to privacy@lyrx.fm.
While Lyrx is listening, it creates an audio signature on your device with Apple's ShazamKit (on Android, Apple's official ShazamKit SDK) and Apple matches it against its catalogue. The raw audio is never sent to Lyrx. This exchange is governed by Apple's privacy terms. On Android, the app first fetches a short-lived ShazamKit access token from our server; that request contains no information about you.
Depending on your device and settings, Lyrx can also recognise music that is playing on the device itself:
Captured audio is only used on the device to create the signature; it is not stored or uploaded.
Speech recognition (iPhone and iPad). To keep lyrics in time with the song, Lyrx can briefly listen for the words being sung using Apple's speech recognition. It runs on the device where your phone supports that; for languages without an on-device model, Apple may process the audio on its servers under Apple's terms. Lyrx does not store or upload the transcripts.
Once a song is identified, Lyrx looks up synced lyrics in our own copy of the open LRCLIB database (and, if that is unavailable, directly at lrclib.net), and fetches artwork and song details from Apple's iTunes catalogue and songwriter credits from MusicBrainz. Some of these requests go straight from your device to those services, so they see your IP address; they only receive the song's title, artist, album, length or ISRC. The Apple Watch app fetches lyrics directly from lrclib.net. When no lyrics can be found, the app reports the song to us so we know which lyrics are missing; that report is kept without any device identifier.
Lyric translation only runs after you pick a language. The lyric lines and the target language are sent to our translation service, which uses DeepSeek (an AI provider based in China) to translate them; no identifier about you is attached. If our service cannot be reached, the app sends the lines directly to Google Translate, which then sees your IP address. If you choose an app language other than English or Turkish, the app's own interface text is translated the same way. Translations are cached by their text, not by user.
Between songs, Song Magazine can show short facts about the song or artist. To create them, the artist, title, release year and your language are sent to our facts service, which uses DeepSeek and a web search; artist photos are loaded from Wikipedia. No identifier about you is sent. You can turn Song Magazine off in Settings.
You can use Lyrx without an account. If you create one, we process:
The codes are e-mailed from noreply@lyrx.fm through our e-mail provider, Titan. If an address permanently bounces, we keep a one-way fingerprint of it so we don't keep mailing it.
Deleting your account. In the app, open Settings › your account › "Delete account" and confirm with your password and an e-mail code. Your account, username, e-mail address, password hash, sessions and listening history are erased immediately. We keep only a deletion confirmation number that is not linked to you, and the bounce fingerprint described above if your address ever bounced. Signing out or deleting your account also clears the history from that device and gives the device a new random identifier.
Party mode shares the song and lyrics a host is playing with guests in real time. To run a party, our server uses each participant's device identifier and display name. The display name is suggested from your phone's name (for example "Arda" from "Arda's iPhone") and you can change it. The party's current state (the host's name and the song and lyrics being shown) is saved briefly so the party survives a server restart; it is deleted when the party ends, or within minutes once it goes idle. When you join with a QR code, the camera image is processed on your device only.
If you allow it in your phone's settings, Lyrx shares your location once per session to show what people nearby are listening to, and for features that build on that. We receive your coordinates rounded to about 11 metres, their accuracy and time, and place names down to the neighbourhood, which your phone looks up through Apple's or Google's location service. We keep the most recent place and coordinates for your device's pseudonymous identifier. Place names are also counted, without any identifier, in daily statistics.
To stop: turn off location access for Lyrx in your phone's settings. The next time you open the app, it asks our server to delete the stored location for your device. You can also e-mail us.
Live map on lyrx.fm. The public map on our website shows, for each country, roughly where someone is listening right now. That spot comes from the app's location above if you allowed it; otherwise our server looks up your IP address, in memory only, in a local copy of the DB-IP city database (IP Geolocation by DB-IP), and does not store the IP address. Either way the spot is rounded to about 50 km, held in memory for about ten minutes, and never saved.
To understand how Lyrx is used and to fix problems, the app sends usage events to our server. Examples: that a song was recognised (with its title, artist and song IDs), that lyrics were missing, that a translation or language was used, and technical events about the audio source. Each event carries your device's random identifier and a session identifier; our server stores only a short one-way hash of the device identifier, together with a coarse country and region derived from the network. Because the same hash appears on every event, this data is pseudonymous, not anonymous.
| What is stored | How long |
|---|---|
| Detailed event log (hashed device ID, session, events including song titles, country/region) | 30 days, then deleted automatically |
| Device record (hashed device ID, first/last seen, number of events, country/region) | Up to 2 years after your last use |
| Daily statistics (counts by event, song, country, region and hour, and the hashed IDs of devices active that day) | Kept without a time limit |
Server-side events are also recorded when a party is created or joined and when a shared lyric link is opened, with country and region only.
You can turn usage statistics off at any time in Settings › Privacy › Usage statistics. While it is off, the app sends no usage events, deletes any that are still waiting to be sent, stops sharing your location, and asks our server to delete the location stored for your device.
On iPhone, iPad and Mac, you can film yourself singing along. The video, with your microphone audio and the lyrics, is created and stored on your device and saved to your photo library. It is never uploaded to Lyrx. If you share it, it goes directly from your device to the app you choose.
If you are signed in you can send feedback from Settings: a complaint, an idea, a bug report or a question. We store the text you write, its category, your app version, device type and language, our replies, and your account ID so the ticket stays yours. For bug reports you may add a screen recording of up to 60 seconds. It shows your screen and includes microphone sound (for example the music playing and your voice). You start it yourself, watch it before sending, and it is uploaded only when you send the ticket. Recordings are stored with our hosting provider in Germany.
Before a ticket is sent, its text is checked once by an AI service (DeepSeek) to filter abuse and off-topic requests, to summarise it for you to confirm, and to find similar requests. A second call may draft a first reply. Only the ticket text is sent: never your e-mail, user name or account ID. AI replies are labelled "Lyrx Asistan" and the first ones are reviewed by us before they are shown. We never use tickets for advertising.
Tickets, replies, recordings and your votes on planned features are kept until you delete your account, which erases them.
Subscriptions are processed by Apple (App Store) or Google (Play). We never see your payment details. The app only learns whether you have an active subscription, from the store, on your device. See the Terms of Use for how renewal and cancellation work.
Shared cards and texts go directly from your device to the app you pick. Lyric links created with earlier versions of the app are stored on our server without any identifier, are public to anyone with the link, and do not expire.
Lyrx updates its interface over the air. To find the right update, the app sends our server its build number and current version only.
The app loads its fonts from Google Fonts, and artwork from Apple's servers. As with any web request, these providers see your IP address.
Your settings, your listening history while you are signed out, cached lyrics and your recordings stay on your device. Your sign-in token is kept in the iOS Keychain or Android Keystore.
| Provider | What for |
|---|---|
| Bunny.net (BunnyWay d.o.o., Slovenia) | Hosting, storage, content delivery and database. Our data is stored in Germany; requests may be handled by servers in other regions, including outside the EU, to keep the app fast. |
| Apple | Song recognition (ShazamKit), speech recognition, location names on iPhone, song details and artwork |
| Fallback translation, fonts, location names on Android | |
| DeepSeek (China) | Translation, Song Magazine texts and the feedback checks; receives lyrics, song details or ticket text only |
| Titan | Sending sign-in e-mails |
| LRCLIB, MusicBrainz, Wikipedia | Lyrics, credits, artist photos; receive song or artist details only |
Some of these providers are outside Türkiye and the European Economic Area. Where personal data is transferred, we rely on the safeguards the law requires, such as standard contractual clauses.
Depending on where you live (for example under the GDPR or Türkiye's KVKK, Art. 11), you can ask to access, correct, delete or receive a copy of your data, object to or restrict its processing, and withdraw consent. You can delete your account yourself in the app; for anything else, e-mail privacy@lyrx.fm. We answer within 30 days. You also have the right to complain to your data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK).
All connections are encrypted (HTTPS). Passwords are stored only as salted hashes, e-mail addresses are encrypted, and sign-in tokens on your device are kept in the system's secure storage. No system is perfectly secure, but we limit what we collect and how long we keep it.
Lyrx is not directed at children under 13, and you must be at least 16 (or the age of digital consent in your country) to create an account. If you believe a child has given us personal data, contact us and we will delete it.
If this policy changes in a meaningful way, we will update the date above and, for important changes, tell you in the app.
Questions about this policy or your data: privacy@lyrx.fm