This policy explains what SASG collects when you use the site, why, how long we keep it, who else is involved, and the choices you have. It applies to everyone: creators who have a SASG link, people who send songs, and people who just read our pages.
1. Information we collect
If you create a link
- Account details: your username, display name and password. Passwords are stored only as a salted, slow hash (PBKDF2) — we can't read them.
- Your page: anything you choose to add — profile photo, bio, prompt, favorite song, link buttons, photos, colors and greeter-character settings.
- Sessions: a random sign-in token for each device you log in on, stored hashed, plus when it was last used.
- Activity: when you last logged in (shown on your page as “last seen”) and simple counts such as stories shared.
If you send a song
- What you send: the song, your optional note, and the time.
- A sender hint: the device category (for example “iPhone” or “Samsung (Android)”), worked out from your browser's user-agent and device-model hints, and an approximate location (city, region, country) worked out from your IP address by our hosting provider. Coordinates are shifted by a few hundred metres before they're stored.
- A hashed network identifier: a one-way hash of your IP address, used only to rate-limit spam. We don't store raw IP addresses.
- A guest id: a random id kept in your browser's local storage so repeat sends and visits from the same browser can be grouped. It's not linked to your name or device.
If you visit someone's page
We record a profile view with the same kind of device category, approximate location and guest id, so the creator can see that someone opened their link. If you go on to send a song, the view is folded into that song instead.
If you read our public pages
Our home page, guides, and pages like this one may show ads from Google AdSense, which uses cookies as described in section 4. We don't run any other analytics or tracking scripts.
2. How we use it
- To run SASG: deliver songs, show your page, keep you signed in, and deliver replies to senders.
- To show creators fuzzy hints and profile views — a guessing game, never an identity.
- To prevent abuse: rate-limiting, blocking, and investigating reports.
- To keep the service free by showing ads on public pages.
We don't sell personal information, and we don't use it to build advertising profiles of our own.
3. Who else processes data
- Cloudflare hosts the site and database and provides the approximate location used for hints.
- Apple provides song search, artwork and previews. Your browser sends what you type in the song search directly to Apple and loads artwork and previews from Apple. If that fails, our server repeats the search with Apple or, as a backup, Deezer — without any information about you.
- Google AdSense serves ads on public pages (see below).
- Google Gemini — only if a creator uses the optional “make my character from a photo” feature, the photo they pick is sent to Google's Gemini API to generate the character. We don't keep the original photo.
4. Advertising and cookies
Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
In your inbox, revealing a sender hint may open a sponsor's page from an advertising partner in a new tab. That page is run by the partner and its own privacy policy applies; SASG doesn't load ad scripts inside the inbox or share your account details with it.
You can opt out of personalised advertising by visiting Google Ads Settings, or opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info. Learn more about how Google uses information from sites that use its services. Visitors in the EEA, UK and Switzerland are asked for consent before personalised ads are shown.
SASG itself doesn't set tracking cookies. It uses your browser's local storage for things the app needs: your sign-in session, light/dark theme, guest id, unlocked hints and blocked senders. Clearing your browser data removes them.
5. Who can see what
- Anyone with your link: your public page and any songs you chose to feature (with the sender kept anonymous).
- Only you: your inbox, notes, hints and profile views.
- Only the sender (via their private link): the song they sent and your reply.
6. How long we keep it
- Songs, replies and profile views stay until the creator deletes them or deletes their account.
- Sign-in sessions expire after 60 days without use, or when you log out.
- Rate-limit counters reset within hours to a day.
- Deleted data may persist in encrypted backups for up to 30 days before it's overwritten.
7. Your choices and rights
Creators can edit their page, delete any song or profile view, and delete their entire account (which erases everything sent to it) from the inbox at any time. Senders can contact us with their private song link to have that song removed. Depending on where you live (for example under the GDPR or CCPA) you may have the right to access, correct, delete or export your data, or object to how it's used — email us and we'll respond within 30 days.
8. Children
SASG is not for children under 13, and we don't knowingly collect their data. If you believe a child under 13 has an account, contact us and we'll delete it.
9. Security
Everything is served over HTTPS. Passwords and session tokens are hashed, the database is only reachable by our server, and access is limited to the developer. No system is perfectly secure, so please use a unique password.
10. Legal requests
We'll disclose information only when required by a valid legal request. Because we never collect senders' names, emails, phone numbers or raw IP addresses, there's very little we could provide about them.
11. Changes
If this policy changes, we'll update the date at the top, and for significant changes we'll also post a notice in the app.
12. Contact
Questions or requests: itsdev1ai@gmail.com, or see the contact page.