Privacy Policy

Effective date: 2 August 2026

Searcherbox ("we", "us") operates searcherbox.com and app.searcherbox.com. This policy explains what we collect, why, and what rights you have. It is written for both the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA). The short version: we collect as little as the service needs, we never see your card details, we delete uploaded audio after analysis, and we do not sell or share your personal information with anyone for advertising. Contact us any time through the contact form.

What we collect and why

• Account and order data. Email, name and order history, processed through Shopify when you create an account or buy a plan. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Payment data. Handled entirely by Shopify Payments or PayPal. Card numbers never reach our systems. Legal basis: contract.
• Uploaded audio. When you drop a file into the search, we analyse it to extract acoustic characteristics such as tempo, key, energy and spectral texture. The file is deleted immediately after analysis. We keep only the derived numbers, which contain no personal data and cannot reconstruct the recording. Legal basis: contract.
• Search queries. Track links you paste are fetched, analysed and the track's public metadata (artist, title, platform, link) may be added to our searchable catalogue. This is metadata about music, not about you; we do not store which user searched for what beyond short-lived technical logs. Legal basis: legitimate interest in operating and improving the index (Art. 6(1)(f)).
• Technical logs. IP address, user agent and request path, kept briefly by our hosting providers for security and debugging, then discarded. Legal basis: legitimate interest in keeping the service secure.
• Cookies and local storage. The storefront sets cookies that are strictly necessary (cart, session, security) plus a local record of your cookie choice. We run no advertising trackers and we do not sell or share anything for advertising. We do run one analytics tool, described below, and only if you allow it. See the Cookie Policy.

Product analytics

Two things measure how the service is used, and they work very differently.

• Our own counters. The search app keeps a daily tally of anonymous actions: how many searches ran, how many similarity lookups, how often Obscurity Mode was switched on. No cookie, no identifier, no IP, nothing tied to you or to any session. It is a set of numbers going up. Legal basis: legitimate interest in knowing which parts of the product work (Art. 6(1)(f)).
• Microsoft Clarity. A behaviour analytics tool that records how pages are used: clicks, scrolling, movement and page performance, replayed as an anonymised session. We use it to find what is broken, not to identify anyone. Text you type and any content on the page is masked by Microsoft before it leaves your browser, and we keep that masking on. Clarity sets its own cookies (_clck, _clsk) and it loads only after you accept analytics in the cookie bar. Decline, and the script is never fetched. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time by clearing the choice in the cookie bar. Microsoft acts as our processor and may also use the data as an independent controller under the Microsoft Privacy Statement.

Who processes data for us

We use a small set of processors: Shopify (storefront, accounts, payments), Railway (application hosting, US), Cloudflare (domain and DNS), and Microsoft (Clarity behaviour analytics, only with your consent). When you search, your query may cause our servers to contact the platform hosting the track: Internet Archive, YouTube, SoundCloud, Bandcamp or Discogs. Track previews play through YouTube's privacy-enhanced player (youtube-nocookie.com) and load only after you press play; at that point Google may process data under its own policy. Where providers are in the United States, transfers from the EU rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

Retention

Account data lives as long as your account does. Uploaded files are deleted right after analysis. Technical logs are short-lived. Catalogue metadata and derived acoustic numbers are kept indefinitely because they are not personal data.

Your rights in the EU and UK (GDPR)

You can request access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest. Where processing relies on consent you can withdraw it at any time. Write to us through the contact form and we will respond within one month. You also have the right to complain to your local supervisory authority.

Your rights in California (CCPA/CPRA)

You have the right to know what personal information we collect, to delete it, to correct it, and to not be discriminated against for exercising these rights. In the last 12 months we have collected only the categories listed above (identifiers, commercial information, internet activity). We do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of; we treat signals like Global Privacy Control as confirmation of that default. Requests go through the contact form; we verify them against your account email and respond within 45 days.

Children

The service is not directed at children under 16 and we do not knowingly collect their data.

Changes

If this policy changes in a way that matters, we will note it here with a new effective date. Continued use after a change means the new version applies.