Privacy policy

Who runs this site

Hot Music Lab (hotmusiclab.com) runs on its own server. For any question about your data, or to have it deleted, write to roman.stratiev@gmail.com.

Audio you upload

Uploads are processed on our server. The audio is never sent to another company, except to your own Telegram chat when you ask for it.

• Vocal and drum removal, audio enhancement, key and tempo changes, cutting, joining and lyrics transcription: the upload and the results are deleted automatically about two hours after processing, and the download links stop working then.
• Key & BPM: the file is deleted as soon as it has been analysed.
• Rap lyrics: the beat is deleted as soon as it has been decoded. Only numbers about it (tempo, key, where the bars fall) are kept, for the same two hours.

Microphone

The tuners and the vocal warm-up listen to your microphone inside your browser, and nothing they hear is sent anywhere. The flow recording on the rap lyrics page is also turned into rhythm patterns in your browser: only those patterns reach our server, never the recording. The audio enhancer is the exception, because cleaning up the recording is what it is for: what you record there stays in your browser until you press Clean up, and is then uploaded and deleted like any other file.

If you sign in

Signing in is optional for most of the site. It is needed for rap lyrics and, on the vocal and drum remover, enhancer, pitch & tempo, cutter and joiner, for more than the few free tracks a day you get without it; it also raises the hourly limits. You get an account when you sign in on the site with Telegram or Google, open the Telegram Mini App, or press Start in our Telegram bot. We never see a password. For each account we keep:

• which of the two you used and its ID for you (your Telegram ID, or Google's account ID);
• your display name and the link to your profile picture, as that service gives them;
• where you first came from, if the link you arrived by says so (for example ?ref= or utm_source), and who invited you, if anyone did;
• your own invite code and when you signed up;
• your sign-in sessions: a one-way hash of each session token and when it expires. The token itself is not stored.

Google also tells us your email address. We check that Google has verified it and then discard it. Accounts hold no email address, no IP address and no browser or device details.

Visit statistics

We count page views, and how often the sign-in suggestion is shown and clicked, as totals per page per day. The counts are not linked to you, your account or your device. There is no Google Analytics and no advertising pixel. The one outside analytics service, Yandex Metrika, runs only if you allow it.

Yandex Metrika

If you press Allow in the banner at the bottom of the page, the site loads Yandex Metrika, a web analytics service run by Yandex. We use it to see how the site is used (which pages people open, where they click, where they get stuck) so we can make the tools easier to use. It is not used for advertising. Until you press Allow, nothing is loaded from Yandex, and if you decline, nothing is loaded later either. Metrika collects:

• page views, the page you came from and how long you stayed;
• clicks, scrolling and mouse or finger movement on the page, including session recordings (Webvisor) that replay them;
• your device, browser, operating system and screen size, and your approximate location, which Yandex works out from your IP address;
• a random id of its own for your browser, kept in cookies and local storage whose names start with _ym.

Session recordings leave out what you type into fields, the names of your files and lyrics on the page: those parts are hidden from Metrika, and audio never goes to Yandex. Yandex processes this data under its own privacy policy. To withdraw your consent, open Cookie settings at the bottom of any page and press Decline: the counter stops, the _ym ids in your browser are deleted, and nothing is loaded from Yandex again.

Yandex privacy policy

Limits and server logs

To keep the free tools fair, requests are counted per IP address, and the free tracks a day without sign-in per browser id (see below), with a higher ceiling per IP address that everyone on it shares. Those counters live only in the server's memory and are never written to disk. The server's technical log records every request to our API, sign-in included, with the IP address and time, for troubleshooting; it is not linked to accounts and is overwritten as the log rotates.

Other services

Only these, and only when you use the feature that needs them:

• Telegram: if you sign in with Telegram or open the Mini App, Telegram gives us your Telegram ID, name and profile picture link. Pressing Start in our bot (or sending it /invite) also creates or updates your account, with your Telegram ID, your name and, if the bot link carried one, where it came from or who invited you. The bot's replies are sent through Telegram, and it never writes first. If you press Send to my Telegram while a track is being split and then Start in the bot, the finished files are sent through Telegram to that chat, and only to it.
• Google: if you sign in with Google, the token your browser receives from Google is sent back to Google once, to confirm it.
• Anthropic (Claude): the rap lyrics tool sends the beat's tempo, key and bar and section layout, the rhythm patterns and what you typed about the track (theme, language, style, mood), plus the lyrics so far when you rewrite a line. Never the audio.

The Telegram and Google sign-in buttons are loaded from telegram.org and accounts.google.com, and only when you open the sign-in window. What you do there is covered by those services' own privacy policies. We do not sell your data or use it for advertising.

Cookies and browser storage

• Our one cookie, hml_session, set only when you sign in. It keeps you signed in for up to 30 days and cannot be read by scripts on the page. Signing out deletes the session on our server as well. Inside the Telegram Mini App the session is kept in memory instead of a cookie.
• In your browser's local storage: where you first came from (sent to us once, when you sign in), your vocal range from the warm-up, and the microphone delay measured for the flow recording on the rap lyrics page. The last two never leave your browser.
• For the current tab only: that you closed the sign-in suggestion.
• A browser id, hml_cid, in local storage: a random string the page makes up the first time it talks to our server and sends with each request. It is not linked to your account, it is used only to count the free tracks a day you get without signing in, and the server keeps it in memory for about a day (24 hours, cleared within the next hour). If your browser blocks storage, a new one is made for each tab.
• Your answer to the Metrika banner, hml_metrika, in local storage, so the banner is not shown on every visit. It never leaves your browser.
• The last track you split, hml_last_job, in local storage for two hours: the job's id, the file's name and the page, so the result can be found again if you close the tab. Only the id is sent to us, to ask whether the result still exists.

There are no advertising cookies. Yandex Metrika's cookies (names starting with _ym) are set only after you allow it. You can clear all of this in your browser settings at any time.

How long we keep it, and deleting it

• Uploads and results: about two hours, as above.
• Sessions: until you sign out, or 30 days.
• Accounts: until you ask us to delete yours.

To delete your account, email us and say whether you signed in with Telegram or Google and the name the site shows for you. We delete the account and its sessions. The same address answers any other question about this policy: roman.stratiev@gmail.com.

Changes

If this policy changes, this page is updated and so is the date at the top.