Privacy

Cantiga is free to use while it is being tested. There are no accounts, no passwords, and no third-party analytics. A number of songs are open to everyone; past that, you can leave an email address to be invited later, and that is the only thing Cantiga ever asks you for. This page says plainly what it stores and why.

The visitor cookie

Cantiga sets a signed session cookie, canta_session. It contains an opaque random id with no name or email behind it and expires after 30 days. The session enforces translation quotas and gives usage events a pseudonymous id, which lets us measure whether the same browser returns during the beta. It cannot be used to sign in and the value written to the event log cannot replay the cookie. A second functional cookie remembers the language you selected.

The same cookie also carries a short list of the songs this browser has already opened, held as truncated one-way digests rather than song names. That list is what the free allowance is counted against, so it lives in your browser and not in a profile on our side. It is signed, so it cannot be edited to grant more songs, and it goes away with the cookie.

IP addresses

Cantiga also uses your IP address, briefly and only in memory, to cap how many new songs can be requested per hour from one address. This is a backstop for the case where the cookie is missing or cleared. The address itself is not written to the event log below. If a request arrives before its session cookie is set, the log uses a generic pending-session marker, never the address itself.

Invite codes

An invite code is exchanged for the same opaque session and then deleted from the browser. The code itself is never written to the event log. It is not an account and is not tied to your name or email unless you gave one directly to whoever invited you.

If you ask for access

After the free songs are used up, Cantiga offers a form asking for an email address, and optionally what you are learning. Both are entirely voluntary: giving them is the only way to be invited later, and refusing costs you nothing you already had.

The address is not stored on our server. It is passed straight to Brevo, an email provider whose servers are in the EU, which sends you a confirmation message. Nothing happens until you click the link in it, and if you never do, the address is never added. The event log records only that a request was made and which part of the site it came from, never the address itself. Every message carries an unsubscribe link, and unsubscribing removes you from the list. Addresses and free-text answers are deleted at the end of the test.

Asking is not a purchase and does not open the song you were on. The songs you have already opened stay open either way.

What is recorded

Everything lands in one append-only file, events.ndjson, kept on the single server that runs Cantiga. Each line holds a timestamp and one of: a page opened, a song opened, a word tapped for its meaning, a translation delayed by the cost limit, or an error. That is the whole list. Nothing is layered on top of it - no ad tech, no analytics service, no third party ever sees this file, and nothing is sold.

Where this runs

Cantiga runs on a single machine on Fly.io, in Stockholm. One server, one disk, no other copies floating around. The cookie, the event log and everything else described above stay on that machine, inside the EU.

Other services

Songs play in an embedded YouTube player, so YouTube sees the video you watch under its own privacy policy. Lyrics come from LRCLIB. Song and artist searches are sent to Deezer, with Apple as a fallback. Translations are generated by OpenAI from lyric text plus the song title and artist, with no session or IP address attached. Results are cached and reused for later visitors.

How long any of this is kept

The event log is kept for as long as this beta runs, and it is deleted once it ends. The visitor cookie expires on its own after 30 days even if you never come back.

Getting something removed

Write to [privacy contact to be set once the domain is live] to ask for a song taken down or your own log lines removed. If you came in through an invite, ask whoever sent it and we will remove every line carrying your code.